|
@@ -131,7 +131,7 @@ class xsser(EncoderDecoder, XSSerReporter):
|
|
|
self.forwarded_connection = 0
|
|
|
self.other_connection = 0
|
|
|
|
|
|
-
|
|
|
+
|
|
|
self.xsr_injection = 0
|
|
|
self.xsa_injection = 0
|
|
|
self.coo_injection = 0
|
|
@@ -153,7 +153,7 @@ class xsser(EncoderDecoder, XSSerReporter):
|
|
|
self.httpsr_found = 0
|
|
|
self.false_positives = 0
|
|
|
|
|
|
-
|
|
|
+
|
|
|
self.heuris_hashes = []
|
|
|
self.heuris_backslash_found = 0
|
|
|
self.heuris_une_backslash_found = 0
|
|
@@ -756,7 +756,10 @@ class xsser(EncoderDecoder, XSSerReporter):
|
|
|
if not url.endswith("/") and not options.getdata.startswith("/"):
|
|
|
url = url + "/"
|
|
|
target_url = url + options.getdata
|
|
|
- p_uri = urlparse(target_url)
|
|
|
+ if not options.dom:
|
|
|
+ p_uri = urlparse(target_url, allow_fragments=False)
|
|
|
+ else:
|
|
|
+ p_uri = urlparse(target_url, allow_fragments=True)
|
|
|
uri = p_uri.netloc
|
|
|
path = p_uri.path
|
|
|
if not uri.endswith('/') and not path.startswith('/'):
|
|
@@ -795,12 +798,14 @@ class xsser(EncoderDecoder, XSSerReporter):
|
|
|
target_url_params = urllib.parse.urlencode(target_params)
|
|
|
if not uri.endswith('/') and not path.startswith('/'):
|
|
|
uri = uri + "/"
|
|
|
- dest_url = p_uri.scheme + "://" + uri + path
|
|
|
+ if path.endswith('/'):
|
|
|
+ path = path.replace('/',"")
|
|
|
+ if not options.getdata:
|
|
|
+ dest_url = url
|
|
|
+ else:
|
|
|
+ dest_url = url + options.getdata
|
|
|
if not "XSS" in dest_url:
|
|
|
- if not dest_url.endswith("/"):
|
|
|
- dest_url = dest_url + "/" + hashed_vector_url
|
|
|
- else:
|
|
|
- dest_url = dest_url + hashed_vector_url
|
|
|
+ dest_url = dest_url + hashed_vector_url
|
|
|
else:
|
|
|
if 'XSS' in dest_url:
|
|
|
dest_url = dest_url.replace('XSS', hashed_vector_url)
|
|
@@ -1027,7 +1032,7 @@ class xsser(EncoderDecoder, XSSerReporter):
|
|
|
pass
|
|
|
else:
|
|
|
self.report("="*45)
|
|
|
- self.report("[+] Checking Response Options:", "\n")
|
|
|
+ self.report("\n[+] Checking Response Options:", "\n")
|
|
|
self.report("[+] Url:", self.options.alt)
|
|
|
self.report("[-] Method:", self.options.altm)
|
|
|
if self.options.ald:
|
|
@@ -1047,10 +1052,15 @@ class xsser(EncoderDecoder, XSSerReporter):
|
|
|
pass
|
|
|
else:
|
|
|
self.report("="*45)
|
|
|
- self.report("[+] Checking Response Results:", "\n")
|
|
|
- self.report("Searching using", self.options.altm, "for:", orig_hash, "on alternative url")
|
|
|
+ self.report("\n[+] Checking Response Results:", "\n")
|
|
|
+ url_orig_hash = self._ongoing_attacks['url']
|
|
|
+ self.report("Searching using", self.options.altm, "for:", url_orig_hash, "on alternative url\n")
|
|
|
if 'PAYLOAD' in payload['payload']:
|
|
|
- user_attack_payload = payload['payload'].replace('PAYLOAD', orig_hash)
|
|
|
+ user_attack_payload = payload['payload'].replace('PAYLOAD', url_orig_hash)
|
|
|
+ if 'XSS' in payload['payload']:
|
|
|
+ user_attack_payload = payload['payload'].replace('XSS', url_orig_hash)
|
|
|
