XSpear 1.3.2 → 1.3.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.idea/workspace.xml +53 -53
- data/README.md +27 -3
- data/XSpear-1.3.2.gem +0 -0
- data/lib/XSpear/version.rb +1 -1
- data/lib/XSpear.rb +3 -1
- metadata +3 -3
- data/XSpear-1.3.1.gem +0 -0
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: afb284c2c76350733a45156127bde1e8fd996a6aabf985b3eef8a1b43e8147a7
|
|
4
|
+
data.tar.gz: f4411c5bdfb84d3ad32a87f34e1ffcd98a7ead48761b07134fcc82f5ded53f5b
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: e031af8d10adfcdb511df45e0e9a34c19df1fdcbfc4bdcaf9179c584f25cf66df9d805204b85a8ef3c108495fa663c6e78dcc861549532d48556b867c9e5f65e
|
|
7
|
+
data.tar.gz: 9dcd8c46a718c459ab7d2b8ebc8a8e4e9181a51d7d0c1c4280219bd3502caa16ea48cbfeb6a3ca02a6fc21d226606801a704ba77824d89bcd07150c3833d3cd8
|
data/.idea/workspace.xml
CHANGED
|
@@ -3,7 +3,6 @@
|
|
|
3
3
|
<component name="ChangeListManager">
|
|
4
4
|
<list default="true" id="4ee2e581-45d7-4c90-b6a1-e92e4b5829dd" name="Default Changelist" comment="">
|
|
5
5
|
<change beforePath="$PROJECT_DIR$/.idea/workspace.xml" beforeDir="false" afterPath="$PROJECT_DIR$/.idea/workspace.xml" afterDir="false" />
|
|
6
|
-
<change beforePath="$PROJECT_DIR$/lib/XSpear.rb" beforeDir="false" afterPath="$PROJECT_DIR$/lib/XSpear.rb" afterDir="false" />
|
|
7
6
|
<change beforePath="$PROJECT_DIR$/lib/XSpear/version.rb" beforeDir="false" afterPath="$PROJECT_DIR$/lib/XSpear/version.rb" afterDir="false" />
|
|
8
7
|
</list>
|
|
9
8
|
<option name="EXCLUDED_CONVERTED_TO_IGNORED" value="true" />
|
|
@@ -30,8 +29,8 @@
|
|
|
30
29
|
<entry file="file://$PROJECT_DIR$/README.md">
|
|
31
30
|
<provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
|
|
32
31
|
<state split_layout="SPLIT">
|
|
33
|
-
<first_editor relative-caret-position="
|
|
34
|
-
<caret line="
|
|
32
|
+
<first_editor relative-caret-position="6840">
|
|
33
|
+
<caret line="456" column="38" selection-start-line="456" selection-start-column="38" selection-end-line="456" selection-end-column="38" />
|
|
35
34
|
</first_editor>
|
|
36
35
|
<second_editor />
|
|
37
36
|
</state>
|
|
@@ -47,11 +46,11 @@
|
|
|
47
46
|
</provider>
|
|
48
47
|
</entry>
|
|
49
48
|
</file>
|
|
50
|
-
<file pinned="false" current-in-tab="
|
|
49
|
+
<file pinned="false" current-in-tab="false">
|
|
51
50
|
<entry file="file://$PROJECT_DIR$/lib/XSpear.rb">
|
|
52
51
|
<provider selected="true" editor-type-id="text-editor">
|
|
53
|
-
<state relative-caret-position="
|
|
54
|
-
<caret line="
|
|
52
|
+
<state relative-caret-position="316">
|
|
53
|
+
<caret line="539" column="443" selection-start-line="539" selection-start-column="443" selection-end-line="539" selection-end-column="443" />
|
|
55
54
|
</state>
|
|
56
55
|
</provider>
|
|
57
56
|
</entry>
|
|
@@ -70,7 +69,7 @@
|
|
|
70
69
|
</provider>
|
|
71
70
|
</entry>
|
|
72
71
|
</file>
|
|
73
|
-
<file pinned="false" current-in-tab="
|
|
72
|
+
<file pinned="false" current-in-tab="true">
|
|
74
73
|
<entry file="file://$PROJECT_DIR$/lib/XSpear/version.rb">
|
|
75
74
|
<provider selected="true" editor-type-id="text-editor">
|
|
76
75
|
<state relative-caret-position="15">
|
|
@@ -163,7 +162,6 @@
|
|
|
163
162
|
<foldersAlwaysOnTop value="true" />
|
|
164
163
|
</navigator>
|
|
165
164
|
<panes>
|
|
166
|
-
<pane id="Scope" />
