vulnz

Tool for finding php source code vulnerabilities.

Scans PHP source code and prints out potentially dangerous lines. This tool is useful for security researchers, pentesters and bug hunters. If any file specified contains line with function call that is inside 'functions.txt' wordlist, it will echo it out.

-h, --help

usage: vulnz.py [-r] [-h] [files ...]

Vulnz, tool for finding php source code vulns.

positional arguments:
  file(s)          Specify php file(s) to look at, '*' for all

optional arguments:
  -r, --recursive  Look recursively from current directory
  -h, --help       Show this help message and exit.

Example 1)

└─$ vulnz ping_equipment.class.php                                                                                                                                                         
ping_equipment.class.php:75     echo "<i class='fas fa-times-circle fa-1x' onclick='$(\"#ping_item\").hide();'></i>";
ping_equipment.class.php:85     echo "<option value='$ip'>$name</option>";
ping_equipment.class.php:101    echo Html::scriptBlock("$(document).on('click', '#ping_ip', function(event) {
ping_equipment.class.php:129    exec("ping -c 1 -w 1 " . $ip, $list);
ping_equipment.class.php:131    exec("ping -c 1 -w 1 " . $ip, $list, $error);
ping_equipment.class.php:146    exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list);
ping_equipment.class.php:148    exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list, $error);
ping_equipment.class.php:163    exec("fping -r1 -c1 -t100 " . $ip, $list);
ping_equipment.class.php:165    exec("fping -r1 -c1 -t100 " . $ip, $list, $error);
ping_equipment.class.php:180    exec("ping -c 1 -W 1 " . $ip, $list);
ping_equipment.class.php:182    exec("ping -c 1 -W 1 " . $ip, $list, $error);
ping_equipment.class.php:197    exec("ping -c 1 -t 1 " . $ip, $list);
ping_equipment.class.php:199    exec("ping -c 1 -t 1 " . $ip, $list, $error);
ping_equipment.class.php:233    exec("ping -c 1 -w 1 -a " . $ip, $list, $error);
ping_equipment.class.php:238    exec("ping.exe -n 1 -w 100 -i 64 -a " . $ip, $list, $error);

Example 2)

