RE: Vulnerability Scanner By The Alchemist 01-06-2013, 03:46 PM
#11
(12-31-2012, 07:45 AM)The Alchemist Wrote: First of all, I'd like to thank a hell lot to my friend ande, who helped me out with this project.
This is a vulnerability scanner made by me(with ande's help). It takes a link as input and checks if the link is vulnerable to SQLi, XSS, RFI or LFI vulnerability.
Copy-paste the code in notepad, save it with the extension .php
For example, save it as scanner.php
Upload it in your free(or paid) webhosting account and make sure your server supports PHP cURL, if it doesn't PM me for help and I'll help you for sure.
Or upload it in your local server. Surf the php file and check for vulnerabilities.
Here's the code :
PHP Code:<html> <head> <title>Vulnerability Scanner</title> <style type="text/css"> body { color: #ffffff; text-shadow: 2px 2px #000000; background-color: #282828; font-family: Arial, Helvetica, sans-serif; } pre { background-color: #353535; border: solid 1px #505050; } input { font-family: Arial, Helvetica, sans-serif; } .Button { padding: 5px 10px; background: #303030; border: solid #101010 1px; color: #fff; cursor: pointer; font-weight: bold; border-radius: 5px; -moz-border-radius: 5px; -webkit-border-radius: 5px; text-shadow: 1px 1px #000; } .Input { border: solid #101010 1px; color: white; font-weight: bold; padding: 3px; background-color: #252525; } </style> </head> <body> <div align="center"> <pre> _____ _ _ _ _ _ _ |_ _| | |__ ___ / \ | | ___ | |__ ___ _ __ ___ (_) ___ | |_ | | | |_ \ / _ \ / _ \ | | / __| | |_ \ / _ \ | |_ ` _ \ | | / __| | __| | | | | | | | __/ / ___ \ | | | (__ | | | | | __/ | | | | | | | | \__ \ | |_ |_| |_| |_| \___| /_/ \_\ |_| \___| |_| |_| \___| |_| |_| |_| |_| |___/ \__| Vulnerability Scanner www.hackcommunity.com </pre> <form method="POST" action=""> Enter URL : <input type="text" name="url" value="<?php if(isset($_POST['url'])){echo(htmlentities($_POST['url']));} else{echo('http://example.com/index.php?id=1');} ?>" size="75" class="Input" /> <input type="submit" name="submit" value="Scan" class="Button" /> </form> <br /> <?php //Coded by The Alchemist //Styled and modified by ande //Thanks again ande class Vulnscanner { private $sql = array("'",'"'); private $rfi = array("http://www.facebook.com"); private $lfi = array("../etc/passwd", "../../etc/passwd", "../../../etc/passwd", "../../../../etc/passwd", "../../../../../etc/passwd", "../../../../../../etc/passwd"); private $xss = array("'\"/><img src=\"http://owned.com\"/>"); private $sqlerrors = array("mysql_", "You have an error in your SQL syntax", "SQL Error", "Database Error", "supplied argument is not a valid MySQL result resource"); private $rfierrors = array("Welcome to Facebook - Log In, Sign Up or Learn More", "failed to open stream: No such file or directory"); private $lfierrors = array("root:x:0:0:root:", "failed to open stream: No such file or directory"); private $xsserrors = array("<img src=\"http://owned.com\"/>"); public function isvalid($link) { if(filter_var($link,FILTER_VALIDATE_URL) && strstr($link,"=")) return true; return false; } private function getcontents($link) { $agent= 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20100101 Firefox/17.0'; $ch = curl_init(); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($ch, CURLOPT_VERBOSE, true); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_USERAGENT, $agent); curl_setopt($ch, CURLOPT_URL,$link); $result=@curl_exec($ch); return $result; } private function errorcheck($url,$addtourl,$errorar) { foreach($addtourl as $val) { $link = $url.$val; $contents = $this->getcontents($link); foreach($errorar as $err) { if(strstr($contents, $err)) return true; } } return false; } public function issqlvulnerable($link) { $orig = $link; if($this->errorcheck($orig,$this->sql,$this->sqlerrors)) echo htmlentities($orig) ." <span style=\"color: red;\">might</span> be vulnerable to SQL Injection.<br />"; else echo htmlentities($orig) ." is probably <span style=\"color: red;\">NOT</span> vulnerable to SQL Injection.<br />"; } public function isrfivulnerable($link) { $orig = $link; $link = substr($link,0,strpos($link,'=')+1); if($this->errorcheck($link,$this->rfi,$this->rfierrors)) echo htmlentities($orig) ." <span style=\"color: red;\">might</span> be vulnerable to RFI.<br />"; else echo htmlentities($orig) ." is probably <span style=\"color: red;\">NOT</span> vulnerable to RFI.<br />"; } public function islfivulnerable($link) { $orig = $link; $link = substr($link,0,strpos($link,'=')+1); if($this->errorcheck($link,$this->lfi,$this->lfierrors)) echo htmlentities($orig) ." <span style=\"color: red;\">might</span> be vulnerable to LFI.<br />"; else echo htmlentities($orig) ." is probably <span style=\"color: red;\">NOT</span> vulnerable to LFI.<br />"; } public function isxssvulnerable($link) { $orig = $link; $link = substr($link,0,strpos($link,'=')+1); if($this->errorcheck($link,$this->xss,$this->xsserrors)) echo htmlentities($orig) ." <span style=\"color: red;\">might</span> be vulnerable to XSS.<br />"; else echo htmlentities($orig) ." is probably <span style=\"color: red;\">NOT</span> vulnerable to XSS.<br />"; } } // END OF CLASS if(isset($_POST['url']) && isset($_POST['submit'])) { $obj = new Vulnscanner(); $link = $_POST['url']; if($obj->isvalid($link)) { $obj->islfivulnerable($link); $obj->isxssvulnerable($link); $obj->issqlvulnerable($link); $obj->isrfivulnerable($link); } else { echo "<span style=\"color: red;\">". htmlentities($link) ." is not a valid link.</span>"; } } ?> <> </body> </html>
If you want to have a look at a sample upload of this code, do let me know.
PLEASE GIVE FEEDBACK!!
And also merge it in Havij in admin text....
![[+]](https://sinister.ly/images/modern/collapse_collapsed.png)
![[Image: 2YpkRjy.png]](http://i.imgur.com/2YpkRjy.png)
![[Image: IRlys.png]](http://i.imgur.com/IRlys.png)
