<?php
error_reporting(0);
/**
 * PHP Admin Location Lookup
 *
 * @version 1.00
 * @author Christian Ditaputratama <ditatompel@gmail.com>
 *
 * Admin location finder for single site.
 * optionally dump scan result to text file.
 *
 * still very early release, just for testing and coding purpose :)
 *
 *------------------------------------------------------------------------+
 * This program is free software; you can redistribute it and/or modify   |
 * it under the terms of the GNU General Public License version 2 as      |
 * published by the Free Software Foundation.                             |
 *                                                                        |
 * This program is distributed in the hope that it will be useful,        |
 * but WITHOUT ANY WARRANTY; without even the implied warranty of         |
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          |
 * GNU General Public License for more details.                           |
 *                                                                        |
 * This script are often used solely for informative, educational         |
 * purposes only. Author cannot be held responsible for any               |
 * damage and (or) (ab)use of this script.                                |
 * Please submit changes of the script so other people can use            |
 * them as well. This script is free to use, don't abuse.                 |
 *------------------------------------------------------------------------+
 */
set_time_limit(0);
$greetz = '
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 PHP Admin Location Lookup by ditatompel < ditatompel [at] gmail [dot] com >
 Please send bug report to help improving this script.

 Greetings for all members of devilzc0de.org, all Indonesian c0ders,
 and all GNU Generation ;-)
 Thanks to : 5ynL0rd who always inspire me, I glue you all my regards.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
';
print $greetz;
if ( $argc < 2) {
        print_r('
-----------------------------------------------------------------------------
    Usage     : php '.$argv[0].' [target] [output]
    target    : domain / url
    output    : file name for Every [+] Wo0t! output will be saved to (optional)
    Example 1 : php '.$argv[0].' myhost.com
    Example 2 : php '.$argv[0].' myhost.com scan_result.txt
-----------------------------------------------------------------------------
');
exit;
}

function doValidLink($link) {
        $validLink = preg_match("|^http(s)?://[a-z0-9-]+(.[a-z0-9-]+)*(:[0-9]+)?(/.*)?$|i", $link) ? $link : "http://" . $link;
    return $validLink . '/';
}
function write($text) {
        global $fh;
        fwrite($fh, $text);
}

$url = doValidLink($argv[1]);
$output = $argv[2];

