XSpear 1.2.0 → 1.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.idea/XSpear.iml +3 -4
- data/.idea/workspace.xml +58 -55
- data/README.md +6 -0
- data/exe/XSpear +3 -0
- data/lib/XSpear.rb +30 -16
- data/lib/XSpear/version.rb +1 -1
- metadata +2 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: c73f10e8f6a68615bb8821fbe7b8e241b5e3726fba69ee0a62a9971b4ba6651f
|
|
4
|
+
data.tar.gz: 69a9af875d06b2aaed7febd65e34bf8d44c686c5a7ba15e6e95b1d6749c81b01
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 85269fd789cf9a58bb5af23f46959b4c9525aebccdce316881ea12a979929a67b0e1f53bf617ff667431f425f519350f6a74d769582f8c9f54d246cdc96476fb
|
|
7
|
+
data.tar.gz: cd8f0d09942deb27aca0d052fa1219fd98caa038411bf27e0476ac145c7f407c526cbcf8b8a14049d26c1930adb4d9a8a16ea6a2cbbad1c678b819a4678df871
|
data/.idea/XSpear.iml
CHANGED
|
@@ -8,11 +8,10 @@
|
|
|
8
8
|
<orderEntry type="inheritedJdk" />
|
|
9
9
|
<orderEntry type="sourceFolder" forTests="false" />
|
|
10
10
|
<orderEntry type="library" scope="PROVIDED" name="bundler (v2.0.2, ruby-2.3.7-p456) [gem]" level="application" />
|
|
11
|
-
<orderEntry type="library" scope="PROVIDED" name="childprocess (
|
|
11
|
+
<orderEntry type="library" scope="PROVIDED" name="childprocess (v3.0.0, ruby-2.3.7-p456) [gem]" level="application" />
|
|
12
12
|
<orderEntry type="library" scope="PROVIDED" name="colorize (v0.8.1, ruby-2.3.7-p456) [gem]" level="application" />
|
|
13
|
-
<orderEntry type="library" scope="PROVIDED" name="
|
|
14
|
-
<orderEntry type="library" scope="PROVIDED" name="
|
|
15
|
-
<orderEntry type="library" scope="PROVIDED" name="selenium-webdriver (v3.142.3, ruby-2.3.7-p456) [gem]" level="application" />
|
|
13
|
+
<orderEntry type="library" scope="PROVIDED" name="rubyzip (v2.0.0, ruby-2.3.7-p456) [gem]" level="application" />
|
|
14
|
+
<orderEntry type="library" scope="PROVIDED" name="selenium-webdriver (v3.142.6, ruby-2.3.7-p456) [gem]" level="application" />
|
|
16
15
|
<orderEntry type="library" scope="PROVIDED" name="terminal-table (v1.8.0, ruby-2.3.7-p456) [gem]" level="application" />
|
|
17
16
|
<orderEntry type="library" scope="PROVIDED" name="unicode-display_width (v1.6.0, ruby-2.3.7-p456) [gem]" level="application" />
|
|
18
17
|
</component>
|
data/.idea/workspace.xml
CHANGED
|
@@ -2,7 +2,9 @@
|
|
|
2
2
|
<project version="4">
|
|
3
3
|
<component name="ChangeListManager">
|
|
4
4
|
<list default="true" id="4ee2e581-45d7-4c90-b6a1-e92e4b5829dd" name="Default Changelist" comment="(1.1.6) Add Event handler pattern (whatthe=""onload)">
|
|
5
|
+
<change beforePath="$PROJECT_DIR$/.idea/XSpear.iml" beforeDir="false" afterPath="$PROJECT_DIR$/.idea/XSpear.iml" afterDir="false" />
|
|
5
6
|
<change beforePath="$PROJECT_DIR$/.idea/workspace.xml" beforeDir="false" afterPath="$PROJECT_DIR$/.idea/workspace.xml" afterDir="false" />
|
|
7
|
+
<change beforePath="$PROJECT_DIR$/exe/XSpear" beforeDir="false" afterPath="$PROJECT_DIR$/exe/XSpear" afterDir="false" />
|
|
6
8
|
<change beforePath="$PROJECT_DIR$/lib/XSpear.rb" beforeDir="false" afterPath="$PROJECT_DIR$/lib/XSpear.rb" afterDir="false" />
|
|
7
9
|
<change beforePath="$PROJECT_DIR$/lib/XSpear/version.rb" beforeDir="false" afterPath="$PROJECT_DIR$/lib/XSpear/version.rb" afterDir="false" />
|
|
8
10
|
</list>
|
|
@@ -20,33 +22,26 @@
|
|
|
20
22
|
<file pinned="false" current-in-tab="false">
|
|
21
23
|
