XSpear 1.1.3 → 1.1.4
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.idea/workspace.xml +78 -68
- data/README.md +3 -2
- data/lib/XSpear.rb +6 -6
- data/lib/XSpear/XSpearRepoter.rb +8 -5
- data/lib/XSpear/version.rb +1 -1
- metadata +2 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: b975c8acedef399b45b9d865d7845d76ef202d1ef19d37dd8d7314644e379537
|
|
4
|
+
data.tar.gz: befb749d80ee758e96aec8809947d607c1a245af4bc41e0ec059ba305b812ebe
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: e4b3d89ad70cdc1c37b095dfd0d7a5cec84057f1ffe7522ace6f8707fa6cdb53e068e7257aa7792395eea9a5e0bc225a4fa06e614a5d41fcab16c20848710884
|
|
7
|
+
data.tar.gz: 39fe93dc3493aa40d91226d72668f21362d2f8dc55b014e43a0b55235a2add24b1ae5ce2a0789c310ec617e50bcc23253b2c5f5819a770c9c2b39387f58456d4
|
data/.idea/workspace.xml
CHANGED
|
@@ -2,6 +2,7 @@
|
|
|
2
2
|
<project version="4">
|
|
3
3
|
<component name="ChangeListManager">
|
|
4
4
|
<list default="true" id="4ee2e581-45d7-4c90-b6a1-e92e4b5829dd" name="Default Changelist" comment="">
|
|
5
|
+
<change beforePath="$PROJECT_DIR$/.idea/workspace.xml" beforeDir="false" afterPath="$PROJECT_DIR$/.idea/workspace.xml" afterDir="false" />
|
|
5
6
|
<change beforePath="$PROJECT_DIR$/lib/XSpear.rb" beforeDir="false" afterPath="$PROJECT_DIR$/lib/XSpear.rb" afterDir="false" />
|
|
6
7
|
</list>
|
|
7
8
|
<option name="EXCLUDED_CONVERTED_TO_IGNORED" value="true" />
|
|
@@ -16,15 +17,22 @@
|
|
|
16
17
|
<component name="FileEditorManager">
|
|
17
18
|
<leaf SIDE_TABS_SIZE_LIMIT_KEY="300">
|
|
18
19
|
<file pinned="false" current-in-tab="false">
|
|
19
|
-
<entry file="file://$PROJECT_DIR$/
|
|
20
|
-
<provider selected="true" editor-type-id="text-editor"
|
|
20
|
+
<entry file="file://$PROJECT_DIR$/README.md">
|
|
21
|
+
<provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
|
|
22
|
+
<state split_layout="SPLIT">
|
|
23
|
+
<first_editor relative-caret-position="407">
|
|
24
|
+
<caret line="243" column="42" lean-forward="true" selection-start-line="243" selection-start-column="42" selection-end-line="243" selection-end-column="42" />
|
|
25
|
+
</first_editor>
|
|
26
|
+
<second_editor />
|
|
27
|
+
</state>
|
|
28
|
+
</provider>
|
|
21
29
|
</entry>
|
|
22
30
|
</file>
|
|
23
31
|
<file pinned="false" current-in-tab="true">
|
|
24
32
|
<entry file="file://$PROJECT_DIR$/lib/XSpear.rb">
|
|
25
33
|
<provider selected="true" editor-type-id="text-editor">
|
|
26
|
-
<state relative-caret-position="
|
|
27
|
-
<caret line="
|
|
34
|
+
<state relative-caret-position="256">
|
|
35
|
+
<caret line="508" column="107" lean-forward="true" selection-start-line="508" selection-start-column="107" selection-end-line="508" selection-end-column="107" />
|
|
28
36
|
</state>
|
|
29
37
|
</provider>
|
|
30
38
|
</entry>
|
|
@@ -41,8 +49,8 @@
|
|
|
41
49
|
<file pinned="false" current-in-tab="false">
|
|
42
50
|
<entry file="file://$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb">
|
|
43
51
|
<provider selected="true" editor-type-id="text-editor">
|
|
44
|
-
<state relative-caret-position="
|
|
45
|
-
<caret line="
|
|
52
|
+
