.net - 如何在PowerShell中根据 'haveibeenpwned Pwned Passwords'检查密码？

我希望能够使用Pwned Passwords提供的Troy Hunt's have I been pwned service列表。

该服务在他的Introducing 306 Million Freely Downloadable Pwned Passwords博客文章中进行了描述。 API使用HTTP Not Found 404状态代码来指示何时在列表中未找到密码，使用200来指示已在受威胁列表中找到密码。这使得很难通过Invoke-WebRequest PowerShell Cmdlet进行消费，它会抛出404的WebException。

最佳答案

较新的HttpClient允许您在较低级别发出HTTP请求并检查HttpStatusCode，而无需处理404的异常，如下所示。

function Test-CompromisedPassword {
    param([Parameter(Mandatory=$True)][string]$password)

    # Force assembly to be loaded
    Add-Type -AssemblyName 'System.Net.Http'
    # By default PowerShell would use TLS 1.0 which is not supported by the API
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

    $baseUrl = "https://haveibeenpwned.com/api/v2/pwnedpassword/{0}?originalPasswordIsAHash={1}"
    $url = $baseUrl -f $password,'false'

    $httpClient = New-Object System.Net.Http.HttpClient
    # User-Agent header must be set to call the API
    $httpClient.DefaultRequestHeaders.Add("User-Agent", "PowerShell script $($MyInvocation.MyCommand.Name)")

    # HttpClient is only Async so use .Result to force the synchronous call
    $response = $httpClient.GetAsync($url).Result

    Write-Verbose "$password $([int]$response.StatusCode) $($response.StatusCode)"

    switch ([int]$response.StatusCode) {
        200 { $passwordFound = $true; break; }
        404 { $passwordFound = $false; break; }
        429 { throw "Rate limit exceeded" }
        default { throw "Not expected" + $response.StatusCode }
    }

    if ($response) { $response.Dispose() }
    if ($httpClient) { $httpClient.Dispose() }

    return $passwordFound
}

您可以如下测试此功能

Test-CompromisedPassword 'password' # Returns true to indicate password found
Start-Sleep -Milliseconds 1500 # Wait for the Rate limit time to expire
Test-CompromisedPassword ([Guid]::NewGuid()) # Returns false to indicate password not found