<entry file="file://$PROJECT_DIR$/exe/XSpear">
|
|
22
24
|
<provider selected="true" editor-type-id="text-editor">
|
|
23
|
-
<state relative-caret-position="
|
|
24
|
-
<caret line="
|
|
25
|
+
<state relative-caret-position="-1138">
|
|
26
|
+
<caret line="28" column="34" selection-start-line="28" selection-start-column="34" selection-end-line="28" selection-end-column="34" />
|
|
25
27
|
</state>
|
|
26
28
|
</provider>
|
|
27
29
|
</entry>
|
|
28
30
|
</file>
|
|
29
31
|
<file pinned="false" current-in-tab="false">
|
|
30
|
-
<entry file="file://$PROJECT_DIR$/README.md">
|
|
31
|
-
<provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
|
|
32
|
-
<state split_layout="SPLIT">
|
|
33
|
-
<first_editor relative-caret-position="180">
|
|
34
|
-
<caret line="12" column="72" selection-start-line="12" selection-start-column="72" selection-end-line="12" selection-end-column="72" />
|
|
35
|
-
</first_editor>
|
|
36
|
-
<second_editor />
|
|
37
|
-
</state>
|
|
38
|
-
</provider>
|
|
39
|
-
</entry>
|
|
40
|
-
</file>
|
|
41
|
-
<file pinned="false" current-in-tab="true">
|
|
42
32
|
<entry file="file://$PROJECT_DIR$/lib/XSpear.rb">
|
|
43
33
|
<provider selected="true" editor-type-id="text-editor">
|
|
44
|
-
<state relative-caret-position="
|
|
45
|
-
<caret line="
|
|
34
|
+
<state relative-caret-position="477">
|
|
35
|
+
<caret line="657" column="35" lean-forward="true" selection-start-line="657" selection-start-column="35" selection-end-line="657" selection-end-column="35" />
|
|
46
36
|
</state>
|
|
47
37
|
</provider>
|
|
48
38
|
</entry>
|
|
49
39
|
</file>
|
|
40
|
+
<file pinned="false" current-in-tab="false">
|
|
41
|
+
<entry file="file://$PROJECT_DIR$/bin/console">
|
|
42
|
+
<provider selected="true" editor-type-id="text-editor" />
|
|
43
|
+
</entry>
|
|
44
|
+
</file>
|
|
50
45
|
<file pinned="false" current-in-tab="false">
|
|
51
46
|
<entry file="file://$USER_HOME$/.rvm/rubies/ruby-2.4.6/lib/ruby/site_ruby/2.4.0/rubygems/core_ext/kernel_require.rb">
|
|
52
47
|
<provider selected="true" editor-type-id="text-editor">
|
|
@@ -74,7 +69,7 @@
|
|
|
74
69
|
</provider>
|
|
75
70
|
</entry>
|
|
76
71
|
</file>
|
|
77
|
-
<file pinned="false" current-in-tab="
|
|
72
|
+
<file pinned="false" current-in-tab="true">
|
|
78
73
|
<entry file="file://$PROJECT_DIR$/lib/XSpear/version.rb">
|
|
79
74
|
<provider selected="true" editor-type-id="text-editor">
|
|
80
75
|
<state relative-caret-position="15">
|
|
@@ -104,6 +99,13 @@
|
|
|
104
99
|
</file>
|
|
105
100
|
</leaf>
|
|
106
101
|
</component>
|
|
102
|
+
<component name="FindInProjectRecents">
|
|
103
|
+
<findStrings>
|
|
104
|
+
<find>BLINDNOTDETECTED</find>
|
|
105
|
+
<find>@all</find>
|
|
106
|
+
<find>@reflected_params</find>
|
|
107
|
+
</findStrings>
|
|
108
|
+
</component>
|
|
107
109
|
<component name="Git.Settings">
|
|
108
110
|
<option name="RECENT_GIT_ROOT_PATH" value="$PROJECT_DIR$" />
|
|
109
111
|
</component>
|
|
@@ -116,12 +118,12 @@
|
|
|
116
118
|
<option value="$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb" />
|
|
117
119
|
<option value="$PROJECT_DIR$/README.md" />
|
|
118
120
|
<option value="$PROJECT_DIR$/exe/XSpear" />
|
|
119
|
-
<option value="$PROJECT_DIR$/lib/XSpear/version.rb" />
|
|
120
121
|
<option value="$PROJECT_DIR$/lib/XSpear.rb" />
|
|
122
|
+
<option value="$PROJECT_DIR$/lib/XSpear/version.rb" />
|
|
121
123
|
</list>
|
|
122
124
|
</option>
|
|
123
125
|
</component>
|
|
124
|
-
<component name="ProjectFrameBounds" fullScreen="true">
|
|
126
|
+
<component name="ProjectFrameBounds" extendedState="6" fullScreen="true">
|
|
125
127
|
<option name="x" value="-1920" />
|
|
126
128
|
<option name="y" value="-643" />
|
|
127
129
|
<option name="width" value="1920" />
|
|
@@ -235,14 +237,8 @@
|
|
|
235
237
|
<workItem from="1563893538891" duration="11917000" />
|
|
236
238
|
<workItem from="1564151699165" duration="2494000" />
|
|
237
239
|
<workItem from="1564413097342" duration="11274000" />
|
|
238
|
-
<workItem from="1574090247432" duration="
|
|
239
|
-
|
|
240
|
-
<task id="LOCAL-00014" summary="Add dependency gems descriptions">
|
|
241
|
-
<created>1563294142811</created>
|
|
242
|
-
<option name="number" value="00014" />
|
|
243
|
-
<option name="presentableId" value="LOCAL-00014" />
|
|
244
|
-
<option name="project" value="LOCAL" />
|
|
245
|
-
<updated>1563294142811</updated>
|
|
240
|
+
<workItem from="1574090247432" duration="1799000" />
|
|
241
|
+
<workItem from="1577115206395" duration="2893000" />
|
|
246
242
|
</task>
|
|
247
243
|
<task id="LOCAL-00015" summary="Add cli banner">
|
|
248
244
|
<created>1563462840440</created>
|
|
@@ -580,11 +576,18 @@
|
|
|
580
576
|
<option name="project" value="LOCAL" />
|
|
581
577
|
<updated>1565965941986</updated>
|
|
582
578
|
</task>
|
|
583
|
-
<
|
|
579
|
+
<task id="LOCAL-00063" summary="(1.1.6) Add Event handler pattern (whatthe=""onload)">
|
|
580
|
+
<created>1574091995789</created>
|
|
581
|
+
<option name="number" value="00063" />
|
|
582
|
+
<option name="presentableId" value="LOCAL-00063" />
|
|
583
|
+
<option name="project" value="LOCAL" />
|
|
584
|
+
<updated>1574091995789</updated>
|
|
585
|
+
</task>
|
|
586
|
+
<option name="localTasksCounter" value="64" />
|
|
584
587
|
<servers />
|
|
585
588
|
</component>
|
|
586
589
|
<component name="TimeTrackingManager">
|
|
587
|
-
<option name="totallyTimeSpent" value="
|
|
590
|
+
<option name="totallyTimeSpent" value="54936000" />
|
|
588
591
|
</component>
|
|
589
592
|
<component name="TodoView">
|
|
590
593
|
<todo-panel id="selected-file">
|
|
@@ -596,10 +599,10 @@
|
|
|
596
599
|
</todo-panel>
|
|
597
600
|
</component>
|
|
598
601
|
<component name="ToolWindowManager">
|
|
599
|
-
<frame x="-1920" y="-643" width="1920" height="1080" extended-state="
|
|
602
|
+
<frame x="-1920" y="-643" width="1920" height="1080" extended-state="6" />
|
|
600
603
|
<editor active="true" />
|
|
601
604
|
<layout>
|
|
602
|
-
<window_info active="true" content_ui="combo" id="Project" order="0" visible="true" weight="0.
|
|
605
|
+
<window_info active="true" content_ui="combo" id="Project" order="0" visible="true" weight="0.13045794" />
|
|
603
606
|
<window_info id="Structure" order="1" side_tool="true" weight="0.25" />
|
|
604
607
|
<window_info id="Favorites" order="2" side_tool="true" />
|
|
605
608
|
<window_info anchor="bottom" id="Message" order="0" />
|
|
@@ -612,7 +615,7 @@
|
|
|
612
615
|
<window_info anchor="bottom" id="Docker" order="7" show_stripe_button="false" />
|
|
613
616
|
<window_info anchor="bottom" id="Database Changes" order="8" />
|
|
614
617
|
<window_info anchor="bottom" id="Version Control" order="9" />
|
|
615
|
-
<window_info anchor="bottom" id="Terminal" order="10" visible="true" weight="0.