<state relative-caret-position="-61">
|
|
53
|
+
<caret line="73" lean-forward="true" selection-start-line="73" selection-end-line="73" />
|
|
46
54
|
</state>
|
|
47
55
|
</provider>
|
|
48
56
|
</entry>
|
|
@@ -59,8 +67,8 @@
|
|
|
59
67
|
<file pinned="false" current-in-tab="false">
|
|
60
68
|
<entry file="file://$PROJECT_DIR$/lib/XSpear/log.rb">
|
|
61
69
|
<provider selected="true" editor-type-id="text-editor">
|
|
62
|
-
<state relative-caret-position="
|
|
63
|
-
<caret line="
|
|
70
|
+
<state relative-caret-position="225">
|
|
71
|
+
<caret line="15" column="28" lean-forward="true" selection-start-line="15" selection-start-column="28" selection-end-line="15" selection-end-column="28" />
|
|
64
72
|
</state>
|
|
65
73
|
</provider>
|
|
66
74
|
</entry>
|
|
@@ -104,17 +112,19 @@
|
|
|
104
112
|
<option value="$PROJECT_DIR$/lib/XSpear/log.rb" />
|
|
105
113
|
<option value="$PROJECT_DIR$/XSpear.gemspec" />
|
|
106
114
|
<option value="$PROJECT_DIR$/exe/XSpear" />
|
|
107
|
-
<option value="$PROJECT_DIR$/README.md" />
|
|
108
115
|
<option value="$PROJECT_DIR$/lib/XSpear/banner.rb" />
|
|
109
|
-
<option value="$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb" />
|
|
110
116
|
<option value="$PROJECT_DIR$/lib/XSpear/version.rb" />
|
|
117
|
+
<option value="$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb" />
|
|
118
|
+
<option value="$PROJECT_DIR$/README.md" />
|
|
111
119
|
<option value="$PROJECT_DIR$/lib/XSpear.rb" />
|
|
112
120
|
</list>
|
|
113
121
|
</option>
|
|
114
122
|
</component>
|
|
115
123
|
<component name="ProjectFrameBounds" fullScreen="true">
|
|
116
|
-
<option name="
|
|
117
|
-
<option name="
|
|
124
|
+
<option name="x" value="-1920" />
|
|
125
|
+
<option name="y" value="-643" />
|
|
126
|
+
<option name="width" value="1920" />
|
|
127
|
+
<option name="height" value="1080" />
|
|
118
128
|
</component>
|
|
119
129
|
<component name="ProjectLevelVcsManager" settingsEditedManually="true">
|
|
120
130
|
<ConfirmationsSetting value="2" id="Add" />
|
|
@@ -223,28 +233,7 @@
|
|
|
223
233
|
<workItem from="1563809961097" duration="4237000" />
|
|
224
234
|
<workItem from="1563893538891" duration="11917000" />
|
|
225
235
|
<workItem from="1564151699165" duration="2494000" />
|
|
226
|
-
<workItem from="1564413097342" duration="
|
|
227
|
-
</task>
|
|
228
|
-
<task id="LOCAL-00004" summary="build gem and edit dependency">
|
|
229
|
-
<created>1562946430273</created>
|
|
230
|
-
<option name="number" value="00004" />
|
|
231
|
-
<option name="presentableId" value="LOCAL-00004" />
|
|
232
|
-
<option name="project" value="LOCAL" />
|
|
233
|
-
<updated>1562946430273</updated>
|
|
234
|
-
</task>
|
|
235
|
-
<task id="LOCAL-00005" summary="build gem and edit dependency">
|
|
236
|
-
<created>1563032773559</created>
|
|
237
|
-
<option name="number" value="00005" />
|
|
238
|
-
<option name="presentableId" value="LOCAL-00005" />
|
|
239
|
-
<option name="project" value="LOCAL" />
|
|
240
|
-
<updated>1563032773559</updated>
|
|
241
|
-
</task>
|
|
242
|
-
<task id="LOCAL-00006" summary="add gem & edit code">
|
|
243
|
-
<created>1563032834354</created>
