function we will reuse this function later in this we want some basic functionality to be available to our brute-forcing script the first is the ability to apply list of extensions to test for when making requests in some casesyou want to try not only the /admin directly for examplebut admin phpadmin incand admin html def dir_bruter(word_queue,extensions=none)while not word_queue empty()attempt word_queue get(attempt_list [check to see if there is file extensionif notit' directory path we're bruting if not in attemptattempt_list append("/% /attemptelseattempt_list append("/%sattemptif we want to bruteforce extensions if extensionsfor extension in extensionsattempt_list append("/% % (attempt,extension)iterate over our list of attempts for brute in attempt_listurl "% % (target_url,urllib quote(brute)tryheaders {headers["user-agent"user_agent urllib request(url,headers=headersresponse urllib urlopen(rif len(response read())print "[% =% (response code,urlexcept urllib urlerror,eif hasattr( 'code'and code ! print "!!% =% ( code,urlpass our dir_bruter function accepts queue object that is populated with words to use for bruteforcing and an optional list of file extensions to test we begin by testing to see if there is file extension in the current word and if there isn'twe treat it as directory that we want to test for on the remote web server if there is list of file extensions passed in then we take the current word and apply each file extension that we want to test for it can be useful here to think of using extensions like orig and bak on top of the regular programming language extensions after we build list of brute-forcing attemptswe set the user-agent header to something innocuous and test the remote web server if the response code is we output the url and if we receive anything but we also output it because this could indicate something interesting on the remote web server aside from "file not founderror it' useful to pay attention to and react to your output becausedepending on the configuration of the remote web serveryou may have to filter out more http error codes in order to clean up your