|
|
618
|
+
<window_info anchor="bottom" id="Terminal" order="10" visible="true" weight="0.32970297" />
|
|
616
619
|
<window_info anchor="bottom" id="Event Log" order="11" side_tool="true" />
|
|
617
620
|
<window_info anchor="bottom" id="Messages" order="12" weight="0.32953367" />
|
|
618
621
|
<window_info anchor="right" id="Commander" internal_type="SLIDING" order="0" type="SLIDING" weight="0.4" />
|
|
@@ -647,10 +650,10 @@
|
|
|
647
650
|
<MESSAGE value="(1.1.4) Released 1.1.4" />
|
|
648
651
|
<MESSAGE value="(1.1.5)(Fixed #21) not reflected params , no testing. but alway blind xss, other bug fix" />
|
|
649
652
|
<MESSAGE value="(1.1.5) Released 1.1.5" />
|
|
650
|
-
<MESSAGE value="(1.1.6) Add Event handler pattern (whatthe=""onload)" />
|
|
651
653
|
<MESSAGE value="(1.1.6) (Fixed #24) Edit Usage" />
|
|
652
654
|
<MESSAGE value="(1.1.6) released 1.1.6 (+ fixed #23)" />
|
|
653
|
-
<
|
|
655
|
+
<MESSAGE value="(1.1.6) Add Event handler pattern (whatthe=""onload)" />
|
|
656
|
+
<option name="LAST_COMMIT_MESSAGE" value="(1.1.6) Add Event handler pattern (whatthe=""onload)" />
|
|
654
657
|
</component>
|
|
655
658
|
<component name="editorHistoryManager">
|
|
656
659
|
<entry file="file://$USER_HOME$/.rvm/gems/ruby-2.4.6/gems/bundler-2.0.1/lib/bundler/rubygems_integration.rb">
|
|
@@ -660,9 +663,6 @@
|
|
|
660
663
|
</state>
|
|
661
664
|
</provider>
|
|
662
665
|
</entry>
|
|
663
|
-
<entry file="file://$PROJECT_DIR$/bin/console">
|
|
664
|
-
<provider selected="true" editor-type-id="text-editor" />
|
|
665
|
-
</entry>
|
|
666
666
|
<entry file="file://$PROJECT_DIR$/bin/setup">
|
|
667
667
|
<provider selected="true" editor-type-id="text-editor" />
|
|
668
668
|
</entry>
|
|
@@ -676,13 +676,6 @@
|
|
|
676
676
|
</state>
|
|
677
677
|
</provider>
|
|
678
678
|
</entry>
|
|
679
|
-
<entry file="file://$PROJECT_DIR$/exe/XSpear">
|
|
680
|
-
<provider selected="true" editor-type-id="text-editor">
|
|
681
|
-
<state relative-caret-position="1185">
|
|
682
|
-
<caret line="79" column="12" selection-start-line="79" selection-start-column="12" selection-end-line="79" selection-end-column="12" />
|
|
683
|
-
</state>
|
|
684
|
-
</provider>
|
|
685
|
-
</entry>
|
|
686
679
|
<entry file="file://$PROJECT_DIR$/README.md">
|
|
687
680
|
<provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
|
|
688
681
|
<state split_layout="SPLIT">
|
|
@@ -707,10 +700,10 @@
|
|
|
707
700
|
</state>
|
|
708
701
|
</provider>
|
|
709
702
|
</entry>
|
|
710
|
-
<entry file="file://$PROJECT_DIR$/
|
|
703
|
+
<entry file="file://$PROJECT_DIR$/XSpear.gemspec">
|
|
711
704
|
<provider selected="true" editor-type-id="text-editor">
|
|
712
|
-
<state relative-caret-position="
|
|
713
|
-
<caret line="
|
|
705
|
+
<state relative-caret-position="105">
|
|
706
|
+
<caret line="7" column="23" selection-start-line="7" selection-start-column="23" selection-end-line="7" selection-end-column="38" />
|
|
714
707
|
</state>
|
|
715
708
|
</provider>
|
|
716
709
|
</entry>
|
|
@@ -720,24 +713,34 @@
|
|
|
720
713
|
<entry file="file:///usr/local/bin/rake">
|
|
721
714
|
<provider selected="true" editor-type-id="text-editor" />
|
|
722
715
|
</entry>
|
|
723
|
-
<entry file="file://$PROJECT_DIR$/XSpear.
