added socket SO_REUSEADDR + updated GeoIP

core/crawler.py

@@ -21,7 +21,6 @@ Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 """
 import sys
 import urllib.request, urllib.parse, urllib.error
-import pycurl
 import time
 import traceback
 from . import curlcontrol
@@ -30,7 +29,11 @@ from queue import Queue
 from collections import defaultdict
 from bs4 import BeautifulSoup
 from bs4.dammit import EncodingDetector
-
+try:
+    import pycurl
+except:
+    print("\n[Error] Cannot import lib: pycurl. \n\n To install it try:\n\n $ 'sudo apt-get install python3-pycurl' or 'pip3 install pycurl'\n")
+    sys.exit()
 class EmergencyLanding(Exception):
     pass
 

core/curlcontrol.py

@@ -19,9 +19,13 @@ You should have received a copy of the GNU General Public License along
 with xsser; if not, write to the Free Software Foundation, Inc., 51
 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 """
-import os, urllib.request, urllib.parse, urllib.error, email, pycurl, re, time, random
+import os, urllib.request, urllib.parse, urllib.error, email, re, time, random, sys
 from io import StringIO as StringIO
-
+try:
+    import pycurl
+except:
+    print("\n[Error] Cannot import lib: pycurl. \n\n To install it try:\n\n $ 'sudo apt-get install python3-pycurl' or 'pip3 install pycurl'\n")
+    sys.exit()
 class Curl:
     """
     Class to control curl on behalf of the application.

core/globalmap.py

@@ -19,7 +19,7 @@ You should have received a copy of the GNU General Public License along
 with xsser; if not, write to the Free Software Foundation, Inc., 51
 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 """
-import os
+import os, sys
 from pathlib import Path
 import gi
 gi.require_version('Gtk', '3.0')
@@ -44,8 +44,11 @@ import gzip
 import time
 from PIL import Image
 import array
-import GeoIP
-
+try:
+    import pygeoip
+except:
+    print("\n[Error] Cannot import lib: pygeoip. \n\n To install it try:\n\n $ 'sudo apt-get install python3-geoip' or 'pip3 install pygeoip'\n")
+    sys.exit()
 class PointType(object):
     checked = 15
     success = 10
@@ -160,7 +163,7 @@ class GlobalMap(gtk.DrawingArea, XSSerReporter):
             delattr(self, '_t')
         parent = self._parent
         geo_db_path = self.get_geodb_path()
-        Geo = GeoIP.open(geo_db_path, GeoIP.GEOIP_STANDARD)
+        Geo = pygeoip.GeoIP(geo_db_path)
         self.geo = Geo
         self.set_has_tooltip(True)
         self._max_points = 200

core/main.py

@@ -20,11 +20,13 @@ with xsser; if not, write to the Free Software Foundation, Inc., 51
 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 """
 import os, re, sys, datetime, hashlib, time, cgi, traceback, webbrowser, random
+
 try:
     import urllib.request, urllib.error, urllib.parse
 except:
     print ("\n[Info] XSSer no longer supports Python2: (https://www.python.org/doc/sunset-python-2/). Try to run the tool with Python3.x.y... (ex: python3 xsser)\n")
     sys.exit()
+
 from random import randint
 from base64 import b64encode, b64decode
 import core.fuzzing
@@ -49,7 +51,7 @@ from core.reporter import XSSerReporter
 from core.threadpool import ThreadPool, NoResultsPending
 from core.update import Updater
 
-# set to emit debug messages about errors (0 = off).
+# set to emit debug messages about errors (False = off).
 DEBUG = False
 
 class xsser(EncoderDecoder, XSSerReporter):
@@ -1642,7 +1644,10 @@ class xsser(EncoderDecoder, XSSerReporter):
     def send_token_exploit(self, orig_url, tok_url, hashing, vector_found):
         try:
             if self.cookie_set_flag == False:
-                self.generate_headless_cookies(orig_url)
+                if not self.options.postdata: # GET
+                    self.generate_headless_cookies(tok_url) # send 'tok_url'
+                else: # POST
+                    self.generate_headless_cookies(orig_url) # send 'orig_url'
                 self.cookie_set_flag = True # cookie has been set!
             if self.options.postdata: # GET + web forms scrapping + POST
                 self.driver.get(orig_url) # GET request to store forms
@@ -2922,13 +2927,16 @@ class xsser(EncoderDecoder, XSSerReporter):
                                         self.report("[Info] XSS [HTTP GET] VECTOR [100% VULNERABLE] FOUND!:\n\n|-> "+"".join(self.successful_urls), "\n")
                                     self.token_arrived_hashes.append(self.token_arrived_hash) # add token arrived hashes for counting
                                 else:
-                                    self.report("[Error] Remote XSS exploit [--reverse-check]  has FAILED! -> [PASSING!]\n")
+                                    self.report("[Error] Remote XSS exploit [--reverse-check] has FAILED! -> [PASSING!]\n")
                 self.report("-"*25+"\n")
         if self.options.reversecheck or self.options.dom:
             try:
                 self.driver.close() # end headless embed web browser driver!
             except:
-                pass
+                try:
+                    self.driver.quit() # try quit()
+                except:
+                    pass
         for reporter in self._reporters:
             reporter.end_attack() # end reports
         if self.mothership:
@@ -3064,13 +3072,11 @@ class xsser(EncoderDecoder, XSSerReporter):
     def final_attack_callback(self, attack_hash):
         if attack_hash in self.final_attacks:
             dest_url = self.final_attacks[attack_hash]['url']
-            self.report('[*] Browser check:', dest_url)
             for reporter in self._reporters:
                 reporter.add_checked(dest_url)
             if self._reporter:
                 from twisted.internet import reactor
                 reactor.callFromThread(self._reporter.post, 'SUCCESS ' + dest_url)
-            self.final_attacks.pop(attack_hash)
 
