daffainfo
/
bash-bounty
mirror of https://github.com/daffainfo/bash-bounty.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Daffa / Fixing minor bugs in tools

master
MD15 2021-02-01 10:38:58 +07:00
parent 22f733aaaa
commit d1311a4f85
12 changed files with 209 additions and 121 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
CSRF PoC Generator/index.html
View File

@ -2,7 +2,7 @@
<html lang="en"> <html lang="en">
<head> <head>
<meta http-equiv="content-type" content="text/html; charset=utf-8"> <meta http-equiv="content-type" content="text/html; charset=utf-8">
<title>CSRF PoC Generator ~ MD15</title> <title>CSRF PoC Generator ~ Daffainfo</title>
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.1/css/bootstrap.min.css"> <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.1/css/bootstrap.min.css">
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script> <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.1/js/bootstrap.min.js"></script> <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.1/js/bootstrap.min.js"></script>

2
Clickjacking/README.md
View File

@ -1,3 +1,3 @@
# Clickjacking # Clickjacking
![Preview](https://i.ibb.co/9HcRVD8/image.png) ![Preview](https://i.ibb.co/9HcRVD8/image.png)
[Live Preview](https://md15.github.io/clickjacking) [Live Preview](https://daffainfo.github.io/Bug-Bounty-Tools/Clickjacking)

11
Clickjacking/index.html
View File

@ -4,6 +4,11 @@
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.1/css/bootstrap.min.css"> <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.1/css/bootstrap.min.css">
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script> <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.1/js/bootstrap.min.js"></script> <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.4.1/js/bootstrap.min.js"></script>
<style>
iframe {
margin-top: 10px;
}
</style>
</head> </head>
<body> <body>
<div class="container"> <div class="container">
@ -14,11 +19,11 @@
<small id="textHelp" class="form-text text-muted">Add http:// or https:// in the beginning</small> <small id="textHelp" class="form-text text-muted">Add http:// or https:// in the beginning</small>
</div> </div>
<button id="submit-test" class="btn btn-primary">Test it!</button> <button id="submit-test" class="btn btn-primary">Test it!</button>
<iframe src="about:blank" id="iframe" frameborder="1" width="100%" height="100%"></iframe> <iframe src="about:blank" id="iframe" frameborder="1" width="100%" height="50%"></iframe>
</div> </div>
</body> </body>
<script> <script>
function frameIt() { function frame() {
var url = document.getElementById("url").value; var url = document.getElementById("url").value;
var iframe = document.getElementById("iframe"); var iframe = document.getElementById("iframe");
iframe.src = url; iframe.src = url;
@ -26,7 +31,7 @@
document.addEventListener('DOMContentLoaded', function () { document.addEventListener('DOMContentLoaded', function () {
document.getElementById('submit-test').addEventListener('click', document.getElementById('submit-test').addEventListener('click',
function() { function() {
frameIt(); frame();
} }
); );
}); });