|
|
167
165
|
<pane id="ProjectPane">
|
|
168
166
|
<subPane>
|
|
169
167
|
<expand>
|
|
@@ -201,6 +199,7 @@
|
|
|
201
199
|
<select />
|
|
202
200
|
</subPane>
|
|
203
201
|
</pane>
|
|
202
|
+
<pane id="Scope" />
|
|
204
203
|
</panes>
|
|
205
204
|
</component>
|
|
206
205
|
<component name="PropertiesComponent">
|
|
@@ -266,35 +265,8 @@
|
|
|
266
265
|
<workItem from="1574090247432" duration="1799000" />
|
|
267
266
|
<workItem from="1577115206395" duration="21990000" />
|
|
268
267
|
<workItem from="1580314696983" duration="286000" />
|
|
269
|
-
<workItem from="1580583824837" duration="
|
|
270
|
-
|
|
271
|
-
<task id="LOCAL-00026" summary="verbose가 1일 떄 배너 출력되지 않도록 수정">
|
|
272
|
-
<created>1563649920055</created>
|
|
273
|
-
<option name="number" value="00026" />
|
|
274
|
-
<option name="presentableId" value="LOCAL-00026" />
|
|
275
|
-
<option name="project" value="LOCAL" />
|
|
276
|
-
<updated>1563649920055</updated>
|
|
277
|
-
</task>
|
|
278
|
-
<task id="LOCAL-00027" summary="verbose가 1일 떄 배너 출력되지 않도록 수정">
|
|
279
|
-
<created>1563649975625</created>
|
|
280
|
-
<option name="number" value="00027" />
|
|
281
|
-
<option name="presentableId" value="LOCAL-00027" />
|
|
282
|
-
<option name="project" value="LOCAL" />
|
|
283
|
-
<updated>1563649975625</updated>
|
|
284
|
-
</task>
|
|
285
|
-
<task id="LOCAL-00028" summary="(1.0.5) Add blind XSS options & edit "filtered Rule testing code"">
|
|
286
|
-
<created>1563813695850</created>
|
|
287
|
-
<option name="number" value="00028" />
|
|
288
|
-
<option name="presentableId" value="LOCAL-00028" />
|
|
289
|
-
<option name="project" value="LOCAL" />
|
|
290
|
-
<updated>1563813695850</updated>
|
|
291
|
-
</task>
|
|
292
|
-
<task id="LOCAL-00029" summary="(1.0.5) Update README.md">
|
|
293
|
-
<created>1563814201784</created>
|
|
294
|
-
<option name="number" value="00029" />
|
|
295
|
-
<option name="presentableId" value="LOCAL-00029" />
|
|
296
|
-
<option name="project" value="LOCAL" />
|
|
297
|
-
<updated>1563814201784</updated>
|
|
268
|
+
<workItem from="1580583824837" duration="1470000" />
|
|
269
|
+
<workItem from="1581089876742" duration="268000" />
|
|
298
270
|
</task>
|
|
299
271
|
<task id="LOCAL-00030" summary="(1.0.6)[fixed #6] Edit Static Analysis code">
|
|
300
272
|
<created>1563893769120</created>
|
|
@@ -611,11 +583,39 @@
|
|
|
611
583
|
<option name="project" value="LOCAL" />
|
|
612
584
|
<updated>1577632578176</updated>
|
|
613
585
|
</task>
|
|
614
|
-
<
|
|
586
|
+
<task id="LOCAL-00075" summary="(Fixed #45 , #47) ruby 2.7.0 troubleshooting(URI)">
|
|
587
|
+
<created>1580585220585</created>
|
|
588
|
+
<option name="number" value="00075" />
|
|
589
|
+
<option name="presentableId" value="LOCAL-00075" />
|
|
590
|
+
<option name="project" value="LOCAL" />
|
|
591
|
+
<updated>1580585220586</updated>
|
|
592
|
+
</task>
|
|
593
|
+
<task id="LOCAL-00076" summary="Released 1.3.2">
|
|
594
|
+
<created>1580585376006</created>
|
|
595
|
+
<option name="number" value="00076" />
|
|
596
|
+
<option name="presentableId" value="LOCAL-00076" />
|
|
597
|
+
<option name="project" value="LOCAL" />
|
|
598
|
+
<updated>1580585376006</updated>
|
|
599
|
+
</task>
|
|
600
|
+
<task id="LOCAL-00077" summary="(Fixed #49) Add onpointerrawupdate event handler for xss">