└─$ vulnz -r
ajax/updatepinginfo.php:42      if (!isset($_POST['addressing_id'])) {
ajax/updatepinginfo.php:45      $addressing_id = $_POST['addressing_id'];
ajax/updatepinginfo.php:46      $old_execution = ini_set("max_execution_time", "0");
ajax/updatepinginfo.php:51      ini_set("max_execution_time", $old_execution);
ajax/ping.php:84        echo $ping_response = $message;
ajax/ping.php:43        if (!isset($_POST['ip'])) {
ajax/ping.php:46        $ip = $_POST['ip'];
ajax/ping.php:47        $itemtype = $_POST['itemtype'];
ajax/ping.php:48        $items_id = $_POST['items_id'];
ajax/addressing.php:60  Html::popHeader(__s('IP reservation', 'addressing'), $_SERVER['PHP_SELF']);
ajax/addressing.php:62  $PluginAddressingReserveip->showReservationForm($_GET["ip"], $_GET['id_addressing'], $_GET['rand']);
ajax/addressing.php:37  if (isset($_POST['action']) && $_POST['action'] == 'viewFilter') {
ajax/addressing.php:38  if (isset($_POST['items_id'])
ajax/addressing.php:39  && isset($_POST["id"])) {
ajax/addressing.php:41  $filter->showForm($_POST["id"], ['items_id' => $_POST['items_id']]);
ajax/addressing.php:46  } else if (isset($_POST['action']) && $_POST['action'] == 'entities_networkip') {
ajax/addressing.php:47  IPNetwork::showIPNetworkProperties($_POST['entities_id']);
ajax/addressing.php:49  } else if (isset($_POST['action']) && $_POST['action'] == 'entities_location') {
ajax/addressing.php:51  'value'  => $_POST["value"],
ajax/addressing.php:52  'entity' => $_POST['entities_id']]);
ajax/addressing.php:54  } else if (isset($_POST['action']) && $_POST['action'] == 'entities_fqdn') {
ajax/addressing.php:56  'value'  => $_POST["value"],
ajax/addressing.php:57  'entity' => $_POST['entities_id']]);
ajax/seePingTab.php:41  echo Html::scriptBlock("$('#ping_item').show();");
ajax/seePingTab.php:31  if (strpos($_SERVER['PHP_SELF'], "seePingTab.php")) {
ajax/seePingTab.php:39  if (isset($_POST['action']) && $_POST['action'] == "viewPingform") {
ajax/seePingTab.php:44  $pingE->showPingForm($_POST['itemtype'], $_POST['items_id']);
ajax/seePingTab.php:47  $_POST['name'] = "ping_item";
ajax/seePingTab.php:48  $_POST['rand'] = "";
ajax/seePingTab.php:49  Ajax::commonDropdownUpdateItem($_POST);
inc/config.class.php:48 echo "<form method='post' action='".$this->getFormURL()."'>";
inc/addressing.class.php:221    echo Html::input('name', ['value' => $this->fields['name'], 'size' => 40]);
inc/addressing.class.php:253    echo Html::input('_ipdeb0', ['value'     => $ipexploded[0],
inc/addressing.class.php:258    echo Html::input('_ipdeb1', ['value'     => $ipexploded[0],
inc/addressing.class.php:263    echo Html::input('_ipdeb2', ['value'     => $ipexploded[0],
inc/addressing.class.php:268    echo Html::input('_ipdeb3', ['value'     => $ipexploded[0],
inc/addressing.class.php:318    echo Html::input('_ipfin0', ['value'     => $ipexploded[0],
inc/addressing.class.php:324    echo Html::input('_ipfin1', ['value'     => $ipexploded[0],
inc/addressing.class.php:330    echo Html::input('_ipfin2', ['value'     => $ipexploded[0],
inc/addressing.class.php:336    echo Html::input('_ipfin3', ['value'     => $ipexploded[0],
inc/addressing.class.php:359    echo Html::hidden('begin_ip', ['value' => $this->fields["begin_ip"],
inc/addressing.class.php:361    echo Html::hidden('end_ip', ['value' => $this->fields["end_ip"],
inc/addressing.class.php:366    echo Html::scriptBlock('$(document).ready(function() {' . $js . '});');
inc/addressing.class.php:448    echo "<a href='./report.form.php?id=".$ID."&export=true'>".__('Export')."</a>";
inc/addressing.class.php:688    echo __('Number of free IP', 'addressing') . " " . $nbipf . "<br>";
inc/addressing.class.php:692    echo __('Number of reserved IP', 'addressing') . " " . $nbipr . "<br>";
inc/addressing.class.php:696    echo __('Number of assigned IP (no doubles)', 'addressing') . " " . $nbipt . "<br>";
inc/addressing.class.php:700    echo __('Number of doubles IP', 'addressing') . " " . $nbipd . "<br>";
inc/addressing.class.php:741    echo "<form method='post' name='filtering_form' id='filtering_form' action='" . Toolbox::getItemTypeFormURL("PluginAddressingAddressing") . "?id=$id'>";
inc/addressing.class.php:744    echo Html::hidden('id', ['value' => $id]);
inc/addressing.class.php:849    echo __('Real free IP (Ping=KO)', 'addressing') . " " . $total_realfreeip;
inc/addressing.class.php:991    echo Html::hidden($name, ['id'    => $name,
inc/addressing.class.php:1012   echo "<a class=\"button\"><i class=\"$name fa-fw fas fa-2x fa-toggle-on enabled\"></i></a>";
inc/addressing.class.php:1014   echo "<a class=\"button\"><i class=\"$name fa-fw fas fa-2x fa-toggle-off disabled\"></i></a>";
inc/addressing.class.php:471    if (isset($_GET["export"])) {