     def apply_postprocessing(self, dest_url, description, method, hashing, query_string, payload, orig_url):
         real_attack_url = self.generate_real_attack_url(dest_url, description, method, hashing, query_string, payload, orig_url)

core/tokenhub.py

@@ -49,7 +49,7 @@ class HubThread(Thread):
         self._clients = []
         self._armed = True
         self.ready = False
-        self.running =False
+        self.running = False
         self.parent = parent
         self.token_arrived_flag = False
         self.success_arrived_flag = False
@@ -103,12 +103,13 @@ class HubThread(Thread):
         while not self.running and self._armed:
             try:
                 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+                s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) # try re-use socket
                 s.bind(('localhost', 19084))
                 self.running = True
             except socket.error as e:
-                #print("socket busy, retry opening")
+                #print("socket busy, retry opening:", e)
                 if e.errno == 98: # its in use wait a bit and retry
-                    time.sleep(3)
+                    time.sleep(5)
         if not self._armed:
             return
         self.socket = s

doc/AUTHOR

@@ -17,21 +17,25 @@
 
  software/projects:
 
+ - Anarcha-Pragmatism: Intellectual model (and movement) based on the culture of the "action/reaction".
  - AnonTwi: Tool for OAuth2 applications (such as: GNUSocial, Twitter) that provides different layers of privacy/encryption.
+ - BrAInStocker: Tool to predict (using Linear Regression) the next number within a series of random numbers.
  - Bordercheck: Tool to visualize 'real-time' on a world map the geolocation of data when surfing the web.
- - BrAInStocker: Tool for predicting random numbers.
  - CIntruder: Tool to bypass captchas using OCR (Optical Character Recognition) bruteforcing methods.
  - Collatz: Tool to simulate the Collatz's conjeture.
+ - DiaNA: Tool for the search and recognition of patterns in DNA sequences.
  - DieKunstDerFuge: Video on different topics related to hacktivism recorded during 2013 from an intimate narrative perspective.
  - ECOin: Decentralized key/value registration and transfer system based on Bitcoin technology (a cryptocurrency).
  - Euler-Bricks: Tool to search for Euler's "bricks".
  - Goldbach: Tool to simulate the Goldbach's conjeture.
- - Lorea: Social networking autonomous project to build a distributed, encrypted and federated network.
+ - Lorea: Social networking autonomous project to build a distributed, encrypted and federated network. 
  - Orb: Tool for massive footprinting.
+ - PandeMaths: Tool that simulates a mathematical model of pandemics.
  - pArAnoIA-Browser: Tool designed to surf the Internet using some "paranoic" methods.
  - Propagare: Tool for extraction, organization and semantic analysis of newspapers.
  - PyAISnake: Tool to train AI models on solve spatial problems through the classic video game "snake".
  - PyDog4Apache: Tool to sneak logs from Apache web server.
+ - Smuggler: Tool to detect and exploit HTTP Smuggling vulnerabilities.
  - UFONet: Denial of Service [DDoS & DoS attacks] Toolkit (a botnet of botnets).
  - XSSer: Automatic -framework- to detect, exploit and report XSS vulnerabilities.
 

doc/INSTALL

@@ -25,7 +25,6 @@ XSSer runs on many platforms. It requires Python (3.x) and the following librari
     - python3-pycurl - Python bindings to libcurl (Python 3)
     - python3-bs4 - error-tolerant HTML parser for Python 3
     - python3-geoip - Python3 bindings for the GeoIP IP-to-country resolver library
-    - python3-geoip2 - Python geoip2 API for web services and databases - Python 3.x
     - python3-gi - Python 3 bindings for gobject-introspection libraries
     - python3-cairocffi - cffi-based cairo bindings for Python (Python3)
     - python3-selenium - Python3 bindings for Selenium
@@ -33,19 +32,18 @@ XSSer runs on many platforms. It requires Python (3.x) and the following librari
 
 On Debian-based systems (ex: Ubuntu), run: 
 
-    sudo apt-get install python3-pycurl python3-bs4 python3-geoip python3-geoip2 python3-cairocffi python3-selenium firefoxdriver
+    sudo apt-get install python3-pycurl python3-bs4 python3-geoip python3-cairocffi python3-selenium firefoxdriver
 
 On other systems such as: Kali, Ubuntu, ArchLinux, ParrotSec, Fedora, etc... also run:
 
-    sudo pip3 install pycurl bs4 geoip2 gobject cairocffi selenium 
+    sudo pip3 install pycurl bs4 pygeoip gobject cairocffi selenium 
 
 ####  Source libs:
 
        * Python: https://www.python.org/downloads/
        * PyCurl: http://pycurl.sourceforge.net/
        * PyBeautifulSoup4: https://pypi.org/project/beautifulsoup4/
-       * PyGeoIP: https://pypi.python.org/pypi/GeoIP
-       * PyGeoIP2: https://pypi.org/project/geoip2/
+       * PyGeoIP: https://pypi.org/project/pygeoip/
        * PyGObject: https://pypi.org/project/gobject/
        * PyCairocffi: https://pypi.org/project/cairocffi/
        * PySelenium: https://pypi.org/project/selenium/

doc/requirements.txt

@@ -1,6 +1,6 @@
 beautifulsoup4==4.8.1
 pycurl==7.43.0.3
-geoip2==2.9.0
+pygeoip=0.3.2
 gobject==0.1.0
 cffi>=1.1.0
 selenium=>3.141.0