|
|
601
|
+
<created>1581089940822</created>
|
|
602
|
+
<option name="number" value="00077" />
|
|
603
|
+
<option name="presentableId" value="LOCAL-00077" />
|
|
604
|
+
<option name="project" value="LOCAL" />
|
|
605
|
+
<updated>1581089940823</updated>
|
|
606
|
+
</task>
|
|
607
|
+
<task id="LOCAL-00078" summary="(Fixed #50) Add SVG Animate XSS Payload">
|
|
608
|
+
<created>1581090128596</created>
|
|
609
|
+
<option name="number" value="00078" />
|
|
610
|
+
<option name="presentableId" value="LOCAL-00078" />
|
|
611
|
+
<option name="project" value="LOCAL" />
|
|
612
|
+
<updated>1581090128596</updated>
|
|
613
|
+
</task>
|
|
614
|
+
<option name="localTasksCounter" value="79" />
|
|
615
615
|
<servers />
|
|
616
616
|
</component>
|
|
617
617
|
<component name="TimeTrackingManager">
|
|
618
|
-
<option name="totallyTimeSpent" value="
|
|
618
|
+
<option name="totallyTimeSpent" value="76057000" />
|
|
619
619
|
</component>
|
|
620
620
|
<component name="TodoView">
|
|
621
621
|
<todo-panel id="selected-file">
|
|
@@ -630,7 +630,7 @@
|
|
|
630
630
|
<frame x="-1920" y="-620" width="1920" height="1057" extended-state="0" />
|
|
631
631
|
<editor active="true" />
|
|
632
632
|
<layout>
|
|
633
|
-
<window_info active="true" content_ui="combo" id="Project" order="0" visible="true" weight="0.
|
|
633
|
+
<window_info active="true" content_ui="combo" id="Project" order="0" visible="true" weight="0.1368477" />
|
|
634
634
|
<window_info id="Structure" order="1" side_tool="true" weight="0.25" />
|
|
635
635
|
<window_info id="Favorites" order="2" side_tool="true" />
|
|
636
636
|
<window_info anchor="bottom" id="Message" order="0" />
|
|
@@ -656,10 +656,6 @@
|
|
|
656
656
|
<option name="version" value="1" />
|
|
657
657
|
</component>
|
|
658
658
|
<component name="VcsManagerConfiguration">
|
|
659
|
-
<MESSAGE value="(1.1.0) [Fixed #14] Edit raw query print code" />
|
|
660
|
-
<MESSAGE value="(1.1.0) [Fixed #15] makeQueryPattern 내 페이로드 생성 코드 수정" />
|
|
661
|
-
<MESSAGE value="(1.1.0) Releases 1.1.0 / Fixed bug, modify report format, etc.." />
|
|
662
|
-
<MESSAGE value="(1.1.1) Add WAF Found module frame..(TO_DO)" />
|
|
663
659
|
<MESSAGE value="(1.1.1) Add code level function & Check WAF code frame" />
|
|
664
660
|
<MESSAGE value="(1.1.2) Releases & Fixed #17 (Add some event handlers..)" />
|
|
665
661
|
<MESSAGE value="(1.1.3) Releases & Fixed #18 (Add onload* event handler)" />
|
|
@@ -681,7 +677,11 @@
|
|
|
681
677
|
<MESSAGE value="(1.3) Released 1.3.0 +_+" />
|
|
682
678
|
<MESSAGE value="(1.3) Fixed dependency bug" />
|
|
683
679
|
<MESSAGE value="XSpear on Burpsuite" />
|
|
684
|
-
<
|
|
680
|
+
<MESSAGE value="(Fixed #45 , #47) ruby 2.7.0 troubleshooting(URI)" />
|
|
681
|
+
<MESSAGE value="Released 1.3.2" />
|
|
682
|
+
<MESSAGE value="(Fixed #49) Add onpointerrawupdate event handler for xss" />
|
|
683
|
+
<MESSAGE value="(Fixed #50) Add SVG Animate XSS Payload" />
|
|
684
|
+
<option name="LAST_COMMIT_MESSAGE" value="(Fixed #50) Add SVG Animate XSS Payload" />
|
|
685
685
|
</component>
|
|
686
686
|
<component name="editorHistoryManager">
|
|
687
687
|
<entry file="file://$USER_HOME$/.rvm/gems/ruby-2.4.6/gems/bundler-2.0.1/lib/bundler/rubygems_integration.rb">
|
|
@@ -751,8 +751,8 @@
|
|
|
751
751
|
