Can You Even Curl Bro

#             CanYouEvenCurlBro.sh

#   Advanced Persistent Attack Web Reconnaissance Tool

#   CanYouEvenCurlBro.sh, ingeniously crafted by Michael Errington of GhostSec, stands at the forefront of advanced persistent attack tools. Specifically designed for web reconnaissance, this tool utilizes intricate curl commands to systematically uncover an array of website issues. Its distinguishing feature lies in its ability to conduct scans that often go undetected due to the contemporary and stealthy use of curl.

#   Operational Framework

#   1. Targeted Domain Definition. The script commences operations by precisely defining a target domain, exemplified by "https://example.com."

#   2. Sophisticated Search Queries (Dorks). Armed with an extensive array of dorks, the script crafts dynamic search queries, strategically targeting vulnerabilities. These queries include patterns associated with admin panels, login interfaces, and prevalent CMS platforms.

#   3. Stealthy Scanning Function. At its core, the script employs a dynamic `scan_url` function. Leveraging intricate curl commands, it inspects HTTP response codes, discreetly identifying potential vulnerabilities ("Found") without triggering conventional flags.

#   4. Automated Iterative Scanning. The script systematically cycles through the array of dorks, merging them with the target domain. It submits each resulting URL to the scrutiny of the `scan_url` function, executing stealthy scans within the target environment.

#   Strategic Applications in Advanced Persistent Attacks

#   1. Covert Security Audits. Positioned as a tool of choice for advanced persistent attackers engaged in covert security audits. It efficiently identifies vulnerabilities for exploitation while minimizing detection.

#   2. Subtle Penetration Testing. Empowers attackers with subtle penetration testing capabilities, allowing for the identification of entry points and potential exploits without raising suspicion.

#   3. Persistent Vulnerability Assessment. Facilitates persistent vulnerability assessments, discreetly uncovering misconfigurations and exposed admin interfaces over an extended period.

#   4. Undercover Educational Exploits. Valuable for educational purposes, demonstrating the efficacy of covert reconnaissance techniques in understanding the critical importance of securing web applications against advanced persistent threats.

#   CanYouEvenCurlBro.sh emerges as a tool tailored for advanced persistent attacks, employing a stealthy approach to web reconnaissance. Its capacity to conduct scans without conventional detection mechanisms makes it a formidable asset for attackers navigating the intricacies of web application vulnerabilities. Awareness of its advanced capabilities is crucial for defenders and security practitioners to fortify against sophisticated threats in the digital landscape.