|
|
716
|
+
<entry file="file://$PROJECT_DIR$/lib/XSpear/log.rb">
|
|
724
717
|
<provider selected="true" editor-type-id="text-editor">
|
|
725
|
-
<state relative-caret-position="
|
|
726
|
-
<caret line="
|
|
718
|
+
<state relative-caret-position="225">
|
|
719
|
+
<caret line="15" column="28" selection-start-line="15" selection-start-column="28" selection-end-line="15" selection-end-column="28" />
|
|
727
720
|
</state>
|
|
728
721
|
</provider>
|
|
729
722
|
</entry>
|
|
730
|
-
<entry file="file://$PROJECT_DIR$/
|
|
723
|
+
<entry file="file://$PROJECT_DIR$/bin/console">
|
|
724
|
+
<provider selected="true" editor-type-id="text-editor" />
|
|
725
|
+
</entry>
|
|
726
|
+
<entry file="file://$PROJECT_DIR$/exe/XSpear">
|
|
731
727
|
<provider selected="true" editor-type-id="text-editor">
|
|
732
|
-
<state relative-caret-position="
|
|
733
|
-
<caret line="
|
|
728
|
+
<state relative-caret-position="-1138">
|
|
729
|
+
<caret line="28" column="34" selection-start-line="28" selection-start-column="34" selection-end-line="28" selection-end-column="34" />
|
|
734
730
|
</state>
|
|
735
731
|
</provider>
|
|
736
732
|
</entry>
|
|
737
733
|
<entry file="file://$PROJECT_DIR$/lib/XSpear.rb">
|
|
738
734
|
<provider selected="true" editor-type-id="text-editor">
|
|
739
|
-
<state relative-caret-position="
|
|
740
|
-
<caret line="
|
|
735
|
+
<state relative-caret-position="477">
|
|
736
|
+
<caret line="657" column="35" lean-forward="true" selection-start-line="657" selection-start-column="35" selection-end-line="657" selection-end-column="35" />
|
|
737
|
+
</state>
|
|
738
|
+
</provider>
|
|
739
|
+
</entry>
|
|
740
|
+
<entry file="file://$PROJECT_DIR$/lib/XSpear/version.rb">
|
|
741
|
+
<provider selected="true" editor-type-id="text-editor">
|
|
742
|
+
<state relative-caret-position="15">
|
|
743
|
+
<caret line="1" column="18" selection-start-line="1" selection-start-column="18" selection-end-line="1" selection-end-column="18" />
|
|
741
744
|
</state>
|
|
742
745
|
</provider>
|
|
743
746
|
</entry>
|
data/README.md
CHANGED
|
@@ -322,6 +322,12 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
|
|
|
322
322
|
|
|
323
323
|
Bug reports and pull requests are welcome on GitHub at https://github.com/hahwul/XSpear. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](http://contributor-covenant.org) code of conduct.
|
|
324
324
|
|
|
325
|
+
## Donate
|
|
326
|
+
|
|
327
|
+
I like coffee! I'm a coffee addict.<br>
|
|
328
|
+
<a href="https://www.paypal.me/hahwul"><img src="https://www.paypalobjects.com/digitalassets/c/website/logo/full-text/pp_fc_hl.svg" height="50px"></a>
|
|
329
|
+
<a href="https://www.buymeacoffee.com/hahwul"><img src="https://cdn.buymeacoffee.com/buttons/default-black.png" alt="Buy Me A Coffee" height="50px"></a>
|
|
330
|
+
|
|
325
331
|
## License
|
|
326
332
|
|
|
327
333
|
The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
|
data/exe/XSpear
CHANGED
|
@@ -25,6 +25,9 @@ class Parser
|
|
|
25
25
|
args.options['data'] = n
|
|
26
26
|
end
|
|
27
27
|
|
|
28
|
+
opts.on('-a','--test-all-params', '[optional] test to all params(include not reflected)') do
|
|
29
|
+
args.options['all'] = true
|
|
30
|
+
end
|
|
28
31
|
|
|
29
32
|
opts.on('--headers=HEADERS', '[optional] Add HTTP Headers') do |n|
|
|
30
33
|
args.options['headers'] = n
|
data/lib/XSpear.rb
CHANGED
|
@@ -22,6 +22,11 @@ class XspearScan
|
|
|
22
22
|
else
|
|
23
23
|
@params = options['params'].split(",")
|
|
24
24
|
end
|
|
25
|
+