// usual admin login place. Add yours if you want ;p
$adminLookup = array(
        "admin1.php",
        "admin1.html",
        "admin2.php",
        "admin2.html",
        "administrator/",
        "administrator/index.html",
        "administrator/index.php",
        "administrator/login.html",
        "administrator/login.php",
        "administrator/account.html",
        "administrator/account.php",
        "administrator.php",
        "administrator.html",
        "admin/",
        "admin/account.php",
        "admin/account.html",
        "admin/index.php",
        "admin/index.html",
        "admin/login.php",
        "admin/login.html",
        "admin/home.php",
        "admin/controlpanel.html",
        "admin/controlpanel.php",
        "admin.php",
        "admin.html",
        "admin/cp.php",
        "admin/cp.html",
        "adm/",
        "account.php",
        "account.html",
        "admincontrol.php",
        "admincontrol.html",
        "adminpanel.php",
        "adminpanel.html",
        "admin1.asp",
        "admin2.asp",
        "admin/account.asp",
        "admin/index.asp",
        "admin/login.asp",
        "admin/home.asp",
        "admin/controlpanel.asp",
        "admin.asp",
        "admin/cp.asp",
        "administr8.php",
        "administr8.html",
        "administr8/",
        "administr8.asp",
        "yonetim.php",
        "yonetim.html",
        "yonetici.php",
        "yonetici.html",
        "maintenance/",
        "webmaster/",
        "configuration/",
        "configure/",
        "cp.php",
        "cp.html",
        "controlpanel/",
        "controlpanel.php",
        "controlpanel.html",
        "ccms/",
        "ccms/login.php",
        "ccms/index.php",
        "login.php",
        "login.html",
        "modelsearch/login.php",
        "moderator.php",
        "moderator.html",
        "moderator/login.php",
        "moderator/login.html",
        "moderator/admin.php",
        "moderator/admin.html",
        "moderator/",
        "yonetim.asp",
        "yonetici.asp",
        "cp.asp",
        "administrator/index.asp",
        "administrator/login.asp",
        "administrator/account.asp",
        "administrator.asp",
        "login.asp",
        "modelsearch/login.asp",
        "moderator.asp",
        "moderator/login.asp",
        "moderator/admin.asp",
        "account.asp",
        "controlpanel.asp",
        "admincontrol.asp",
        "adminpanel.asp",
        "fileadmin/",
        "fileadmin.php",
        "fileadmin.asp",
        "fileadmin.html",
        "administration/",
        "administration.php",
        "administration.html",
        "sysadmin.php",
        "sysadmin.html",
        "phpmyadmin/",
        "myadmin/",
        "sysadmin.asp",
        "sysadmin/",
        "ur-admin.asp",
        "ur-admin.php",
        "ur-admin.html",
        "ur-admin/",
        "Server.php",
        "Server.html",
        "Server.asp",
        "Server/",
        "webadmin/",
        "webadmin.php",
        "webadmin.asp",
        "webadmin.html",
        "administratie/",
        "admins/",
        "admins.php",
        "admins.asp",
        "admins.html",
        "administrivia/",
        "Database_Administration/",
        "WebAdmin/",
        "useradmin/",
        "sysadmins/",
        "admin1/",
        "system-administration/",
        "administrators/",
        "pgadmin/",
        "directadmin/",
        "staradmin/",
        "ServerAdministrator/",
        "SysAdmin/",
        "administer/",
        "LiveUser_Admin/",
        "sys-admin/",
        "typo3/",
        "panel/",
        "cpanel/",
        "cPanel/",
        "cpanel_file/",
        "platz_login/",
        "rcLogin/",
        "blogindex/",
        "formslogin/",
        "autologin/",
        "support_login/",
        "meta_login/",
        "manuallogin/",
        "simpleLogin/",
        "loginflat/",
        "utility_login/",
        "showlogin/",
        "memlogin/",
        "members/",
        "login-redirect/",
        "sub-login/",
        "wp-login/",
        "wp-admin/",
        "blog/wp-admin/",
        "blog/wp-login/",
        "forum/admin/",
        "login1/",
        "dir-login/",
        "login_db/",
        "xlogin/",
        "smblogin/",
        "customer_login/",
        "UserLogin/",
        "login-us/",
        "acct_login/",
        "admin_area/",
        "bigadmin/",
        "project-admins/",
        "phppgadmin/",
        "pureadmin/",
        "sql-admin/",
        "radmind/",
        "openvpnadmin/",
        "wizmysqladmin/",
        "vadmind/",
        "ezsqliteadmin/",
        "hpwebjetadmin/",
        "newsadmin/",
        "adminpro/",
        "Lotus_Domino_Admin/",
        "bbadmin/",
        "vmailadmin/",
        "Indy_admin/",
        "ccp14admin/",
        "irc-macadmin/",
        "banneradmin/",
        "sshadmin/",
        "phpldapadmin/",
        "macadmin/",
        "administratoraccounts/",
        "admin4_account/",
        "admin4_colon/",
        "radmind-1/",
        "Super-Admin/",
        "AdminTools/",
        "cmsadmin/",
        "SysAdmin2/",
        "globes_admin/",
        "cadmins/",
        "phpSQLiteAdmin/",
        "navSiteAdmin/",
        "server_admin_small/",
        "logo_sysadmin/",
        "server/",
        "database_administration/",
        "power_user/",
        "system_administration/",
        "ss_vms_admin_sm/",
        "websvn/"
);
echo "\r\nChecking " . $url . "\r\n";

// get server headers
$check = get_headers($url, 1);
if ( empty($check)) {
        print_r('
    No repsond from server.
    make sure your target url are correct!
    Exiting...
-----------------------------------------------------------------------------
'); exit;
}
$serverInfo = $check['Server'];
// handle for redirect status.
// replace target path with server redirect location.
if (preg_match('/301/', $check[0]) || preg_match('/302/', $check[0]) ) {
        $url = $check['Location'];
        $serverInfo = $check['Server'][0];
}

$additionalInfo = NULL;
if ( !empty($output) ) {
        $fh = fopen($output, 'w');
        $additionalInfo = $fh ? 'Every [+] Wo0t! output will be saved on ' . $output : '[!] Cannot write scan result to ' . $output;
}

$info = '
-----------------------------------------------------------------------------
    Target : ' . $url . '
    Status : ' . $check[0] . '
    Server : ' . $serverInfo . '
    Start Scan : ' . date("Y-m-d H:i:s") . '
    ' . $additionalInfo . '
-----------------------------------------------------------------------------
';
print_r($info);

if ( $fh ) {
        write($greetz);
        write($info);
}

foreach ($adminLookup as $admin){
        $headers = get_headers($url . $admin, 1);
        if ( preg_match('/200/', $headers[0]) ) {
                $result = "[+] Wo0t! " . $url . $admin . " Found!\r\n";
                echo $result;
                if ( $fh ) { write($result); }
        }
        elseif (preg_match('/301/', $headers[0]) || preg_match('/302/', $headers[0]) ) {
                $result = "[+] Wo0t! " . $url . $admin . " Found! redirect to -> " . $headers['Location'] . "\r\n";
                echo $result;
                if ( $fh ) { write($result); }
        }
        else {
                echo "[-] " . $url . $admin . " NOT Found!\r\n";
        }
}
if ( !empty($output) ) {
        write("-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Finish -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\r\n");
        fclose($fh);
}
echo "-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Finish -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\r\n";
?>