Feature request about ufonet

[epsylon]

UFONet had 5 search engines on previous versions.
The problem is that some of them started to add filters: max num requests per IP, removing 'inurl' search pattern, complete block with captcha requests from TOR network, etc...
Looks that they doesn't want dorking systems connected to engines APIs.
Also they are changing how to present results to users ofently and our magic regular exp needs to be updated. For that I added "last time working" info to UFONet comments.
Take a look into the code to understand what I mean.

To have different results probably you need to change your (geo)IP. You can make that for example, by updating TOR circuit.

[peterpt]

Some search engines that accept inurl option that could be added to ufonet :
https://www.qwant.com
http://www.blackle.com
http://www.yippy.com

In many more will work too depending in how the search is made .
Example : In some if i use inurl:example.php? it is blocked automatically , but if use inurl=example.php? , or iniurl:example.php? it will work too , may not be 100% results as the input , but as i saw it here , 70% of the results come with the end of the url in the search results like i wanted .
You should change how ufonet works with search engines , and by this i mean that you should add a new variable in the program that will read a textfile on the program dir the urls to search .
This way people could insert new search engines manually .
Also an output variable to how ufonet will interact with specific search engine could be interesting too , this way instead using always the default "inurl:value" , you could add other text file config just for that .

Example : urlconfig.conf

line 1 : google
line 2 : bing
line 3 : etc

Now in how program will interact wiith specific search engine ex: urlinter.conf :

line 1 : inurl:
line 2 : inurl=
line 3 : iniurl=

and by this you could use "sed" to catch variable of urlconfig file to the place of url , and then use sed again to catch that line nunber also on urlinter.conf .

Basically using : url='sed -1p urlconfig.conf' <- this will catch the first line from google
and var="sed -1p urlinter.conf' <- this will catch how ufonet will send requests to that url .

for line 2 is : 'sed -2p urlinter.conf'

Or you can use only 1 file for everything and use awk to grab the first word of each line and consider that variable as url , and the use again awk to grab the second word of each line and consider that variable in how requests must be made to search engine .
Imagine that urlsetup.conf file is organized by this inside :

http://google.com inurl:
http://bing.com inurl:
http://etc.com inurl=

to get google variables you can set this command , where url is the URL and inp is how request must be made t that url :

url=awk 'NR==1{print $1}' urlsetup.conf
inp=awk 'NR==1{print $2}' urlsetup.conf

and then declare those variables for url request in python like you did , and adding a 1 more variable witch is the dork , that is not included here .

For line 3 you just need to change the "NR==1" to "NR==3" , and so on .

i have no idea if you are getting my point , but this could be the next step of ufonet , because this way the user will be not limited only to the pre configured search engines in the tool .

[epsylon]

Did you tried to search for: inurl:"proxy.php?url=" (or similar dorks) on any of those search engines that you provided?. I tried, not any results.

A more long list of search engines: https://en.wikipedia.org/wiki/List_of_search_engines

Do you think that I didn't spend any time on understand how to deploy a dorking system as better as possible?

Look, a commit from 2012 made by me implementing 32 search engines on XSSer.

Maybe you didn't realize that Yahoo and Big are using: instreamset:(url), not inurl:(dork).

Btw, actually this "dorking" feature can be done manually.

It is really easy to open a browser and a text editor and going searching page by page, filling captcha if need, etc.
And after that, launch -t zombies.txt to confirm that your results are vulnerables to "Open Redirect" and to add them automatically to your 'zombies' list. As easy as fast.

I think this feature had sense some years ago. Mostly now that you can share your 'zombies' by using a 'blackhole' (p2p).

On a pragmatic way, for me is more easy to spell some static regular expressions every sometime (with a new release of after a user report of a complete broken system) and make it work again than generate a different structure of code that we don't know if gonna work.

So if you provide me a list of search engines with inurl/instream working, will be a pleasure for me to implement it when possible.

Also don't forget that this is free software and I am not a slave.

You can make that cool idea by yourself and send me a pull request with code, that I will review more happy than reading you explaining me about how I need to do or not the things.

Even when your solution to this "problem", is generating more static configuration files which is, let me say, not so elegant.

Btw, I understand your feature request and I will think deeply on it.

Thanks for your time.