<entry file="file://$PROJECT_DIR$/README.md">
|
|
752
752
|
<provider selected="true" editor-type-id="split-provider[text-editor;markdown-preview-editor]">
|
|
753
753
|
<state split_layout="SPLIT">
|
|
754
|
-
<first_editor relative-caret-position="
|
|
755
|
-
<caret line="
|
|
754
|
+
<first_editor relative-caret-position="6840">
|
|
755
|
+
<caret line="456" column="38" selection-start-line="456" selection-start-column="38" selection-end-line="456" selection-end-column="38" />
|
|
756
756
|
</first_editor>
|
|
757
757
|
<second_editor />
|
|
758
758
|
</state>
|
|
@@ -799,17 +799,17 @@
|
|
|
799
799
|
</state>
|
|
800
800
|
</provider>
|
|
801
801
|
</entry>
|
|
802
|
-
<entry file="file://$PROJECT_DIR$/lib/XSpear
|
|
802
|
+
<entry file="file://$PROJECT_DIR$/lib/XSpear.rb">
|
|
803
803
|
<provider selected="true" editor-type-id="text-editor">
|
|
804
|
-
<state relative-caret-position="
|
|
805
|
-
<caret line="
|
|
804
|
+
<state relative-caret-position="316">
|
|
805
|
+
<caret line="539" column="443" selection-start-line="539" selection-start-column="443" selection-end-line="539" selection-end-column="443" />
|
|
806
806
|
</state>
|
|
807
807
|
</provider>
|
|
808
808
|
</entry>
|
|
809
|
-
<entry file="file://$PROJECT_DIR$/lib/XSpear.rb">
|
|
809
|
+
<entry file="file://$PROJECT_DIR$/lib/XSpear/version.rb">
|
|
810
810
|
<provider selected="true" editor-type-id="text-editor">
|
|
811
|
-
<state relative-caret-position="
|
|
812
|
-
<caret line="
|
|
811
|
+
<state relative-caret-position="15">
|
|
812
|
+
<caret line="1" column="18" selection-start-line="1" selection-start-column="18" selection-end-line="1" selection-end-column="18" />
|
|
813
813
|
</state>
|
|
814
814
|
</provider>
|
|
815
815
|
</entry>
|
data/README.md
CHANGED
|
@@ -3,7 +3,28 @@
|
|
|
3
3
|
# XSpear
|
|
4
4
|
XSpear is XSS Scanner on ruby gems
|
|
5
5
|
|
|
6
|
-
<img src="https://img.shields.io/
|
|
6
|
+
<img src="https://img.shields.io/github/languages/top/hahwul/xspear?color=red"> <img src="https://img.shields.io/gem/v/XSpear.svg"> <img src="https://img.shields.io/gem/dt/XSpear.svg"> <img src="https://img.shields.io/librariesio/sourcerank/rubygems/Xspear"> <img src="https://img.shields.io/github/license/hahwul/XSpear.svg"> <a href="https://twitter.com/intent/follow?screen_name=hahwul"><img src="https://img.shields.io/twitter/follow/hahwul?style=flat-square"></a>
|
|
7
|
+
|
|
8
|
+
## TOC
|
|
9
|
+
- [XSpear](#xspear)
|
|
10
|
+
* [Key features](#key-features)
|
|
11
|
+
* [Installation](#installation)
|
|
12
|
+
+ [Dependency gems](#dependency-gems)
|
|
13
|
+
* [Usage on cli](#usage-on-cli)
|
|
14
|
+
+ [Result types](#result-types)
|
|
15
|
+
+ [Verbose Mode](#verbose-mode)
|
|
16
|
+
+ [Case by Case](#case-by-case)
|
|
17
|
+
+ [Sample log](#sample-log)
|
|
18
|
+
* [Usage on ruby code](#usage-on-ruby-code)
|
|
19
|
+
* [Add Scanning Module](#add-scanning-module)
|
|
20
|
+
* [Update](#update)
|
|
21
|
+
* [Development](#development)
|
|
22
|
+
* [Contributing](#contributing)
|
|
23
|
+
* [Donate](#donate)
|
|
24
|
+
* [License](#license)
|
|
25
|
+
* [Code of Conduct](#code-of-conduct)
|
|
26
|
+
* [ScreenShot](#screenshot)
|
|
27
|
+
* [Video](#video)
|
|
7
28
|
|
|
8
29
|
## Key features
|
|
9
30
|
- Pattern matching based XSS scanning
|
|