+ if 'X1S' in payload['payload']:
|
|
|
+ user_attack_payload = payload['payload'].replace('X1S', url_orig_hash)
|
|
|
if self.options.ald:
|
|
|
query_string = self.options.ald
|
|
|
if "VECTOR" in self.options.alt:
|
|
@@ -1135,7 +1145,18 @@ class xsser(EncoderDecoder, XSSerReporter):
|
|
|
self.final_hashes[key] = value
|
|
|
current_hashes.append(key)
|
|
|
else:
|
|
|
- payload_string = payload["payload"].replace("PAYLOAD", key)
|
|
|
+ if "PAYLOAD" in payload["payload"]:
|
|
|
+ payload_string = payload["payload"].replace("PAYLOAD", key)
|
|
|
+ elif "VECTOR" in payload["payload"]:
|
|
|
+ payload_string = payload["payload"].replace("VECTOR", key)
|
|
|
+ elif "XSS" in payload["payload"]:
|
|
|
+ payload_string = payload["payload"].replace("XSS", key)
|
|
|
+ elif "X1S" in payload["payload"]:
|
|
|
+ payload_string = payload["payload"].replace("X1S", key)
|
|
|
+ if key not in current_hashes:
|
|
|
+ self.report(" [ " +key+" ] : [" , value + " ]")
|
|
|
+ self.final_hashes[key] = value
|
|
|
+ current_hashes.append(key)
|
|
|
hashed_payload = self.encoding_permutations(payload_string)
|
|
|
if self.options.Cem:
|
|
|
enc_perm = options.Cem.split(",")
|
|
@@ -1198,7 +1219,7 @@ class xsser(EncoderDecoder, XSSerReporter):
|
|
|
if options.postdata:
|
|
|
self.report("[*] Trying: \n\n" + orig_url.strip(), "(POST:", query_string + ")\n")
|
|
|
else:
|
|
|
- self.report("[*] Trying: \n\n" + dest_url.strip() + "\n")
|
|
|
+ self.report("[*] Trying: \n\n" + dest_url.strip()+"\n")
|
|
|
if not self.options.hash and not self.options.script:
|
|
|
if not "XSS" in dest_url or not "X1S" in dest_url and self.options.xsa or self.options.xsr or self.options.coo:
|
|
|
pass
|
|
@@ -1220,7 +1241,7 @@ class xsser(EncoderDecoder, XSSerReporter):
|
|
|
self.report("\n[+] Vulnerable(s): \n\n " + payload['browser'] + "\n")
|
|
|
if not self.options.verbose:
|
|
|
self.report("-"*45 + "\n")
|
|
|
-
|
|
|
+
|
|
|
if payload['browser']=="[hashed_precheck_system]" or payload['browser']=="[Heuristic test]":
|
|
|
self.check_positives = self.check_positives + 1
|
|
|
elif payload['browser']=="[Data Control Protocol Injection]":
|
|
@@ -1720,8 +1741,8 @@ class xsser(EncoderDecoder, XSSerReporter):
|
|
|
value = str(tok_parsed[param_parsed])
|
|
|
if "#http://localhost:19084/success/"+str(hashing) in value:
|
|
|
value = value.replace("#http://localhost:19084/success/"+str(hashing), "")
|
|
|
- if "<script>document.location=document.location.hash.substring(1)</script>" in value:
|
|
|
- value = value.replace("<script>document.location=document.location.hash.substring(1)", "<script src='http://localhost:19084/success/"+str(hashing)+"'>")
|
|
|
+ if "<SCrIpT>document.location=document.location.hash.substring(1)</ScRiPt>" in value:
|
|
|
+ value = value.replace("<SCrIpT>document.location=document.location.hash.substring(1)", "<SCrIpT src='http://localhost:19084/success/"+str(hashing)+"'>")
|
|
|
if "['" in value:
|
|
|
value = value.replace("['", "")
|
|
|
if "']" in value:
|