WPKnife - WordPress Scanner Vulnerabilities (BUG7SEC)

<?php
/*
Title  : WPKnife - WordPress Scanner Vulnerabilities
Desc   : WordPress Scanner Vulnerabilities
Author : Shor7cut - http://facebook.com/bug7sec
----------------------------------------------
(C) BUG7SEC - 2015
----------------------------------------------
Spesial :
- BUG7SEC team
- Tuban Cyber Team
- Defacer tersakiti team
- IndoXploit Coders
- ISD-Team
- IDCA (Indonesian Cyber Army)
*/
error_reporting(0);
session_start();
echo "
  .------------------------------------------------------.
  | WPKnife - WordPress Scanner Vulnerabilities          |
  |                          SHOR7CUT (Bug7sec)          |
  .------------------------------------------------------.
";
if($argv[1]){
    scan($argv[1]);
}else{
echo '  [Usage] : php '.$argv[0].' http://localhost/';
}


function scan($url){
echo "\r\n";
$start_vuln=1;
$total_vuln=0;
$wpvuln = array(
    'wp-content/plugins/wp-responsive-thumbnail-slider/'    => 'https://www.exploit-db.com/exploits/37998/',
    'wp-content/plugins/recent-backups/'                    => 'https://www.exploit-db.com/exploits/37752/',
    'wp-content/themes/agritourismo-theme/'                 => 'https://www.exploit-db.com/exploits/29946/',
    'wp-content/themes/bordeaux-theme/'                     => 'https://www.exploit-db.com/exploits/29946/',
    'wp-content/themes/bulteno-theme/'                      => 'https://www.exploit-db.com/exploits/29946/',
    'wp-content/themes/oxygen-theme/'                       => 'https://www.exploit-db.com/exploits/29946/',
    'wp-content/themes/radial-theme/'                       => 'https://www.exploit-db.com/exploits/29946/',
    'wp-content/themes/rayoflight-theme/'                   => 'https://www.exploit-db.com/exploits/29946/',
    'wp-content/themes/reganto-theme/'                      => 'https://www.exploit-db.com/exploits/29946/',
    'wp-content/themes/rockstar-theme/'                     => 'https://www.exploit-db.com/exploits/29946/',
    'wp-content/plugins/mypixs/mypixs/downloadpage.php?url=/etc/passwd'=> 'http://www.vapid.dhs.org/advisory.php?v=154',
    'wp-content/plugins/wp-front-end-repository/js/'        => 'http://www.vapid.dhs.org/advisory.php?v=141',
    'wp-content/plugins/candidate-application-form/'        => 'http://www.vapid.dhs.org/advisory.php?v=142',
    'wp-content/plugins/mp3-jplayer/'                       => 'http://www.vapid.dhs.org/advisory.php?v=149',
    'wp-content/plugins/filedownload/'                      => 'http://www.vapid.dhs.org/advisory.php?v=140',
    'wp-content/plugins/fast-image-adder/'                  => 'http://www.vapid.dhs.org/advisory.php?v=139',
    'wp-content/plugins/mailcwp/'                           => 'http://www.vapid.dhs.org/advisory.php?v=138',
    'wp-content/plugins/ibs-mappro/lib'                     => 'http://www.vapid.dhs.org/advisory.php?v=137',
    'wp-content/plugins/wp-ecommerce-shop-styling/'         => 'http://www.vapid.dhs.org/advisory.php?v=136',
    'wp-content/plugins/wp-swimteam/include'                => 'http://www.vapid.dhs.org/advisory.php?v=134',
    'wp-content/plugins/mdc-youtube-downloader'             => 'http://www.vapid.dhs.org/advisory.php?v=133',
    'wp-content/plugins/image-export/'                      => 'http://www.vapid.dhs.org/advisory.php?v=135',
    'wp-content/plugins/zip-attachments/'                   => 'http://www.vapid.dhs.org/advisory.php?v=126',
    'wp-content/plugins/aviary-image-editor-add-on-for-gravity-forms/' => 'http://www.vapid.dhs.org/advisory.php?v=125',
    'wp-content/plugins/se-html5-album-audio-player/js/'    => 'http://www.vapid.dhs.org/advisory.php?v=124',
    'wp-content/plugins/adsense-click-fraud-monitoring'     => 'http://www.vapid.dhs.org/advisory.php?v=119',
    'wp-content/plugins/videowhisper-video-conference-integration' => 'http://www.vapid.dhs.org/advisory.php?v=116',
    'wp-content/plugins/videowhisper-video-presentation'    => 'http://www.vapid.dhs.org/advisory.php?v=117',
    );
foreach(array_keys($wpvuln) as $patchvuln)
{
    $ch = curl_init($url.$patchvuln);
    curl_setopt($ch, CURLOPT_NOBODY  , true);
    curl_exec($ch);
    $info = curl_getinfo($ch);
echo "[SCAN] Themes/plugins $start_vuln of ".count($wpvuln)." Vulnerabilities [Http Code : ".$info['http_code']."]\r\n";
if($info['http_code']==200){
    $exploit_url = $wpvuln[$patchvuln];
    $_SESSION[$start_vuln]=$exploit_url;
    $total_vuln++;
}
curl_close($ch);
$start_vuln++;
}
if(!$total_vuln){
    echo "\r\n[REPORT] Ditemukan 0 dari ".count($wpvuln)." Vulnerabilities.\r\n";
}else{
    echo "\r\n[REPORT] Ditemukan $total_vuln dari ".count($wpvuln)." Vulnerabilities.\r\n";
    foreach ($_SESSION as $key => $value) {
    if($value){
        echo "-> ".$value."\r\n";
    }
}
}
session_destroy();
} //akhir func



