scan

#!/usr/bin/env php
<?php
if ( $argc < 2 ) {
    die( "usage {$argv[0]} [url] [file-extension] [IGNORE HTTP RESPONSE CODE][..]\n" );
}
$url = rtrim( $argv[1], '/' );
$url_parsed = parse_url( $url );
$ext = $argc >= 3 ? $argv[2] : '';
$ignore_code = [404];
$linew = 80;
if ( $argc >= 4 ) {
    $ignore_code = array_merge( $ignore_code, array_splice( $argv, 3 ) );
}

function randomIp(){
    return rand(0,255) . '.' . rand(0,255) . '.' . rand(0,255) . '.' . rand(0,255);
}

$content_type = null;
$last_http_code = 0;
function do_test( $str, &$no )
{
    global $url, $ext, $curl_opt, $ignore_code, $ch, $linew, $content_type, $last_http_code;
    $newline = false;
    $str = trim( $str );
    if ( $no != 0 && strlen( $str ) == 0 ) {
        return;
    }

    $str = str_replace( ' ', '%20', $str );
    $full_url = $url . '/' . $str . $ext;
    if( isset($_SERVER['RANDOM_IP'])  ){
        $curl_opt[CURLOPT_HTTPHEADER][ count($curl_opt[CURLOPT_HTTPHEADER]) -1 ] = $_SERVER['RANDOM_IP'] . ": " . randomIp();
    }

    $curl_opt[CURLOPT_URL] = $full_url;
    curl_setopt_array( $ch, $curl_opt );
    echo str_pad( $no, 6 ) . ": $full_url ";
    $resp = curl_exec( $ch );
    $info =  curl_getinfo( $ch );
    if($info['redirect_url']){
        echo "Redirect: " . $info['redirect_url'] . ' ';
        $newline = $no == 0;
    }
    $http_code = $info['http_code'];
    if( $no == 1){
        // if first two path has same http_code, auto add it to ignore
        $content_type = $info['content_type'];
        if( $http_code === $last_http_code && !@$_SERVER['NO_AUTO'] && !in_array($http_code, $ignore_code)){
            echo "\rAdded to ignore code: $http_code      ";
            $ignore_code[] = $http_code;
            $newline = true;
        }
    }else if ($content_type){
        if( $content_type != $info['content_type'] && $http_code != 404){
            echo $info['content_type'] . ' ';
            $newline = true;
        }
    }
    echo $http_code;
    $last_http_code = $http_code;
    $no++;
    if ( !$newline && in_array( $http_code, $ignore_code ) ) {
        echo "\r" . str_repeat( ' ', $linew ) . "\r";
    } else {
        echo "\n";
    }
}

function probe_words( $base )
{
    $arr = [
        ucfirst( $base ),
        "${base}-data", "${base}_data",
        "${base}-db", "${base}_db",
        "${base}-backup", "${base}_backup",
        "${base}_old", "${base}_new",
        "${base}-old", "${base}-new",
        "${base}-latest", "${base}-release",
        "${base}_latest", "${base}_release",
        "${base}_files", "${base}_web",
        "${base}-files", "${base}-web",
    ];
    $cnt = count( $arr );
    for ( $i = 0; $i < $cnt; $i++ ) {
        $arr[] = strtoupper( $arr[$i] );
    }
    for ( $i = 1; $i < 5; $i++ ) {
        $arr[] = "{$base}-v$i";
        $arr[] = "{$base}-V$i";
        $arr[] = "{$base}_v$i";
        $arr[] = "{$base}_V$i";
        $arr[] = "{$base}v$i";
        $arr[] = "{$base}V$i";
        $arr[] = "{$base}/v$i";
        $arr[] = "{$base}/V$i";
    }
    $cnt = count( $arr );
    for ( $i = 0; $i < $cnt; $i++ ) {
        $arr[] = "{$arr[$i]}.zip";
        $arr[] = "{$arr[$i]}.gzip";
        $arr[] = "{$arr[$i]}.tar";
        $arr[] = "{$arr[$i]}.tar.gz";
        $arr[] = "{$arr[$i]}.sql";
        $arr[] = "{$arr[$i]}.rar";
        $arr[] = "{$arr[$i]}.md";
        $arr[] = "{$arr[$i]}.txt";
    }
    return $arr;
}

