vulnz
Tool for finding php source code vulnerabilities.
Scans PHP source code and prints out potentially dangerous lines. This tool is useful for security researchers, pentesters and bug hunters. If any file specified contains line with function call that is inside 'functions.txt' wordlist, it will echo it out.
-h, --help
usage: vulnz.py [-r] [-h] [files ...]
Vulnz, tool for finding php source code vulns.
positional arguments:
file(s) Specify php file(s) to look at, '*' for all
optional arguments:
-r, --recursive Look recursively from current directory
-h, --help Show this help message and exit.
Example 1)
"; ping_equipment.class.php:85 echo ""; ping_equipment.class.php:101 echo Html::scriptBlock("$(document).on('click', '#ping_ip', function(event) { ping_equipment.class.php:129 exec("ping -c 1 -w 1 " . $ip, $list); ping_equipment.class.php:131 exec("ping -c 1 -w 1 " . $ip, $list, $error); ping_equipment.class.php:146 exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list); ping_equipment.class.php:148 exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list, $error); ping_equipment.class.php:163 exec("fping -r1 -c1 -t100 " . $ip, $list); ping_equipment.class.php:165 exec("fping -r1 -c1 -t100 " . $ip, $list, $error); ping_equipment.class.php:180 exec("ping -c 1 -W 1 " . $ip, $list); ping_equipment.class.php:182 exec("ping -c 1 -W 1 " . $ip, $list, $error); ping_equipment.class.php:197 exec("ping -c 1 -t 1 " . $ip, $list); ping_equipment.class.php:199 exec("ping -c 1 -t 1 " . $ip, $list, $error); ping_equipment.class.php:233 exec("ping -c 1 -w 1 -a " . $ip, $list, $error); ping_equipment.class.php:238 exec("ping.exe -n 1 -w 100 -i 64 -a " . $ip, $list, $error);">
└─$ vulnz ping_equipment.class.php
ping_equipment.class.php:75 echo "";
ping_equipment.class.php:85 echo "";
ping_equipment.class.php:101 echo Html::scriptBlock("$(document).on('click', '#ping_ip', function(event) {
ping_equipment.class.php:129 exec("ping -c 1 -w 1 " . $ip, $list);
ping_equipment.class.php:131 exec("ping -c 1 -w 1 " . $ip, $list, $error);
ping_equipment.class.php:146 exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list);
ping_equipment.class.php:148 exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list, $error);
ping_equipment.class.php:163 exec("fping -r1 -c1 -t100 " . $ip, $list);
ping_equipment.class.php:165 exec("fping -r1 -c1 -t100 " . $ip, $list, $error);
ping_equipment.class.php:180 exec("ping -c 1 -W 1 " . $ip, $list);
ping_equipment.class.php:182 exec("ping -c 1 -W 1 " . $ip, $list, $error);
ping_equipment.class.php:197 exec("ping -c 1 -t 1 " . $ip, $list);
ping_equipment.class.php:199 exec("ping -c 1 -t 1 " . $ip, $list, $error);
ping_equipment.class.php:233 exec("ping -c 1 -w 1 -a " . $ip, $list, $error);
ping_equipment.class.php:238 exec("ping.exe -n 1 -w 100 -i 64 -a " . $ip, $list, $error);
Example 2)
showReservationForm($_GET["ip"], $_GET['id_addressing'], $_GET['rand']); ajax/addressing.php:37 if (isset($_POST['action']) && $_POST['action'] == 'viewFilter') { ajax/addressing.php:38 if (isset($_POST['items_id']) ajax/addressing.php:39 && isset($_POST["id"])) { ajax/addressing.php:41 $filter->showForm($_POST["id"], ['items_id' => $_POST['items_id']]); ajax/addressing.php:46 } else if (isset($_POST['action']) && $_POST['action'] == 'entities_networkip') { ajax/addressing.php:47 IPNetwork::showIPNetworkProperties($_POST['entities_id']); ajax/addressing.php:49 } else if (isset($_POST['action']) && $_POST['action'] == 'entities_location') { ajax/addressing.php:51 'value' => $_POST["value"], ajax/addressing.php:52 'entity' => $_POST['entities_id']]); ajax/addressing.php:54 } else if (isset($_POST['action']) && $_POST['action'] == 'entities_fqdn') { ajax/addressing.php:56 'value' => $_POST["value"], ajax/addressing.php:57 'entity' => $_POST['entities_id']]); ajax/seePingTab.php:41 echo Html::scriptBlock("$('#ping_item').show();"); ajax/seePingTab.php:31 if (strpos($_SERVER['PHP_SELF'], "seePingTab.php")) { ajax/seePingTab.php:39 if (isset($_POST['action']) && $_POST['action'] == "viewPingform") { ajax/seePingTab.php:44 $pingE->showPingForm($_POST['itemtype'], $_POST['items_id']); ajax/seePingTab.php:47 $_POST['name'] = "ping_item"; ajax/seePingTab.php:48 $_POST['rand'] = ""; ajax/seePingTab.php:49 Ajax::commonDropdownUpdateItem($_POST); inc/config.class.php:48 echo "
9 Jul 04, 2022
16 Oct 08, 2022
355 Aug 03, 2022
1.9k Dec 26, 2022
5 Oct 08, 2022
4 Jun 08, 2022
19 Nov 15, 2022
2 Feb 05, 2022
1 Jan 06, 2022
6 Jun 07, 2021
17 Aug 23, 2021
6 Oct 24, 2022
5 Mar 19, 2022
20 Apr 07, 2022
1 Oct 12, 2021
109 Dec 28, 2022
22.1k Jan 02, 2023
1 Jan 09, 2022
3 Feb 22, 2022
1 Oct 22, 2021