there may come time in your web hacking career where you need to either gain access to targetor if you're consultingyou might need to assess the password strength on an existing web system it has become more and more common for web systems to have brute-force protectionwhether captchaa simple math equationor login token that has to be submitted with the request there are number of brute forcers that can do the brute-forcing of post request to the login scriptbut in lot of cases they are not flexible enough to deal with dynamic content or handle simple "are you humanchecks we'll create simple brute forcer that will be useful against joomlaa popular content management system modern joomla systems include some basic anti-brute-force techniquesbut still lack account lockouts or strong captchas by default in order to brute-force joomlawe have two requirements that need to be metretrieve the login token from the login form before submitting the password attempt and ensure that we accept cookies in our urllib session in order to parse out the login form valueswe'll use the native python class htmlparser this will also be good whirlwind tour of some additional features of urllib that you can employ when building tooling for your own targets let' get started by having look at the joomla administrator login form this can be found by browsing to form elements <form action="/administrator/index phpmethod="postid="form-loginclass="form-inline"<input name="usernametabindex=" id="mod-login-usernametype="textclass="input-mediumplaceholder="user namesize=" "/<input name="passwdtabindex=" id="mod-login-passwordtype="passwordclass="input-mediumplaceholder="passwordsize=" "/language default english (united kingdomreading through this formwe are privy to some valuable information that we'll need to incorporate into our brute forcer the first is that the form gets submitted to the /administrator/index php path as an http post the next are all of the fields required in order for the form submission to be successful in particularif you look at the last hidden fieldyou'll see that its name attribute is set to longrandomized string this is the essential piece of joomla' anti-brute-forcing technique that randomized string is checked against your current user sessionstored in cookieand even if you are passing the correct credentials into the login processing scriptif the randomized token is not presentthe authentication will fail this means we have to use the following request flow in our brute forcer in order to be successful against joomla retrieve the login pageand accept all cookies that are returned parse out all of the form elements from the html set the username and/or password to guess from our dictionary