@@ -53,7 +74,7 @@ And then execute:
|
|
|
53
74
|
$ bundle
|
|
54
75
|
|
|
55
76
|
### Dependency gems
|
|
56
|
-
`colorize` `selenium-webdriver` `terminal-table`<br>
|
|
77
|
+
`colorize` `selenium-webdriver` `terminal-table` `progress_bar`<br>
|
|
57
78
|
If you configured it to install automatically in the Gem library, but it behaves abnormally, install it with the following command.
|
|
58
79
|
|
|
59
80
|
```
|
|
@@ -394,7 +415,7 @@ $ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123&zfdfasdf=124fff
|
|
|
394
415
|
{"starttime":"2019-08-14 23:58:12 +0900","endtime":"2019-08-14 23:58:44 +0900","issue_count":24,"issue_list":[{"id":0,"type":"INFO","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Found Server: nginx/1.4.1"},{"id":1,"type":"INFO","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Not set HSTS"},{"id":2,"type":"INFO","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Content-Type: text/html"},{"id":3,"type":"LOW","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Not Set X-Frame-Options"},{"id":4,"type":"MIDUM","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Not Set CSP"},{"id":5,"type":"INFO","issue":"DYNAMIC ANALYSIS","method":"GET","param":"cat","payload":"XsPeaR\"","description":"Found SQL Error Pattern"},{"id":6,"type":"INFO","issue":"REFLECTED","method":"GET","param":"cat","payload":"rEfe6","description":"reflected parameter"},{"id":7,"type":"INFO","issue":"FILERD RULE","method":"GET","param":"cat","payload":"onhwul=64","description":"not filtered event handler on{any} pattern"},{"id":8,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<script>alert(45)</script>","description":"reflected XSS Code"},{"id":9,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<textarea autofocus onfocus=alert(45)>","description":"reflected onfocus XSS Code"},{"id":10,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<video/poster/onerror=alert(45)>","description":"reflected HTML5 XSS Code"},{"id":11,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<audio src onloadstart=alert(45)>","description":"reflected HTML5 XSS Code"},{"id":12,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<details/open/ontoggle=\"alert`45`\">","description":"reflected HTML5 XSS Code"},{"id":13,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<select autofocus onfocus=alert(45)>","description":"reflected onfocus XSS Code"},{"id":14,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<marquee onstart=alert(45)>","description":"reflected HTML5 XSS Code"},{"id":15,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<input autofocus onfocus=alert(45)>","description":"reflected onfocus XSS Code"},{"id":16,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"\"><iframe/src=JavaScriPt:alert(45)>","description":"reflected XSS Code"},{"id":17,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<meter onmouseover=alert(45)>0</meter>","description":"reflected HTML5 XSS Code"},{"id":18,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<keygen autofocus onfocus=alert(45)>","description":"reflected onfocus XSS Code"},{"id":19,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<audio src onloadstart=alert(45)>","description":"triggered <audio src onloadstart=alert(45)>"},{"id":20,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<marquee