Question

我正在尝试登录网络服务器（通过powershell）以创建有效（经过身份验证的）会话。我们的想法是使用该会话来访问只有在您登录时才能访问的报告的链接。问题是尝试登录。查看Web服务器的日志，用户从未登录过。谢谢！真诚的，在Powershell中感到无能为力

#Build Vars, later on take as parameters for a function
$server = '192.168.1.1'
$port = '3780'
$uri = "https://${server}:${port}/login.jsp"
$username = "user"
$password = "password"

#Make Webrequest to get session, and form
$nxCon = Invoke-WebRequest $uri -SessionVariable svNex
$form = $nxCon.Forms[0]
$form.fields #returns: "screenresolution, nexposeccusername, nexposeccpassword, login_button"
$form.Action #returns: empty
$form.Method #returns: "get"

#Fill out Form
$form.fields['nexposeccusername'] = $username
$form.fields['nexposeccpassword'] = $password
#$form.fields['login_button'] =
#above: Form has this field, filled with "Log on" by default. In other iterations I've tried setting this to $true.  

$response = Invoke-WebRequest -Uri ($uri + $form.Action) -WebSession $sNex -Method $form.Method -Body $form.fields
#above: Since form.action is empty, it will be the same URL, but included it anyway.


#Returned data:
$response 
<# Returns Below: 
StatusCode        : 200
StatusDescription : OK
Content           : <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
                    <html>
                       <head>
                          <meta http-equiv="Content-Language" content="en-us" ></...
RawContent        : HTTP/1.1 200 OK
                    X-Frame-Options: SAMEORIGIN
                    ...

$response.Content
<#     ...
     <div class="alert-container">
        <div id="authErrorMsg" class="alert login-alert alert-warning" role="alert" style="display:none;"><p>One or more authentication serv
            ices are unavailable.</p></div>
        <div id="siloErrorMsg" class="alert login-alert alert-warning" role="alert" style="display:none;"><p>Login scope required.</p></div>
        <div id="invalidErrorMsg" class="alert login-alert alert-error" role="alert" style="display:none;"><p>The user name or password is invalid.</p></div>
        <div id="serverMsg" class="alert login-alert alert-error" role="alert" style="display:none;"><p>Your browser failed to contact the Security Console.</p></div>
     </div>

     <div class="login-header"></div>
     <div class="login-main">
        <div class="loginContent">
           <div class="loginBoxDiv" id="loginBoxDiv">
              <div class="loginContentDiv">
                 <p>Log on</p>
                 <form id="login_form" name="login" autocomplete="off">
                    <input type="hidden" name="screenresolution" id="screenresolution" value=""/>
                    <div id="siloSelect" class="form-group"></div>
                    <div class="form-group">
                       <label for="nexposeccusername">Username</label>
                       <input type="text" class="form-control" id="nexposeccusername" name="nexposeccusername" autofocus="true" maxlength="255"></input>
                    </div> ...

Answer 1

在浏览器中打开开发者控制台。（例如谷歌浏览器中的F12）
开始捕获网络流量。
手动登录。
查看和请求，它可能是POST，在细节中你会看到哪些参数被传输。
忘记填写表格，直接使用相同的参数发出POST请求。

以下是我登录内部网站的方式：

$Username = 'YOUR_USERNAME'
$Password = 'YOUR_PASSWORD'
$Url = 'http://www.example.com/'
$Body = @{'txtUserName' = $Username; 'txtPassword' = $Password; 'btnLogin' = 'Login'}

Invoke-WebRequest -Uri $Url -SessionVariable VariableName -Method 'POST' -Body $Body

那就是它。

使用Powershell的invoke-webrequest登录服务器（Nexpose Security Console）

1 个答案: