XSpear 1.2.0 → 1.2.1

Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: a5d85bdfb4ab3c29fc779ed105466a6f7bb98d3de5bef09a067c7c03ef052e87
4
- data.tar.gz: 747e93f8654e4792c5b442b90eb78b3e78c9cd6d42500a1a773cc723bd14a06d
3
+ metadata.gz: c73f10e8f6a68615bb8821fbe7b8e241b5e3726fba69ee0a62a9971b4ba6651f
4
+ data.tar.gz: 69a9af875d06b2aaed7febd65e34bf8d44c686c5a7ba15e6e95b1d6749c81b01
5
5
  SHA512:
6
- metadata.gz: 8fbfd32ff6952f7df9904c241d242eb6ceca7930fc77b9054700b6dd200223a183038e5825cbbef7c97603165f704d9f9c7f2d4024100d646c98a36ed68a35c2
7
- data.tar.gz: ef6a97579450145408cf5fcdefabc74e4893c9bebe56a28df0046c1b7083fb9578437e63a63c586d19aaa04ab6612aea05d982c30e952cce1c6e0487fdd4747d
6
+ metadata.gz: 85269fd789cf9a58bb5af23f46959b4c9525aebccdce316881ea12a979929a67b0e1f53bf617ff667431f425f519350f6a74d769582f8c9f54d246cdc96476fb
7
+ data.tar.gz: cd8f0d09942deb27aca0d052fa1219fd98caa038411bf27e0476ac145c7f407c526cbcf8b8a14049d26c1930adb4d9a8a16ea6a2cbbad1c678b819a4678df871
data/.idea/XSpear.iml CHANGED
@@ -8,11 +8,10 @@
8
8
  <orderEntry type="inheritedJdk" />
9
9
  <orderEntry type="sourceFolder" forTests="false" />
10
10
  <orderEntry type="library" scope="PROVIDED" name="bundler (v2.0.2, ruby-2.3.7-p456) [gem]" level="application" />
11
- <orderEntry type="library" scope="PROVIDED" name="childprocess (v1.0.1, ruby-2.3.7-p456) [gem]" level="application" />
11
+ <orderEntry type="library" scope="PROVIDED" name="childprocess (v3.0.0, ruby-2.3.7-p456) [gem]" level="application" />
12
12
  <orderEntry type="library" scope="PROVIDED" name="colorize (v0.8.1, ruby-2.3.7-p456) [gem]" level="application" />
13
- <orderEntry type="library" scope="PROVIDED" name="rake (v12.3.2, ruby-2.3.7-p456) [gem]" level="application" />
14
- <orderEntry type="library" scope="PROVIDED" name="rubyzip (v1.2.3, ruby-2.3.7-p456) [gem]" level="application" />
15
- <orderEntry type="library" scope="PROVIDED" name="selenium-webdriver (v3.142.3, ruby-2.3.7-p456) [gem]" level="application" />
13
+ <orderEntry type="library" scope="PROVIDED" name="rubyzip (v2.0.0, ruby-2.3.7-p456) [gem]" level="application" />
14
+ <orderEntry type="library" scope="PROVIDED" name="selenium-webdriver (v3.142.6, ruby-2.3.7-p456) [gem]" level="application" />
16
15
  <orderEntry type="library" scope="PROVIDED" name="terminal-table (v1.8.0, ruby-2.3.7-p456) [gem]" level="application" />
17
16
  <orderEntry type="library" scope="PROVIDED" name="unicode-display_width (v1.6.0, ruby-2.3.7-p456) [gem]" level="application" />
18
17
  </component>
data/.idea/workspace.xml CHANGED
@@ -2,7 +2,9 @@
2
2
  <project version="4">
3
3
  <component name="ChangeListManager">
4
4
  <list default="true" id="4ee2e581-45d7-4c90-b6a1-e92e4b5829dd" name="Default Changelist" comment="(1.1.6) Add Event handler pattern (whatthe=&quot;&quot;onload)">
5
+ <change beforePath="$PROJECT_DIR$/.idea/XSpear.iml" beforeDir="false" afterPath="$PROJECT_DIR$/.idea/XSpear.iml" afterDir="false" />
5
6
  <change beforePath="$PROJECT_DIR$/.idea/workspace.xml" beforeDir="false" afterPath="$PROJECT_DIR$/.idea/workspace.xml" afterDir="false" />
7
+ <change beforePath="$PROJECT_DIR$/exe/XSpear" beforeDir="false" afterPath="$PROJECT_DIR$/exe/XSpear" afterDir="false" />
6
8
  <change beforePath="$PROJECT_DIR$/lib/XSpear.rb" beforeDir="false" afterPath="$PROJECT_DIR$/lib/XSpear.rb" afterDir="false" />
7
9
  <change beforePath="$PROJECT_DIR$/lib/XSpear/version.rb" beforeDir="false" afterPath="$PROJECT_DIR$/lib/XSpear/version.rb" afterDir="false" />
8
10
  </list>
@@ -20,33 +22,26 @@
20
22
  <file pinned="false" current-in-tab="false">
21
23
  <entry file="file://$PROJECT_DIR$/exe/XSpear">
22
24
  <provider selected="true" editor-type-id="text-editor">
23
- <state relative-caret-position="1185">
24
- <caret line="79" column="12" selection-start-line="79" selection-start-column="12" selection-end-line="79" selection-end-column="12" />
25
+ <state relative-caret-position="-1138">
26
+ <caret line="28" column="34" selection-start-line="28" selection-start-column="34" selection-end-line="28" selection-end-column="34" />
25
27
  </state>
26
28
  </provider>
27
29
  </entry>
28
30
  </file>
29
31
  <file pinned="false" current-in-tab="false">
30
- <entry file="file://$PROJECT_DIR$/README.md">
31
- <provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
32
- <state split_layout="SPLIT">
33
- <first_editor relative-caret-position="180">
34
- <caret line="12" column="72" selection-start-line="12" selection-start-column="72" selection-end-line="12" selection-end-column="72" />
35
- </first_editor>
36
- <second_editor />
37
- </state>
38
- </provider>
39
- </entry>
40
- </file>
41
- <file pinned="false" current-in-tab="true">
42
32
  <entry file="file://$PROJECT_DIR$/lib/XSpear.rb">
43
33
  <provider selected="true" editor-type-id="text-editor">
44
- <state relative-caret-position="274">
45
- <caret line="247" column="2" selection-start-line="247" selection-start-column="2" selection-end-line="247" selection-end-column="2" />
34
+ <state relative-caret-position="477">
35
+ <caret line="657" column="35" lean-forward="true" selection-start-line="657" selection-start-column="35" selection-end-line="657" selection-end-column="35" />
46
36
  </state>
47
37
  </provider>
48
38
  </entry>
49
39
  </file>
40
+ <file pinned="false" current-in-tab="false">
41
+ <entry file="file://$PROJECT_DIR$/bin/console">
42
+ <provider selected="true" editor-type-id="text-editor" />
43
+ </entry>
44
+ </file>
50
45
  <file pinned="false" current-in-tab="false">
51
46
  <entry file="file://$USER_HOME$/.rvm/rubies/ruby-2.4.6/lib/ruby/site_ruby/2.4.0/rubygems/core_ext/kernel_require.rb">
52
47
  <provider selected="true" editor-type-id="text-editor">
@@ -74,7 +69,7 @@
74
69
  </provider>
75
70
  </entry>
76
71
  </file>
77
- <file pinned="false" current-in-tab="false">
72
+ <file pinned="false" current-in-tab="true">
78
73
  <entry file="file://$PROJECT_DIR$/lib/XSpear/version.rb">
79
74
  <provider selected="true" editor-type-id="text-editor">
80
75
  <state relative-caret-position="15">
@@ -104,6 +99,13 @@
104
99
  </file>
105
100
  </leaf>
106
101
  </component>
102
+ <component name="FindInProjectRecents">
103
+ <findStrings>
104
+ <find>BLINDNOTDETECTED</find>
105
+ <find>@all</find>
106
+ <find>@reflected_params</find>
107
+ </findStrings>
108
+ </component>
107
109
  <component name="Git.Settings">
108
110
  <option name="RECENT_GIT_ROOT_PATH" value="$PROJECT_DIR$" />
109
111
  </component>
@@ -116,12 +118,12 @@
116
118
  <option value="$PROJECT_DIR$/lib/XSpear/XSpearRepoter.rb" />
117
119
  <option value="$PROJECT_DIR$/README.md" />
118
120
  <option value="$PROJECT_DIR$/exe/XSpear" />
119
- <option value="$PROJECT_DIR$/lib/XSpear/version.rb" />
120
121
  <option value="$PROJECT_DIR$/lib/XSpear.rb" />
122
+ <option value="$PROJECT_DIR$/lib/XSpear/version.rb" />
121
123
  </list>
122
124
  </option>
123
125
  </component>
124
- <component name="ProjectFrameBounds" fullScreen="true">
126
+ <component name="ProjectFrameBounds" extendedState="6" fullScreen="true">
125
127
  <option name="x" value="-1920" />
126
128
  <option name="y" value="-643" />
127
129
