home *** CD-ROM | disk | FTP | other *** search
/ Hackers Handbook - Millenium Edition / Hackers Handbook.iso / files / c_scripts / cgichk-11b.c < prev    next >
Encoding:
C/C++ Source or Header  |  1999-04-11  |  5.7 KB  |  189 lines
  1. /* ---------------------------------------------------------------------- */
  2. /* CGI scanner v1.0, m0dify and recode by su1d sh3ll //UnlG 1999          */
  3. /* Tested on Slackware linux with kernel 2.0.35 and FreeBSD 2.2.2-3.0     */
  4. /* Source c0de by [CKS & Fdisk]                                           */
  5. /* Gr33tz to: r00tshell, Packet St0rm, ADM crew, mishgan[kpz]             */
  6. /* Fuck to: www.hackzone.ru , HDT......  CHC fuck u 2  llamas             */
  7. /* -----------------------------------------------[12:03 11.03.99  UnlG]- */
  8.  
  9. #include <fcntl.h>
  10. #include <sys/types.h>
  11. #include <sys/socket.h>
  12. #include <netinet/in.h>
  13. #include <signal.h>
  14. #include <stdio.h>
  15. #include <string.h>
  16. #include <netdb.h>
  17. #include <ctype.h>
  18. #include <arpa/nameser.h>
  19. #include <sys/stat.h>
  20. #include <strings.h>
  21. #include <stdio.h>
  22. #include <stdlib.h>
  23. #include <unistd.h>
  24. #include <sys/socket.h>
  25.  
  26. void main(int argc, char *argv[])
  27. {
  28.  int sock,debugm=0;
  29.  struct in_addr addr;
  30.  struct sockaddr_in sin;
  31.  struct hostent *he;
  32.  unsigned long start;
  33.  unsigned long end;
  34.  unsigned long counter;
  35.  char foundmsg[] = "200";
  36.  char *cgistr;
  37.  char buffer[1024];
  38.  int count=0;
  39.  int numin;
  40.  char cgibuff[1024];
  41.  char *buff[50];    /* Don't u think 50 is enought? */
  42.  char *cginame[50]; /* Don't u think 50 is enought? */
  43.  
  44.  
  45.  
  46.  buff[1] = "GET /cgi-bin/UnlG1.1 HTTP/1.0\n\n";
  47.  buff[2] = "GET /cgi-bin/phf HTTP/1.0\n\n";
  48.  buff[3] = "GET /cgi-bin/Count.cgi HTTP/1.0\n\n";
  49.  buff[4] = "GET /cgi-bin/test-cgi HTTP/1.0\n\n";
  50.  buff[5] = "GET /cgi-bin/nph-test-cgi HTTP/1.0\n\n";
  51.  buff[6] = "GET /cgi-bin/php.cgi HTTP/1.0\n\n";
  52.  buff[7] = "GET /cgi-bin/handler HTTP/1.0\n\n";
  53.  buff[8] = "GET /cgi-bin/webgais HTTP/1.0\n\n";
  54.  buff[9] = "GET /cgi-bin/websendmail HTTP/1.0\n\n";
  55.  buff[10] = "GET /cgi-bin/webdist.cgi HTTP/1.0\n\n";
  56.  buff[11] = "GET /cgi-bin/faxsurvey HTTP/1.0\n\n";
  57.  buff[12] = "GET /cgi-bin/htmlscript HTTP/1.0\n\n";
  58.  buff[13] = "GET /cgi-bin/pfdispaly.cgi HTTP/1.0\n\n";
  59.  buff[14] = "GET /cgi-bin/perl.exe HTTP/1.0\n\n";
  60.  buff[15] = "GET /cgi-bin/wwwboard.pl HTTP/1.0\n\n";
  61.  buff[16] = "GET /cgi-bin/www-sql HTTP/1.0\n\n";
  62.  buff[17] = "GET /cgi-bin/view-source HTTP/1.0\n\n";
  63.  buff[18] = "GET /cgi-bin/campas HTTP/1.0\n\n";
  64.  buff[19] = "GET /cgi-bin/aglimpse HTTP/1.0\n\n";
  65.  buff[20] = "GET /cgi-bin/man.sh HTTP/1.0\n\n";
  66.  buff[21] = "GET /cgi-bin/AT-admin.cgi HTTP/1.0\n\n";
  67.  buff[22] = "GET /cgi-bin/filemail.pl HTTP/1.0\n\n";
  68.  buff[23] = "GET /cgi-bin/maillist.pl HTTP/1.0\n\n";
  69.  buff[24] = "GET /cgi-bin/jj HTTP/1.0\n\n";
  70.  buff[25] = "GET /cgi-bin/info2www HTTP/1.0\n\n";
  71.  buff[26] = "GET /_vti_pvt/service.pwd HTTP/1.0\n\n";
  72.  buff[27] = "GET /_vti_pvt/users.pwd HTTP/1.0\n\n";
  73.  buff[28] = "GET /_vti_pvt/authors.pwd HTTP/1.0\n\n";
  74.  buff[29] = "GET /cgi-dos/args.bat HTTP/1.0\n\n";
  75.  buff[30] = "GET /cgi-win/uploader.exe HTTP/1.0\n\n";
  76.  
