Such things exist that are called rDNS AMP Lists, for DDoS attacks to amplify their output with greater strength. I have a client that wants a script that makes AMP lists on the fly for them, and we don't have the resources to make this list ourselves. We are looking for someone to take on the project and finish in a day or so. The script would have to be PHP, would have to scrape URLs, check to verify that they are vulnerable, and output all the vulnerable urls into a text file, of which they can change the name of in a settings file. A competitor of theirs got this completed for $100, and they are looking to spend at MOST that.
Please bid only if you have experience with this or absolutely know you can get this completed. We don't like to disappoint our clients.