  <option name="width" value="1920" />
@@ -235,14 +237,8 @@
235
237
  <workItem from="1563893538891" duration="11917000" />
236
238
  <workItem from="1564151699165" duration="2494000" />
237
239
  <workItem from="1564413097342" duration="11274000" />
238
- <workItem from="1574090247432" duration="1239000" />
239
- </task>
240
- <task id="LOCAL-00014" summary="Add dependency gems descriptions">
241
- <created>1563294142811</created>
242
- <option name="number" value="00014" />
243
- <option name="presentableId" value="LOCAL-00014" />
244
- <option name="project" value="LOCAL" />
245
- <updated>1563294142811</updated>
240
+ <workItem from="1574090247432" duration="1799000" />
241
+ <workItem from="1577115206395" duration="2893000" />
246
242
  </task>
247
243
  <task id="LOCAL-00015" summary="Add cli banner">
248
244
  <created>1563462840440</created>
@@ -580,11 +576,18 @@
580
576
  <option name="project" value="LOCAL" />
581
577
  <updated>1565965941986</updated>
582
578
  </task>
583
- <option name="localTasksCounter" value="63" />
579
+ <task id="LOCAL-00063" summary="(1.1.6) Add Event handler pattern (whatthe=&quot;&quot;onload)">
580
+ <created>1574091995789</created>
581
+ <option name="number" value="00063" />
582
+ <option name="presentableId" value="LOCAL-00063" />
583
+ <option name="project" value="LOCAL" />
584
+ <updated>1574091995789</updated>
585
+ </task>
586
+ <option name="localTasksCounter" value="64" />
584
587
  <servers />
585
588
  </component>
586
589
  <component name="TimeTrackingManager">
587
- <option name="totallyTimeSpent" value="51483000" />
590
+ <option name="totallyTimeSpent" value="54936000" />
588
591
  </component>
589
592
  <component name="TodoView">
590
593
  <todo-panel id="selected-file">
@@ -596,10 +599,10 @@
596
599
  </todo-panel>
597
600
  </component>
598
601
  <component name="ToolWindowManager">
599
- <frame x="-1920" y="-643" width="1920" height="1080" extended-state="0" />
602
+ <frame x="-1920" y="-643" width="1920" height="1080" extended-state="6" />
600
603
  <editor active="true" />
601
604
  <layout>
602
- <window_info active="true" content_ui="combo" id="Project" order="0" visible="true" weight="0.14802982" />
605
+ <window_info active="true" content_ui="combo" id="Project" order="0" visible="true" weight="0.13045794" />
603
606
  <window_info id="Structure" order="1" side_tool="true" weight="0.25" />
604
607
  <window_info id="Favorites" order="2" side_tool="true" />
605
608
  <window_info anchor="bottom" id="Message" order="0" />
@@ -612,7 +615,7 @@
612
615
  <window_info anchor="bottom" id="Docker" order="7" show_stripe_button="false" />
613
616
  <window_info anchor="bottom" id="Database Changes" order="8" />
614
617
  <window_info anchor="bottom" id="Version Control" order="9" />
615
- <window_info anchor="bottom" id="Terminal" order="10" visible="true" weight="0.34059405" />
618
+ <window_info anchor="bottom" id="Terminal" order="10" visible="true" weight="0.32970297" />
616
619
  <window_info anchor="bottom" id="Event Log" order="11" side_tool="true" />
617
620
  <window_info anchor="bottom" id="Messages" order="12" weight="0.32953367" />
618
621
  <window_info anchor="right" id="Commander" internal_type="SLIDING" order="0" type="SLIDING" weight="0.4" />
@@ -647,10 +650,10 @@
647
650
  <MESSAGE value="(1.1.4) Released 1.1.4" />
648
651
  <MESSAGE value="(1.1.5)(Fixed #21) not reflected params , no testing. but alway blind xss, other bug fix" />
649
652
  <MESSAGE value="(1.1.5) Released 1.1.5" />
650
- <MESSAGE value="(1.1.6) Add Event handler pattern (whatthe=&quot;&quot;onload)" />
