python文件扫描器,htpwdScan HTTP弱口令扫描器(python)

optional arguments:

-h, --help show this help message and exit

-f REQUESTFILE Load HTTP request from file

-https Set -https only when load request from file and

HTTPS was enabled

-u REQUESTURL Explicitly Set request URL, e.g.

-u="http://www.test.com/login.php"

-m METHOD Set -m=GET only when -u was set and request method

is GET,default is POST

-d Param=DictFilePath [Param=DictFilePath ...]

set dict file for each parameter,

support hash functions like md5, md5_16, sha1. e.g.

-d user=users.dic pass=md5(pass.dic)

-no302 302 redirect insensitive, default is sensitive

-err ERR [ERR ...] String indicates fail in response text, e.g.

-err "user not exist" "password wrong"

-suc SUC [SUC ...] String indicates success in response text, e.g.

-suc "welcome," "admin"

-herr HERR String indicates fail in response headers

-hsuc HSUC String indicates success in response headers

-proxy Server:Port Set HTTP proxies, e.g.

-proxy=127.0.0.1:8000,8.8.8.8:8000

-proxylist ProxyListFile

Load HTTP proxies from file, one proxy per line, e.g.

-proxylist=proxys.txt

-fip Spoof source IP

-t THREADS 50 threads by default

-o OUTPUT Output file, defaut is Cracked_Pass.txt

-rtxt RetryText Retry when it appears in response text,

e.g. -rtxt="IP blocked"

-rntxt RetryNoText Retry when it does not appear in response text,

e.g. -rntxt="

"

-rheader RetryHeader Retry when it appears in response headers,

e.g. -rheader="Set-Cookie:"

-rnheader RetryNoHeader

Retry when it didn't appear in response headers,

e.g. -rheader="Content-Length:"

-sleep SECONDS Sleep some time after each request,

avoid IP blocked by web server

-debug Send a request and check

response headers and response text

-nov Do not print verbose info, only print the cracked ones

-v show program's version number and exit