Multithreading Python3 whit Sql-Injection

Question

Good afternoon, I have a question that I cannot solve. I want to do a SQL injection in Hack The Box (Legal Platform). The case is that I am trying to execute a query to the server, if the query is valid, the server takes two seconds to return the response. To speed this up, I want to do it with threads... The problem comes because if I try to do it with the threading module, it doesn't work correctly for me, the order in which the threads start and finish is important. I show you an example:

from threading import Thread

import time

import string


def prueba(a):

    if a in letras:
        time.sleep(2)
        letras_agregadas.append(a)



letras_agregadas = []

progreso = ""

letras = ["a", "k", "s", "C", "F", "Z"]

antes = time.time()

for letra in string.ascii_letters:

    h1 = Thread(target=prueba, args=(letra,))

    h1.start()

resultado = "".join(letras_agregadas)

despues = time.time()

print("".join(letras_agregadas) + "antes")

print(resultado)

print(antes - despues)

I would like the "resultado" variable to obtain the letters in the order it was received, but the program ends and does not add anything to "resultado", I have tried with .join() but then the program takes the same time as without using Thread , Thank you very much in advance.

Answer 1

You could try multiprocessing and running everything with Pool, which allows you patallelize across multiple variables.

Here's how I did it:

from multiprocessing import Pool
def prueba(a):
    letras_agregadas = []
    if a in letras:
        time.sleep(2)
        letras_agregadas.append("".join(a+'antes'))
    return letras_agregadas


progreso = ""

letras = ["a", "k", "s", "C", "F", "Z"]

antes = time.time()
if __name__ == '__main__':
    with Pool(5) as p:
        h1 = p.map(prueba, letras)
        print(h1)

The output:

['aantes'], ['kantes'], ['santes'], ['Cantes'], ['Fantes'], ['Zantes']

Additionally - there is some confusion with what you are trying to achieve. For example, why are you doing this print("".join(letras_agregadas) + "antes"), and then you haves antes = time.time() as a time action.