xp_CAPTCHA(白嫖版) burp 验证码识别 burp插件

Last update: Jan 09, 2023

Overview

xp_CAPTCHA(白嫖版)

说明

xp_CAPTCHA (白嫖版)

验证码识别
burp插件

安装

需要python3 小于3.7的版本

安装 muggle_ocr 模块（大概400M左右）

python3 -m pip install -i http://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com muggle-ocr

运行 server.py

等待显示出 Starting server, listen at: 0.0.0.0:8899 访问 http://127.0.0.1:8899/ 显示下面界面即为正常。

linux 下安装可能会需要

安装即可

yum install libglvnd-glx-1.0.1-0.8.git5baa1e5.el7.x86_64

验证码识别率

使用方法

把图片base64编码后POST发送至接口http://localhost:8899/base64 的base64参数即可，返回结果为识别的后的结果。

burp联动识别验证码爆破

如果 server.py 在服务器上跑的话，xp_CAPTCHA.py需要修改对应的IP。

修改完后导入burp

Attack type处选择 Pitchfork,在http头部位置插入xiapao:验证码的URL地址

此处导入字典

选择验证码识别

然后把线程设置为1

blog

http://www.nmd5.com

A tool to find good RCE From my series: A powerful Burp extension to make bounties rain

52 Dec 16, 2022

Burp-UI is a web-ui for burp backup written in python with Flask and jQuery/Bootstrap

Burp-UI Contents Introduction Screenshots Demo What's that? Who are you? Documentation FAQ Community Notes See also Licenses Thanks Introduction Scree

84 Dec 20, 2022

A Burp Pro extension that adds log4shell checks to Burp Scanner

scan4log4shell A Burp Pro extension that adds log4shell checks to Burp Scanner, written by Daniel Crowley of IBM X-Force Red. Installation To install

26 Mar 15, 2022

Nuclei - Burp Extension allows to run nuclei scanner directly from burp and transforms json results into the issues

Nuclei - Burp Extension Simple extension that allows to run nuclei scanner directly from burp and transforms json results into the issues. Installatio

106 Dec 22, 2022

A Burp extension adding a passive scan check to flag parameters whose name or value may indicate a possible insertion point for SSRF or LFI.

BurpParamFlagger A Burp extension adding a passive scan check to flag parameters whose name or value may indicate a possible insertion point for SSRF

118 Nov 7, 2022

Burp Extension that copies a request and builds a FFUF skeleton

ffuf is gaining a lot of traction within the infosec community as a fast portable web fuzzer. It has been compared and aligned (kinda) to Burp's Intruder functionality. Thus, Copy As FFUF is trying to build that interoperatability bridge between the two.

81 Dec 22, 2022

Burp Extensions

Burp Extensions This is a collection of extensions to Burp Suite that I have written. getAllParams.py - Version 1.2 This is a python extension that ru

364 Dec 30, 2022

Python script to launch burp scans automatically

SimpleAutoBurp Python script that takes a config.json file as config and uses Burp Suite Pro to scan a list of websites.

26 Jul 18, 2022

Burp Suite extension to log GraphQL operations as a comment

Burp GraphQL Logger A very simple, straightforward extension that logs GraphQL operations as a comment in the Proxy view. To enable the highlight, unc

22 Jul 2, 2022

Broken Link Finder is a Burp Extension to detect broken links for a passive scanning domains and links.

Broken Link Finder Broken Link Finder is a Burp Extension to detect broken links for a passive scanning domains and links. Inspired by InitRoot's link

10 Sep 11, 2021

Generate a bunch of malicious pdf files with phone-home functionality. Can be used with Burp Collaborator

Malicious PDF Generator ☠️ Generate ten different malicious pdf files with phone-home functionality. Can be used with Burp Collaborator. Used for pene

1.9k Jan 1, 2023

Burp Suite extension for encoding/decoding EVM calldata

unblocker Burp Suite extension for encoding/decoding EVM calldata 0x00_prerequisites Burp Suite Java 8+ Python 2.7 0x01_installation clone this reposi

16 Aug 30, 2022

A simple Burp Suite extension to extract datas from source code

DataExtractor A simple Burp Suite extension to extract datas from source code. Features in scope parsing file extensions to ignore files exclusion bas

86 Dec 31, 2022

A burp-suite plugin that extract all parameter names from in-scope requests

ParamsExtractor A burp-suite plugin that extract all parameters name from in-scope requests. You can run the plugin while you are working on the targe

29 Nov 9, 2022

A Burp Suite extension made to automate the process of finding reverse proxy path based SSRF.