651
653
  <MESSAGE value="(1.1.6) (Fixed #24) Edit Usage" />
652
654
  <MESSAGE value="(1.1.6) released 1.1.6 (+ fixed #23)" />
653
- <option name="LAST_COMMIT_MESSAGE" value="(1.1.6) released 1.1.6 (+ fixed #23)" />
655
+ <MESSAGE value="(1.1.6) Add Event handler pattern (whatthe=&quot;&quot;onload)" />
656
+ <option name="LAST_COMMIT_MESSAGE" value="(1.1.6) Add Event handler pattern (whatthe=&quot;&quot;onload)" />
654
657
  </component>
655
658
  <component name="editorHistoryManager">
656
659
  <entry file="file://$USER_HOME$/.rvm/gems/ruby-2.4.6/gems/bundler-2.0.1/lib/bundler/rubygems_integration.rb">
@@ -660,9 +663,6 @@
660
663
  </state>
661
664
  </provider>
662
665
  </entry>
663
- <entry file="file://$PROJECT_DIR$/bin/console">
664
- <provider selected="true" editor-type-id="text-editor" />
665
- </entry>
666
666
  <entry file="file://$PROJECT_DIR$/bin/setup">
667
667
  <provider selected="true" editor-type-id="text-editor" />
668
668
  </entry>
@@ -676,13 +676,6 @@
676
676
  </state>
677
677
  </provider>
678
678
  </entry>
679
- <entry file="file://$PROJECT_DIR$/exe/XSpear">
680
- <provider selected="true" editor-type-id="text-editor">
681
- <state relative-caret-position="1185">
682
- <caret line="79" column="12" selection-start-line="79" selection-start-column="12" selection-end-line="79" selection-end-column="12" />
683
- </state>
684
- </provider>
685
- </entry>
686
679
  <entry file="file://$PROJECT_DIR$/README.md">
687
680
  <provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
688
681
  <state split_layout="SPLIT">
@@ -707,10 +700,10 @@
707
700
  </state>
708
701
  </provider>
709
702
  </entry>
710
- <entry file="file://$PROJECT_DIR$/lib/XSpear/log.rb">
703
+ <entry file="file://$PROJECT_DIR$/XSpear.gemspec">
711
704
  <provider selected="true" editor-type-id="text-editor">
712
- <state relative-caret-position="225">
713
- <caret line="15" column="28" selection-start-line="15" selection-start-column="28" selection-end-line="15" selection-end-column="28" />
705
+ <state relative-caret-position="105">
706
+ <caret line="7" column="23" selection-start-line="7" selection-start-column="23" selection-end-line="7" selection-end-column="38" />
714
707
  </state>
715
708
  </provider>
716
709
  </entry>
@@ -720,24 +713,34 @@
720
713
  <entry file="file:///usr/local/bin/rake">
721
714
  <provider selected="true" editor-type-id="text-editor" />
722
715
  </entry>
723
- <entry file="file://$PROJECT_DIR$/XSpear.gemspec">
716
+ <entry file="file://$PROJECT_DIR$/lib/XSpear/log.rb">
724
717
  <provider selected="true" editor-type-id="text-editor">
725
- <state relative-caret-position="105">
726
- <caret line="7" column="23" selection-start-line="7" selection-start-column="23" selection-end-line="7" selection-end-column="38" />
718
+ <state relative-caret-position="225">
719
+ <caret line="15" column="28" selection-start-line="15" selection-start-column="28" selection-end-line="15" selection-end-column="28" />
727
720
  </state>
728
721
  </provider>
729
722
  </entry>
730
- <entry file="file://$PROJECT_DIR$/lib/XSpear/version.rb">
723
+ <entry file="file://$PROJECT_DIR$/bin/console">
724
+ <provider selected="true" editor-type-id="text-editor" />
725
+ </entry>
726
+ <entry file="file://$PROJECT_DIR$/exe/XSpear">
731
727
  <provider selected="true" editor-type-id="text-editor">
732
- <state relative-caret-position="15">
733
- <caret line="1" column="18" selection-start-line="1" selection-start-column="18" selection-end-line="1" selection-end-column="18" />
728
