使用brup suite暴力破解

暴力破解dvwa登录账号和密码

安全等级为low

1.1 查看源码

<?php
if( isset( $_GET['Login'] ) ) {//只对是否设置进行验证
$user = $_GET['username'];
$pass = $_GET['password'];
$pass = md5($pass);

$qry = "SELECT * FROM `users` WHERE user='$user' AND password='$pass';";
$result = mysql_query( $qry ) or die( '<pre>' . mysql_error() . '</pre>' );
if( $result && mysql_num_rows( $result ) == 1 ) {
    // Get users details
    $i=0; // Bug fix.
    $avatar = mysql_result( $result, $i, "avatar" );
    // Login Successful
    echo "<p>Welcome to the password protected area " . $user . "</p>";
    echo '<img src="' . $avatar . '" />';
} els