Offensive Security Researcher & Quantum Cryptography Analyst

Brute-Forcing Directories and File Location Using Socket Library

Abdul Wahab Junaid
Brute-Forcing Directories and File Location Using Socket Library

Brute-forcing is a hacking technique where an attacker systematically attempts all possible combinations of passwords or encryption keys until the correct one is found. It is a common method used in password cracking, encryption key breaking, and gaining unauthorized access to systems.

Python
import queue
import threading
import urllib.error
import urllib.parse
import urllib.request

threads = 50
target_url = "http://testphp.vulnweb.com"
wordlist_file = "all.txt"  # from SVNDigger
resume = None
user_agent = "Mozilla/5.0 (X11; Linux x86_64; rv:19.0) " \
             "Gecko/20100101 " \
             "Firefox/19.0"


def build_wordlist(wordlst_file):
    # read in the word list
    fd = open(wordlst_file, "r")
    raw_words = [line.rstrip('\n') for line in fd]
    fd.close()

    found_resume = False
    words = queue.Queue()

    for word in raw_words:
        if resume:
            if found_resume:
                words.put(word)
            else:
                if word == resume:
                    found_resume = True
                    print("Resuming wordlist from: %s" % resume)
        else:
            words.put(word)
    return words


def dir_bruter(extensions=None):
    while not word_queue.empty():
        attempt = word_queue.get()
        attempt_list = []

        # check if there is a file extension if not
        # it's a directory path we're bruting
        if "." not in attempt:
            attempt_list.append("/%s/" % attempt)
        else:
            attempt_list.append("/%s" % attempt)

        # if we want to bruteforce extensions
        if extensions:
            for extension in extensions:
                attempt_list.append("/%s%s" % (attempt, extension))

        # iterate over our list of attempts        
        for brute in attempt_list:
            url = "%s%s" % (target_url, urllib.parse.quote(brute))
            try:
                headers = {"User-Agent": user_agent}
                r = urllib.request.Request(url, headers=headers)
                response = urllib.request.urlopen(r)
                if len(response.read()):
                    print("[%d] => %s" % (response.code, url))
            except urllib.error.HTTPError as e:
                if e.code != 404:
                    print("!!! %d => %s" % (e.code, url))
                pass


word_queue = build_wordlist(wordlist_file)
file_extensions = [".php", ".bak", ".orig", ".inc"]

for i in range(threads):
    t = threading.Thread(target=dir_bruter, args=(file_extensions,))
    t.start()
all.txtDownload

A simple web directory brute-forcing tool that uses multiple threads to discover hidden paths on a web server. The script takes a list of potential directory and file names from a wordlist and appends them to the target URL, attempting to access each path. The goal is to find valid paths that might be vulnerable to unauthorized access or information disclosure.

Explanation:

  1. Import Modules:

    import queue
import threading
import urllib.error
import urllib.parse
import urllib.request
    • Importing necessary modules for handling threading and HTTP requests.

  2. Configuration:

    threads = 50
target_url = "http://testphp.vulnweb.com"
wordlist_file = "all.txt"  # from SVNDigger
resume = None
user_agent = "Mozilla/5.0 (X11; Linux x86_64; rv:19.0) " \
             "Gecko/20100101 " \
             "Firefox/19.0"
    • threads: Number of threads to use for parallel processing.
    • target_url: The base URL to perform directory brute-forcing.
    • wordlist_file: File containing a list of potential directory and file names.
    • resume: A specific word from which to resume the wordlist processing (optional).
    • user_agent: User-Agent header for HTTP requests.

  3. Build Wordlist Function:

    def build_wordlist(wordlst_file):
    # Function to read the wordlist and create a queue of words
    ...
    • Reads the wordlist file and creates a queue of words for brute-forcing.

  4. Directory Bruter Function:

    def dir_bruter(extensions=None):
    # Function to perform directory brute-forcing
    ...
    • Performs the actual directory brute-forcing by iterating over the wordlist queue and trying various path combinations.

  5. Main Execution:

    word_queue = build_wordlist(wordlist_file)
file_extensions = [".php", ".bak", ".orig", ".inc"]

for i in range(threads):
    t = threading.Thread(target=dir_bruter, args=(file_extensions,))
    t.start()
    • Creates a wordlist queue using the build_wordlist function.
    • Defines a list of file extensions to append to directory names.
    • Spawns a specified number of threads, each executing the dir_bruter function.

  6. Handling HTTP Requests:

    url = "%s%s" % (target_url, urllib.parse.quote(brute))
try:
    headers = {"User-Agent": user_agent}
    r = urllib.request.Request(url, headers=headers)
    response = urllib.request.urlopen(r)
    if len(response.read()):
        print("[%d] => %s" % (response.code, url))
except urllib.error.HTTPError as e:
    if e.code != 404:
        print("!!! %d => %s" % (e.code, url))
    pass
    • Constructs the full URL by appending the brute-forced path to the target URL.
    • Sends an HTTP request to the constructed URL with a specified User-Agent.
    • Prints the result, indicating whether the path is valid or not.

This script is intended for educational purposes and should only be used in environments where you have explicit permission to perform such tests. Unauthorized or malicious use of this script is illegal and unethical.

Exit mobile version