Website Backup File Leak Scan Tool - ihoneyBakFileScan

import requests/nimport logging/nfrom binascii import b2a_hex/nimport multiprocessing/nfrom argparse import ArgumentParser/nfrom copy import deepcopy/nfrom datetime import datetime/n/nrequests.packages.urllib3.disable_warnings()/n/nlogging.basicConfig(level=logging.WARNING, format=/'%(message)s/')/n/n/ndef vlun(urltarget, df):/n rar_byte = b'526172'/n zip_byte = b'504b03'/n gz_byte = b'1f8b080000000000000b'/n mysqldump_byte = b'2d2d204d7953514c'/n phpmyadmin_byte = b'2d2d207068704d794164'/n navicat_byte = b'2f2a0a204e6176696361'/n adminer_byte = b'2d2d2041646d696e6572'/n other_byte = b'2d2d202d2d2d2d2d2d2d'/n navicat_MDT_byte = b'2f2a0a4e617669636174'/n tar_gz_byte = b'1f8b0800'/n try:/n r = requests.get(url=urltarget, headers=headers, timeout=timeout, allow_redirects=False, stream=True, verify=False)/n content = b2a_hex(r.raw.read(10)).decode()/n/n if r.status_code == 200:/n rarsize = int(r.headers.get('Content-Length'))/n if rarsize >= 1024000000:/n unit = int(rarsize) // 1024 // 1024 / 1000/n rarsize = str(unit) + 'G'/n elif rarsize >= 1024000:/n unit = int(rarsize) // 1024 // 1024/n rarsize = str(unit) + 'M'/n else:/n unit = int(rarsize) // 1024/n rarsize = str(unit) + 'K'/n if content.startswith(rar_byte) or content.startswith(zip_byte) or content.startswith(gz_byte) or content.startswith(/n mysqldump_byte) or content.startswith(/n phpmyadmin_byte) or content.startswith(navicat_byte) or content.startswith(adminer_byte) or content.startswith(/n other_byte) or content.startswith(navicat_MDT_byte) or content.startswith(tar_gz_byte):/n logging.warning('[*] {} size:{}'.format(urltarget, rarsize))/n with open(df, 'a') as f:/n try:/n f.write(str(urltarget) + ' ' + 'size:' + str(rarsize) + '//n')/n except:/n pass/n else:/n logging.warning('[ ] {}'.format(urltarget))/n else:/n logging.warning('[ ] {}'.format(urltarget))/n except Exception as e:/n pass/n/n/ndef urlcheck(target=None, ulist=None):/n if target is not None and ulist is not None:/n if target.startswith('http://') or target.startswith('https://'):/n if target.endswith('/'):/n ulist.append(target)/n else:/n ulist.append(target + '/')/n else:/n line = 'http://' + target/n if line.endswith('/'):/n ulist.append(line)/n else:/n ulist.append(line + '/')/n return ulist/n/n/ndef dispatcher(url_file=None, url=None, max_thread=1, dic=None):/n urllist = []/n/n if url_file is not None and url is None:/n with open(str(url_file)) as f:/n while True:/n line = str(f.readline()).strip()/n if line:/n urllist = urlcheck(line, urllist)/n else:/n break/n elif url is not None and url_file is None:/n url = str(url.strip())/n urllist = urlcheck(url, urllist)/n else:/n pass/n/n with open(datefile, 'w'):/n pass/n/n # MultiProcess/n pool = multiprocessing.Pool(max_thread)/n/n for u in urllist:/n cport = None/n # ucp = u.strip('https://').strip('http://')/n if u.startswith('http://'):/n ucp = u.lstrip('http://')/n elif u.startswith('https://'):/n ucp = u.lstrip('https://')/n if '/' in ucp:/n ucp = ucp.split('/')[0]/n if ':' in ucp:/n cport = ucp.split(':')[1]/n ucp = ucp.split(':')[0]/n www1 = ucp.split('.')/n else:/n www1 = ucp.split('.')/n wwwlen = len(www1)/n wwwhost = ''/n for i in range(1, wwwlen):/n wwwhost += www1[i]/n/n current_info_dic = deepcopy(dic) # deep copy/n suffixFormat = ['.rar', '.zip', '.gz', '.sql.gz', '.tar.gz', '.sql', '.tar.tgz', ]/n domainDic = [ucp, ucp.replace('.', ''), wwwhost, ucp.split('.', 1)[-1], www1[0], www1[1]]/n/n for s in suffixFormat:/n for d in domainDic:/n current_info_dic.extend([d + s])/n/n for info in current_info_dic:/n url = str(u) + str(info)/n pool.apply_async(vlun, args=(url, datefile))/n/n pool.close()/n pool.join()/n/n/nif name == 'main':/n usageexample = '//n Example: python3.5 ihoneyBakFileScan -t 100 -f url.txt//n'/n usageexample += ' '/n usageexample += 'python3.5 ihoneyBakFileScan.py -u https://www.example.com/'/n/n parser = ArgumentParser(add_help=True, usage=usageexample, description='A Website Backup File Leak Scan Tool.')/n parser.add_argument('-f', '--url-file', dest=/'url_file/', help=/'Example: url.txt/')/n parser.add_argument('-t', '--thread', dest=/'max_threads/', nargs='?', type=int, default=1, help=/'Max threads/')/n parser.add_argument('-u', '--url', dest='url', nargs='?', type=str, help=/'Example: http://www.example.com//')/n parser.add_argument('-d', '--dict-file', dest='dict_file', nargs='?', help=/'Example: dict.txt/')/n/n args = parser.parse_args()/n # Use the program default dictionary，Accurate scanning mode，Automatic dictionary generation based on domain name./n info_dic = ['zep/js.zip', 'faisunzip.zip', 'wwwroot.zip', 'wwwroot.rar', 'wwwroot.tar.gz', 'wwwroot.gz', 'wwwroot.sql.zip', 'wwwroot.sql', 'backup.zip',/n 'bbs.zip']/n/n datefile = datetime.now().strftime('%Y%m%d_%H-%M-%S.txt')/n/n headers = {'User-Agent': /'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36/', }/n timeout = 5/n/n try:/n if args.dict_file:/n # Custom scan dictionary/n # This mode is not recommended for bulk scans. It is prone to false positives and can reduce program efficiency./n custom_dict = list(set([i.replace(/'////n/', /'/') for i in open(str(args.dict_file), /'r/').readlines()]))/n info_dic = info_dic.extend(custom_dict)/n if args.url:/n dispatcher(url=args.url, max_thread=args.max_threads, dic=info_dic)/n elif args.url_file:/n dispatcher(url_file=args.url_file, max_thread=args.max_threads, dic=info_dic)/n else:/n print(/'[/!] Please specify a URL, or URL file name./')/n except Exception as e:/n pass/n