owncloud_bruteforcer

README

owncloud_bruteforcer

Simple tool to bruteforce owncloud instance accounts

A word of caution - tool by default can DOS owncloud instance.

Description

Tool:

• make GET request to acquire CSRF token + cookies
• make POST request using given username and password wordlist.

Installation

go install git.sual.in/casual/owncloud_bruteforcer@latest

Example

owncloud_bruteforce -u "https://target.com/login" -P ./rockyou.txt

Help

Owncloud_bruteforcer - tool to bruteforce user

Usage:
  owncloud_bruteforcer [flags]

Flags:
INPUT:
   -url, -u string                target's url to login page. Example "https://example.com/index.php/login, http://example.com/login "
   -login, -l string              username to bruteforce (default "admin")
   -login-wordlist, -L string     username wordlist
   -password-wordlist, -P string  password wordlist
   -proxy, -x string              HTTP proxy for packet inspection (Burp/Caidu/ZAP) (for example http://127.0.0.1:8080). But be aware, if you enable inspection then attack will fail because of delays
   -threads, -t int               threads to bruteforce (default 10)

Notes (TODO)

• Expect to DOS service (100% CPU) (even if it have bruteforce protection enabled) if you prefer not to, set -t 5 or less (but it will slowdown attack)
• Successful login detected by redirect location after POST request. If user have 2FA, then app will not show found login:password. (Detects by redirect location)
• Bruteforce protection isn't detected (after hitting limit, response to POST - 403 instead 303)
• If there is internet connection problem or WAF/rate-limit/etc blocked you, you may recieve can't create (POST) request: Post "https://target.com/login": context deadline exceeded (Client.Timeout exceeded while awaiting headers) and attack will stop without a way to continue
• There is way to bruteforce administrator account which use different endpoint, possibly can allow to bruteforce admin account in same time without slowing down current version of tool

License

This project is licensed under the MIT License - see the LICENSE file for details. I am not responsible for any actions or damage.