+ <state relative-caret-position="-1138">
729
+ <caret line="28" column="34" selection-start-line="28" selection-start-column="34" selection-end-line="28" selection-end-column="34" />
734
730
  </state>
735
731
  </provider>
736
732
  </entry>
737
733
  <entry file="file://$PROJECT_DIR$/lib/XSpear.rb">
738
734
  <provider selected="true" editor-type-id="text-editor">
739
- <state relative-caret-position="274">
740
- <caret line="247" column="2" selection-start-line="247" selection-start-column="2" selection-end-line="247" selection-end-column="2" />
735
+ <state relative-caret-position="477">
736
+ <caret line="657" column="35" lean-forward="true" selection-start-line="657" selection-start-column="35" selection-end-line="657" selection-end-column="35" />
737
+ </state>
738
+ </provider>
739
+ </entry>
740
+ <entry file="file://$PROJECT_DIR$/lib/XSpear/version.rb">
741
+ <provider selected="true" editor-type-id="text-editor">
742
+ <state relative-caret-position="15">
743
+ <caret line="1" column="18" selection-start-line="1" selection-start-column="18" selection-end-line="1" selection-end-column="18" />
741
744
  </state>
742
745
  </provider>
743
746
  </entry>
data/README.md CHANGED
@@ -322,6 +322,12 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
322
322
 
323
323
  Bug reports and pull requests are welcome on GitHub at https://github.com/hahwul/XSpear. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](http://contributor-covenant.org) code of conduct.
324
324
 
325
+ ## Donate
326
+
327
+ I like coffee! I'm a coffee addict.<br>
328
+ <a href="https://www.paypal.me/hahwul"><img src="https://www.paypalobjects.com/digitalassets/c/website/logo/full-text/pp_fc_hl.svg" height="50px"></a>
329
+ <a href="https://www.buymeacoffee.com/hahwul"><img src="https://cdn.buymeacoffee.com/buttons/default-black.png" alt="Buy Me A Coffee" height="50px"></a>
330
+
325
331
  ## License
326
332
 
327
333
  The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
data/exe/XSpear CHANGED
@@ -25,6 +25,9 @@ class Parser
25
25
  args.options['data'] = n
26
26
  end
27
27
 
28
+ opts.on('-a','--test-all-params', '[optional] test to all params(include not reflected)') do
29
+ args.options['all'] = true
30
+ end
28
31
 
29
32
  opts.on('--headers=HEADERS', '[optional] Add HTTP Headers') do |n|
30
33
  args.options['headers'] = n
data/lib/XSpear.rb CHANGED
@@ -22,6 +22,11 @@ class XspearScan
22
22
  else
23
23
  @params = options['params'].split(",")
24
24
  end
25
+ if options['all'] == true
26
+ @all = true
27
+ else
28
+ @all = false
29
+ end
25
30
  @thread = options['thread']
26
31
  @output = options['output']
27
32
  @verbose = options['verbose']
@@ -478,7 +483,13 @@ class XspearScan
478
483
  end
479
484
  end.each(&:join)
480
485
  end
481
- log('s',"creating a test query [for reflected #{@reflected_params.length} param + blind xss ]")
486
+ if @all == true
487
+ log('s',"used test-all-params mode(-a)")
488
+ log('s',"creating a test query all param")
489
+ else
490
+ log('s',"used test-reflected-params mode(default)")
491
+ log('s',"creating a test query [for reflected #{@reflected_params.length} param + blind XSS ]")
492
+ end
482
493
  @param_check_switch = false
483
494
  ## [ XSS Scanning ]
484
495
  r = []
@@ -622,29 +633,30 @@ class XspearScan
622
633
  else
623
634
  uri = URI.parse(@url)
624
635
  begin
625
- params = URI.decode_www_form(uri.query)
626
- params.each do |p|
627
- if (@param_check_switch) || (@reflected_params.include? p[0]) || pattern == "BLINDNOTDETECTED"
628
- if @params.nil? || (@params.include? p[0] if !@params.nil?)