|
|
244
|
-
<option name="number" value="00006" />
|
|
245
|
-
<option name="presentableId" value="LOCAL-00006" />
|
|
246
|
-
<option name="project" value="LOCAL" />
|
|
247
|
-
<updated>1563032834354</updated>
|
|
236
|
+
<workItem from="1564413097342" duration="6632000" />
|
|
248
237
|
</task>
|
|
249
238
|
<task id="LOCAL-00007" summary="edit gem dependency(runtime, developement)">
|
|
250
239
|
<created>1563202364398</created>
|
|
@@ -568,17 +557,38 @@
|
|
|
568
557
|
<option name="project" value="LOCAL" />
|
|
569
558
|
<updated>1564582096828</updated>
|
|
570
559
|
</task>
|
|
571
|
-
<
|
|
560
|
+
<task id="LOCAL-00053" summary="(1.1.3) Releases & Fixed #18 (Add onload* event handler)">
|
|
561
|
+
<created>1564848490467</created>
|
|
562
|
+
<option name="number" value="00053" />
|
|
563
|
+
<option name="presentableId" value="LOCAL-00053" />
|
|
564
|
+
<option name="project" value="LOCAL" />
|
|
565
|
+
<updated>1564848490467</updated>
|
|
566
|
+
</task>
|
|
567
|
+
<task id="LOCAL-00054" summary="(1.1.3) Releases & Fixed #18 (Add onload* event handler)">
|
|
568
|
+
<created>1564848526961</created>
|
|
569
|
+
<option name="number" value="00054" />
|
|
570
|
+
<option name="presentableId" value="LOCAL-00054" />
|
|
571
|
+
<option name="project" value="LOCAL" />
|
|
572
|
+
<updated>1564848526961</updated>
|
|
573
|
+
</task>
|
|
574
|
+
<task id="LOCAL-00055" summary="(1.1.4) [Fixed #20 #22] Modified JSON Format&Remove Color in XSpearReporter">
|
|
575
|
+
<created>1565281795460</created>
|
|
576
|
+
<option name="number" value="00055" />
|
|
577
|
+
<option name="presentableId" value="LOCAL-00055" />
|
|
578
|
+
<option name="project" value="LOCAL" />
|
|
579
|
+
<updated>1565281795460</updated>
|
|
580
|
+
</task>
|
|
581
|
+
<option name="localTasksCounter" value="56" />
|
|
572
582
|
<servers />
|
|
573
583
|
</component>
|
|
574
584
|
<component name="TimeTrackingManager">
|
|
575
|
-
<option name="totallyTimeSpent" value="
|
|
585
|
+
<option name="totallyTimeSpent" value="45602000" />
|
|
576
586
|
</component>
|
|
577
587
|
<component name="ToolWindowManager">
|
|
578
|
-
<frame x="
|
|
588
|
+
<frame x="-1920" y="-643" width="1920" height="1080" extended-state="0" />
|
|
579
589
|
<editor active="true" />
|
|
580
590
|
<layout>
|
|
581
|
-
<window_info content_ui="combo" id="Project" order="0" visible="true" weight="0.
|
|
591
|
+
<window_info content_ui="combo" id="Project" order="0" visible="true" weight="0.14643237" />
|
|
582
592
|
<window_info id="Structure" order="1" side_tool="true" weight="0.25" />
|
|
583
593
|
<window_info id="Favorites" order="2" side_tool="true" />
|
|
584
594
|
<window_info anchor="bottom" id="Message" order="0" />
|
|
@@ -591,7 +601,7 @@
|
|
|
591
601
|
<window_info anchor="bottom" id="Docker" order="7" show_stripe_button="false" />
|
|
592
602
|
<window_info anchor="bottom" id="Database Changes" order="8" />
|
|
593
603
|
<window_info anchor="bottom" id="Version Control" order="9" />
|
|
594
|
-
<window_info active="true" anchor="bottom" id="Terminal" order="10" visible="true" weight="0.
