暴力破解口令

暴力破解思想的阐述；

“暴力破解”是一攻击手段，在web攻击中，一般会使用这种手段对应用系统的认证信息进行获取。 其过程就是使用大量的认证信息在认证接口进行尝试登录，直到得到正确的结果。 为了提高效率，暴力破解一般会使用带有字典的工具来进行自动化操作。

理论上来说，大多数系统都是可以被暴力破解的，只要攻击者有足够强大的计算能力和时间，所以断定一个系统是否存在暴力破解漏洞，其条件也不是绝对的。 我们说一个web应用系统存在暴力破解漏洞，一般是指该web应用系统没有采用或者采用了比较弱的认证安全策略，导致其被暴力破解的“可能性”变的比较高。

执行流程

1. 该实验基于DVWA中的Brute Force模块展开，首先查看源码：

 <?php

 

if( isset( $_POST[ 'Login' ] ) && isset ($_POST['username']) && isset ($_POST['password']) ) {

    // Check Anti-CSRF token

    checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );

 

    // Sanitise username input

    $user = $_POST[ 'username' ];

    $user = stripslashes( $user );

    $user = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $user ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

 

    // Sanitise password input

    $pass = $_POST[ 'password' ];

    $pass = stripslashes( $pass );

    $pass = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"],  $pass ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));

    $pass = md5( $pass );

 

    // Default values

    $total_failed_login = 3;

    $lockout_time       = 15;

    $account_locked     = false;

 

    // Check the database (Check user information)

    $data = $db->prepare( 'SELECT failed_login, last_login FROM users WHERE user = (:user) LIMIT 1;' );

    $data->bindParam( ':user', $user, PDO::PARAM_STR );

    $data->execute();

    $row = $data->fetch();

 

    // Check to see if the user has been locked out.

    if( ( $data->rowCount() == 1 ) && ( $row[ 'failed_login' ] >= $total_failed_login ) )  {

        // User locked out.  Note, using this method would allow for user enumeration!

        //echo "<pre><br />This account has been locked due to too many incorrect logins.</pre>";

 

        // Calculate when the user would be allowed to login again

        $last_login = strtotime( $row[ 'last_login' ] );

        $timeout    = $last_login + ($lockout_time * 60);

        $timenow    = time();

 

        /*

        print "The last login was: " . date ("h:i:s", $last_login) . "<br />";

        print "The timenow is: " . date ("h:i:s", $timenow) . "<br />";

        print "The timeout is: " . date ("h:i:s", $timeout) . "<br />";

        */

 

        // Check to see if enough time has passed, if it hasn't locked the account

        if( $timenow < $timeout ) {

            $account_locked = true;

            // print "The account is locked<br />";

        }

    }

 

    // Check the database (if username matches the password)

    $data = $db->prepare( 'SELECT * FROM users WHERE user = (:user) AND password = (:password) LIMIT 1;' );

    $data->bindParam( ':user', $user, PDO::PARAM_STR);

    $data->bindParam( ':password', $pass, PDO::PARAM_STR );

    $data->execute();

    $row = $data->fetch();

 

    // If its a valid login...

    if( ( $data->rowCount() == 1 ) && ( $account_locked == false ) ) {

        // Get users details

        $avatar       = $row[ 'avatar' ];

        $failed_login = $row[ 'failed_login' ];

        $last_login   = $row[ 'last_login' ];

 

        // Login successful

        echo "<p>Welcome to the password protected area <em>{$user}</em></p>";

        echo "<img src=\"{$avatar}\" />";

 

        // Had the account been locked out since last login?

        if( $failed_login >= $total_failed_login ) {

            echo "<p><em>Warning</em>: Someone might of been brute forcing your account.</p>";

            echo "<p>Number of login attempts: <em>{$failed_login}</em>.<br />Last login attempt was at: <em>${last_login}</em>.</p>";

        }

 

        // Reset bad login count

        $data = $db->prepare( 'UPDATE users SET failed_login = "0" WHERE user = (:user) LIMIT 1;' );

        $data->bindParam( ':user', $user, PDO::PARAM_STR );

        $data->execute();

    } else {

        // Login failed

        sleep( rand( 2, 4 ) );

 

        // Give the user some feedback

        echo "<pre><br />Username and/or password incorrect.<br /><br/>Alternative, the account has been locked because of too many failed logins.<br />If this is the case, <em>please try again in {$lockout_time} minutes</em>.</pre>";

 

        // Update bad login count

        $data = $db->prepare( 'UPDATE users SET failed_login = (failed_login + 1) WHERE user = (:user) LIMIT 1;' );

        $data->bindParam( ':user', $user, PDO::PARAM_STR );

        $data->execute();

    }

 

    // Set the last login time

    $data = $db->prepare( 'UPDATE users SET last_login = now() WHERE user = (:user) LIMIT 1;' );

    $data->bindParam( ':user', $user, PDO::PARAM_STR );

    $data->execute();

}

 

// Generate Anti-CSRF token

generateSessionToken();

 

?>

 

配置好burpsuite的本地代理，Login输入用户名和密码后用burpsuite进行拦截，将表单进行提交到intruder模块，并将password设置为破解的payload。

 

 

设置字典文件

 应用Sniper标签，它会针对每个position中$$位置设置payload。攻击中的请求总数应该是position数量和payload数量的乘积。对数据参数，无论添加多少个payload，其sniper的作用就限于第一个参数变量值遍历字典时，第二个参数或其他参数都处于原参数的变量值，直到第一个参数变量值遍历完字典后才会依次往下进行，同时已经遍历完字典的参数变量值维持原状不再改变，最终以这样的方式完成所有参数变量值的改变，达到暴力破解的目的。

 破解时间的长短就取决于密码字典的大小和CPU的计算能力，破解完成后，可以通过length的不同找到正确的密码。