TProxer A Burp Suite extension made to automate the process of finding reverse proxy path based SSRF. How • Install • Todo • Join Discord How it works

162 Nov 25, 2022

About Hive Burp Suite Extension

Hive Burp Suite Extension Description Hive extension for Burp Suite. This extension allows you to send data from Burp to Hive in one click. Create iss

7 Dec 7, 2022

log4j burp scanner

log4jscanner log4j burp插件特点如下： 0x01 基于Cookie字段、XFF头字段、UA头字段发送payload 0x02 基于域名的唯一性，将host带入dnslog中插件主要识别五种形式： 1.get请求，a=1&b=2&c=3 2.post请求，a=1&b=2&c=

1 Jun 30, 2022

log4j2 passive burp rce scanning tool get post cookie full parameter recognition

log4j2_burp_scan 自用脚本log4j2 被动 burp rce扫描工具 get post cookie 全参数识别，在ceye.io api速率限制下，最大线程扫描每一个参数，记录过滤已检测地址，重复地址 token替换为你自己的http://ceye.io/ token 和域名地址

5 Dec 10, 2021

PortSwigger Burp Plugin for the Log4j (CVE-2021-44228)

yLog4j This is Y-Sec's @PortSwigger Burp Plugin for the Log4j CVE-2021-44228 vulnerability. The focus of yLog4j is to support mass-scanning of the Log

1 Jan 31, 2022

Comments

安装报错

ERROR: Could not find a version that satisfies the requirement onnxruntime (from ddddocr) (from versions: none) ERROR: No matching distribution found for onnxruntime 这是版本原因嘛，我已经换了3.6.6版本

opened by jinzezhi 21

安装muggle-ocr依赖的时候报错

系统M1 Pro MacOS 12.3
python版本 3.6.13

报错1(已解决)

(py36) ➜  xp_CAPTCHA_4.1 python server_4.1.py
正在加载中请稍后……
[5]    61471 illegal hardware instruction  python server_4.1.py

解决方法

m1 直接安装会报错，需要修改

报错2(已解决)

python -m pip install -i http://mirrors.aliyun.com/pypi/simple/ --trusted-host mirrors.aliyun.com muggle-ocr

INFO: pip is looking at multiple versions of opencv-python to determine which version is compatible with other requirements. This could take a while.
Collecting opencv-python
  Using cached http://mirrors.aliyun.com/pypi/packages/bc/71/4575227302db0b95bbf635dd87f2c58339f84c6e63ade1afc7d332414da2/opencv_python-4.6.0.66-cp36-abi3-macosx_10_15_x86_64.whl (46.4 MB)
INFO: pip is looking at multiple versions of numpy to determine which version is compatible with other requirements. This could take a while.
Collecting numpy
  Using cached http://mirrors.aliyun.com/pypi/packages/6a/9d/984f87a8d5b28b1d4afc042d8f436a76d6210fb582214f35a0ea1db3be66/numpy-1.19.5-cp36-cp36m-macosx_10_9_x86_64.whl (221 bytes)
ERROR: THESE PACKAGES DO NOT MATCH THE HASHES FROM THE REQUIREMENTS FILE. If you have updated the package versions, please update the hashes. Otherwise, examine the package contents carefully; someone may have tampered with them.
    numpy from http://mirrors.aliyun.com/pypi/packages/6a/9d/984f87a8d5b28b1d4afc042d8f436a76d6210fb582214f35a0ea1db3be66/numpy-1.19.5-cp36-cp36m-macosx_10_9_x86_64.whl#sha256=cc6bd4fd593cb261332568485e20a0712883cf631f6f5e8e86a52caa8b2b50ff (from muggle-ocr):
        Expected sha256 cc6bd4fd593cb261332568485e20a0712883cf631f6f5e8e86a52caa8b2b50ff
             Got        d562090e210ad52be5dc246c355a92e8b0098ff969426e16d8ebed0f539b13ee

更换为一下代码解决依赖问题

pip install  -i https://pypi.douban.com/simple/ muggle_ocr

opened by AlexANSO 2

Releases(4.2)

4.2(Sep 5, 2022)
新增支持从验证码反回包中获取内容填充到请求包中（该功能可以支持uuid验证码格式以及其他类似模式）

如果下载我打包好的环境的，请替换掉对应的server.py脚本

Source code(tar.gz)
Source code(zip)
NEW_xp_CAPTCHA_4.2.zip(61.50 KB)
4.1(Jun 24, 2022)
大更新强烈推荐更新！！！！

如果是用win系统可以直接下载打包好的环境,内置python3.6.6版本以及下载好对应的模块 NEW_xp_CAPTCHA win64 python环境完整版.rar 链接: https://pan.baidu.com/s/1U0ZRjtxdqmNYF0b_O-6B1Q 提取码: tfi5
Source code(tar.gz)
Source code(zip)
xp_CAPTCHA_4.1.zip(54.37 KB)
3.3(Jun 1, 2022)

