Joomla 2.5 post with python to login

Question

I´m trying to create an script to do fails logins in Joomla. I had a brutal force attack some days ago and the plugin Brutal Force Stop was failed, I have changed the database from MySQL to DynamoDB and I would like try if I can set many computers failing a login and if DynamoDB works fine.

Them, I have my own simple script to make a post with user and password:

mydata=[
   ('username','sistemas'),
   ('password','fake'),
   ('return', "L2luZGV4LnBocA"),
   ('8c7b78172222114c616d844e7dd4a75e', "1"),
   ('url', 'aHR0cDovL3czLnRvdGFsY2hhbm5lbC5jb20vbG9naW4=')
       ]
mydata=urllib.urlencode(mydata)
path= "www.myweb.com/login.php"
req=urllib2.Request(path, mydata)
req.add_header("Content-type", "application/x-www-form-urlencoded")
page=urllib2.urlopen(req).read()
print page 

This works fine in localhost with my php script. But when I do the real test I get nothing.

Someone know why? Maybe something of joomla 2.5?

Answer 1

Could it be you don't handle the form token correctly? Your value ('8c7b78172222114c616d844e7dd4a75e', "1") is the form token set by the joomla application, and when you try to log in you need to present the same form token that was presented to you on the login page. So you should pick up the form token from the site where you want to log in. I dont know python that well, but if you can first read the login page ( http://yoursite.com?option=com_users ) and use a regex to get the token in the output, you can reuse this token when you log in. Hope it make sense...