onstart=alert(45)>","description":"triggered <marquee onstart=alert(45)>"},{"id":21,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<details/open/ontoggle=\"alert(45)\">","description":"triggered <details/open/ontoggle=\"alert(45)\">"},{"id":22,"type":"VULN","issue":"XSS","method":"GET","param":"cat","payload":"<script>alert(45)</script>","description":"triggered <script>alert(45)</script>"},{"id":23,"type":"VULN","issue":"XSS","method":"GET","param":"cat","payload":"'\"><svg/onload=alert(45)>","description":"triggered <svg/onload=alert(45)>"}]}
|
|
395
416
|
```
|
|
396
417
|
|
|
397
|
-
## Usage on ruby code
|
|
418
|
+
## Usage on ruby code
|
|
398
419
|
```ruby
|
|
399
420
|
require 'XSPear'
|
|
400
421
|
|
|
@@ -479,6 +500,9 @@ if develpers (hard)
|
|
|
479
500
|
$ git reset --hard HEAD; git pull -v
|
|
480
501
|
```
|
|
481
502
|
|
|
503
|
+
## RubyDoc
|
|
504
|
+
https://www.rubydoc.info/gems/XSpear/
|
|
505
|
+
|
|
482
506
|
## Development
|
|
483
507
|
|
|
484
508
|
After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
|
data/XSpear-1.3.2.gem
ADDED
|
Binary file
|
data/lib/XSpear/version.rb
CHANGED
data/lib/XSpear.rb
CHANGED
|
@@ -392,7 +392,8 @@ class XspearScan
|
|
|
392
392
|
'onvolumechange',
|
|
393
393
|
'onwaiting',
|
|
394
394
|
'onwheel',
|
|
395
|
-
'whatthe=""onload'
|
|
395
|
+
'whatthe=""onload',
|
|
396
|
+
'onpointerrawupdate'
|
|
396
397
|
]
|
|
397
398
|
tags = [
|
|
398
399
|
"script",
|
|
@@ -536,6 +537,7 @@ class XspearScan
|
|
|
536
537
|
r.push makeQueryPattern('x', '"\'><audio src onloadstart=alert(45)>', '<audio src onloadstart=alert(45)>', 'h', "reflected "+"HTML5 XSS Code".red, CallbackStringMatch)
|
|
537
538
|
r.push makeQueryPattern('x', '"\'><marquee onstart=alert(45)>', '<marquee onstart=alert(45)>', 'h', "reflected "+"HTML5 XSS Code".red, CallbackStringMatch)
|
|
538
539
|
r.push makeQueryPattern('x', '"\'><meter onmouseover=alert(45)>0</meter>', '<meter onmouseover=alert(45)>0</meter>', 'h', "reflected "+"HTML5 XSS Code".red, CallbackStringMatch)
|
|
540
|
+
r.push makeQueryPattern('x', '"\'><svg><animate xlink:href=#xss attributeName=href dur=5s repeatCount=indefinite keytimes=0;0;1 values="https://portswigger.net?;javascript:alert(1);0" /><a id=xss><text x=20 y=20>XSS</text></a>', '<svg><animate xlink:href=#xss attributeName=href dur=5s repeatCount=indefinite keytimes=0;0;1 values="https://portswigger.net?;javascript:alert(1);0" />', 'h', "reflected "+"SVG Animate XSS".red, CallbackStringMatch)
|
|
539
541
|
|
|
540
542
|
|
|
541
543
|
onfocus_tags.each do |t|
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: XSpear
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 1.3.
|
|
4
|
+
version: 1.3.3
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- hahwul
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: exe
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2020-02-
|
|
11
|
+
date: 2020-02-07 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: colorize
|
|
@@ -186,7 +186,7 @@ files:
|
|
|
186
186
|
- LICENSE.txt
|
|
187
187
|
- README.md
|
|
188
188
|
- Rakefile
|
|
189
|
-
- XSpear-1.3.
|
|
189
|
+
- XSpear-1.3.2.gem
|
|
190
190
|
- XSpear.gemspec
|
|
191
191
|
- bin/console
|
|
192
192
|
- bin/setup
|
data/XSpear-1.3.1.gem
DELETED
|
Binary file
|