function status_code($key){
     switch ($key) {
                    case 100: $text = 'Continue'; break;
                    case 101: $text = 'Switching Protocols'; break;
                    case 200: $text = 'OK'; break;
                    case 201: $text = 'Created'; break;
                    case 202: $text = 'Accepted'; break;
                    case 203: $text = 'Non-Authoritative Information'; break;
                    case 204: $text = 'No Content'; break;
                    case 205: $text = 'Reset Content'; break;
                    case 206: $text = 'Partial Content'; break;
                    case 300: $text = 'Multiple Choices'; break;
                    case 301: $text = 'Moved Permanently'; break;
                    case 302: $text = 'Moved Temporarily'; break;
                    case 303: $text = 'See Other'; break;
                    case 304: $text = 'Not Modified'; break;
                    case 305: $text = 'Use Proxy'; break;
                    case 400: $text = 'Bad Request'; break;
                    case 401: $text = 'Unauthorized'; break;
                    case 402: $text = 'Payment Required'; break;
                    case 403: $text = 'Forbidden'; break;
                    case 404: $text = 'Not Found'; break;
                    case 405: $text = 'Method Not Allowed'; break;
                    case 406: $text = 'Not Acceptable'; break;
                    case 407: $text = 'Proxy Authentication Required'; break;
                    case 408: $text = 'Request Time-out'; break;
                    case 409: $text = 'Conflict'; break;
                    case 410: $text = 'Gone'; break;
                    case 411: $text = 'Length Required'; break;
                    case 412: $text = 'Precondition Failed'; break;
                    case 413: $text = 'Request Entity Too Large'; break;
                    case 414: $text = 'Request-URI Too Large'; break;
                    case 415: $text = 'Unsupported Media Type'; break;
                    case 500: $text = 'Internal Server Error'; break;
                    case 501: $text = 'Not Implemented'; break;
                    case 502: $text = 'Bad Gateway'; break;
                    case 503: $text = 'Service Unavailable'; break;
                    case 504: $text = 'Gateway Time-out'; break;
                    case 505: $text = 'HTTP Version not supported'; break;
                    default:
                        exit('Unknown http status code');
                    break;
                }
return $text;
}
?>