Finds c99 shells

php-shell-finder.nse

---The Head Section---
local httpspider = require "httpspider"

description = [[
Spiders a web site and searchs for any uploaded php shells using information from a Google dork.

Work in progress, should be able to use Google dork syntax
]]

---
-- @usage
-- nmap --script=php-shell-spider <target>
--


author = "Trevor Sibanda <trevorsibb@gmail.com>"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"discovery", "fuzzing"}


---The Rule Section---

portrule = function(host,port)
	return port.protocol == "tcp"
		and port.number == 80
		and port.state == "open"
end

---The Action Section ---
action = function(host, port )
	local crawler = httpspider.Crawler:new( host, port, '/', { scriptname = SCRIPT_NAME } )
  crawler:set_timeout(10000)

  local result
  while(true) do
    local status, r = crawler:crawl()
    if ( not(status) ) then
      break
    end
    if (  r.response.body:match('<title>(phpshell|c99shell|r57shell|PHP Shell|phpRemoteView)</title>') ) then
       crawler:stop()
       result = "\n[!]\tSeveral PHP Shells Found" 
       print("[-] Found PHP Shell at: " , r.url )	
    end
  end

  return result
end