vulnz
Tool for finding php source code vulnerabilities.
Scans PHP source code and prints out potentially dangerous lines. This tool is useful for security researchers, pentesters and bug hunters. If any file specified contains line with function call that is inside 'functions.txt' wordlist, it will echo it out.
-h, --help
usage: vulnz.py [-r] [-h] [files ...]
Vulnz, tool for finding php source code vulns.
positional arguments:
file(s) Specify php file(s) to look at, '*' for all
optional arguments:
-r, --recursive Look recursively from current directory
-h, --help Show this help message and exit.
Example 1)
"; ping_equipment.class.php:85 echo ""; ping_equipment.class.php:101 echo Html::scriptBlock("$(document).on('click', '#ping_ip', function(event) { ping_equipment.class.php:129 exec("ping -c 1 -w 1 " . $ip, $list); ping_equipment.class.php:131 exec("ping -c 1 -w 1 " . $ip, $list, $error); ping_equipment.class.php:146 exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list); ping_equipment.class.php:148 exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list, $error); ping_equipment.class.php:163 exec("fping -r1 -c1 -t100 " . $ip, $list); ping_equipment.class.php:165 exec("fping -r1 -c1 -t100 " . $ip, $list, $error); ping_equipment.class.php:180 exec("ping -c 1 -W 1 " . $ip, $list); ping_equipment.class.php:182 exec("ping -c 1 -W 1 " . $ip, $list, $error); ping_equipment.class.php:197 exec("ping -c 1 -t 1 " . $ip, $list); ping_equipment.class.php:199 exec("ping -c 1 -t 1 " . $ip, $list, $error); ping_equipment.class.php:233 exec("ping -c 1 -w 1 -a " . $ip, $list, $error); ping_equipment.class.php:238 exec("ping.exe -n 1 -w 100 -i 64 -a " . $ip, $list, $error);">
└─$ vulnz ping_equipment.class.php
ping_equipment.class.php:75 echo "";
ping_equipment.class.php:85 echo "";
ping_equipment.class.php:101 echo Html::scriptBlock("$(document).on('click', '#ping_ip', function(event) {
ping_equipment.class.php:129 exec("ping -c 1 -w 1 " . $ip, $list);
ping_equipment.class.php:131 exec("ping -c 1 -w 1 " . $ip, $list, $error);
ping_equipment.class.php:146 exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list);
ping_equipment.class.php:148 exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list, $error);
ping_equipment.class.php:163 exec("fping -r1 -c1 -t100 " . $ip, $list);
ping_equipment.class.php:165 exec("fping -r1 -c1 -t100 " . $ip, $list, $error);
ping_equipment.class.php:180 exec("ping -c 1 -W 1 " . $ip, $list);
ping_equipment.class.php:182 exec("ping -c 1 -W 1 " . $ip, $list, $error);
ping_equipment.class.php:197 exec("ping -c 1 -t 1 " . $ip, $list);
ping_equipment.class.php:199 exec("ping -c 1 -t 1 " . $ip, $list, $error);
ping_equipment.class.php:233 exec("ping -c 1 -w 1 -a " . $ip, $list, $error);
ping_equipment.class.php:238 exec("ping.exe -n 1 -w 100 -i 64 -a " . $ip, $list, $error);
Example 2)
showReservationForm($_GET["ip"], $_GET['id_addressing'], $_GET['rand']); ajax/addressing.php:37 if (isset($_POST['action']) && $_POST['action'] == 'viewFilter') { ajax/addressing.php:38 if (isset($_POST['items_id']) ajax/addressing.php:39 && isset($_POST["id"])) { ajax/addressing.php:41 $filter->showForm($_POST["id"], ['items_id' => $_POST['items_id']]); ajax/addressing.php:46 } else if (isset($_POST['action']) && $_POST['action'] == 'entities_networkip') { ajax/addressing.php:47 IPNetwork::showIPNetworkProperties($_POST['entities_id']); ajax/addressing.php:49 } else if (isset($_POST['action']) && $_POST['action'] == 'entities_location') { ajax/addressing.php:51 'value' => $_POST["value"], ajax/addressing.php:52 'entity' => $_POST['entities_id']]); ajax/addressing.php:54 } else if (isset($_POST['action']) && $_POST['action'] == 'entities_fqdn') { ajax/addressing.php:56 'value' => $_POST["value"], ajax/addressing.php:57 'entity' => $_POST['entities_id']]); ajax/seePingTab.php:41 echo Html::scriptBlock("$('#ping_item').show();"); ajax/seePingTab.php:31 if (strpos($_SERVER['PHP_SELF'], "seePingTab.php")) { ajax/seePingTab.php:39 if (isset($_POST['action']) && $_POST['action'] == "viewPingform") { ajax/seePingTab.php:44 $pingE->showPingForm($_POST['itemtype'], $_POST['items_id']); ajax/seePingTab.php:47 $_POST['name'] = "ping_item"; ajax/seePingTab.php:48 $_POST['rand'] = ""; ajax/seePingTab.php:49 Ajax::commonDropdownUpdateItem($_POST); inc/config.class.php:48 echo "
12 Nov 22, 2022
29 Nov 20, 2022
2 Jan 17, 2022
142 Jan 05, 2023
1 Jan 11, 2022
36 Sep 21, 2022
219 Nov 28, 2022
15 Sep 23, 2022
1 Dec 05, 2021
74 Dec 23, 2022
99 Jan 04, 2023
23 Nov 17, 2022
16 Dec 30, 2022
1.4k Dec 31, 2022
42 Dec 01, 2022
52 Dec 22, 2022
3 Oct 05, 2022
701 Dec 27, 2022
181 Jan 02, 2023
1 Dec 25, 2021