API tools faq
paste
MrPaan

gay

MrPaan
Dec 11th, 2013
274
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 6.43 KB | None | 0 0
raw download clone embed print report
  1. <html>
  2. <title>Joomla & Wordpress Scanner Vulnerability</title>
  3. <center>
  4. <form method=get>
  5. Website : <input type=text name=url>
  6. <p>Website Type</p>
  7. <input type=radio name=lol value='joomla'>JOOMLA</br>
  8. <input type=radio name=lol value='wordpress'>Wordpress</br>
  9. <input type=submit value=Scan>
  10. </form>
  11. <?php
  12.  
  13.  
  14.  
  15. $url = $_POST['url'];
  16. $lol = $_POST['lol'];
  17.  
  18. if ($lol == 'joomla') {
  19.  
  20. $url = $_POST['url'];
  21. $jMe = new jComDetect($url);
  22.  
  23. class jComDetect {
  24.     public $url;
  25.  
  26.     function __construct($url){
  27.         $this->url = $url;
  28.         $this->init();
  29.     }
  30.    
  31.     function init() {
  32.         $content = $this->cURL($this->url);
  33.         if(!preg_match("/200 OK/", $content)) {
  34.             $this->msg("[-] Error! 404 Not Found -- By Ahlspiess");
  35.             exit;
  36.         } else {
  37.             print $this->jCheckComp($content);
  38.         }
  39.     }
  40.    
  41.     function jCheckComp($content) {
  42.         $dupe = array();
  43.         $nstack = array();
  44.         preg_match_all("/Joomla! (.*?) -/", $content, $ver);
  45.         $this->msg("[+] Joomla version ".$ver[1][0]);
  46.         #$nstack[] = "joomla ".$ver[1][0];
  47.       preg_match_all("//component(s?)/(.*?)//", $content, $val_1);
  48.         preg_match_all("/option=(.*?)&/", $content, $val_2);
  49.         $var1 = explode(',', str_replace("com_com_", "com_", join(',com_', $val_1[2])));
  50.         $var2 = $val_2[1];
  51.         $stack = array_merge($var1, $var2);
  52.         foreach($stack as $unstack) {
  53.             if(!isset($dupe[$unstack]) and !is_null($unstack) and !empty($unstack) and (preg_match("/com_/", $unstack))) {
  54.                 $this->msg("[+] Founded {$unstack} Component");
  55.                 $nstack[] = $unstack;
  56.                 $dupe[$unstack] = true;
  57.             }
  58.         }
  59.         //echo "[Debug]".__fVULN__."n";
  60.         $this->fVuln($nstack);
  61.     }
  62.    
  63.     function fVuln($c = array()) {
  64.         $content = "";
  65.         foreach($c as $com) {
  66.             $content .= $this->cURL("http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description={$com}&filter_exploit_text=&filter_author=&filter_platform=31&filter_type=6&filter_lang_id=0&filter_port=&filter_osvdb=&filter_cve=");
  67.         }
  68.         preg_match_all('/<a href="http://www.exploit-db.com/exploits/(.*?)">(.*?)n/', $content, $me);
  69.         for($i=0;$i<count($me[1]);$i++) {
  70.             $this->msg("[+] ".trim(str_replace("</a>", "", $me[2][$i]))."n --> http://www.exploit-db.com\/exploits\/".trim($me[1][$i]));
  71.         }
  72.        
  73.     }
  74.    
  75.     function cURL($url) {
  76.         $ch = curl_init();
  77.         curl_setopt($ch, CURLOPT_HEADER, 1);
  78.         curl_setopt($ch, CURLOPT_TIMEOUT, 15);
  79.         curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  80.         curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
  81.         curl_setopt($ch, CURLOPT_URL, $url);
  82.         curl_setopt($ch, CURLOPT_USERAGENT, "jVulnComponent Crawler v1-Ahlspiess, Ported by wcypierre");
  83.         curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  84.         $data = curl_exec($ch);
  85.         if($data) {
  86.             return $data;
  87.         } else {
  88.             return 0;
  89.         }
  90.     }
  91.    
