Website login brute force crack method and system capable of identifying verification code

Abstract

The invention provides a website login brute force crack method and system capable of identifying a verification code. The method comprises the steps of 1, through static webpage analysis, extracting information required for website login; 2, through dynamic webpage analysis, intercepting a login data package submitted to a website server by a client browser; 3, reading a group of user names and passwords from a brute force crack dictionary; 4, obtaining a verification code picture; 5, identifying the obtained verification code picture; 6, filling corresponding parameters in the login data package intercepted in the step 2 with a verification code identification result as well as the user names and the passwords read in the step 3, and submitting the replaced login data package to the website server; and 7, analyzing a website server response, if it is prompted that the verification code is wrong, returning to the step 4; if it is prompted that the user name or the password is wrong, returning to the step 3; and if it is prompted that the login succeeds, recording the user name and the password by which the login succeeds. According to the method and system, a website with a verification code login function can be subjected to automated security testing.

Description

technical field [0001] The present invention relates to the field of information security, in particular to a method and system for brute force cracking of website logins that can identify verification codes. Background technique [0002] In recent years, with the development of Internet technology and the recent introduction of the concept of "Internet +", more and more traditional industries have integrated the Internet to develop new forms and new formats. Today, many enterprises cannot do business without the support of information systems. More and more industries tend to adopt the B / S mode to develop application systems, and users can access application systems only through browsers. However, while web applications provide convenience, they also bring a lot of security risks. Because of its openness and ease of access, web applications have always been the key targets of hackers. According to Gartner's data, more than 75% of attacks on the current network are directed...

AI Technical Summary

Problems solved by technology

[0006] The technical problem solved by the present invention is to provide a method and system for brute force cracking of website logins that can identify verification codes, which can solve the problem that the existing brute force cracking methods cannot handle the need to input verification codes when logging in. problem, which can realize automated security testing of websites with verification code login

Images