新增支持新的图片格式
Source code(tar.gz)
Source code(zip)
xp_CAPTCHA3.3.zip(4.32 KB)
3.2(Jan 18, 2022)

修复bug
Source code(tar.gz)
Source code(zip)
xp_CAPTCHA3.2.zip(4.29 KB)
3.1(Jan 13, 2022)

新增支持验证码返回包为json格式
Source code(tar.gz)
Source code(zip)
xp_CAPTCHA.3.1.zip(4.23 KB)
3.0(Sep 4, 2021)

修复点小问题
Source code(tar.gz)
Source code(zip)
xp_CAPTCHA.3.0.rar(3.14 KB)
2.0(May 6, 2021)

Source code(tar.gz)
Source code(zip)
xp_CAPTCHA.2.0.rar(3.07 KB)
1.1(Apr 23, 2021)

Source code(tar.gz)
Source code(zip)
xp_CAPTCHA.rar(2.64 KB)

xp_CAPTCHA(白嫖版) burp 验证码 识别 burp插件

Related tags

Overview

xp_CAPTCHA(白嫖版)

说明

安装

验证码识别率

使用方法

burp联动识别验证码爆破

blog

You might also like...

A tool to find good RCE From my series: A powerful Burp extension to make bounties rain

Burp-UI is a web-ui for burp backup written in python with Flask and jQuery/Bootstrap

A Burp Pro extension that adds log4shell checks to Burp Scanner

Nuclei - Burp Extension allows to run nuclei scanner directly from burp and transforms json results into the issues

A Burp extension adding a passive scan check to flag parameters whose name or value may indicate a possible insertion point for SSRF or LFI.

Burp Extension that copies a request and builds a FFUF skeleton

Burp Extensions

Python script to launch burp scans automatically

Burp Suite extension to log GraphQL operations as a comment

Broken Link Finder is a Burp Extension to detect broken links for a passive scanning domains and links.

Generate a bunch of malicious pdf files with phone-home functionality. Can be used with Burp Collaborator

Burp Suite extension for encoding/decoding EVM calldata

A simple Burp Suite extension to extract datas from source code

A burp-suite plugin that extract all parameter names from in-scope requests

A Burp Suite extension made to automate the process of finding reverse proxy path based SSRF.

About Hive Burp Suite Extension

log4j burp scanner

log4j2 passive burp rce scanning tool get post cookie full parameter recognition

PortSwigger Burp Plugin for the Log4j (CVE-2021-44228)

Comments

安装报错

安装muggle-ocr依赖的时候报错

报错1(已解决)

解决方法

报错2(已解决)

更换为一下代码解决依赖问题

Releases(4.2)

4.2(Sep 5, 2022)

4.1(Jun 24, 2022)

3.3(Jun 1, 2022)

3.2(Jan 18, 2022)

3.1(Jan 13, 2022)

3.0(Sep 4, 2021)

2.0(May 6, 2021)

1.1(Apr 23, 2021)

Owner

算命縖子

log4j2 passive burp rce scanning tool get post cookie full parameter recognition

Fast Fb Cracking Tool

Obfuscate your Python scripts better, faster.

Log4Shell Proof of Concept (CVE-2021-44228)

Pre-Auth Blind NoSQL Injection leading to Remote Code Execution in Rocket Chat 3.12.1

Cam-Hacker: Ip Cameras hack with python

对naabu的端口扫描结果，调用nmap进行指纹识别

Something I built to test for Log4J vulnerabilities on customer networks.

NS-Defacer: a auto html injecter, In other words It's a auto defacer to deface a lot of websites in less time

This tool allows to automatically test for Content Security Policy bypass payloads.

macOS persistence tool

ProxyLogon Pre-Auth SSRF To Arbitrary File Write

Notebooks, slides and dataset of the CorrelAid Machine Learning Winter School

Script to calculate Active Directory Kerberos keys (AES256 and AES128) for an account, using its plaintext password

Simulating Log4j Remote Code Execution (RCE) vulnerability in a flask web server using python's logging library with custom formatter that simulates lookup substitution by executing remote exploit code.

A simple python-function, to gain all wlan passwords from stored wlan-profiles on a computer.

Facebook account cloning/hacking advanced tool + dictionary attack added | Facebook automation tool

The Decompressoin tool for Vxworks MINIFS

Sentinel-1 SAR time series analysis for OSINT use

Meterpreter Reverse shell over TOR network using hidden services

xp_CAPTCHA(白嫖版) burp 验证码识别 burp插件