// malicious web requests
$vulnchars[0] = array("%00","%2527%252esasdf","%u0000", "%u5c00%u2700","/","../","./..././","/%2e/", "%2e","%5C","%s", "'","'''''","\"", "%%%%%%","!!!!!!!!!!!!!!!!!!","#", "%5C27","%%5C%56" , "\'", "\\",';',";a", "|", "\?>", "%a0");

// malicious sql requests
$vulnchars[1] = array(" OR 1=1", "' OR '!'='!");

// malicious xss requests  
$vulnchars[2] = array("javascript:alert(String.fromCharCode(65,66,67))", "<script>alert('cookies, yo: ' + document.cookie);</script>");

$flags[0] = array("<b>warning</b>:", "warning:", "<b>fatal error</b>", "failed to open stream:", "internal server error", "there was an error when processing this directive.", "http/1.1 400", "http/1.1 403", "http/1.1 500", "gateway error", "command not found", "file not found");
$flags[1] = array("[obdc", "mysql error", "you have an error in your sql syntax", "odbc drivers error", "[microsoft sql", );
$flags[2] = array("javascript:alert(string.fromcharcode(65,66,67))", "<script>alert('cookies, yo: ' + document.cookie);</script>");

function MakeRequest($url, $method="GET") {
  $url = str_replace(" ", "%20", $url);
  if ($method=="GET") {
    $host = substr($url, strpos($url, "://") + 3);$host=substr($host, 0,strpos($host, "/"));
  $request = substr($url, strpos($host, "/"));

  $fp = @fsockopen($host, 80, $errno, $errstr, 10);
  if (!$fp) {
     echo "    ERROR . $url $errstr ($errno)$newline";
  } else {
     $out  = "GET $request HTTP/1.1\r\n";
     $out .= "Host: $host\r\n";
     $out .= "Connection: Close\r\n\r\n";
     fwrite($fp, $out);
     while (!feof($fp)) {
         $buf.= fgets($fp);
     }
     fclose($fp);
    }
  } 
  return $buf;
}

function TestResult ($result) {
  global $flags;
  $result = strtolower($result);
  for ($i=0;$i < count($flags);$i++) {
    for ($o=0;$o < count($flags);$o++) {
      if (!(strpos($result, $flags[$i][$o]) === false)) {
        return 1;
      }
    }
  }
  return 0;
}

for ($inc=0;$inc<count($list);$inc++) {
	  if ($localonly == true AND (substr($list[$inc], 0, 17) != "http://localhost/" AND substr($list[$inc], 0, 17) != "http://127.0.0.1/")) die("This script can only be tested against localhost."); 
	  // SetUpParameters parses and stores each GET paramater from a URL into the array $get and $getvalues
	  $url = SetUpParameters($list[$inc]);
	  if (trim($url) != "") { 
	  echo "$newline$url$newline";
      // go through each kind of vulnerability we are testing
	  for ($vulni=0;$vulni<count($vulnchars);$vulni++) {
		switch ($vulni) {
		  case 0: echo "  * General web vulnerabilities$newline"; break;
		  case 1: echo "  * SQL vulnerabilities$newline"; break;
		  case 2: echo "  * XSS vulnerabilities$newline"; break;
		}
		// go through each GET parameter in the URL
		for ($o=0;$o < count($get);$o++) {
		  for ($i=0;$i<count($vulnchars[$vulni]);$i++) {
			// generate url from list of vulnerable characters
			$whichparam = $get[$o];
			$testing = $url . "?";
			// put together the default values for all the other parameters in the script
			for ($z=0;$z<count($get);$z++) {
			  if ($get[$z] != $whichparam) $testing.="&".$get[$z]."=".$getvalue[$z];
			}
			$testing .= "&" . $whichparam . "=" . $vulnchars[$vulni][$i];
		  
			$fun = MakeRequest($testing);
			if ($parseforlinks == true) ParseForLinks($fun);
			$error = TestResult($fun);
			if ($error != 0) 
			  echo "    FLAG! .. $testing$newline";
	  		if ($error == 0 and $verbose == true)
		  	  echo "    OK    .. $testing $newline";
		    }
		  }
	    }
	  }
}