|
|
604
|
+
<window_info active="true" anchor="bottom" id="Terminal" order="10" visible="true" weight="0.32277226" />
|
|
595
605
|
<window_info anchor="bottom" id="Event Log" order="11" side_tool="true" />
|
|
596
606
|
<window_info anchor="bottom" id="Messages" order="12" weight="0.32953367" />
|
|
597
607
|
<window_info anchor="right" id="Commander" internal_type="SLIDING" order="0" type="SLIDING" weight="0.4" />
|
|
@@ -604,8 +614,6 @@
|
|
|
604
614
|
<option name="version" value="1" />
|
|
605
615
|
</component>
|
|
606
616
|
<component name="VcsManagerConfiguration">
|
|
607
|
-
<MESSAGE value="(1.0.5) Add blind XSS options & edit "filtered Rule testing code"" />
|
|
608
|
-
<MESSAGE value="(1.0.5) Update README.md" />
|
|
609
617
|
<MESSAGE value="(1.0.6)[fixed #6] Edit Static Analysis code" />
|
|
610
618
|
<MESSAGE value="(1.0.6)[fixed #7] CallbackNotAdded 쪽 분기문 수정" />
|
|
611
619
|
<MESSAGE value="(1.0.6)[fixed #4] Report 객체 수정" />
|
|
@@ -629,7 +637,9 @@
|
|
|
629
637
|
<MESSAGE value="(1.1.1) Add WAF Found module frame..(TO_DO)" />
|
|
630
638
|
<MESSAGE value="(1.1.1) Add code level function & Check WAF code frame" />
|
|
631
639
|
<MESSAGE value="(1.1.2) Releases & Fixed #17 (Add some event handlers..)" />
|
|
632
|
-
<
|
|
640
|
+
<MESSAGE value="(1.1.3) Releases & Fixed #18 (Add onload* event handler)" />
|
|
641
|
+
<MESSAGE value="(1.1.4) [Fixed #20 #22] Modified JSON Format&Remove Color in XSpearReporter" />
|
|
642
|
+
<option name="LAST_COMMIT_MESSAGE" value="(1.1.4) [Fixed #20 #22] Modified JSON Format&Remove Color in XSpearReporter" />
|
|
633
643
|
</component>
|
|
634
644
|
<component name="editorHistoryManager">
|
|
635
645
|
<entry file="file://$USER_HOME$/.rvm/gems/ruby-2.4.6/gems/bundler-2.0.1/lib/bundler/rubygems_integration.rb">
|
|
@@ -652,16 +662,6 @@
|
|
|
652
662
|
</state>
|
|
653
663
|
</provider>
|
|
654
664
|
</entry>
|
|
655
|
-
<entry file="file://$PROJECT_DIR$/README.md">
|
|
656
|
-
<provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
|
|
657
|
-
<state split_layout="SPLIT">
|
|
658
|
-
<first_editor relative-caret-position="2865">
|
|
659
|
-
<caret line="191" column="13" selection-start-line="191" selection-start-column="13" selection-end-line="191" selection-end-column="13" />
|
|
660
|
-
</first_editor>
|
|
661
|
-
<second_editor />
|
|
662
|
-
</state>
|
|
663
|
-
</provider>
|
|
664
|
-
</entry>
|
|
665
665
|
<entry file="file://$PROJECT_DIR$/spec/XSpear_spec.rb">
|
|
666
666
|
<provider selected="true" editor-type-id="text-editor" />
|
|
667
667
|
</entry>
|
|
@@ -672,13 +672,6 @@
|
|
|
672
672
|
</state>
|
|
673
673
|
</provider>
|
|
674
674
|
</entry>
|
|
675
|
-
<entry file="file://$PROJECT_DIR$/lib/XSpear/log.rb">
|
|
676
|
-
<provider selected="true" editor-type-id="text-editor">
|
|
677
|
-
<state relative-caret-position="195">
|
|
678
|
-
<caret line="13" column="19" selection-start-line="13" selection-start-column="19" selection-end-line="13" selection-end-column="19" />
|
|
679
|
-
</state>
|
|
680
|
-
</provider>
|
|
681
|
-
</entry>
|
|
682
675
|
<entry file="file://$PROJECT_DIR$/XSpear.gemspec">
|
|
683
676
|
<provider selected="true" editor-type-id="text-editor">
|
|
684
677
|
<state relative-caret-position="105">
|
|
@@ -692,13 +685,6 @@
|
|
|
692
685
|
<entry file="file:///usr/local/bin/rake">
|
|
693
686
|
<provider selected="true" editor-type-id="text-editor" />
|
|
694
687
|
</entry>
|
|
695
|
-
<entry file="file://$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb">
|
|
696
|
-
<provider selected="true" editor-type-id="text-editor">
