vulnz
Tool for finding php source code vulnerabilities.
Scans PHP source code and prints out potentially dangerous lines. This tool is useful for security researchers, pentesters and bug hunters. If any file specified contains line with function call that is inside 'functions.txt' wordlist, it will echo it out.
-h, --help
usage: vulnz.py [-r] [-h] [files ...]
Vulnz, tool for finding php source code vulns.
positional arguments:
file(s) Specify php file(s) to look at, '*' for all
optional arguments:
-r, --recursive Look recursively from current directory
-h, --help Show this help message and exit.
Example 1)
"; ping_equipment.class.php:85 echo ""; ping_equipment.class.php:101 echo Html::scriptBlock("$(document).on('click', '#ping_ip', function(event) { ping_equipment.class.php:129 exec("ping -c 1 -w 1 " . $ip, $list); ping_equipment.class.php:131 exec("ping -c 1 -w 1 " . $ip, $list, $error); ping_equipment.class.php:146 exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list); ping_equipment.class.php:148 exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list, $error); ping_equipment.class.php:163 exec("fping -r1 -c1 -t100 " . $ip, $list); ping_equipment.class.php:165 exec("fping -r1 -c1 -t100 " . $ip, $list, $error); ping_equipment.class.php:180 exec("ping -c 1 -W 1 " . $ip, $list); ping_equipment.class.php:182 exec("ping -c 1 -W 1 " . $ip, $list, $error); ping_equipment.class.php:197 exec("ping -c 1 -t 1 " . $ip, $list); ping_equipment.class.php:199 exec("ping -c 1 -t 1 " . $ip, $list, $error); ping_equipment.class.php:233 exec("ping -c 1 -w 1 -a " . $ip, $list, $error); ping_equipment.class.php:238 exec("ping.exe -n 1 -w 100 -i 64 -a " . $ip, $list, $error);">
└─$ vulnz ping_equipment.class.php
ping_equipment.class.php:75 echo "";
ping_equipment.class.php:85 echo "";
ping_equipment.class.php:101 echo Html::scriptBlock("$(document).on('click', '#ping_ip', function(event) {
ping_equipment.class.php:129 exec("ping -c 1 -w 1 " . $ip, $list);
ping_equipment.class.php:131 exec("ping -c 1 -w 1 " . $ip, $list, $error);
ping_equipment.class.php:146 exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list);
ping_equipment.class.php:148 exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list, $error);
ping_equipment.class.php:163 exec("fping -r1 -c1 -t100 " . $ip, $list);
ping_equipment.class.php:165 exec("fping -r1 -c1 -t100 " . $ip, $list, $error);
ping_equipment.class.php:180 exec("ping -c 1 -W 1 " . $ip, $list);
ping_equipment.class.php:182 exec("ping -c 1 -W 1 " . $ip, $list, $error);
ping_equipment.class.php:197 exec("ping -c 1 -t 1 " . $ip, $list);
ping_equipment.class.php:199 exec("ping -c 1 -t 1 " . $ip, $list, $error);
ping_equipment.class.php:233 exec("ping -c 1 -w 1 -a " . $ip, $list, $error);
ping_equipment.class.php:238 exec("ping.exe -n 1 -w 100 -i 64 -a " . $ip, $list, $error);
Example 2)
showReservationForm($_GET["ip"], $_GET['id_addressing'], $_GET['rand']); ajax/addressing.php:37 if (isset($_POST['action']) && $_POST['action'] == 'viewFilter') { ajax/addressing.php:38 if (isset($_POST['items_id']) ajax/addressing.php:39 && isset($_POST["id"])) { ajax/addressing.php:41 $filter->showForm($_POST["id"], ['items_id' => $_POST['items_id']]); ajax/addressing.php:46 } else if (isset($_POST['action']) && $_POST['action'] == 'entities_networkip') { ajax/addressing.php:47 IPNetwork::showIPNetworkProperties($_POST['entities_id']); ajax/addressing.php:49 } else if (isset($_POST['action']) && $_POST['action'] == 'entities_location') { ajax/addressing.php:51 'value' => $_POST["value"], ajax/addressing.php:52 'entity' => $_POST['entities_id']]); ajax/addressing.php:54 } else if (isset($_POST['action']) && $_POST['action'] == 'entities_fqdn') { ajax/addressing.php:56 'value' => $_POST["value"], ajax/addressing.php:57 'entity' => $_POST['entities_id']]); ajax/seePingTab.php:41 echo Html::scriptBlock("$('#ping_item').show();"); ajax/seePingTab.php:31 if (strpos($_SERVER['PHP_SELF'], "seePingTab.php")) { ajax/seePingTab.php:39 if (isset($_POST['action']) && $_POST['action'] == "viewPingform") { ajax/seePingTab.php:44 $pingE->showPingForm($_POST['itemtype'], $_POST['items_id']); ajax/seePingTab.php:47 $_POST['name'] = "ping_item"; ajax/seePingTab.php:48 $_POST['rand'] = ""; ajax/seePingTab.php:49 Ajax::commonDropdownUpdateItem($_POST); inc/config.class.php:48 echo "
2 Oct 31, 2022
17 Dec 20, 2021
1.6k Dec 30, 2022
1 Nov 23, 2021
3 Apr 09, 2022
33 Sep 23, 2022
6 Feb 21, 2022
75 Nov 25, 2022
2 Dec 24, 2021
4 Apr 16, 2022
185 Dec 25, 2022
6 May 17, 2022
30 Jan 17, 2022
4 Apr 05, 2022
384 Dec 23, 2022
181 Dec 20, 2022
34 Dec 01, 2022
48 Aug 28, 2022
52 Jul 16, 2022
44 Nov 21, 2022