Pain_R

WordPress Infected Themes Scanner

Mar 22nd, 2014
389
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 2.99 KB | None | 0 0
  1. <?
  2.     @set_time_limit(0);
  3.     /*
  4.      * Title    : WordPress Infected Themes Scanner
  5.      * Coded By : xSecurity
  6.      * Home     : www.sec4ever.com - www.is-sec.com
  7.      * Skype    : xSecur1ty
  8.      * Greets   : Lov3rDNS - NeoDz - Mr.Dm4r - massacreur - b0x !
  9.      * Dorks    : ?page_id & ?p= & Powered By Wordpress
  10.      */
  11.     $ip = $_POST['ip'];
  12. ?>
  13.     <title>WordPress Infected Themes Scanner</title>
  14.     <form method="POST">
  15.     <input type="text" name="ip" value="<? if(isset($_POST['ip'])) { echo $ip; }  else { echo '127.0.0.1'; } ?>" />
  16.     <select name='dork'>
  17.         <option>#-Dork-#?</option>
  18.         <option>?page_id=</option>
  19.         <option>?p=</option>
  20.         <option>Powered By Wordpress</option>
  21.     </select>
  22.     <input type="submit" value="Get Infected Themes" name="start" />
  23.     </form>
  24. <?
  25.    
  26.     if($_POST['dork'] == "?page_id=")
  27.     {
  28.         $bing = "IP:$ip+?page_id=";
  29.     } else if($_POST['dork'] == "?p=") {
  30.         $bing = "IP:$ip+?p=";
  31.     } else if($_POST['dork'] == "Powered By Wordpress") {
  32.         $bing = "IP:$ip+Powered+By+Wordpress";
  33.     }
  34.    
  35.     function check($url)
  36.     {
  37.         $url=(!eregi("http://www",$url))?str_replace("http://","http://www.",$url):$url;
  38.         $m = parse_url($url);
  39.         return "http://".$m[host]."/";
  40.     }
  41.    
  42.     function b0x($check)
  43.     {
  44.         $curl = curl_init();
  45.         curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
  46.         curl_setopt($curl,CURLOPT_FOLLOWLOCATION,1);
  47.         curl_setopt($curl,CURLOPT_URL, $check);
  48.         @curl_setopt($curl,CURLOPT_COOKIEJAR, getcwd()."./cookie.txt");
  49.         @curl_setopt($curl,CURLOPT_COOKIEFILE, getcwd()."./cookie.txt");
  50.         $get = curl_exec($curl);
  51.         preg_match_all('#/themes/(.*?)/#', $get, $theme);
  52.         $theme = array_unique($theme[1]);
  53.         foreach($theme as $themes)
  54.         {
  55.             $url = "http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description={$themes}&filter_exploit_text=&filter_author=&filter_platform=0&filter_type=6&filter_lang_id=0&filter_port=&filter_osvdb=&filter_cve=";
  56.             $x = @file_get_contents($url);
  57.             if(!eregi("No results", $x))
  58.             {
  59.                 print "<a href='{$check}' target='_blank' style='text-decoration: none'><font face='Tahoma' size='2' color='red' >".$check."</a> -> <a href='{$url}' target='_blank' style='text-decoration: none'>".$themes."</a> <- </font><font size='2' face='Tahoma'>Exploit-DB<br></font>";
  60.             } else {
  61.                 print "<font face='Tahoma' size='2'>".$check." -> ".$themes."</font><br>";
  62.             }
  63.         }
  64.     }
  65.     if($_POST['start'])
  66.     {
  67.         print "<font face='Tahoma' size='2'>Dork Using : <font color='red'>".$dork."</font><br></font><br>";
  68.         for($i=1;$i<=10+10;$i++)
  69.         {
  70.             $get = @file_get_contents("http://www.bing.com/search?q=$bing&go=&qs=ds&filt=all&first=$i");
  71.             preg_match_all('#(<div class="sb_tlst">.*<h3>.*<a href="(.*)".*>(.*)</a>.*</h3>.*</div>)#siU',$get, $site);
  72.         }
  73.             $sites = array_unique($site[2]);
  74.             foreach($sites as $webs)
  75.             {
  76.                 $check = check($webs);
  77.                 print b0x($check);
  78.             }
  79.     }
  80.     echo "<font face='Tahoma' size='2'><br> <font color='red'>RED</font> Color Mean Infected Theme !<br>Coded By: xSecurity - Sec4ever.CoM - Is-SeC.CoM</font>";
  81. ?>
Add Comment
Please, Sign In to add comment