|
|
697
|
-
<state relative-caret-position="457">
|
|
698
|
-
<caret line="54" column="10" selection-start-line="54" selection-start-column="10" selection-end-line="54" selection-end-column="10" />
|
|
699
|
-
</state>
|
|
700
|
-
</provider>
|
|
701
|
-
</entry>
|
|
702
688
|
<entry file="file://$USER_HOME$/.rvm/rubies/ruby-2.4.6/lib/ruby/site_ruby/2.4.0/rubygems/core_ext/kernel_require.rb">
|
|
703
689
|
<provider selected="true" editor-type-id="text-editor">
|
|
704
690
|
<state relative-caret-position="207">
|
|
@@ -713,10 +699,34 @@
|
|
|
713
699
|
</state>
|
|
714
700
|
</provider>
|
|
715
701
|
</entry>
|
|
702
|
+
<entry file="file://$PROJECT_DIR$/README.md">
|
|
703
|
+
<provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
|
|
704
|
+
<state split_layout="SPLIT">
|
|
705
|
+
<first_editor relative-caret-position="407">
|
|
706
|
+
<caret line="243" column="42" lean-forward="true" selection-start-line="243" selection-start-column="42" selection-end-line="243" selection-end-column="42" />
|
|
707
|
+
</first_editor>
|
|
708
|
+
<second_editor />
|
|
709
|
+
</state>
|
|
710
|
+
</provider>
|
|
711
|
+
</entry>
|
|
712
|
+
<entry file="file://$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb">
|
|
713
|
+
<provider selected="true" editor-type-id="text-editor">
|
|
714
|
+
<state relative-caret-position="-61">
|
|
715
|
+
<caret line="73" lean-forward="true" selection-start-line="73" selection-end-line="73" />
|
|
716
|
+
</state>
|
|
717
|
+
</provider>
|
|
718
|
+
</entry>
|
|
719
|
+
<entry file="file://$PROJECT_DIR$/lib/XSpear/log.rb">
|
|
720
|
+
<provider selected="true" editor-type-id="text-editor">
|
|
721
|
+
<state relative-caret-position="225">
|
|
722
|
+
<caret line="15" column="28" lean-forward="true" selection-start-line="15" selection-start-column="28" selection-end-line="15" selection-end-column="28" />
|
|
723
|
+
</state>
|
|
724
|
+
</provider>
|
|
725
|
+
</entry>
|
|
716
726
|
<entry file="file://$PROJECT_DIR$/lib/XSpear.rb">
|
|
717
727
|
<provider selected="true" editor-type-id="text-editor">
|
|
718
|
-
<state relative-caret-position="
|
|
719
|
-
<caret line="
|
|
728
|
+
<state relative-caret-position="256">
|
|
729
|
+
<caret line="508" column="107" lean-forward="true" selection-start-line="508" selection-start-column="107" selection-end-line="508" selection-end-column="107" />
|
|
720
730
|
</state>
|
|
721
731
|
</provider>
|
|
722
732
|
</entry>
|
data/README.md
CHANGED
|
@@ -207,7 +207,7 @@ __((_)(_)) /(/( /((_))(_))(()\
|
|
|
207
207
|
**to JSON**
|
|
208
208
|
```
|
|
209
209
|
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -d "searchFor=yy" -o json -v 1
|
|
210
|
-
{"starttime":"2019-
|
|
210
|
+
{"starttime":"2019-08-09 01:26:32 +0900","endtime":"2019-08-09 01:27:04 +0900","issue_count":25,"issue_list":[{"id":0,"type":"INFO","issue":"REFLECTED","method":"GET","param":"cat","payload":"rEfe6","description":"reflected parameter"},{"id":1,"type":"INFO","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Found Server: nginx/1.4.1"},{"id":2,"type":"INFO","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Not set HSTS"},{"id":3,"type":"INFO","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Content-Type: text/html"},{"id":4,"type":"LOW","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Not Set X-Frame-Options"},{"id":5,"type":"MIDUM","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Not Set CSP"},{"id":6,"type":"INFO","issue":"DYNAMIC ANALYSIS","method":"GET","param":"cat","payload":"XsPeaR\"","description":"Found