Joomla Vulnerability Scanner By Ahlspiess

Joomla Vulnerability Scanner By Ahlspiess

How It Work ?
=Crawling /components/ path , sometimes didnt work because robots.txt Dissallow /components/

Code : -

1. <?php
2. /*
3.     jComDetect - Joomla Components Detection.
4.     Copyright (C) 2011  Ahlspiess <ahlspiess@tbdsecurity.com>
5.     Link: http://rempah-proj.googlecode.com/svn/trunk/PHP/jcomdetect.php
6.    
7.     Ported By Wcypierre <wcypierre@gmail.com>
8.     http://intizone.net
9.    
10.     This program is free software: you can redistribute it and/or modify
11.     it under the terms of the GNU General Public License as published by
12.     the Free Software Foundation, either version 3 of the License, or
13.     (at your option) any later version.
14.  
15.     This program is distributed in the hope that it will be useful,
16.     but WITHOUT ANY WARRANTY; without even the implied warranty of
17.     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18.     GNU General Public License for more details.
19.  
20.     You should have received a copy of the GNU General Public License
21.     along with this program.  If not, see <http://www.gnu.org/licenses/>.
22. */
23.  
24. $url = $_GET['url'];
25. $jMe = new jComDetect($url);
26.  
27. class jComDetect {
28.     public $url;
29.  
30.     function __construct($url){
31.         $this->url = $url;
32.         $this->init();
33.     }
34.    
35.     function init() {
36.         $content = $this->cURL($this->url);
37.         if(!preg_match("/200 OK/", $content)) {
38.             $this->msg("[-] Error! 404 Not Found -- By Ahlspiess");
39.             exit;
40.         } else {
41.             print $this->jCheckComp($content);
42.         }
43.     }
44.    
45.     function jCheckComp($content) {
46.         $dupe = array();
47.         $nstack = array();
48.         preg_match_all("/Joomla\! (.*?) \-/", $content, $ver);
49.         $this->msg("[+] Joomla version ".$ver[1][0]);
50.         #$nstack[] = "joomla ".$ver[1][0];
51.        preg_match_all("/\/component(s?)\/(.*?)\//", $content, $val_1);
52.         preg_match_all("/option=(.*?)\&/", $content, $val_2);
53.         $var1 = explode(',', str_replace("com_com_", "com_", join(',com_', $val_1[2])));
54.         $var2 = $val_2[1];
55.         $stack = array_merge($var1, $var2);
56.         foreach($stack as $unstack) {
57.             if(!isset($dupe[$unstack]) and !is_null($unstack) and !empty($unstack) and (preg_match("/com_/",$unstack))) {
58.                 $this->msg("[+] Founded {$unstack} Component");
59.                 $nstack[] = $unstack;
60.                 $dupe[$unstack] = true;
61.             }
62.         }
63.         //echo "[Debug]".__fVULN__."\n";
64.         $this->fVuln($nstack);
65.     }
66.    
67.     function fVuln($c = array()) {
68.         $content = "";
69.         foreach($c as $com) {
70.             $content .= $this->cURL("http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description={$com}&filter_exploit_text=&filter_author=&filter_platform=31&filter_type=6&filter_lang_id=0&filter_port=&filter_osvdb=&filter_cve=");
71.         }
72.         preg_match_all("/\<a  href=\"http\:\/\/www\.exploit\-db\.com\/exploits\/(.*?)\"\>(.*?)\n/", $content,$me);
73.         for($i=0;$i<count($me[1]);$i++) {
74.             $this->msg("[+] ".trim(str_replace("</a>", "", $me[2][$i]))."\n --> http://www.exploit-db.com/exploits/".trim($me[1][$i]));
75.         }
76.        
77.     }
78.    
79.     function cURL($url) {
80.         $ch = curl_init();
81.         curl_setopt($ch, CURLOPT_HEADER, 1);
82.         curl_setopt($ch, CURLOPT_TIMEOUT, 15);
83.         curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
84.         curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
85.         curl_setopt($ch, CURLOPT_URL, $url);
86.         curl_setopt($ch, CURLOPT_USERAGENT, "jVulnComponent Crawler v1-Ahlspiess, Ported by wcypierre");
87.         curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
88.         $data = curl_exec($ch);
89.         if($data) {
90.             return $data;
91.         } else {
92.             return 0;
93.         }
94.     }
95.    
96.     function msg($x) {
97.         printf("%s<br />", $x);
98.     }
99.  
100. }
101.  
102. ?>

How To Use ?

1. Save As joomla.php in localhost or website.
2. Go to file,example 127.0.0.1/joomla.php?url=(www.target.com)
3. Copy The Components And Search At exploit-db.com / 1337day.org