Don't like ads? PRO users don't see any ads ;-)
Guest

Enumerate users from web form

By: cd1zz on May 27th, 2012  |  syntax: Python  |  size: 3.60 KB  |  hits: 139  |  expires: Never
download  |  raw  |  embed  |  report abuse  |  print
Text below is selected. Please press Ctrl+C to copy to your clipboard. (⌘+C on Mac)
  1. #!/usr/bin/python
  2. #Author: Craig Freyman
  3. #Description: Brute force usernames on a web form
  4. #Version: 1.0
  5. #Date: May 27, 2012
  6. #Website: www.pwnag3.com
  7.  
  8. import urllib2,re,sys,os.path
  9.  
  10. def check_found_users():
  11.         global append_or_overwrite     
  12.         if os.path.exists("found_users.txt"):
  13.                 append_or_overwrite = raw_input("\033[1;32m[*] Found an existing \"found_users.txt\" file. Press \"w\" to overwrite or \"a\" to append.\033[1;m\n")
  14.         if append_or_overwrite not in ("w","a"):
  15.                 print "\033[1;31m[-] Please only press \"w\" or \"a\" .\033[1;m"
  16.                 check_found_users()
  17.                        
  18. def check_resume():
  19.         global resume_or_not
  20.         global resume_start_word
  21.  
  22.         #simply check the current directory for our resume file
  23.         if os.path.exists("resume_file.txt"):
  24.                 resume_or_not = raw_input("\033[1;32m[*] Found a resume file - Press \"R\" to resume or ENTER continue\033[1;m\n")
  25.                 #if user wants to resume, read the resume file to store the last word as a variable
  26.                 if resume_or_not in ("R","r"):
  27.                         open_resume = open("resume_file.txt")
  28.                         resume_start_word = open_resume.readline()
  29.                         open_resume.close()
  30.                                                                        
  31. def resumefile():
  32.         resume_file = open("resume_file.txt","w")
  33.         resume_file.write(username+"\n")
  34.         resume_file.close()
  35.  
  36. def search_file():
  37.         global offset
  38.         b = open(usernamefile).read()
  39.         offset = b.find(resume_start_word)
  40.  
  41. def main():
  42.         global username
  43.         global counter
  44.         counter = 0
  45.        
  46.         #attempt to open the user specified username file
  47.         try:
  48.                 f = open(usernamefile,'r')
  49.        
  50.         except:
  51.                 print "\033[1;31m[-] Could not open file\033[1;m"
  52.                 sys.exit(1)
  53.        
  54.         #check to see if we're resuming. if we are, search the file and calc offset so we can jump to it
  55.         if resume_or_not == "R" or resume_or_not == "r":
  56.                 search_file()
  57.                 f.seek(offset)
  58.        
  59.         #main program loop to iterate through our text file and do stuff
  60.         for username in f:
  61.                 username = username[:-1]
  62.  
  63.                 #every iteration, call resumefile() to write the last word to the file
  64.                 resumefile()
  65.  
  66.                 #in my situation, I had to do things with 2 urls - adjust for your purposes
  67.                 url = "ADD YOUR URL"
  68.                 url2 = "ADD YOUR URL"
  69.  
  70.                 #since we have custom headers use the build_opener and add headers
  71.                 opener = urllib2.build_opener()
  72.                 opener.addheaders.append(('Cookie', 'ADD ANY COOKIE INFORMATION HERE'))
  73.                 opener.addheaders.append(('Referer', 'PUT THE REFERER IN HERE IF NECESSARY'))
  74.                 f = opener.open(url,"PUT ANY REQUIRED POST INFORMATION HERE")
  75.  
  76.                 #access the next url
  77.                 f2 = opener.open(url2)
  78.  
  79.                 #capture the response in the_page
  80.                 the_page = f2.read()
  81.  
  82.                 #regex match
  83.                 answer = re.search(r'PUT SOMETHING IN HERE THAT WILL BE IN THE RESPONSE FROM THE SERVER[a-zA-Z]',the_page,re.M)
  84.  
  85.                 #print our results
  86.                 if answer is None:
  87.                         print "\033[1;31m[-] " +username+ "\033[1;m"
  88.                
  89.                 else:
  90.                         print "\033[1;32m[+] "+username+ "\033[1;m"
  91.                         outfile.write(username+"\n")
  92.                         counter+=1
  93.  
  94.         f.close()
  95.         outfile.close()
  96.  
  97.  
  98. if __name__ == '__main__':
  99.  
  100.         try:
  101.                
  102.                 if len(sys.argv) != 2:
  103.                         print "[+] Usage: ./filename <username_file>"
  104.                         sys.exit(1)
  105.  
  106.                 usernamefile = sys.argv[1]
  107.                
  108.                 append_or_overwrite = "a"
  109.                 resume_or_not = "no"
  110.  
  111.                 #check for found_users file
  112.                 check_found_users()
  113.                 #if it returns nothing, lets just default to append
  114.                
  115.                 #check to see if there is an existing resume file
  116.                 check_resume()
  117.        
  118.                 #open the file to write discovered users to and append or overwrite, based on users response
  119.                 outfile = open("found_users.txt",append_or_overwrite)
  120.  
  121.                 #start main program
  122.                 main()
  123.  
  124.                 #done
  125.                 print "\033[1;34m[*] Done - found "+str(counter)+" users.\033[1;m"
  126.  
  127.         except KeyboardInterrupt:
  128.                 print "\033[1;34m\n[*] Program terminated.\033[1;m"