weakPasswordDetect.py

# -*- coding: utf-8 -*-

import requests


def detect(url,para_list,GET = True):
    
    f = open("database\\weakPasswordLogo.txt", 'r')
    logo = f.read()
    f.close()
    print(logo)
    
    params = []
    if '?' in url:
        request = url.split('?')[1].split('#')[0]
        request = request.split('&')
        if len(request) != 2:
            print("Weak Password Detector: param number error!")
        for each in request:
            params.append(each.split('=')[0])
    if len(para_list) < 3:
        pass
    else:

        params = para_list[0:2]
    
    submitUrl = url.split('?')[0]
    if GET:
        res = requests.get(submitUrl, data = {params[0]: "wvfr3frg", params[1]: "hgrihasd"})
    
    else:
        res = requests.post(submitUrl, params = {params[0]: "wvfr3frg", params[1]: "hgrihasd"})
    
    res.encoding = 'utf-8'
    bullshit = []
    bullshit.append(res.text)
    
    Yes = ""
    
    ans = []
    
    sure = "Y"
    if sure == 'y' or sure == 'Y':
        username = para_list[2]
        level = 1
        tot = 0
        if level == 1:
            f = open('database\\FastPwds.txt', 'r')
            tot = 488
        elif level == 2:
            f = open('database\\MimiPwds.txt', 'r')
            tot = 35663
        else:
            f = open('database\\MidPwds.txt', 'r')
            tot = 126880
            
        cnt = 0
        for eachLine in f:
            print('percent: {:.2%}\r'.format(cnt / tot), end = '', flush = True)
            cnt += 1
            thisParam = {params[0]: username, params[1]: eachLine[:-1]}
            if GET:
                res = requests.get(submitUrl, data = thisParam)
            else:
                res = requests.post(submitUrl, params = thisParam)
            
            res.encoding = 'utf-8'
            
            if res.text not in bullshit:
                print("Weak Password Detector: \nusername=%s,password=%s" % (username, eachLine[:-1]))

                confirm = input("Is this Password?(Y/n):")
                if confirm == 'n' or confirm == 'N':
                    bullshit.append(res.text)
                    continue
                
                ans.append([username, eachLine[:-1]])
                return ans
    
    else:
        f = open("database\\User_Pwds.txt", 'r')
        tot = 701
        cnt = 0
        for eachLine in f:
            print('percent: {:.2%}\r'.format(cnt / tot), end = '', flush = True)
            cnt += 1
            [username, password] = eachLine[:-1].split(":")
            thisParam = {params[0]: username, params[1]: password}
            
            if GET:
                res = requests.get(submitUrl, data = thisParam)
            else:
                res = requests.post(submitUrl, params = thisParam)
            
            res.encoding = 'utf-8'
            if (Yes and res.text == Yes) or res.text not in bullshit:
                print("Weak Password Detector: \nusername=%s,password=%s" % (username, password))
                confirm = input("Is this Password?(Y/n):")
                if confirm == 'n' or confirm == 'N':
                    bullshit.append(res.text)
                    continue
                else:
                    Yes = res.text
                print("Success!")
                ans.append([username, password])
                con = input("Continue?(Y/n):")
                if con == 'n' or con == 'N':
                    print("Weak Password Detect finished")
                    return ans
    
    print("Weak Password Detector: Seems no more weak password here...")
    return ans