vulnz
Tool for finding php source code vulnerabilities.
Scans PHP source code and prints out potentially dangerous lines. This tool is useful for security researchers, pentesters and bug hunters. If any file specified contains line with function call that is inside 'functions.txt' wordlist, it will echo it out.
-h, --help
usage: vulnz.py [-r] [-h] [files ...]
Vulnz, tool for finding php source code vulns.
positional arguments:
file(s) Specify php file(s) to look at, '*' for all
optional arguments:
-r, --recursive Look recursively from current directory
-h, --help Show this help message and exit.
Example 1)
"; ping_equipment.class.php:85 echo ""; ping_equipment.class.php:101 echo Html::scriptBlock("$(document).on('click', '#ping_ip', function(event) { ping_equipment.class.php:129 exec("ping -c 1 -w 1 " . $ip, $list); ping_equipment.class.php:131 exec("ping -c 1 -w 1 " . $ip, $list, $error); ping_equipment.class.php:146 exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list); ping_equipment.class.php:148 exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list, $error); ping_equipment.class.php:163 exec("fping -r1 -c1 -t100 " . $ip, $list); ping_equipment.class.php:165 exec("fping -r1 -c1 -t100 " . $ip, $list, $error); ping_equipment.class.php:180 exec("ping -c 1 -W 1 " . $ip, $list); ping_equipment.class.php:182 exec("ping -c 1 -W 1 " . $ip, $list, $error); ping_equipment.class.php:197 exec("ping -c 1 -t 1 " . $ip, $list); ping_equipment.class.php:199 exec("ping -c 1 -t 1 " . $ip, $list, $error); ping_equipment.class.php:233 exec("ping -c 1 -w 1 -a " . $ip, $list, $error); ping_equipment.class.php:238 exec("ping.exe -n 1 -w 100 -i 64 -a " . $ip, $list, $error);">
└─$ vulnz ping_equipment.class.php
ping_equipment.class.php:75 echo "";
ping_equipment.class.php:85 echo "";
ping_equipment.class.php:101 echo Html::scriptBlock("$(document).on('click', '#ping_ip', function(event) {
ping_equipment.class.php:129 exec("ping -c 1 -w 1 " . $ip, $list);
ping_equipment.class.php:131 exec("ping -c 1 -w 1 " . $ip, $list, $error);
ping_equipment.class.php:146 exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list);
ping_equipment.class.php:148 exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list, $error);
ping_equipment.class.php:163 exec("fping -r1 -c1 -t100 " . $ip, $list);
ping_equipment.class.php:165 exec("fping -r1 -c1 -t100 " . $ip, $list, $error);
ping_equipment.class.php:180 exec("ping -c 1 -W 1 " . $ip, $list);
ping_equipment.class.php:182 exec("ping -c 1 -W 1 " . $ip, $list, $error);
ping_equipment.class.php:197 exec("ping -c 1 -t 1 " . $ip, $list);
ping_equipment.class.php:199 exec("ping -c 1 -t 1 " . $ip, $list, $error);
ping_equipment.class.php:233 exec("ping -c 1 -w 1 -a " . $ip, $list, $error);
ping_equipment.class.php:238 exec("ping.exe -n 1 -w 100 -i 64 -a " . $ip, $list, $error);
Example 2)
showReservationForm($_GET["ip"], $_GET['id_addressing'], $_GET['rand']); ajax/addressing.php:37 if (isset($_POST['action']) && $_POST['action'] == 'viewFilter') { ajax/addressing.php:38 if (isset($_POST['items_id']) ajax/addressing.php:39 && isset($_POST["id"])) { ajax/addressing.php:41 $filter->showForm($_POST["id"], ['items_id' => $_POST['items_id']]); ajax/addressing.php:46 } else if (isset($_POST['action']) && $_POST['action'] == 'entities_networkip') { ajax/addressing.php:47 IPNetwork::showIPNetworkProperties($_POST['entities_id']); ajax/addressing.php:49 } else if (isset($_POST['action']) && $_POST['action'] == 'entities_location') { ajax/addressing.php:51 'value' => $_POST["value"], ajax/addressing.php:52 'entity' => $_POST['entities_id']]); ajax/addressing.php:54 } else if (isset($_POST['action']) && $_POST['action'] == 'entities_fqdn') { ajax/addressing.php:56 'value' => $_POST["value"], ajax/addressing.php:57 'entity' => $_POST['entities_id']]); ajax/seePingTab.php:41 echo Html::scriptBlock("$('#ping_item').show();"); ajax/seePingTab.php:31 if (strpos($_SERVER['PHP_SELF'], "seePingTab.php")) { ajax/seePingTab.php:39 if (isset($_POST['action']) && $_POST['action'] == "viewPingform") { ajax/seePingTab.php:44 $pingE->showPingForm($_POST['itemtype'], $_POST['items_id']); ajax/seePingTab.php:47 $_POST['name'] = "ping_item"; ajax/seePingTab.php:48 $_POST['rand'] = ""; ajax/seePingTab.php:49 Ajax::commonDropdownUpdateItem($_POST); inc/config.class.php:48 echo "
0 Aug 31, 2022
1 Oct 28, 2021
172 Nov 28, 2022
3 Jul 23, 2022
20 Nov 24, 2022
0 Dec 20, 2021
148 Nov 09, 2022
13 Oct 24, 2022
10 Nov 23, 2022
25.7k Jan 08, 2023
42 Aug 09, 2022
52 Jul 16, 2022
20 Nov 11, 2022
1 Dec 31, 2021
77 Dec 16, 2022
30 Nov 27, 2022
38 Dec 31, 2022
4 Feb 22, 2022
1 Jan 31, 2022
3 Dec 22, 2021