inc/addressing.class.php:867    $item->showReport($_GET);
inc/filter.class.php:96 echo Html::hidden('id', ['value' => $ID]);
inc/filter.class.php:97 echo Html::hidden('plugin_addressing_addressings_id', ['value' => $options['items_id']]);
inc/filter.class.php:100        echo Html::input('name', ['value' => $this->fields['name'], 'size' => 40]);
inc/filter.class.php:135        echo Html::input('_ipdeb0', ['value' => $ipexploded[0],
inc/filter.class.php:140        echo Html::input('_ipdeb1', ['value' => $ipexploded[0],
inc/filter.class.php:145        echo Html::input('_ipdeb2', ['value' => $ipexploded[0],
inc/filter.class.php:150        echo Html::input('_ipdeb3', ['value' => $ipexploded[0],
inc/filter.class.php:190        echo Html::input('_ipfin0', ['value' => $ipexploded[0],
inc/filter.class.php:196        echo Html::input('_ipfin1', ['value' => $ipexploded[0],
inc/filter.class.php:202        echo Html::input('_ipfin2', ['value' => $ipexploded[0],
inc/filter.class.php:208        echo Html::input('_ipfin3', ['value' => $ipexploded[0],
inc/filter.class.php:221        echo Html::hidden('begin_ip', ['id' => 'plugaddr_ipdeb', 'value' => $this->fields["begin_ip"]]);
inc/filter.class.php:222        echo Html::hidden('end_ip', ['id' => 'plugaddr_ipfin', 'value' => $this->fields["end_ip"]]);
inc/filter.class.php:226        echo Html::scriptBlock('$(document).ready(function() {'.$js.'});');
inc/filter.class.php:265        echo "<div id='viewfilter" . $item_id . "$rand'></div>\n";
inc/filter.class.php:268        echo "function viewAddFilter" . $item_id . "$rand() {\n";
inc/filter.class.php:295        echo "<table $style>";
inc/filter.class.php:319        echo $header_begin . $header_top . $header_end;
inc/filter.class.php:330        echo $header_begin . $header_bottom . $header_end;
inc/filter.class.php:361        echo "function viewEditFilter" . $filter["id"] . "$rand() {\n";
inc/filter.class.php:374        echo "<td $edit>" . $filter['name'] . "</td>";
inc/filter.class.php:375        echo "<td $edit>" . Dropdown::getDropdownName('glpi_entities', $filter['entities_id']) . "</td>";
inc/filter.class.php:377        echo "<td $edit>" . $types[$filter['type']] . "</td>";
inc/filter.class.php:378        echo "<td $edit>" . $filter['begin_ip'] . "</td>";
inc/filter.class.php:379        echo "<td $edit>" . $filter['end_ip'] . "</td>";
inc/filter.class.php:49 self::showList($_GET);
inc/reserveip.class.php:181     echo Html::hidden('ip', ['value' => $ip]);
inc/reserveip.class.php:182     echo Html::hidden('id_addressing', ['value' => $id_addressing]);
inc/reserveip.class.php:259     echo Html::input('name_reserveip', $option);
inc/profile.class.php:66        echo "<form method='post' action='".$profile->getFormURL()."'>";
inc/profile.class.php:96        echo Html::hidden('id', ['value' => $profiles_id]);
inc/ping_equipment.class.php:75 echo "<i class='fas fa-times-circle fa-1x' onclick='$(\"#ping_item\").hide();'></i>";
inc/ping_equipment.class.php:85 echo "<option value='$ip'>$name</option>";
inc/ping_equipment.class.php:101        echo Html::scriptBlock("$(document).on('click', '#ping_ip', function(event) {
inc/ping_equipment.class.php:129        exec("ping -c 1 -w 1 " . $ip, $list);
inc/ping_equipment.class.php:131        exec("ping -c 1 -w 1 " . $ip, $list, $error);
inc/ping_equipment.class.php:146        exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list);
inc/ping_equipment.class.php:148        exec("ping.exe -n 1 -w 100 -i 64 " . $ip, $list, $error);
inc/ping_equipment.class.php:163        exec("fping -r1 -c1 -t100 " . $ip, $list);
inc/ping_equipment.class.php:165        exec("fping -r1 -c1 -t100 " . $ip, $list, $error);
inc/ping_equipment.class.php:180        exec("ping -c 1 -W 1 " . $ip, $list);
inc/ping_equipment.class.php:182        exec("ping -c 1 -W 1 " . $ip, $list, $error);
inc/ping_equipment.class.php:197        exec("ping -c 1 -t 1 " . $ip, $list);
inc/ping_equipment.class.php:199        exec("ping -c 1 -t 1 " . $ip, $list, $error);
inc/ping_equipment.class.php:233        exec("ping -c 1 -w 1 -a " . $ip, $list, $error);
inc/ping_equipment.class.php:238        exec("ping.exe -n 1 -w 100 -i 64 -a " . $ip, $list, $error);
inc/pinginfo.class.php:202      echo $content;
inc/pinginfo.class.php:206      echo "<button form='' class='btn btn-warning' onclick='javascript:viewPingform" . $items_id . "$rand();'>";
inc/pinginfo.class.php:211      echo "function viewPingform" . $items_id . "$rand() {\n";
inc/pinginfo.class.php:85       $old_memory = ini_set("memory_limit", "-1");
inc/pinginfo.class.php:86       $old_execution = ini_set("max_execution_time", "0");
inc/pinginfo.class.php:96       ini_set("memory_limit", $old_memory);
inc/pinginfo.class.php:97       ini_set("max_execution_time", $old_execution);