if options['all'] == true
|
|
26
|
+
@all = true
|
|
27
|
+
else
|
|
28
|
+
@all = false
|
|
29
|
+
end
|
|
25
30
|
@thread = options['thread']
|
|
26
31
|
@output = options['output']
|
|
27
32
|
@verbose = options['verbose']
|
|
@@ -478,7 +483,13 @@ class XspearScan
|
|
|
478
483
|
end
|
|
479
484
|
end.each(&:join)
|
|
480
485
|
end
|
|
481
|
-
|
|
486
|
+
if @all == true
|
|
487
|
+
log('s',"used test-all-params mode(-a)")
|
|
488
|
+
log('s',"creating a test query all param")
|
|
489
|
+
else
|
|
490
|
+
log('s',"used test-reflected-params mode(default)")
|
|
491
|
+
log('s',"creating a test query [for reflected #{@reflected_params.length} param + blind XSS ]")
|
|
492
|
+
end
|
|
482
493
|
@param_check_switch = false
|
|
483
494
|
## [ XSS Scanning ]
|
|
484
495
|
r = []
|
|
@@ -622,29 +633,30 @@ class XspearScan
|
|
|
622
633
|
else
|
|
623
634
|
uri = URI.parse(@url)
|
|
624
635
|
begin
|
|
625
|
-
|
|
626
|
-
|
|
627
|
-
|
|
628
|
-
if
|
|
629
|
-
|
|
630
|
-
|
|
631
|
-
|
|
632
|
-
|
|
633
|
-
|
|
636
|
+
if @data.nil?
|
|
637
|
+
params = URI.decode_www_form(uri.query)
|
|
638
|
+
params.each do |p|
|
|
639
|
+
if (@param_check_switch) || (@reflected_params.include? p[0]) || pattern == "BLINDNOTDETECTED" || @all
|
|
640
|
+
if @params.nil? || (@params.include? p[0] if !@params.nil?)
|
|
641
|
+
attack = ""
|
|
642
|
+
dparams = params
|
|
643
|
+
dparams.each do |d|
|
|
644
|
+
attack = uri.query.sub "#{d[0]}=#{d[1]}","#{d[0]}=#{d[1]}#{URI::encode(payload)}" if p[0] == d[0]
|
|
645
|
+
#d[1] = p[1] + payload if p[0] == d[0]
|
|
646
|
+
end
|
|
647
|
+
result.push("inject": 'url',"param":p[0] ,"type": type, "query": attack, "pattern": pattern, "desc": desc, "category": category, "callback": callback)
|
|
634
648
|
end
|
|
635
|
-
result.push("inject": 'url',"param":p[0] ,"type": type, "query": attack, "pattern": pattern, "desc": desc, "category": category, "callback": callback)
|
|
636
649
|
end
|
|
637
650
|
end
|
|
638
|
-
|
|
639
|
-
unless @data.nil?
|
|
651
|
+
else
|
|
640
652
|
params = URI.decode_www_form(@data)
|
|
641
653
|
params.each do |p|
|
|
642
|
-
if
|
|
654
|
+
if (@param_check_switch) || (@reflected_params.include? p[0]) || pattern == "BLINDNOTDETECTED" || @all
|
|
643
655
|
if @params.nil? || (@params.include? p[0] if !@params.nil?)
|
|
644
656
|
attack = ""
|
|
645
657
|
dparams = params
|
|
646
658
|
dparams.each do |d|
|
|
647
|
-
attack =
|
|
659
|
+
attack = @data.sub "#{d[0]}=#{d[1]}","#{d[0]}=#{d[1]}#{URI::encode(payload)}" if p[0] == d[0]
|
|
648
660
|
#d[1] = p[1] + payload if p[0] == d[0]
|
|
649
661
|
end
|
|
650
662
|
result.push("inject": 'body', "param":p[0], "type": type, "query": attack, "pattern": pattern, "desc": desc, "category": category, "callback": callback)
|
|
@@ -652,8 +664,10 @@ class XspearScan
|
|
|
652
664
|
end
|
|
653
665
|
end
|
|
654
666
|
end
|
|
655
|
-
rescue StandardError
|
|
667
|
+
rescue => e #StandardError
|
|
656
668
|
# bypass
|
|
669
|
+
puts @data
|
|
670
|
+
puts e
|
|
657
671
|
end
|
|
658
672
|
result
|
|
659
673
|
end
|
data/lib/XSpear/version.rb
CHANGED
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: XSpear
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 1.2.
|
|
4
|
+
version: 1.2.1
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- hahwul
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: exe
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2019-
|
|
11
|
+
date: 2019-12-23 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: colorize
|