0
Google Maps API Scanner/index.php → Google Maps API Scanner/index.html
View File

202
Google Maps API Scanner/result.php
View File

@ -1,5 +1,5 @@
<?php <?php
error_reporting(0);
$input = $_POST['apikey']; $input = $_POST['apikey'];
$url = 'https://maps.googleapis.com/maps/api/staticmap?center=45%2C10&zoom=7&size=400x400&key='.$input; $url = 'https://maps.googleapis.com/maps/api/staticmap?center=45%2C10&zoom=7&size=400x400&key='.$input;
@ -42,82 +42,126 @@ function getContents($url) {
$data = file_get_contents($url); $data = file_get_contents($url);
return $data; return $data;
} }
?>
if ($yourProducts[0] == 200) { <!DOCTYPE html>
echo "<p>API key is vulnerable for Staticmap API.</p>"; <html>
echo $url; <head>
} else if ($yourProducts[0] == 403) { <title>Result Google Map API Key</title>
echo "<p>API key is not vulnerable for Staticmap API.</p>"; <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
} <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.16.0/umd/popper.min.js"></script>
if ($yourProducts[1] == 200) { <script src="https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"></script>
echo "<p>API key is vulnerable for Streetview API.</p>"; <style type="text/css">
echo $url2; a {
} else if ($yourProducts[1] == 403) { font-size: 1.25em;
echo "<p>API key is not vulnerable for Streetview API.</p>"; }
} h1 {
margin: 25px 0px;
if ($yourProducts[2] == 200) { }
echo "<p>API key is vulnerable for Embed API.</p>"; </style>
echo $url3; </head>
} else if ($yourProducts[2] == 403) { <body>
echo "<p>API key is not vulnerable for Embed API.</p>"; <div class="container">
} <h1 class="text-center">Results</h1>
<h5>Staticmap API</h5>
if (strpos($yourProducts1[0], 'REQUEST_DENIED' === false)) { <?php
echo "<p>API key is vulnerable for Directions API.</p>"; if ($yourProducts[0] == 200) {
echo $url4; echo "<p>API key is vulnerable for Staticmap API</p>";
} else if ($yourProducts[3] == 200) { echo "<a href='".$url."' target='_blank'>Staticmap API</a>";
echo "<p>API key is not vulnerable for Directions API.</p>"; } else if ($yourProducts[0] == 403) {
} echo "<p>API key is not vulnerable for Staticmap API</p>";
}
if (strpos($yourProducts1[1], 'REQUEST_DENIED') === false) { ?>
echo "<p>API key is vulnerable for Geocoding API.</p>"; <h5>Streetview API</h5>
echo $url5; <?php
} else if ($yourProducts[4] == 200) { if ($yourProducts[1] == 200) {
echo "<p>API key is not vulnerable for Geocoding API.</p>"; echo "<p>API key is vulnerable for Streetview API</p>";
} echo "<a href='".$url2."' target='_blank'>Streetview API</a>";
} else if ($yourProducts[1] == 403) {
if (strpos($yourProducts1[2], 'REQUEST_DENIED') === false) { echo "<p>API key is not vulnerable for Streetview API</p>";
echo "<p>API key is vulnerable for Distance Matrix API.</p>"; }
echo $url6; ?>
} else if ($yourProducts[5] == 200) { <h5>Embed API</h5>
echo "<p>API key is not vulnerable for Distance Matrix API.</p>"; <?php
} if ($yourProducts[2] == 200) {
echo "<p>API key is vulnerable for Embed API</p>";
if (strpos($yourProducts1[3], 'REQUEST_DENIED') === false) { echo "<a href='".$url3."' target='_blank'>Embed API</a>";
echo "<p>API key is vulnerable for Find Place from Text API.</p>"; } else if ($yourProducts[2] == 403) {
echo $url7; echo "<p>API key is not vulnerable for Embed API</p>";
} else if ($yourProducts[6] == 200) { }
echo "<p>API key is not vulnerable for Find Place from Text API.</p>"; ?>
} <h5>Directions API</h5>
<?php
if (strpos($yourProducts1[4], 'REQUEST_DENIED') === false) { if (strpos($yourProducts1[0], 'REQUEST_DENIED' === false)) {
echo "<p>API key is vulnerable for Autocomplete API.</p>"; echo "<p>API key is vulnerable for Directions API</p>";
echo $url8; echo "<a href='".$url4."' target='_blank'>Directions API</a>";
} else if ($yourProducts[7] == 200) { } else if ($yourProducts[3] == 200) {
echo "<p>API key is not vulnerable for Autocomplete API.</p>"; echo "<p>API key is not vulnerable for Directions API</p>";
} }
?>
if (strpos($yourProducts1[5], 'REQUEST_DENIED') === false) { <h5>Geocoding API</h5>
echo "<p>API key is vulnerable for Elevation API.</p>"; <?php
echo $url9; if (strpos($yourProducts1[1], 'REQUEST_DENIED') === false) {
} else if ($yourProducts[8] == 200) { echo "<p>API key is vulnerable for Geocoding API</p>";
echo "<p>API key is not vulnerable for Elevation API.</p>"; echo "<a href='".$url5."' target='_blank'>Geocoding API</a>";
} } else if ($yourProducts[4] == 200) {
echo "<p>API key is not vulnerable for Geocoding API</p>";
if (strpos($yourProducts1[5], 'REQUEST_DENIED') === false) { }
echo "<p>API key is vulnerable for Timezone API.</p>"; ?>
echo $url10; <h5>Matrix API</h5>
} else if ($yourProducts[9] == 200) { <?php
echo "<p>API key is not vulnerable for Timezone API.</p>"; if (strpos($yourProducts1[2], 'REQUEST_DENIED') === false) {
} echo "<p>API key is vulnerable for Matrix API</p>";
echo "<a href='".$url6."' target='_blank'>Matrix API</a>";
if (strpos($yourProducts1[6], 'REQUEST_DENIED') === false) { } else if ($yourProducts[5] == 200) {
echo "<p>API key is vulnerable for Roads API.</p>"; echo "<p>API key is not vulnerable for Matrix API</p>";
echo $url11; }
} else if (strpos($yourProducts[10], '403') === false) { ?>
echo "<p>API key is not vulnerable for Roads API.</p>"; <h5>Find Place from Text API</h5>
} <?php
if (strpos($yourProducts1[3], 'REQUEST_DENIED') === false) {
?> echo "<p>API key is vulnerable for Find Place from Text API</p>";
echo "<a href='".$url7."' target='_blank'>Find Place from Text API</a>";
} else if ($yourProducts[6] == 200) {
echo "<p>API key is not vulnerable for Find Place from Text API</p>";
}
?>
<h5>Autocomplete API</h5>
<?php
if (strpos($yourProducts1[4], 'REQUEST_DENIED') === false) {
echo "<p>API key is vulnerable for Autocomplete API</p>";
echo "<a href='".$url8."' target='_blank'>Autocomplete API</a>";
} else if ($yourProducts[7] == 200) {
echo "<p>API key is not vulnerable for Autocomplete API</p>";
}
?>
<h5>Elevation API</h5>
<?php
if (strpos($yourProducts1[4], 'REQUEST_DENIED') === false) {
echo "<p>API key is vulnerable for Elevation API</p>";
echo "<a href='".$url9."' target='_blank'>Elevation API</a>";
} else if ($yourProducts[7] == 200) {
echo "<p>API key is not vulnerable for Elevation API</p>";
}
?>
<h5>Timezone API</h5>
<?php
if (strpos($yourProducts1[5], 'REQUEST_DENIED') === false) {
echo "<p>API key is vulnerable for Timezone API</p>";
echo "<a href='".$url10."' target='_blank'>Timezone API</a>";
} else if ($yourProducts[9] == 200) {
echo "<p>API key is not vulnerable for Timezone API</p>";
}
?>
<h5>Roads API</h5>
<?php
if (strpos($yourProducts1[6], 'REQUEST_DENIED') === false) {
echo "<p>API key is vulnerable for Roads API</p>";
echo "<a href='".$url11."' target='_blank'>Roads API</a>";
} else if (strpos($yourProducts[10], '403') === false) {
echo "<p>API key is not vulnerable for Roads API</p>";
}
?>
</body>
</html>

