burp验证码识别插件

插件下载地址：https://github.com/f0ng/captcha-killer-modified

burp插件配合ddddocr实现验证码识别，适配新版burpsuite。

1、burp配置

img

2、本地启动验证码识别脚本

python ocr_server.py --port 9898 --ocr

image-20240702101657734

3、插件配置

右键发送验证码请求包到插件，接口url填写验证码识别接口：http://127.0.0.1:9898

Requst数据包：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
POST /ocr/b64/text HTTP/1.1
Host: 127.0.0.1:9898
Connection: close
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: none
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded
Content-Length: 55

<@BASE64><@IMG_RAW></@IMG_RAW></@BASE64>

4、在Intruder模块调用

img