#!/bin/bash

# Define the target domain
target_domain="https://example.com"

# List of dorks
dorks=(
    "inurl:/admin"
    "inurl:/login"
    "inurl:/administrator"
    "inurl:/adminLogin"
    "inurl:/adminPanel"
    "intitle:\"phpMyAdmin\""
    "intitle:\"Admin Login\""
    "intitle:\"Admin Panel\""
    "intitle:\"Login\""
    "intext:\"Powered by PHPMyAdmin\""
    "intext:\"Admin Login\""
    "intext:\"Admin Panel\""
    "intext:\"Login\""
    "intext:\"Powered by phpMyAdmin\""
    "inurl:/wp-admin"
    "inurl:/wp-login"
    "intitle:\"WordPress Login\""
    "inurl:/drupal"
    "intext:\"Powered by Drupal\""
    "inurl:/joomla"
    "intext:\"Powered by Joomla\""
    "inurl:/phpmyadmin"
    "inurl:/dbadmin"
    "inurl:/myadmin"
    "inurl:/phpMyAdmin2"
    "inurl:/phpMyAdmin3"
    "intext:\"Welcome to phpMyAdmin\""
    "intext:\"Welcome to phpMyAdmin 2\""
    "intext:\"Welcome to phpMyAdmin 3\""
    "inurl:/webadmin"
    "inurl:/siteadmin"
    "inurl:/phpmyadmin2"
    "inurl:/phpmyadmin3"
    "inurl:/phpmyadmin4"
    "intext:\"Administer your database\""
    "intext:\"Database management system\""
    "intext:\"MySQL administrator\""
    "intext:\"phpMyAdmin login\""
    "intext:\"Control Panel\""
    "inurl:/controlpanel"
    "intext:\"cPanel Login\""
    "inurl:/phpmyadmin/index.php"
    "intext:\"phpMyAdmin setup\""
    "intext:\"phpMyAdmin username\""
    "intext:\"phpMyAdmin password\""
    "intext:\"phpMyAdmin hostname\""
    "inurl:/phpmyadmin/config.inc.php"
    "intext:\"config file\" ext:txt"
    "inext:\"root@localhost\" intext:\"phpMyAdmin\""
    "inurl:/administrator/index.php"
    "inurl:/admin1.php"
    "inurl:/admin1.html"
    "inurl:/login.php"
    "inurl:/login.html"
    "inurl:/login.aspx"
    "inurl:/siteadmin/index.php"
    "inurl:/siteadmin"
    "inurl:/siteadmin/login.asp"
    "inurl:/admin/controlpanel.asp"
    "inurl:/admin/login.asp"
    "inurl:/admin/index.asp"
    "inurl:/user/login"
    "inurl:/users/login"
    "inurl:/adminarea"
    "inurl:/bb-admin"
    "inurl:/wp-admin"
    "inurl:/wp-login"
    "inurl:/wp-login.php"
    "inurl:/bb-admin/login"
    "inurl:/bb-admin/admin"
    "inurl:/bb-admin/admin.html"
    "inurl:/bb-admin/admin.php"
    "inurl:/administrator/index.html"
    "inurl:/administrator/index.php"
    "inurl:/administrator/login"
    "inurl:/admin/cp.php"
    "inurl:/admin/index.html"
    "inurl:/admin/index.php"
    "inurl:/admin/admin.html"
    "inurl:/admin/admin.php"
    "inurl:/login/login.html"
    "inurl:/login/login.php"
    "inurl:/admin/account.html"
    "inurl:/admin/account.php"
    "inurl:/admin/index.html"
    "inurl:/admin/index.php"
    "inurl:/admin/admin.html"
    "inurl:/admin/admin.php"
    "inurl:/admin/login/login.html"
    "inurl:/admin/login/login.php"
    "inurl:/admin/login/admin.html"
    "inurl:/admin/login/admin.php"
    "inurl:/admin/login/account.html"
    "inurl:/admin/login/account.php"
    "inurl:/admin/cp.html"
    "inurl:/admin/cp.php"
    "inurl:/admin/home.html"
    "inurl:/admin/home.php"
    "inurl:/admin/admin/home.html"
    "inurl:/admin/admin/home.php"
    "inurl:/admin/login/home.html"
    "inurl:/admin/login/home.php"
    "inurl:/admin/login/index.html"
    "inurl:/admin/login/index.php"
    "inurl:/admin/index/home.html"
    "inurl:/admin/index/home.php"
    "inurl:/admin/index/login/index.html"
    "inurl:/admin/index/login/index.php"
    "inurl:/admin/login/home/index.html"
    "inurl:/admin/login/home/index.php"
    "inurl:/admin/index/login/index.html"
    "inurl:/admin/index/login/index.php"
    "inurl:/admin/home/index/index.html"
    "inurl:/admin/home/index/index.php"
    "inurl:/phpmyadmin/index.html"
    "inurl:/phpmyadmin/index.php"
    "inurl:/phpmyadmin/phpmyadmin/index.html"
    "inurl:/phpmyadmin/phpmyadmin/index.php"
    "inurl:/phpmyadmin/phpmyadmin/phpmyadmin/index.html"
    "inurl:/phpmyadmin/phpmyadmin/phpmyadmin/index.php"
)

# Function to scan a URL
scan_url() {
    url="$1"
    echo "Scanning $url"
    response=$(curl -s -o /dev/null -w "%{http_code}" "$url")
    if [ "$response" -eq 200 ]; then
        echo "Found: $url"
    else
        echo "Not Found: $url"
    fi
}

# Loop through dorks and scan URLs
for dork in "${dorks[@]}"; do
    full_url="$target_domain/$dork"
    scan_url "$full_url"
done