<?php die(); /* XSS SHIELD, REMOVE THIS LINE */ ?>
<?PHP


/* 
*  Php network security scanners 
* 
* (c) 2000 by: Devergranne thiébaut 
* 
* View Example @  http://persoweb.francenet.fr/~tbilger/linux/
* 
* Permission to use and modify this software and its  
* documentation for any purpose other than its incorporation  
* into a commercial product is hereby granted without fee,  
* as long as the author is notified that this piece of software  
* is being used in other applications.  
* Permission to copy and distribute this software and its  
* documentation only for non-commercial use is also granted  
* without fee, provided, however, that the above copyright  
* notice appear in all copies, that both that copyright notice  
* and this permission notice appear in supporting documentation.  
* The author makes no representations about the suitability  
* of this software for any purpose.  It is provided ''as is'',  
* without express or implied warranty.  
* 
* I'm not responsable for the use you make of those files.
* Do not abuse.
*/ 

$cginame[] = "AnyForm2";
$cginame[] = "AT-admin.cgi";
$cginame[] = "AT-generate.cgi";
$cginame[] = "architext_query.pl";
$cginame[] = "anyform.cgi";
$cginame[] = "aglimpse";
$cginame[] = "ax-admin.cgi";
$cginame[] = "axs.cgi";
$cginame[] = "bb-hist.sh";
$cginame[] = "bnbform";
$cginame[] = "bnbform.cgi";
$cginame[] = "campas";
$cginame[] = "carbo";
$cginame[] = "cachemgr.cgi";
$cginame[] = "classified.cgi";
$cginame[] = "classifieds";
$cginame[] = "Count.cgi";
$cginame[] = "count.cgi";
$cginame[] = "dfire.cgi";
$cginame[] = "download.cgi";
$cginame[] = "dumpenv.pl";
$cginame[] = "environ.cgi";
$cginame[] = "finger.pl";
$cginame[] = "finger.cgi";
$cginame[] = "finger";
$cginame[] = "flexform";
$cginame[] = "flexform.cgi";
$cginame[] = "file.pl";
$cginame[] = "filemail.pl";
$cginame[] = "faxsurvey.cgi";
$cginame[] = "formail";
$cginame[] = "guestbook";
$cginame[] = "glimpse";
$cginame[] = "handler";
$cginame[] = ".htaccess";
$cginame[] = "htmlscript";
$cginame[] = "hello.bat";
$cginame[] = "info2www";
$cginame[] = "imagemap.exe";
$cginame[] = "jj";
$cginame[] = "loadpage.cgi";
$cginame[] = "LWGate";
$cginame[] = "lwgate";
$cginame[] = "LWGate.cgi";
$cginame[] = "lwgate.cgi";
$cginame[] = "man.sh";
$cginame[] = "maillist.pl";
$cginame[] = "nph-test.cgi";
$cginame[] = "nph-publish";
$cginame[] = "nph-test-cgi";
$cginame[] = "nlog-smb.pl";
$cginame[] = "pfdispaly.cgi";
$cginame[] = "perl.exe";
$cginame[] = "perlshop.cgi";
$cginame[] = "php";
$cginame[] = "php.cgi";
$cginame[] = "phf";
$cginame[] = "plusmail";
$cginame[] = "ppdscgi.exe";
$cginame[] = "printenv";
$cginame[] = "responder.cgi";
$cginame[] = "rwwwshell.pl";
$cginame[] = "s97.cgi";
$cginame[] = "search97.vts";
$cginame[] = "survey.cgi";
$cginame[] = "survey";
$cginame[] = "test-cgi";
$cginame[] = "textcounter.pl";
$cginame[] = "uploader.cgi";
$cginame[] = "view-source";
$cginame[] = "visadmin.exe";
$cginame[] = "webdist.cgi";
$cginame[] = "webgais";
$cginame[] = "websendmail";
$cginame[] = "webbbs.cgi";
$cginame[] = "webmap.cgi";
$cginame[] = "wwwacl";
$cginame[] = "../wwwboard/wwwboard.pl";
$cginame[] = "ws_ftp.ini";
$cginame[] = "w3-sql";
$cginame[] = "www-sql";
$cginame[] = "whois_raw.cgi";

// other specials

$cginame[] = "../~root/";
$cginame[] = "../_vti_pvt/users.pwd";
$cginame[] = "../_vti_pvt/administrators.pwd";
$cginame[] = "../_vti_pvt/service.pwd";
$cginame[] = "../_vti_pvt/authors.pwd";
$cginame[] = "../_vti_bin/shtml.dll";
$cginame[] = "../_vti_bin/shtml.exe";


$cginame[] = "../scripts/issadmin/bdir.htr";
$cginame[] = "../scripts/CGImail.exe";
$cginame[] = "../scripts/tools/newdsn.exe";
$cginame[] = "../scripts/fpcount.exe";
$cginame[] = "../scripts/counter.exe";

$cginame[] = "../?PageServices";
$cginame[] = "perl?-v";

// let's check for a shell

$cginame[] = "ash";
$cginame[] = "bash";
$cginame[] = "csh";
$cginame[] = "ksh";
$cginame[] = "sh";
$cginame[] = "tcsh";


$cginame[] = "..//etc/passwd";
$cginame[] = "../../../../../../etc/passwd";

$cginame[] = "../webcart/orders/";
$cginame[] = "../webcart/orders/carts/.txt";
$cginame[] = "../webcart/config/";
$cginame[] = "../webcart/carts/";
$cginame[] = "../webcart/config/clients.txt";
$cginame[] = "../webcart-lite/config/clients.txt";
$cginame[] = "../webcart-lite/orders/import.txt";


$cginumber = count($cginame);


if ($host) {

 for ($count = 0 ; $count < $cginumber ; $count++) {
  $fp = fsockopen($host, 80);
        if(!$fp){ echo "Could not open connection \n"; }
           
    else {
    fputs($fp,"GET  $path$cginame[$count] HTTP/1.0\n\n");
 
         while(!feof($fp))
         {

            $nom=fgets($fp,200);
          
            if (ereg("200 OK",$nom))
            { 
             print("<b>Founf somthing here: $cginame[$count] </b><br>\n");
             break;
            }

                                         // else > break;
             else 
            {
             print("not found $cginame[$count] <br> \n");
             break;
            }
        }

  fclose($fp);

      }

 }     
}

?> 

<FORM ACTION="<?PHP echo($PHP_SELF); ?>" METHOD="post"> 

HOST <INPUT TYPE="text" NAME="host" SIZE="10" MAXLENGTH="100" value="localhost"> 
<br>
Here's the path : <INPUT TYPE="text" NAME="path" SIZE="10" MAXLENGTH="100" value="/cgi-bin/">

<INPUT TYPE=submit VALUE="Find out"><INPUT TYPE=reset VALUE="Reset"> 
</FORM>