  92.     function msg($x) {
  93.         printf("%s<br />", $x);
  94.     }
  95.  
  96. }
  97. }
  98.  
  99. else if ($lol =='wordpress') {
  100.  
  101. $url = $_POST['url'];
  102. $jMe = new WordpressScanner($url);
  103.  
  104. class WordpressScanner {
  105.     public $url;
  106.  
  107.     function __construct($url){
  108.         $this->url = $url;
  109.         $this->init();
  110.     }
  111.    
  112.     function init() {
  113.         $content = $this->cURL($this->url);
  114.         if(!preg_match("/200 OK/", $content)) {
  115.             $this->msg("[-] Error! 404 Not Found");
  116.             exit;
  117.         } else {
  118.             print $this->wpscan($content);
  119.         }
  120.     }
  121.    
  122.     function wpscan($content) {
  123.        $dupe = array();
  124.                 $nstack = array();
  125.                 preg_match_all("/wp-content/themes/(.*?)/style.css/", $content, $ret_1);
  126.                 preg_match_all("/Theme URI: (.+)/", $this->cURL($this->argv[1]."/".$ret_1[0][0]), $ret_2);
  127.                 preg_match_all('/<meta name="generator" content="WordPress (.*?)" \/>/', $content, $ret_3);
  128.                 $this->msg("[+] Using Wordpress Version: ".trim($ret_3[1][0]));
  129.                 $this->msg("[+] Using ".trim($ret_1[1][0])." Theme. Url --> ".trim($ret_2[1][0]));
  130.                 preg_match_all("/wp-content/plugins/(.*?)//", $content, $stack);
  131.                 foreach($stack[1] as $unstack) {
  132.                         if(!isset($dupe[$unstack]) and !is_null($unstack) and !empty($unstack)) {
  133.                                 if(preg_match("/200 OK/", $this->cURL("http://svn.wp-plugins.org/".trim($unstack)."/"))) {
  134.                                         $this->msg("[+] Founded {$unstack} Plugins");
  135.                                         $this->msg(" --> Plugin URL --> http://svn.wp-plugins.org/".trim($unstack)."/");
  136.                                 } else {
  137.                                         $this->msg("[+] Founded {$unstack} Plugins.");
  138.                                 }
  139.                                 $nstack[] = $unstack;
  140.                                 $dupe[$unstack] = true;
  141.                         }
  142.                 }
  143.         //echo "[Debug]".__fVULN__."n";
  144.         $this->fVuln($nstack);
  145.     }
  146.    
  147.     function fVuln($c = array()) {
  148.         $content = "";
  149.         foreach($c as $com) {
  150.             $content .= $this->cURL("http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description={$com}&filter_exploit_text=&filter_author=&filter_platform=31&filter_type=6&filter_lang_id=0&filter_port=&filter_osvdb=&filter_cve=");
  151.         }
  152.         preg_match_all('/<a  href="http://www.exploit-db.com/exploits/(.*?)">(.*?)n/', $content, $me);
  153.         for($i=0;$i<count($me[1]);$i++) {
  154.             $this->msg("[+] ".trim(str_replace("</a>", "", $me[2][$i]))."n --> http://www.exploit-db.com/exploits/".trim($me[1][$i]));
  155.         }
  156.        
  157.     }
  158.    
  159.  
  160.  
  161.     function cURL($url) {
  162.         $ch = curl_init();
  163.         curl_setopt($ch, CURLOPT_HEADER, 1);
  164.         curl_setopt($ch, CURLOPT_TIMEOUT, 15);
  165.         curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  166.         curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
  167.         curl_setopt($ch, CURLOPT_URL, $url);
  168.         curl_setopt($ch, CURLOPT_USERAGENT, "~fap~fap");
  169.         curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  170.         $data = curl_exec($ch);
  171.         if($data) {
  172.             return $data;
  173.         } else {
  174.             return 0;
  175.         }
  176.     }
  177.    
  178.     function msg($x) {
  179.         printf("%s<br />", $x);
  180.     }
  181.  
  182. }
  183.  }
  184.  
  185. ?>
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!