86
Laravel Bug Scanner/result.php
View File

@ -1,5 +1,5 @@
<?php <?php
error_reporting(0);
$input = $_POST['website']; $input = $_POST['website'];
$url = $input.'/.env'; $url = $input.'/.env';
@ -24,37 +24,55 @@ function getHttpcode($url){
curl_close($ch); curl_close($ch);
return $httpcode; return $httpcode;
} }
?>
// var_dump($listUrl[0]); <!DOCTYPE html>
<html>
if ($listUrl[0] == "200") { <head>
echo "<p>.env exposed</p>"; <title>Result Laravel</title>
echo '<a target="_blank" href="'.$url.'">'.$url.'</a><br>'; <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css">
echo "==========================================="; <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js"></script>
} <script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.16.0/umd/popper.min.js"></script>
else if ($listUrl[0] != "200") { <script src="https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js"></script>
echo "<p>.env not exposed</p><br>"; <style type="text/css">
echo "==========================================="; a {
} font-size: 1.25em;
}
if ($listUrl[1] == "200") { h1 {
echo "<p>Logs exposed</p>"; margin: 25px 0px;
echo '<a target="_blank" href="'.$url2.'">'.$url2.'</a><br>'; }
echo "==========================================="; </style>
} </head>
else if ($listUrl[1] != "200") { <body>
echo "<p>Logs file not exposed</p><br>"; <div class="container">
echo "==========================================="; <h1 class="text-center">Results</h1>
} <h5>.env File</h5>
<?php
if ($listUrl[2] == "405") { if ($listUrl[0] == "200") {
echo '<p>Debug mode enabled</p>'; echo "<p>.env exposed</p>";
echo '<a target="_blank" href="'.$url3.'">'.$url3.'</a><br>'; echo '<a target="_blank" href="'.$url.'">'.$url.'</a><br>';
echo "==========================================="; }
} else if ($listUrl[0] != "200") {
else if ($listUrl[2] != "405") { echo "<p>.env not exposed</p><br>";
echo "<p>Debug mode in ".$input." disabled</p><br>"; }
echo "==========================================="; ?>
} <h5>Logs file</h5>
<?php
?> if ($listUrl[1] == "200") {
echo "<p>Logs exposed</p>";
echo '<a target="_blank" href="'.$url2.'">'.$url2.'</a><br>';
}
else if ($listUrl[1] != "200") {
echo "<p>Logs file not exposed</p><br>";
}
?>
<h5>Debug mode</h5>
<?php
if ($listUrl[2] == "405") {
echo '<p>Debug mode enabled</p>';
echo '<a target="_blank" href="'.$url3.'">'.$url3.'</a><br>';
}
else if ($listUrl[2] != "405") {
echo "<p>Debug mode in ".$input." disabled</p><br>";
}
?>