$file = @$_SERVER['WORDS'] ?: 'words.txt';
if ( !is_file( $file ) ) {
    die( "File not exists" );
}
$hostname =  @$_SERVER['CURL_HOST'] ?: parse_url( strtolower( $url ), PHP_URL_HOST );
// Remove domain extension
$hostname_no_extension = preg_replace( '/(\.[^.]{2,3})?(\.[^.]{2,10})$/', '', $hostname );
$hostname_parts = explode( '.', $hostname_no_extension );
$autowords = [];
if ( @$_SERVER['ADD'] ) {
    $autowords[] =  $_SERVER['ADD'];  
}
$autowords += $hostname_parts;
$autowords[] = $hostname_no_extension;

if ( strpos( $hostname_no_extension, '.' ) > 0 ) {
    $autowords[] = str_replace( '.', '-', $hostname_no_extension );
    $autowords[] = str_replace( '.', '_', $hostname_no_extension );
}
$autowords[] = $hostname;

echo "TARGET    : $url\n";
echo "WORDS     : $file\n";
echo "AUTOWORDS : " . implode( ' ', $autowords ) . "\n";
echo "IGNORE    : " . implode( ' ', $ignore_code ) . "\n";
echo str_repeat( "-", $linew ) . "\n";

$curl_opt = [
    CURLOPT_AUTOREFERER => false,
    CURLOPT_SSL_VERIFYPEER => false,
    CURLOPT_SSL_VERIFYHOST => false,
    CURLOPT_FOLLOWLOCATION => false,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_NOBODY => true,
    CURLOPT_USERAGENT => 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36'
    // CURLOPT_COOKIE => ''
    // CURLOPT_NOPROGRESS => false,
    // CURLOPT_CUSTOMREQUEST    => 'HEAD'
];
if ( isset( $_SERVER['COOKIE'] ) ) {
    $curl_opt[CURLOPT_COOKIE] = $_SERVER['COOKIE'];
}
if ( isset( $_SERVER['BODY'] ) ) {
    echo "With body\n";
    $curl_opt[CURLOPT_NOBODY] = false;
}
if ( isset( $_SERVER['USERAGENT'] ) ) {
    echo "With USERAGENT\n";
    $curl_opt[CURLOPT_USERAGENT] = $_SERVER['USERAGENT'];
}
if ( isset( $_SERVER['CURL_HOST'] ) ) {
    echo "With host: " . $_SERVER['CURL_HOST'] . "\n";
    $curl_opt[CURLOPT_HTTPHEADER] = ["Host: " . $_SERVER['CURL_HOST']];
}
if ( isset( $_SERVER['HEADER'] ) ) {
    echo "With header: " . $_SERVER['HEADER'] . "\n";
    if(@!$curl_opt[CURLOPT_HTTPHEADER]){
        $curl_opt[CURLOPT_HTTPHEADER] = [];
    }
    $curl_opt[CURLOPT_HTTPHEADER][] = $_SERVER['HEADER'];
}
if( isset($_SERVER['RANDOM_IP'])  ){
    echo "With Proxy random IP: " . $_SERVER['RANDOM_IP'] . "\n";
    if(@!$curl_opt[CURLOPT_HTTPHEADER]){
        $curl_opt[CURLOPT_HTTPHEADER] = [];
    }
    $curl_opt[CURLOPT_HTTPHEADER][] = $_SERVER['RANDOM_IP'] . ": 0.0.0.0";
}

$ch = curl_init();
# heuristic by content size
$no = 0;
do_test( '', $no );
$no = 1;
if ( ! @$_SERVER['AUTO'] ) {
    $words = fopen( $file, 'r' );
    while (  ( $str = fgets( $words ) ) !== false ) {
        do_test( $str, $no );
    }
    
    fclose( $words );
}

// Auto heuristic keyboard
foreach ( $autowords as $basestr ) {
	$str_list = [$basestr] + probe_words( $basestr );
    foreach ( $str_list as $str ) {
		do_test( $str, $no );
    }
}
curl_close( $ch );

echo "\n";