epixoip

#!/usr/bin/perl
# Mon May 18 13:33:40 PDT 2009 by epixoip <epixoip@hush.com>
# multi-threaded scanner for webdav-enabled servers. note this
# does NOT tell you if your server is vulnerable to any WebDAV
# exploits! it only tells you if WebDAV is enabled.


$|++;
use IO::Socket;
use threads;
use Thread::Queue;
use Term::ANSIColor qw(:constants);
our $starttime : shared;
our $count : shared;
our $hostcnt : shared;
our $thrnum :  shared = 75; # change to adjust performance
our $q : shared;
our %webdav : shared;

sub scan {
        my $host = shift;
        my $sock = new IO::Socket::INET (PeerAddr => "$host:http(80)",Timeout => 1);
        if ($sock) {
                print $sock "OPTIONS * HTTP/1.0\n\n";
                while (<$sock>) {
                        if ( $_ =~ /^(?:Allow|Public)\:\ (.*(?:COPY|MOVE|MKCOL|PROPFIND|PROPPATCH|LOCK|UNLOCK|SEARCH))/img ) {
                                $webdav{$host} = $1;
                        }
                }
                close $sock;
        }
}

sub report {
        print BOLD WHITE."\n\n[".GREEN."+".WHITE."]".RESET." The following hosts were discovered supporting WebDAV:\n";
        while ( my ($key, $value) = each(%webdav) ) { print "\t$key \t=> $value\n"; }
        exit;
}

sub main {
        print BOLD WHITE."[".GREEN."+".WHITE."]".RESET." Building queue... ";
        $q = new Thread::Queue;
        my $file = shift;
        open HOSTS, $file or die $!;
        while (<HOSTS>) { chomp $_; $q->enqueue($_); $hostcnt++; }
        close HOSTS;
        print "added $hostcnt hosts\n";
        print BOLD WHITE."[".GREEN."+".WHITE."]".RESET." $thrnum worker thread(s) will be spawned\n";
        print BOLD WHITE."[".GREEN."+".WHITE."]".RESET." WebDAV scan initiated for $hostcnt hosts\n";
        while (1) {
                my @threads = threads->list;
                if ($q->pending > 0) {
                        if  ($#threads <= $thrnum + 1) {
                                threads->new(\&scan, $q->dequeue);
                                $count++;
                        } else {
                                foreach $running (@threads) {
                                        $running->join();
                                }
                        }
                        my $percent = $count / $hostcnt * 100;
                        $width = `tput cols` - 35;
                        $char = ON_GREEN " ". RESET;
                        printf GREEN."---".RESET." %s hosts scanned  %s %.0f%%\r", $count, $char x (($width)*$count/$hostcnt), $percent;
                } else {
                        if ($#threads > 0) {
                                foreach $running (@threads) {
                                        $running->join();
                                }
                        }
                        &report;
                }
        }
}

&main($ARGV[0]);