靶场内容:
This lab is vulnerable due to a logic flaw in its brute-force protection. To solve the lab, brute-force Carlos’s password, then access his account page.
Victim’s username: carlos
Candidate passwords
靶场复盘:
- 这道题怎么说呢,比较复杂
- 我们截获到了发送用户名和密码的数据包,是json格式的,其实json就是一个字典,并没有那么复杂。
- 把这个包发送到repeater中,修改报文为这种形式:
“username” : “carlos”,
“password” : [
“123456”,
“password”,
“qwerty”
…
] - 再发送,302请求
- 单机右键,选择Show response in browser,然后把URL放到浏览器里面执行就可以过了
- 这种就是单个请求里面可以附加多个密码的格式
- 这道题还是专家级别
关键点
要写一个python脚本把数据改一下,手改太麻烦了吧:
def trans_file_string_to_be_string(path):
s=""
with open(path, 'r') as f1:
list1 = f1.readlines()
for i in range(0, len(list1)):
list1[i] = list1[i].rstrip('\n')
for a in list1:
s="\""+a+"\","+s
print(s)
trans_file_string_to_be_string("password.txt")