黑板客 -- 爬虫闯关 -- 关卡04

Posted 2021-01-09 peterz1997

简介

爬虫闯关链接：

1.?http://www.heibanke.com/accounts/login/?next=/lesson/crawler_ex03/

2. http://www.heibanke.com/accounts/login

知识点：cookie & session , csrf , Web编程，多线程密码枚举

提示：和第三题一样，看清楚，题目在http://www.heibanke.com/accounts/login/?next=/lesson/crawler_ex03/登录后显示，而不是URL链接2的登录界面。从URL1或URL2中获取Cookie（CSRFTOKEN）登录，然后得到一个提示密码很长的页面。随便输入帐号密码，会跳出一个页面让你找密码，密码文档页面加载非常慢，是由于后端人为限制时间，密码位置随机生成，从页数与行数可知密码一共100位。为了加快猜测时间，我们要为每一个密码页面开一个线程（多线程处理），提高枚举密码的速度。

参考代码

#!/usr/bin/env python
# encoding: utf-8
 
import requests
import sys
import re
import threading
reload(sys)
 
sys.setdefaultencoding("utf-8")
 
csrf = ""
username = "Peter"
password = "112233"
final_password = ""
 
payload_login = {
    "username":username,
    "password":password,
    "csrfmiddlewaretoken":csrf
}
 
dict = {}
thread = []
 
website_signUp = "http://www.heibanke.com/accounts/login"
website_login = "http://www.heibanke.com/accounts/login/?next=/lesson/crawler_ex03/"
website_PWlist = "http://www.heibanke.com/lesson/crawler_ex03/pw_list/?page=%s"
 
s = requests.Session()
s.get(website_signUp)
csrf = s.cookies["csrftoken"]
payload_login["csrfmiddlewaretoken"] = csrf
s.post(website_login,data=payload_login)
csrf = s.cookies["csrftoken"]
 
 
def GetPassword(page):
    global dict
    while True:
        resp = s.get(website_PWlist%page)
        word_pos = re.findall('<td data-toggle="tooltip" data-placement="left" title="password_pos">(d+)</td>', resp.content)
        word_val = re.findall('<td data-toggle="tooltip" data-placement="left" title="password_val">(d+)</td>', resp.content)
        for i in range(len(word_pos)):
            dict[int(word_pos[i])] = word_val[i]
            print word_pos[i]+" -- "+word_val[i]
        if len(dict)==100:
            break
 
def main():
    global dict
    global final_password
    for i in range(1,14):
        t = threading.Thread(target=GetPassword,args=(i,))
        thread.append(t)
    for i in thread:
        i.start()
        print "Thread Runing"
    for i in thread:
        i.join()
        print "Thread Join"
    if len(dict)==100:
        k = dict.keys()
        k.sort()
        for i in range(len(dict)):
            final_password += dict[k[i]]
        print "[+]FOUND:" + final_password
 
 
 
if __name__ == '__main__':
    main()