18
Mass Find Configuration File/laravel.sh Normal file
View File

@ -0,0 +1,18 @@
#!/bin/bash
# Find Laravel Configuration File Mass Scanner
LISTS=$1
if [[ ! -f ${LISTS} ]]; then
echo "ERROR: ${LISTS} not found"
echo "usage: bash $0 list.txt"
exit
fi
for SITE in $(cat $LISTS);
do
if [[ $(curl --connect-timeout 3 --max-time 3 -kLs "${SITE}/.env" ) =~ 'DB_DATABASE' ]]; then
echo -e "\e[32m[+] FOUND: ${SITE}/.env"
else
echo -e "\e[31m[-] NOT FOUND: ${SITE}"
fi
done

2
Mass Find Logs/zend.sh → Mass Find Configuration File/zend.sh
View File

@ -1,5 +1,5 @@
#!/bin/bash #!/bin/bash
# Log Zend Mass Scanner # Find Zend Configuration File Mass Scanner
LISTS=$1 LISTS=$1
if [[ ! -f ${LISTS} ]]; then if [[ ! -f ${LISTS} ]]; then

0
Mass Find Logs/laravel.sh → Mass Find Logs File/laravel.sh
View File

0
Mass Find Logs/wordpress.sh → Mass Find Logs File/wordpress.sh
View File

2
README.md
View File

@ -1,2 +1,2 @@
# BugBounty # BugBounty
Tools for Bug Bounty Random tools for Bug Bounty

5
WordPress Bug Scanner/result.php
View File

@ -1,4 +1,5 @@
<?php <?php
error_reporting(0);
$nomer = 1; $nomer = 1;
$input = $_POST['wordpress']; $input = $_POST['wordpress'];
@ -10,6 +11,7 @@
$url4 = $input.'/wp-content/debug.log'; $url4 = $input.'/wp-content/debug.log';
//Backup file
$url5 = $input.'/.wp-config.php.swp'; $url5 = $input.'/.wp-config.php.swp';
$url6 = $input.'/wp-config.inc'; $url6 = $input.'/wp-config.inc';
$url7 = $input.'/wp-config.old'; $url7 = $input.'/wp-config.old';
@ -24,6 +26,7 @@
$url16 = $input.'/wp-config.php.txt'; $url16 = $input.'/wp-config.php.txt';
$url17 = $input.'/wp-config.php~'; $url17 = $input.'/wp-config.php~';
//xmlrpc
$url18 = $input.'/xmlrpc.php'; $url18 = $input.'/xmlrpc.php';
$output = file_get_contents($url); $output = file_get_contents($url);
@ -69,7 +72,7 @@
<th>Username Wordpress</th> <th>Username Wordpress</th>
<tr> <tr>
<?php <?php
for($i=0; $i<count($json); $i++) { for($i=0; $i < count($json); $i++) {
echo "<tr>"; echo "<tr>";
echo "<td>".$nomer++."</td>"; echo "<td>".$nomer++."</td>";
echo "<td>".$json[$i]["slug"]."</td>"; echo "<td>".$json[$i]["slug"]."</td>";