SQL Error Pattern"},{"id":7,"type":"INFO","issue":"FILERD RULE","method":"GET","param":"cat","payload":"onhwul=64","description":"not filtered event handler on{any} pattern"},{"id":8,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<script>alert(45)</script>","description":"reflected XSS Code"},{"id":9,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<details/open/ontoggle=\"alert`45`\">","description":"reflected HTML5 XSS Code"},{"id":10,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<marquee onstart=alert(45)>","description":"reflected HTML5 XSS Code"},{"id":11,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<video/poster/onerror=alert(45)>","description":"reflected HTML5 XSS Code"},{"id":12,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<audio src onloadstart=alert(45)>","description":"reflected HTML5 XSS Code"},{"id":13,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"\"><iframe/src=JavaScriPt:alert(45)>","description":"reflected XSS Code"},{"id":14,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<keygen autofocus onfocus=alert(45)>","description":"reflected onfocus XSS Code"},{"id":15,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<meter onmouseover=alert(45)>0</meter>","description":"reflected HTML5 XSS Code"},{"id":16,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<select autofocus onfocus=alert(45)>","description":"reflected onfocus XSS Code"},{"id":17,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<textarea autofocus onfocus=alert(45)>","description":"reflected onfocus XSS Code"},{"id":18,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<input autofocus onfocus=alert(45)>","description":"reflected onfocus XSS Code"},{"id":19,"type":"VULN","issue":"XSS","method":"GET","param":"cat","payload":"<svg(0x0c)onload=alert(1)>","description":"triggered <svg(0x0c)onload=alert(1)>"},{"id":20,"type":"VULN","issue":"XSS","method":"GET","param":"cat","payload":"<script>alert(45)</script>","description":"triggered <script>alert(45)</script>"},{"id":21,"type":"VULN","issue":"XSS","method":"GET","param":"cat","payload":"'\"><svg/onload=alert(45)>","description":"triggered <svg/onload=alert(45)>"},{"id":22,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<audio src onloadstart=alert(45)>","description":"triggered <audio src onloadstart=alert(45)>"},{"id":23,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<marquee onstart=alert(45)>","description":"triggered <marquee onstart=alert(45)>"},{"id":24,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<details/open/ontoggle=\"alert(45)\">","description":"triggered <details/open/ontoggle=\"alert(45)\">"}]}
|
|
211
211
|
```
|
|
212
212
|
|
|
213
213
|
## Usage on ruby code (gem library)
|
|
@@ -225,7 +225,8 @@ options['output'] = json
|
|
|
225
225
|
s = XspearScan.new "https://www.hahwul.com?target_url", options
|
|
226
226
|
|
|
227
227
|
# Scanning
|
|
228
|
-
|
|
228
|
+
s.run
|
|
229
|
+
result = s.report.to_json
|
|
229
230
|
r = JSON.parse result
|
|
230
231
|
```
|
|
231
232
|
|
data/lib/XSpear.rb
CHANGED
|
@@ -66,7 +66,7 @@ class XspearScan
|
|
|
66
66
|
def run
|
|
67
67
|
if @response.body.include? @query
|
|
68
68
|
time = Time.now
|
|
69
|
-
puts '[I]'.blue + " [#{time.strftime('%H:%M:%S')}] reflected #{@query}"
|
|
69
|
+
puts '[I]'.blue + " [#{time.strftime('%H:%M:%S')}] [#{@response.code}/#{@response.message}] reflected #{@query}"
|
|
70
70
|
[false, true]
|
|
71
71
|
else
|
|
72
72
|
[false, "Not reflected #{@query}"]
|
|
@@ -503,18 +503,18 @@ class XspearScan
|
|
|
503
