_________    ___.        .___                    .__           _________                                         
 /   _____/__ _\_ |__    __| _/____   _____ _____  |__| ____    /   _____/ ____ _____    ____   ____   ___________ 
 \_____  \|  |  \ __ \  / __ |/  _ \ /     \\__  \ |  |/    \   \_____  \_/ ___\\__  \  /    \ /    \_/ __ \_  __ \
 /        \  |  / \_\ \/ /_/ (  <_> )  Y Y  \/ __ \|  |   |  \  /        \  \___ / __ \|   |  \   |  \  ___/|  | \/
/_______  /____/|___  /\____ |\____/|__|_|  (____  /__|___|  / /_______  /\___  >____  /___|  /___|  /\___  >__|   
        \/          \/      \/            \/     \/        \/          \/     \/     \/     \/     \/     \/       
Coded By The Alchemist                                                                        www.HackCommunity.com

subdomains.inc'; exit(); } ?> //action is blank and its POST method

// form that user sees and fills in once subdomains.inc has been uploaded to same directory as scanner. //"target" is the name of $_POST value, if its been set remove any malicious characters from it with htmlentities(). // place holder is what the user sees as an example to follow: Enter URL : //submit button saying "scan" to user

http [host] => cindycullen.com [path] => /example/test.php [query] => id=255 [fragment] => faq1 ) $targ = parse_url($_POST['target']); //will take only the host name as the $targ variable has been parced and assign it to new $target variable $target = $targ['host']; //str_replace function removes the www from the hostname assigned to the $target variable $target = str_replace("www.","",$target); //assign value of 0 to $i variable $i = 0; //assign the names in $subdomains to $val variable and loop foreach($Subdomains as $val) //using curl now, assign a $url variables thatgoes like this //http://$val (containing our subdomain names), with $target appended to it which is the user supplied host. { $url = "http://".$val.".".$target; $ch[$i] = curl_init($url); //setup a new curl session curl_setopt($ch[$i], CURLOPT_PORT, 80); // set curl option to connect to port 80 curl_setopt($ch[$i], CURLOPT_RETURNTRANSFER, true); //get contents $i++; //implement $i by 1 } $numberof = $i; $mh = curl_multi_init(); // initialize a multi curl session for($i=0 ; $i < $numberof ; $i++) //I DONT UNDERSTAND THIS, AS $numberof and $i appear to hav ethe same value as they were assigned to each other 2 lines ago with, $numberof = $i; { curl_multi_add_handle($mh,$ch[$i]); //adding each individual curl session to multi curl handler } $null = NULL; try { curl_multi_exec($mh,$null);// execute multi curl sessions } catch(Exception $e) { echo "Could Not Execute"; //inform user of error } for($i = 0 ; $i < $numberof ; $i++) //SAME HERE AGAIN, I DO NOT UNDERSTAND DUE TO THEM HAVING THE SAME VALUE { if(!curl_error($ch[$i]) && !strstr(curl_multi_getcontent($ch[$i]))) //check if no error is given { echo ' http://'.htmlentities($Subdomains[$i].".".$target).' exists
'; //give result to user in color } curl_multi_remove_handle($mh,$ch[$i]); curl_close($ch[$i]); //close curl } curl_multi_close($mh); //close the multi curl sessions } ?>