https://github.com/yanncam/phpwndb
phpwndb : search credentials leaked on pwndb database with variation
https://github.com/yanncam/phpwndb
burpsuite credentials hashcat intruder leak leaks password pwndb tor
Last synced: 6 months ago
JSON representation
phpwndb : search credentials leaked on pwndb database with variation
- Host: GitHub
- URL: https://github.com/yanncam/phpwndb
- Owner: yanncam
- License: gpl-3.0
- Created: 2022-02-18T08:42:54.000Z (over 3 years ago)
- Default Branch: main
- Last Pushed: 2022-02-28T11:30:44.000Z (over 3 years ago)
- Last Synced: 2025-02-11T08:40:17.779Z (8 months ago)
- Topics: burpsuite, credentials, hashcat, intruder, leak, leaks, password, pwndb, tor
- Language: PHP
- Homepage:
- Size: 124 KB
- Stars: 3
- Watchers: 2
- Forks: 1
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# 💡 phpwndb : search credentials leaked on pwndb database with variation
PHPwnDB is an adaptation of tools like [pwndb.py](https://github.com/davidtavarez/pwndb) in PHP for using it simply via a web browser.
PHPwnDB permits search based on `domain.tld`, `username`, `firstname lastname` permutations and the use of **wildcard**.
Results can be filtered to produce instant wordlists *read-to-use* through hashs cracker tools or Burp Intruder.
PHPwnDB can be very usefull during security assessments or Bug Bounty, when *firstname lastname* or *email* of the web-developer / maintainer / webmaster / author of the web application is discovered in footer, CSS file or HTML comment. By providing this information to PHPwnDB, a list of potential credentials already leaked by the past can be quickly tested against the web-app.
## 🔍 How it works?
PHPwnDB use `tor` to interact with `http://pwndb2am4tzkvold.onion`. So before use PHPwnDB, the **Tor** service must be running as a local proxy (default: `socks5h://127.0.0.1:9050`).
PHPwnDB allows an auditor to:
- Search credentials from a `domain.tld` to retrieve leaks matching emails like `xxx@domain.tld`;
- Search credentials from a specific login or email, like `bill.gates` or `bgates@microsoft.com`;
- Search credentials from a specific identity (firstname + lastname), by computing permutation, login generation and others combinations.
Wildcard can be used like: `_` to indicate any character. So it possible to make search like:
- `bill_gates` to find `bill.gates, bill-gates, bill0gates, etc.`;
- `bgates_, bgates__, bgates___` to find `bgates0, bgates10, bgates999, bgatesadm, etc.`
The search based on firstname + lastname sanitizes the diacritics and all character not allowed in a potential email-address, then compute several combinations like:
- `FirstnameLastname`;
- `LastnameFirstname`;
- `FLastname`;
- `LFirstname`;
- `LastnameF`;
- `FirstnameL`;
- `F_Lastname` (wildcard `_` included);
- `L_Firstname` (wildcard `_` included);
- `Lastname_F` (wildcard `_` included);
- `Firstname_L` (wildcard `_` included);
- `Firstname_Lastname` (wildcard `_` included);
- `Lastname_Firstname` (wildcard `_` included);
- All the previous combinaisons with additional wildcard `_` at the end;
- All the previous combinaisons with two additionals wildcards `__` at the end.
All results of PHPwnDB are displayed in a textarea which can be easily filtered to:
- Display only **logins** (part before any `@`);
- Display only **domains** (part after any `@`);
- Display only **passwords** leaked (part after `:`);
- Or any combination of these filter, which permit a quick generation of a wordlist `username:password` or `username@domain.tld:password` or `username` or `username@domain.tld` or `password` to use it through `hashcat` or the **Burp Intruder** during web security assessments.
## 🔨 Installation
```
## With a standard Kali Linux, tor is already installed. If not:
# sudo apt-get install tor
## Then run tor in a separated shell / service:
tor & # or through a new screen command
## once tor is started, the service listens on 127.0.0.1:9050
## Be sure you have Apache + PHP7 + Curl
# apt install libapache2-mod-php php-curl
# phpenmod curl
# service apache2 restart
## deploy PHPwnDB into Apache/PHP document root
cd /var/www/html/
git clone https://github.com/yanncam/phpwndb/
```
Then, just browse `http://[SERVER]/phpwndb/phpwndb.php`.
## 🔥 Demonstration / Example / How to use?
Simply use one of the three textareas available to search `domain.tld` based, `username` based or `firstname + lastname` permutations based :
Results in the last textarea can be dynamicaly *on-the-fly* filtered and copied.
## 🧰 To go deeper...
PHPwnDB needs **Tor** deployed locally to access `http://pwndb2am4tzkvold.onion`. The PHP script proxies his request through the Tor proxy listening on `127.0.0.1:9050` by default.
DNS resolution of the domain `pwndb2am4tzkvold.onion` needs to be done through the Tor network to work.
So, the PHP script use the **Curl** PHP library with the `CURLOPT_PROXYTYPE` define to `CURLPROXY_SOCKS5_HOSTNAME` (7).
Plus, the scheme to reference the proxy target is explicitly defined to `socks5h://127.0.0.1:9050`. The `h` at the end of `sock5h` is needed to delegate DNS resolution to the proxy (Tor) itself (need PHP 7 at least with recent Curl module).
The `pwndb2am4tzkvold.onion` domain seems to be regularly unavailable for long periods (several days or even 1-2 weeks) within the same year (observation made over the last 2-3 years). As a result, PHPwnDB may not be functional during these down-times.
Original PwnDB service is a simple web-page hosted on `pwndb2am4tzkvold.onion` to request via SQL a simple MySQL/MariaDB database, with **result limited to 1000**. Through PHPwnDB and the *firstname + lastname* search, many requests are realized for all permutation (more time needed), so results can be larger more than 1000.
## 🍻 Credits
- GreetZ to all the Le££e team :)