簡介

爬蟲闖關鏈接：

1.?http://www.heibanke.com/accounts/login/?next=/lesson/crawler_ex03/

2. http://www.heibanke.com/accounts/login

知識點：cookie & session , csrf , Web編程，多線程密碼枚舉

提示：和第三題一樣，看清楚，題目在http://www.heibanke.com/accounts/login/?next=/lesson/crawler_ex03/登錄後顯示，而不是URL鏈接2的登錄界面。從URL1或URL2中獲取Cookie（CSRFTOKEN）登錄，然後得到一個提示密碼很長的頁面。隨便輸入帳號密碼，會跳出一個頁面讓你找密碼，密碼文檔頁面加載非常慢，是由於後端人為限制時間，密碼位置隨機生成，從頁數與行數可知密碼一共100位。為了加快猜測時間，我們要為每一個密碼頁面開一個線程（多線程處理），提高枚舉密碼的速度。

參考代碼

#!/usr/bin/env python
# encoding: utf-8
 
import requests
import sys
import re
import threading
reload(sys)
 
sys.setdefaultencoding("utf-8")
 
csrf = ""
username = "Peter"
password = "112233"
final_password = ""
 
payload_login = {
    "username":username,
    "password":password,
    "csrfmiddlewaretoken":csrf
}
 
dict = {}
thread = []
 
website_signUp = "http://www.heibanke.com/accounts/login"
website_login = "http://www.heibanke.com/accounts/login/?next=/lesson/crawler_ex03/"
website_PWlist = "http://www.heibanke.com/lesson/crawler_ex03/pw_list/?page=%s"
 
s = requests.Session()
s.get(website_signUp)
csrf = s.cookies["csrftoken"]
payload_login["csrfmiddlewaretoken"] = csrf
s.post(website_login,data=payload_login)
csrf = s.cookies["csrftoken"]
 
 
def GetPassword(page):
    global dict
    while True:
        resp = s.get(website_PWlist%page)
        word_pos = re.findall('<td data-toggle="tooltip" data-placement="left" title="password_pos">(\d+)</td>', resp.content)
        word_val = re.findall('<td data-toggle="tooltip" data-placement="left" title="password_val">(\d+)</td>', resp.content)
        for i in range(len(word_pos)):
            dict[int(word_pos[i])] = word_val[i]
            print word_pos[i]+" -- "+word_val[i]
        if len(dict)==100:
            break
 
def main():
    global dict
    global final_password
    for i in range(1,14):
        t = threading.Thread(target=GetPassword,args=(i,))
        thread.append(t)
    for i in thread:
        i.start()
        print "Thread Runing"
    for i in thread:
        i.join()
        print "Thread Join"
    if len(dict)==100:
        k = dict.keys()
        k.sort()
        for i in range(len(dict)):
            final_password += dict[k[i]]
        print "[+]FOUND:" + final_password
 
 
 
if __name__ == '__main__':
    main()
 

黑板客 -- 爬蟲闖關 -- 關卡04