利用Python多线程与Burp Suite检测Web应用并发漏洞

方予

发布时间：2026-10-14| 6人浏览过

原创

本文介绍如何使用Python多线程结合Burp Suite插件检测Web应用中的并发漏洞。通过拦截请求生成Python代码，利用threading模块模拟高并发场景，验证支付或兑换场景下是否存在加锁缺失导致的超额领取问题。

Python多线程并发漏洞测试概述

本文详细讲解如何利用Python多线程技术来测试Web应用中可能存在的并发漏洞。文中提供了具体的示例代码和操作步骤，对从事相关开发或安全测试工作的人员具有较高的参考价值。

测试需求与场景分析

需求背景

在某些业务场景（如支付、积分兑换等）中，开发者可能在代码或数据库层面未正确实现锁机制。通过多线程并发访问进行测试，可以有效验证是否存在并发竞争条件导致的逻辑漏洞。

具体实施步骤与代码实现

操作步骤

第一步：安装Burp Suite相关插件

建议安装“Copy As Python-Requests”插件，该插件能显著提升后续编码效率。

第二步：拦截请求并生成代码

打开文本编辑器，通过右键菜单将拦截到的请求代码粘贴出来。


import requests

burp0_url = "https://www.baidu.com:443/s?word=test123&tn=50000021_hao_pg&ie=utf-8&sc=UWd1pgw-pA7EnHc1FMfqnHRdnHfkP163PWD3PzuW5y99U1Dznzu9m1Y1rj0zPjRYP1Ds&ssl_sample=s_108&srcqid=2890185856410820647&H123Tmp=nu"
burp0_cookies = {"BAIDUID": "DE39C3557AA883A517F3717D9ED1B346:FG=1", "BIDUPSID": "DE39C3557AA883A517F3717D9ED1B346", "PSTM": "1548660573", "BD_UPN": "13314352", "H_PS_PSSID": "1431_21111_18560_28585_26350_28519", "H_PS_645EC": "0701XLkxqPa8GpBa6wBJs%2BrZyNuhMOA%2FIRfHCR7YuUcETmxXSKm0g32CT0c", "delPer": "0", "BD_CK_SAM": "1", "PSINO": "1", "BDSVRTM": "142"}
burp0_headers = {"User-Agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2", "Accept-Encoding": "gzip, deflate", "Referer": "https://www.hao123.com/", "Connection": "close", "Upgrade-Insecure-Requests": "1"}
requests.get(burp0_url, headers=burp0_headers, cookies=burp0_cookies)

第三步：执行Python多线程测试

将生成的Python代码片段粘贴到自定义的action()函数中，构建完整的测试脚本。


import threading
import requests

threads = []

def action():
  burp0_url = "https://www.baidu.com:443/s?word=test123&tn=50000021_hao_pg&ie=utf-8&sc=UWd1pgw-pA7EnHc1FMfqnHRdnHfkP163PWD3PzuW5y99U1Dznzu9m1Y1rj0zPjRYP1Ds&ssl_sample=s_108&srcqid=2890185856410820647&H123Tmp=nu"
  burp0_cookies = {"BAIDUID": "DE39C3557AA883A517F3717D9ED1B346:FG=1", "BIDUPSID": "DE39C3557AA883A517F3717D9ED1B346",
           "PSTM": "1548660573", "BD_UPN": "13314352", "H_PS_PSSID": "1431_21111_18560_28585_26350_28519",
           "H_PS_645EC": "0701XLkxqPa8GpBa6wBJs%2BrZyNuhMOA%2FIRfHCR7YuUcETmxXSKm0g32CT0c", "delPer": "0",
           "BD_CK_SAM": "1", "PSINO": "1", "BDSVRTM": "142"}
  burp0_headers = {"User-Agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0",
           "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
           "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2",
           "Accept-Encoding": "gzip, deflate", "Referer": "https://www.hao123.com/", "Connection": "close",
           "Upgrade-Insecure-Requests": "1"}
  requests.get(burp0_url, headers=burp0_headers, cookies=burp0_cookies)


if __name__ == '__main__':
  print("Threading ready:")

  for i in range(0,100):
    t = threading.Thread(target=action)
  t.setDaemon(True) // 开启守护进程，如果宿主进程挂了，不用执行完全部线程任务也要立即结束。 参考 https://www.cnblogs.com/Haojq/p/10278365.html
  t.start()

  print("Threading ran end!")

第四步：验证测试结果

检查最终领取的数量是否超过了系统设定的原始可领数量。如果实际领取量超过限制，则说明存在并发漏洞，结果值得肯定（666）。

以上内容为本文的全部分享，希望能为读者的学习和工作提供有益帮助，欢迎继续支持本站获取更多技术资讯。