Captcha killer verification code identification plug-in

Catalog

Configuration of the environment

The first step in actual combat How to grab the bag

The second step of actual combat Interface configuration

The third step in actual combat Setting of blasting module

---

Configuration of the environment

Plug in download address GitHub - broken5/captcha-killer-java8https://github.com/broken5/captcha-killer-java8

0x01 effect

In the current actual combat mining src Or penetration testing Most verification codes cannot be bypassed . Want to enter the background page by blasting . repeat After module test , The verification code cannot be bypassed , use captcha-killer Be able to identify the verification code . Then conduct weak password blasting .

0x02 Installing a plug-in

        jar Installation of skipped   The effect of successful installation is as follows

 

The first step in actual combat How to grab the bag

0x01  Intercept the verification code package

After intercepting here, there will be no porxy It shows that   however history You can view packets

 0x02 Send package

Send the verification code package to captcha-killer As shown in the figure above, there is no extension by right clicking

First send the package to repeat in And then repeat Send to capcha-killer modular

 

Send successfully, click to get   

The second step of actual combat Interface configuration

0x01 Interface configuration  

The interface here is cloud coding platform （ The error rate is probably 5%）：

Image recognition - Code platform - Code website - Identification verification code - Tujian Network Technology Co., Ltd http://www.ttshitu.com/

POST /predict HTTP/1.1
Host: api.ttshitu.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
Accept: application/json;
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: Hm_lvt_d92eb5418ecf5150abbfe0e505020254=1585994993,1586144399; SESSION=5ebf9c31-a424-44f8-8188-62ca56de7bdf; Hm_lpvt_d92eb5418ecf5150abbfe0e505020254=1586144399
Connection: close
Content-Type: application/json;charset=UTF-8
Content-Length: 109

{"username":" account number ","password":" password ","typeid":"3","image":"<@BASE64><@IMG_RAW></@IMG_RAW></@BASE64>"}

 

The recognition rate is shown in the figure above

The third step in actual combat Setting of blasting module

0x01 Set variables for the verification code