SHOW:
|
|
- or go back to the newest paste.
| 1 | #!/usr/bin/python | |
| 2 | from BeautifulSoup import BeautifulSoup as soup | |
| 3 | import httplib | |
| 4 | import sys | |
| 5 | """ | |
| 6 | **I've fixed some issues and upgraded the output a bit | |
| 7 | ||
| 8 | A simple extension to goofile.py | |
| 9 | features in this version: | |
| 10 | *allows you to dork from the command line, and returns critical information | |
| 11 | about the targets like | |
| 12 | >title text of the page | |
| 13 | >a short description | |
| 14 | >the URL to the target | |
| 15 | TODO: | |
| 16 | >Duckduckgo search script on the way, im gonna include results from both search engines ;) | |
| 17 | >server type detection | |
| 18 | >dork presets for specifying targets with | |
| 19 | *SQLi vulnerabilities in pages | |
| 20 | *LFI/RFI vulnerabilities | |
| 21 | *XSS vulnerabilities | |
| 22 | *vulnerable files | |
| 23 | I will implement this in such a way that you can localize a search to a given target | |
| 24 | >CMS type detection | |
| 25 | >I would like in the future to have googledorker learn from the searches you have performed and cache them | |
| 26 | for faster results, and also use a lil machine learning to enhance the responsiveness to certain targets | |
| 27 | ||
| 28 | Depedencies: | |
| 29 | are availble in the second line of the script! | |
| 30 | ||
| 31 | >>>If you wanna get something really awesome going, you could plug these results into an nmap scan, and automate | |
| 32 | penetration testing XD | |
| 33 | ||
| 34 | This was inspired by googile.py | |
| 35 | ||
| 36 | Author: Keith Makan | |
| 37 | Twitter: k3170makan | |
| 38 | site:k3170makan.blogspot.com | |
| 39 | """ | |
| 40 | class resultManager: | |
| 41 | """ | |
| 42 | An object to manage results | |
| 43 | *title | |
| 44 | *URL | |
| 45 | *server type | |
| 46 | *script_type | |
| 47 | Ill just send a request to each server and swipe the details from the response headers ;) | |
| 48 | """ | |
| 49 | def __init__(self): | |
| 50 | - | h.putrequest('GET',"/search?num=100&q="+dork)
|
| 50 | + | |
| 51 | ||
| 52 | - | h.putheader('User-agent','Internet Explorer 6.0')
|
| 52 | + | |
| 53 | - | h.putheader('Referrer','www.g13net.com')
|
| 53 | + | |
| 54 | return | |
| 55 | def get_page(self,dork): | |
| 56 | h = httplib.HTTP('www.google.com')
| |
| 57 | h.putrequest('GET',"/search?num=500&q="+dork)
| |
| 58 | h.putheader('Host','www.google.com')
| |
| 59 | h.putheader('User-agent','Internet Explorer 6.0 ')
| |
| 60 | h.putheader('Referrer','k3170makan.blogspot.com')
| |
| 61 | h.endheaders() | |
| 62 | returncode,returnmsg,headers = h.getreply() | |
| 63 | html=h.getfile().read() | |
| 64 | #print html | |
| 65 | return html | |
| 66 | - | print "Google is refusing you search query, please wait about 10mins before trying again" |
| 66 | + | |
| 67 | soop = soup(page) | |
| 68 | resTag = soop.findAll("div",{"id":"res"}) #get the divider that wraps the results
| |
| 69 | if len(resTag) == 0: | |
| 70 | print page | |
| 71 | ||
| 72 | print "Google is being naabs by refusing your queries, please wait about 10mins before trying again" | |
| 73 | return [] | |
| 74 | results_wrapperTag = soup(str(resTag)).findAll("ol")
| |
| 75 | results_list = soup(str(results_wrapperTag)).findAll("li",{"class":"g"})
| |
| 76 | - | URL = str(results_anchorTAG).split("/url?q=")[1].split(";")[0]
|
| 76 | + | |
| 77 | - | URL = URL[:len(URL)-4] #okay so we have the url |
| 77 | + | |
| 78 | - | print "> %s " % (etc), |
| 78 | + | |
| 79 | - | results_summaryTAG = soup(string_res).findAll("div",{"class":"s"})
|
| 79 | + | |
| 80 | - | for etc in results_summaryTAG: |
| 80 | + | |
| 81 | - | print "\t>>%s" % (etc) |
| 81 | + | |
| 82 | if len(results_anchorTAG) == 1: | |
| 83 | URL = str(results_anchorTAG).split("/url?q=")
| |
| 84 | if len(URL) >= 1: | |
| 85 | try: #sometimes the search will return links to google images or other crap, if so i stop processing because the anchors have a slightly different form to the results, in which case the follow code will raise an exception. | |
| 86 | URL = URL[1].split(";")[0]
| |
| 87 | URL = URL[:len(URL)-4] #okay so we have the url | |
| 88 | result_URLs.append(URL) | |
| 89 | - | self.stripURLs(html) |
| 89 | + | except: |
| 90 | return result_URLs | |
| 91 | ||
| 92 | print "target:> %s " % (URL), | |
| 93 | results_summaryTAG = soup(string_res).findAll("div",{"class":"s"})
| |
| 94 | if len(results_summaryTAG) == 1: | |
| 95 | for etc in results_summaryTAG: | |
| 96 | print "summary:\n\t>>%s" % (str(etc)) | |
| 97 | ||
| 98 | return result_URLs | |
| 99 | def dork(self,dork_term): | |
| 100 | - | print 'example: ./googledorker.py inurl:".php?*=*"' |
| 100 | + | |
| 101 | print the results for the dork_term supplied | |
| 102 | """ | |
| 103 | html = self.get_page(dork_term) | |
| 104 | results = self.stripURLs(html) | |
| 105 | print "listing URLS" | |
| 106 | for index,result in enumerate(results): #enumerate is awesome btw! | |
| 107 | print index+1,"]",result | |
| 108 | return | |
| 109 | if __name__ == "__main__": | |
| 110 | dorky = Dorker() | |
| 111 | if len(sys.argv) > 1: | |
| 112 | print "Running dork <%s>" % (sys.argv[1]) | |
| 113 | dorky.dork(sys.argv[1]) | |
| 114 | else: | |
| 115 | print ".::Google Dorker::." | |
| 116 | ||
| 117 | print "Usage: ./googledorker.py [dork_term]" | |
| 118 | ||
| 119 | print 'example: ./googledorker.py filetype:sql' | |
| 120 | print "*Please ensure that you're dork in all in a single line, use %20 for spaces and + to combine search operators" | |
| 121 | print "See: http://k3170makan.blogspot.com/2012/01/science-of-google-dorking.html" |