Question

我希望能够使用Pwned Passwords提供的Troy Hunt's have I been pwned service列表。

该服务在他的 Introducing 306 Million Freely Downloadable Pwned Passwords 博文中有所描述。 API使用HTTP Not Found 404状态代码来指示何时在列表中找不到密码，以及200表示已在受感染列表中找到密码。这使得很难通过Invoke-WebRequest PowerShell Cmdlet来消费，这会引发404的WebException。

Answer 1

较新的HttpClient允许您在较低级别发出HTTP请求并检查HttpStatusCode而不处理404的异常，如下所示。

function Test-CompromisedPassword {
    param([Parameter(Mandatory=$True)][string]$password)

    # Force assembly to be loaded
    Add-Type -AssemblyName 'System.Net.Http'    
    # By default PowerShell would use TLS 1.0 which is not supported by the API
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

    $baseUrl = "https://haveibeenpwned.com/api/v2/pwnedpassword/{0}?originalPasswordIsAHash={1}"
    $url = $baseUrl -f $password,'false'

    $httpClient = New-Object System.Net.Http.HttpClient
    # User-Agent header must be set to call the API
    $httpClient.DefaultRequestHeaders.Add("User-Agent", "PowerShell script $($MyInvocation.MyCommand.Name)")

    # HttpClient is only Async so use .Result to force the synchronous call
    $response = $httpClient.GetAsync($url).Result

    Write-Verbose "$password $([int]$response.StatusCode) $($response.StatusCode)"

    switch ([int]$response.StatusCode) {
        200 { $passwordFound = $true; break; }
        404 { $passwordFound = $false; break; }
        429 { throw "Rate limit exceeded" }
        default { throw "Not expected" + $response.StatusCode }
    }

    if ($response) { $response.Dispose() }
    if ($httpClient) { $httpClient.Dispose() }

    return $passwordFound
}

您可以按如下方式测试此功能

Test-CompromisedPassword 'password' # Returns true to indicate password found
Start-Sleep -Milliseconds 1500 # Wait for the Rate limit time to expire
Test-CompromisedPassword ([Guid]::NewGuid()) # Returns false to indicate password not found

如何根据“已发布的密码”检查密码？来自PowerShell？

1 个答案: