Host Header Injection Scanner with Msfconsole Auxiliary

hhi-scanner.sh

#!/bin/bash
# unk9vvn@avi:~$ sudo chmod +x hhi-scanner.sh;sudo ./hhi-scanner.sh targetlist.txt
# v98



UBUNTU=$(cat /etc/apt/sources.list|grep -o "deb http://http.kali.org/kali")
METASPLOIT=/usr/share/metasploit-framework/


if [ "$UBUNTU" != "deb http://http.kali.org/kali" ]; then
	sudo apt-get update;echo "deb http://http.kali.org/kali kali-rolling main non-free contrib" >> /etc/apt/sources.list;sudo apt-get -y --allow-unauthenticated install kali-archive-keyring;sudo apt-get update;sudo apt-get install -y curl metasploit-framework;sudo msfdb init
fi

if [ ! -d "$METASPLOIT" ]; then
	sudo apt-get update;sudo apt-get install -y curl metasploit-framework;sudo msfdb init
fi


RED='\e[1;31m%s\e[0m\n'
GREEN='\e[1;32m%s\e[0m\n'
YELLOW='\e[1;33m%s\e[0m\n'
BLUE='\e[1;34m%s\e[0m\n'
MAGENTO='\e[1;35m%s\e[0m\n'
CYAN='\e[1;36m%s\e[0m\n'
WHITE='\e[1;37m%s\e[0m\n'


reset;clear
printf "$GREEN"   "                            --/osssssssssssso/--                    "
printf "$GREEN"   "                        -+sss+-+--os.yo:++/.o-/sss+-                "
printf "$GREEN"   "                     /sy+++-.h.-dd++m+om/s.h.hy/:+oys/              "
printf "$GREEN"   "                  .sy/// h/h-:d-y:/+-/+-+/-s/sodooh:///ys.          "
printf "$GREEN"   "                -ys-ss/:y:so-/osssso++++osssso+.oo+/s-:o.sy-        "
printf "$GREEN"   "              -ys:oossyo/+oyo/:-:.-:.:/.:/-.-:/syo/+/s+:oo:sy-      "
printf "$GREEN"   "             /d/:-soh/-+ho-.:::--:- .os: -:-.:-/::sy+:+ysso+:d/     "
printf "$GREEN"   "            sy-..+oo-+h:--:..hy+y/  :s+.  /y/sh..:/-:h+-oyss:.ys    "
printf "$WHITE"   "           ys :+oo/:d/   .m-yyyo/- - -:   .+oyhy-N.   /d::yosd.sy   "
printf "$WHITE"   "          oy.++++//d.  ::oNdyo:     .--.     :oyhN+-:  .d//s//y.ys  "
printf "$WHITE"   "         :m-y+++//d-   dyyy++::-. -.o.-+.- .-::/+hsyd   -d/so+++.m: "
printf "$WHITE"   "        -d/-/+++.m-  /.ohso- ://:///++++///://:  :odo.+  -m.syoo:/d-"
printf "$WHITE"   "        :m-+++y:y+   smyms-   -//+/-ohho-/+//-    omsmo   +y s+oy-m:"
printf "$WHITE"   "        sy:+++y-N-  -.dy+:...-- :: ./hh/. :: --...//hh.:  -N-o+/:-so"
printf "$WHITE"   "        yo-///s-m   odohd.-.--:/o.-+/::/+-.o/:--.--hd:ho   m-s+++-+y"
printf "$WHITE"   "        yo::/+o-m   -yNy/:  ...:+s.//:://.s+:...  :/yNs    m-h++++oy"
printf "$WHITE"   "        oy/hsss-N-  oo:oN-   .-o.:ss:--:ss:.o-.   -My-oo  -N-o+++.so"
printf "$WHITE"   "        :m :++y:y+   sNMy+: -+/:.--:////:--.:/+- -+hNNs   +y-o++o-m:"
printf "$WHITE"   "        -d/::+o+.m-  -:/+ho:.       -//-       ./sdo::-  -m-o++++/d-"
printf "$WHITE"   "         :m-yo++//d- -ommMo//        -:        +oyNhmo- -d//s+++-m: "
printf "$WHITE"   "          oy /o++//d.  -::/oMss-   -+++s     :yNy+/:   .d//y+---ys  "
printf "$WHITE"   "           ys--+o++:d/ -/sdmNysNs+/./-//-//hNyyNmmy+- /d-+y--::sy   "
printf "$RED"     "            sy:..ooo-+h/--.-//odm/hNh--yNh+Ndo//-./:/h+-so+:+/ys    "
printf "$RED"     "             /d-o.ssy+-+yo:/:/:-:+sho..ohs/-:://::oh+.h//syo-d/     "
printf "$RED"     "              -ys-oosyss:/oyy//::..-.--.--:/.//syo+-ys//o/.sy-      "
printf "$RED"     "                -ys.sooh+d-s:+osssysssosssssso:/+/h:/yy/.sy-        "
printf "$RED"     "                  .sy/:os.h--d/o+-/+:o:/+.+o:d-y+h-o+-+ys.          "
printf "$RED"     "                     :sy+:+ s//sy-y.-h-m/om:s-y.++/+ys/             "
printf "$RED"     "                        -+sss+/o/ s--y.s+/:++-+sss+-                "
printf "$RED"     "                            --/osssssssssssso/--                    "
printf "$BLUE"    "                                  Unk9vvN                           "
printf "$YELLOW"  "                            https://t.me/Unk9vvN                    "
printf "$CYAN"    "                                HHi-Scanner                         "
printf "\n\n"


FILENAME=$1
sudo service postgresql start
sed -i 's#http://##g' $FILENAME
sed -i 's#https://##g' $FILENAME


function DETECT () {
	sleep 1
	HTTP=$(curl --connect-timeout 1 -Is $TARGET:80 | head -n 1)
	HTTPS=$(curl --connect-timeout 1 -Is $TARGET:443 | head -n 1)
	sleep 1
	if echo "$HTTPS" | grep -q "200" || echo "$HTTPS" | grep -q "301" || echo "$HTTPS" | grep -q "302"; then
		PORT=443
		TRUE_FALSE=true
	elif echo "$HTTP" | grep -q "200" || echo "$HTTP" | grep -q "301" || echo "$HTTP" | grep -q "302"; then
		PORT=80
		TRUE_FALSE=false
	else
		PORT=80
		TRUE_FALSE=false
	fi
}

while read TARGET; do
PING=$(dig +short $TARGET)
if [ "$PING" != "" ]; then
	DETECT
	r=$(msfconsole -qx "use auxiliary/scanner/http/host_header_injection;set RHOSTS "$TARGET";set RPORT "$PORT";set SSL "$TRUE_FALSE";set TARGETHOST bing.com;run;exit")
	if echo "$r" | grep -q "(403)";then
		printf "$RED"    "[X] TARGET Blocked is WAF/Recaptcha: "$TARGET":"$PORT
	else
		if echo "$r" | grep -q "is vulnerable to HTTP Host header injection";then
			printf "$YELLOW"    "[*] It is Vulnerable to HTTP HHi: "$TARGET":"$PORT
		else
			printf "$GREEN"     "[i] Not Vulnerable to HTTP HHi:   "$TARGET":"$PORT
		fi
	fi
else
	printf "$RED"     "[X] TARGET is Resolve DEAD: "$TARGET"
fi
done <$FILENAME