  77.  cginame[1] = "UnlG - backd00r";
  78.  cginame[2] = "phf            ";
  79.  cginame[3] = "Count.cgi      ";
  80.  cginame[4] = "test-cgi       ";
  81.  cginame[5] = "nph-test-cgi   ";
  82.  cginame[6] = "php.cgi        ";
  83.  cginame[7] = "handler        ";
  84.  cginame[8] = "webgais        ";
  85.  cginame[9] = "websendmail    ";
  86.  cginame[10] = "webdist.cgi    ";
  87.  cginame[11] = "faxsurvey      ";
  88.  cginame[12] = "htmlscript     ";
  89.  cginame[13] = "pfdisplay      ";
  90.  cginame[14] = "perl.exe       ";
  91.  cginame[15] = "wwwboard.pl    ";
  92.  cginame[16] = "www-sql        ";
  93.  cginame[17] = "view-source    ";
  94.  cginame[18] = "campas         ";
  95.  cginame[19] = "aglimpse       ";
  96.  cginame[20] = "man.sh         ";
  97.  cginame[21] = "AT-admin.cgi   ";
  98.  cginame[22] = "filemail.pl    ";
  99.  cginame[23] = "maillist.pl    ";
  100.  cginame[24] = "jj             ";
  101.  cginame[25] = "info2www       ";
  102.  cginame[26] = "service.pwd    ";
  103.  cginame[27] = "users.pwd      ";
  104.  cginame[28] = "authors.pwd    ";
  105.  cginame[29] = "args.bat       ";
  106.  cginame[30] = "uploader.exe   ";
  107.  
  108.  
  109.  if (argc<2)
  110.    {
  111.    printf("\n [-- CGI Checker 1.1b. Modified by su1d sh3ll //UnlG  --]");
  112.    printf("\nusage : %s host ",argv[0]);
  113.    printf("\n   Or : %s host -d   for debug mode\n\n",argv[0]); 
  114.    exit(0);
  115.    }
  116.  
  117.  if (argc>2)
  118.    {
  119.    if(strstr("-d",argv[2]))
  120.      {
  121.      debugm=1;
  122.      }
  123.    }
  124.  
  125.  if ((he=gethostbyname(argv[1])) == NULL)
  126.    {
  127.    herror("gethostbyname");
  128.    exit(0);
  129.    }
  130.  
  131.  printf("\n\n\t [CKS & Fdisk]'s CGI Checker - modify by su1d sh3ll 11.03.99\n\n\n");
  132.  start=inet_addr(argv[1]);
  133.  counter=ntohl(start);
  134.  
  135.    sock=socket(AF_INET, SOCK_STREAM, 0);
  136.    bcopy(he->h_addr, (char *)&sin.sin_addr, he->h_length);
  137.    sin.sin_family=AF_INET;
  138.    sin.sin_port=htons(80);
  139.  
  140.   if (connect(sock, (struct sockaddr*)&sin, sizeof(sin))!=0)
  141.      {
  142.      perror("connect");
  143.      }
  144.    printf("\n\n\t [ Press any key to check out the httpd version...... ]\n");
  145.    getchar(); 
  146.    send(sock, "HEAD / HTTP/1.0\n\n",17,0);
  147.    recv(sock, buffer, sizeof(buffer),0);
  148.    printf("%s",buffer);
  149.    close(sock); 
  150.    printf("\n\t [ Press any key to search 4 CGI stuff...... ]\n");
  151.    getchar();
  152.    
  153. while(count++ < 30)   
  154.    {
  155.    sock=socket(AF_INET, SOCK_STREAM, 0);
  156.    bcopy(he->h_addr, (char *)&sin.sin_addr, he->h_length);
  157.    sin.sin_family=AF_INET;
  158.    sin.sin_port=htons(80);
  159.    if (connect(sock, (struct sockaddr*)&sin, sizeof(sin))!=0)
  160.      {
  161.      perror("connect");
  162.      }
  163.    printf("Searching for %s : ",cginame[count]);
  164.   
  165.    for(numin=0;numin < 1024;numin++)
  166.       {
  167.       cgibuff[numin] = '\0';
  168.       } 
  169.   
  170.    send(sock, buff[count],strlen(buff[count]),0);
  171.    recv(sock, cgibuff, sizeof(cgibuff),0);
  172.    cgistr = strstr(cgibuff,foundmsg);
  173.    if( cgistr != NULL)
  174.        printf("Found !! ;)\n");
  175.    else
  176.        printf("Not Found\n");
  177.       
  178.   if(debugm==1)
  179.     { 
  180.     printf("\n\n ------------------------\n %s \n ------------------------\n",cgibuff); 
  181.     printf("Press any key to continue....\n");
  182.     getchar();
  183.     }  
  184.    close(sock);
  185.    }
  186.    printf("...have a nice hack... ;-)\n");
  187.  
  188.  }
  189.