暴力破解无回显shell的密码

摘自：91ri.org

 

工具：手工注入帮助系统

先抓个输入错误密码的包..把post的数据抓出来

POST /fckeditor/editor/filemanager/connectors/php/xxx.php HTTP/1.1
Host:?www.xxx.net
Connection: keep-alive
Referer:?http://www.xxx.net/fckeditor/edi … nectors/php/xxx.php
Content-Length: 33
Cache-Control: max-age=0
Origin:?http://www.xxx.net
Content-Type: application/x-www-form-urlencoded
Accept: application/xml,application/xhtml
+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko)
Maxthon/3.0 Safari/534.12
Accept-Encoding: gzip,deflate
Accept-Language: zh-CN,zh;q=0.8
Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3
Cookie:

wespaceuser=Ah8AHQUnQl9PXwgXCx52AhgCAFdBXCcGSl1NV0xUBh1QHQIeB0sEG1hLBBYAAUtXHAUYAkoAHDAe;
AJSTAT_ok_times=1; rTvgYGhchbcookietime=0; rTvgYGhchbusername=hzck1999;
PHPSESSID=bnkc817f11htk4huq67p7nfpd1; cdb_sid=OhXi57;
__utma=125976530.309523011.1322900520.1322900520.1322904263.2; __utmc=125976530;
__utmz=125976530.1322900520.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
Hm_lvt_9dad9a39dc2779b297b1621b72055626=1322906408673;
Hm_lpvt_9dad9a39dc2779b297b1621b72055626=1322906408673
password=sss&doing=login

　　

这里这么填…注意把密码段改成字典的变量

然后看看返回信息

看我标蓝得这段是密码输错的时候返回的信息..就拿这段作为关键字

密码字典再设一下

点start就可以开始破了..