---
# System prepended metadata

title: 驗證碼繞過on client

---

# 驗證碼繞過on client
- 常見問題
	- 使用前端js實現驗證碼(紙老虎)
		- 前端js驗證
	- 將驗證碼在cookie中洩漏,容易被獲取
	- 將驗證碼在前端源代碼中洩漏,容易被獲取
	- -> 驗證碼一定要在服務端進行認證
	- ->服務端認證不嚴格也會有相應的問題

- 分析
	- 先傳進repeater裡面
	- 按send 會看到他輸出``username or password is not exist ~``
		![image](https://hackmd.io/_uploads/SyUI52CIT.png)

	- 嘗試更改驗證碼
		- 回傳``username or password is not exist ~``
		- ---> 前端認證
			![image](https://hackmd.io/_uploads/ByiDc3AUa.png)

- 開始爆破
	- send to intruder
	- 將參數設定在username和password上
	- Attack Type選擇Cluster Bomb
	- 設定字典
		- 第一個參數username
			![image](https://hackmd.io/_uploads/BJmt5hCIp.png)
		- 第二個參數password
			- 使用numbers
			![image](https://hackmd.io/_uploads/SJ0FchCI6.png)
		- (optional)設定查看有無輸出``username or password is not exist ~``
			- 也可直接查看長度來爆破
			- 選擇 options
				- Grep - Match
					- 在grep-match中刪除原有字符串,添加username or password is not exists, burp就會將所有含有此字符串的數據包flag出來。沒有被flag出的數據包則是我們破解成功的數據包
					![image](https://hackmd.io/_uploads/SyAc9h0Ip.png)

				- Grep - Extract
					- 搜尋``username or password is not exist ~``
					![image](https://hackmd.io/_uploads/B1no9nAI6.png)

- 結果
	![image](https://hackmd.io/_uploads/SkEnqnCL6.png)
    
- [Pikachu靶场通关秘籍---暴力破解---验证码绕过（On Clinet）](https://www.cnblogs.com/redHskb/p/16802283.html)
- [pikachu靶场通关之暴力破解](https://developer.aliyun.com/article/1044330)