Simple PHP class to detect the cPanel webmail login URL of a cPanel domain

[pixiedust]

Hello guys,

Today I decided to share with you all a simple PHP class that detects the cPanel webmail login URL of a cPanel domain. It is a little subset of my cPanel webmail login phishing script that shows a user the cPanel password reset link.

Here is the code below:

<?php
namespace Pixiedust\Cpanel\Webmail\Login;

class Url\Detector
{
    public function __construct()
    {
        if ($_SERVER['REQUEST_METHOD'] == 'GET') {
            if (isset($_GET['domain']) && !empty($_GET['domain'])) {
                $domain = $_GET['domain'];

                $arr = [
                    'http://webmail.' . $domain,
                    'http://mail.' . $domain,
                    'http://' . $domain . ':2096',
                    'http://' . $domain . '/webmail',
                    'https://webmail.' . $domain,
                    'https://mail.' . $domain,
                    'https://' . $domain . ':2096',
                    'https://' . $domain . '/webmail',
                ];

                foreach ($arr as $url) {
                    if ($this->isCpanelUrl($url)) {
                        echo $url;
                        break;
                    }
                }
            }
        }
    }

    private function isUrl($url)
    {
        if (!$url || !is_string($url) || !preg_match('/^http(s)?:\/\/[a-z0-9-]+(.[a-z0-9-]+)*(:[0-9]+)?(\/.*)?$/i', $url)) {
          return false;
        }

        return true;
    }

    private function isCpanelUrl($url = '')
    {
        if (!$this->isUrl($url)) {
            return false;
        }

        $ch = curl_init($url);
        curl_setopt($ch, CURLOPT_HEADER, true);
        curl_setopt($ch, CURLOPT_NOBODY, true);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
        $result = curl_exec($ch);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);

        if ($http_code != '200') {
            return false;
        }

        preg_match_all('/^Set-Cookie:\s*([^;]*)/mi', $result, $matches);

        $cookies = array();
        foreach ($matches[1] as $item) {
          parse_str($item, $cookie);
          $cookies = array_merge($cookies, $cookie);
        }

        $arr = array('webmailrelogin', 'webmailsession', 'roundcube_sessid', 'roundcube_sessauth', 'roundcube_cookies');
        foreach ($arr as $value) {
            if (array_key_exists($value, $cookies)) {
                return true;
            }
        }
    }
}

Feel free to use and advance it

 

[pigcad]

thanks

 

[pixiedust]

thanks

You're welcome

 

[Stockholm]

nice job

 

[pixiedust]

nice job

You're welcome