629
- attack = ""
630
- dparams = params
631
- dparams.each do |d|
632
- attack = uri.query.sub "#{d[0]}=#{d[1]}","#{d[0]}=#{d[1]}#{URI::encode(payload)}" if p[0] == d[0]
633
- #d[1] = p[1] + payload if p[0] == d[0]
636
+ if @data.nil?
637
+ params = URI.decode_www_form(uri.query)
638
+ params.each do |p|
639
+ if (@param_check_switch) || (@reflected_params.include? p[0]) || pattern == "BLINDNOTDETECTED" || @all
640
+ if @params.nil? || (@params.include? p[0] if !@params.nil?)
641
+ attack = ""
642
+ dparams = params
643
+ dparams.each do |d|
644
+ attack = uri.query.sub "#{d[0]}=#{d[1]}","#{d[0]}=#{d[1]}#{URI::encode(payload)}" if p[0] == d[0]
645
+ #d[1] = p[1] + payload if p[0] == d[0]
646
+ end
647
+ result.push("inject": 'url',"param":p[0] ,"type": type, "query": attack, "pattern": pattern, "desc": desc, "category": category, "callback": callback)
634
648
  end
635
- result.push("inject": 'url',"param":p[0] ,"type": type, "query": attack, "pattern": pattern, "desc": desc, "category": category, "callback": callback)
636
649
  end
637
650
  end
638
- end
639
- unless @data.nil?
651
+ else
640
652
  params = URI.decode_www_form(@data)
641
653
  params.each do |p|
642
- if !@param_check_switch || (@reflected_params.include? p)
654
+ if (@param_check_switch) || (@reflected_params.include? p[0]) || pattern == "BLINDNOTDETECTED" || @all
643
655
  if @params.nil? || (@params.include? p[0] if !@params.nil?)
644
656
  attack = ""
645
657
  dparams = params
646
658
  dparams.each do |d|
647
- attack = uri.query.sub "#{d[0]}=#{d[1]}","#{d[0]}=#{d[1]}#{URI::encode(payload)}" if p[0] == d[0]
659
+ attack = @data.sub "#{d[0]}=#{d[1]}","#{d[0]}=#{d[1]}#{URI::encode(payload)}" if p[0] == d[0]
648
660
  #d[1] = p[1] + payload if p[0] == d[0]
649
661
  end
650
662
  result.push("inject": 'body', "param":p[0], "type": type, "query": attack, "pattern": pattern, "desc": desc, "category": category, "callback": callback)
@@ -652,8 +664,10 @@ class XspearScan
652
664
  end
653
665
  end
654
666
  end
655
- rescue StandardError
667
+ rescue => e #StandardError
656
668
  # bypass
669
+ puts @data
670
+ puts e
657
671
  end
658
672
  result
659
673
  end
@@ -1,3 +1,3 @@
1
1
  module XSpear
2
- VERSION = "1.2.0"
2
+ VERSION = "1.2.1"
3
3
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: XSpear
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.2.0
4
+ version: 1.2.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - hahwul
8
8
  autorequire:
9
9
  bindir: exe
10
10
  cert_chain: []
11
- date: 2019-11-18 00:00:00.000000000 Z
11
+ date: 2019-12-23 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: colorize