503
|
jobs.map do |node|
|
|
504
504
|
Thread.new do
|
|
505
505
|
begin
|
|
506
|
-
result, res = task(node[:query], node[:inject], node[:pattern], node[:callback])
|
|
506
|
+
result, req, res = task(node[:query], node[:inject], node[:pattern], node[:callback])
|
|
507
507
|
# p result.body
|
|
508
508
|
if @verbose.to_i > 2
|
|
509
|
-
log('d', "[#{res.code}] #{node[:query]} in #{node[:inject]}
|
|
509
|
+
log('d', "[#{res.code}/#{res.message}] #{node[:query]} in #{node[:inject]}\n[ Request ]\n#{req.to_hash.inspect}\n[ Response ]\n#{res.to_hash.inspect}")
|
|
510
510
|
end
|
|
511
511
|
if result[0]
|
|
512
|
-
log(node[:category], (result[1]).to_s.yellow+"[param: #{node[:param]}][#{node[:desc]}]")
|
|
512
|
+
log(node[:category], "[#{res.code}/#{res.message}] "+(result[1]).to_s.yellow+"[param: #{node[:param]}][#{node[:desc]}]")
|
|
513
513
|
@report.add_issue(node[:category],node[:type],node[:param],node[:query],node[:pattern],node[:desc])
|
|
514
514
|
elsif (node[:callback] == CallbackNotAdded) && (result[1].to_s == "true")
|
|
515
515
|
@filtered_objects[node[:param].to_s].nil? ? (@filtered_objects[node[:param].to_s] = [node[:pattern].to_s]) : (@filtered_objects[node[:param].to_s].push(node[:pattern].to_s))
|
|
516
516
|
else
|
|
517
|
-
log('d', "'#{node[:param]}' "+(result[1]).to_s)
|
|
517
|
+
log('d', "[#{res.code}/#{res.message}] '#{node[:param]}' "+(result[1]).to_s)
|
|
518
518
|
end
|
|
519
519
|
rescue => e
|
|
520
520
|
end
|
|
@@ -626,7 +626,7 @@ class XspearScan
|
|
|
626
626
|
result = callback.new(uri.to_s, method, pattern, response, @report).run
|
|
627
627
|
# result = result.run
|
|
628
628
|
# p request.headers
|
|
629
|
-
return result, response
|
|
629
|
+
return result, request, response
|
|
630
630
|
end
|
|
631
631
|
end
|
|
632
632
|
rescue => e
|
data/lib/XSpear/XSpearRepoter.rb
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
require 'terminal-table'
|
|
2
2
|
|
|
3
|
-
IssueStruct = Struct.new(:id, :type, :issue, :payload, :description)
|
|
3
|
+
IssueStruct = Struct.new(:id, :type, :issue, :method, :param, :payload, :description)
|
|
4
4
|
class IssueStruct
|
|
5
5
|
def to_json(*a)
|
|
6
|
-
|
|
6
|
+
# NO TYPE ISSUE METHOD PARAM PAYLOAD DESCRIPTION
|
|
7
|
+
{:id => self.id, :type => self.type, :issue => self.issue, :method => self.method, :param => self.param, :payload => self.payload, :description => self.description}.to_json(*a)
|
|
7
8
|
end
|
|
8
9
|
|
|
9
|
-
|
|
10
10
|
def self.json_create(o)
|
|
11
|
-
new(o['id'], o['type'], o['issue'], o['payload'], o['description'])
|
|
11
|
+
new(o['id'], o['type'], o['issue'], o['method'], o['param'], o['payload'], o['description'])
|
|
12
12
|
end
|
|
13
13
|
end
|
|
14
14
|
|
|
@@ -65,7 +65,10 @@ class XspearRepoter
|
|
|
65
65
|
def to_json
|
|
66
66
|
buffer = []
|
|
67
67
|
@issue.each do |i|
|
|
68
|
-
|
|
68
|
+
i[1] = i[1].uncolorize
|
|
69
|
+
i[6] = i[6].uncolorize
|
|
70
|
+
# NO TYPE ISSUE METHOD PARAM PAYLOAD DESCRIPTION
|
|
71
|
+
tmp = IssueStruct.new(i[0],i[1],i[2],i[3],i[4],i[5],i[6])
|
|
69
72
|
buffer.push(tmp)
|
|
70
73
|
end
|
|
71
74
|
|
data/lib/XSpear/version.rb
CHANGED
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: XSpear
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 1.1.
|
|
4
|
+
version: 1.1.4
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- hahwul
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: exe
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2019-08-
|
|
11
|
+
date: 2019-08-08 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: colorize
|