gtkcontroller.py 80 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003
  1. #!/usr/bin/env python
  2. # -*- coding: utf-8 -*-"
  3. # vim: set expandtab tabstop=4 shiftwidth=4:
  4. """
  5. This file is part of the XSSer project, https://xsser.03c8.net
  6. Copyright (c) 2010/2020 | psy <epsylon@riseup.net>
  7. xsser is free software; you can redistribute it and/or modify it under
  8. the terms of the GNU General Public License as published by the Free
  9. Software Foundation version 3 of the License.
  10. xsser is distributed in the hope that it will be useful, but WITHOUT ANY
  11. WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
  12. FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
  13. details.
  14. You should have received a copy of the GNU General Public License along
  15. with xsser; if not, write to the Free Software Foundation, Inc., 51
  16. Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
  17. """
  18. import sys
  19. import os, datetime
  20. import math
  21. import socket
  22. import webbrowser
  23. import threading
  24. import gi
  25. gi.require_version('Gtk', '3.0')
  26. gi.require_version('Gdk', '3.0')
  27. from gi.repository import Gtk as gtk
  28. from gi.repository import Gdk as gdk
  29. from gi.repository import GLib as gobject
  30. from threading import Thread
  31. from xml.dom import minidom
  32. gdk.threads_init()
  33. use_twisted = False
  34. if use_twisted:
  35. from twisted.internet import gtk2reactor
  36. gtk2reactor.install()
  37. from twisted.internet import reactor
  38. else:
  39. reactor = None
  40. from core.main import xsser
  41. from core.globalmap import GlobalMap
  42. from core.reporter import XSSerReporter
  43. from core.mozchecker import MozChecker
  44. class Controller(XSSerReporter):
  45. def __init__(self, uifile, mothership, window='window1'):
  46. wTree = gtk.Builder()
  47. self.xsser = xsser()
  48. self.mothership = mothership
  49. self._flying = None
  50. self._quitting = False
  51. self.map = None
  52. self.wTree = wTree
  53. path = self.mothership.get_gtk_directory()
  54. wTree.add_from_file(os.path.join(path, uifile))
  55. self.fill_combos()
  56. wTree.connect_signals(self)
  57. window = wTree.get_object(window)
  58. window.set_size_request(800, 600)
  59. window.maximize()
  60. window.show()
  61. self._window = window
  62. self.output = wTree.get_object('textview_main')
  63. self.status = wTree.get_object('status_bar')
  64. self.output_wizard = wTree.get_object('textview_w_start')
  65. self._wizard_buffer = self.output_wizard.get_buffer()
  66. self.counters_label = wTree.get_object('counters_label')
  67. self._report_vulnerables = wTree.get_object('report_vulnerables').get_buffer()
  68. self._report_success = wTree.get_object('report_success').get_buffer()
  69. self._report_failed = wTree.get_object('report_failed').get_buffer()
  70. self._report_errors = wTree.get_object('report_errors').get_buffer()
  71. self._report_crawling = wTree.get_object('report_crawling').get_buffer()
  72. # GUI spinner inits
  73. threads_spin = self.wTree.get_object('threads')
  74. threads_spin.set_range(0,100)
  75. threads_spin.set_value(5)
  76. threads_spin.set_increments(1, 1)
  77. timeout_spin = self.wTree.get_object('timeout')
  78. timeout_spin.set_range(0,100)
  79. timeout_spin.set_value(30)
  80. timeout_spin.set_increments(1, 1)
  81. retries_spin = self.wTree.get_object('retries')
  82. retries_spin.set_range(0,10)
  83. retries_spin.set_value(1)
  84. retries_spin.set_increments(1, 1)
  85. delay_spin = self.wTree.get_object('delay')
  86. delay_spin.set_range(0,100)
  87. delay_spin.set_value(0)
  88. delay_spin.set_increments(1, 1)
  89. follow_spin = self.wTree.get_object('follow-limit')
  90. follow_spin.set_range(0,100)
  91. follow_spin.set_value(0)
  92. follow_spin.set_increments(1, 1)
  93. alive_spin = self.wTree.get_object('alive-limit')
  94. alive_spin.set_range(0,100)
  95. alive_spin.set_value(0)
  96. alive_spin.set_increments(1, 1)
  97. crawler2_spin = self.wTree.get_object('combobox5')
  98. crawler2_spin.set_range(1, 99999)
  99. crawler2_spin.set_value(50)
  100. crawler2_spin.set_increments(1, 1)
  101. window.connect("destroy", self.on_quit)
  102. # geoip + geomap inits
  103. self.domaintarget = ""
  104. # wizard options inits
  105. self.text_ascii = ""
  106. # step 1
  107. self.target_option = ""
  108. self.dork_option = ""
  109. self.dorkengine_option = ""
  110. self.combo_step1_choose = ""
  111. # step 2
  112. self.payload_option = ""
  113. self.combo_step2_choose = ""
  114. # step 3
  115. self.combo_step3_choose = ""
  116. self.proxy_option = ""
  117. self.useragent_option = ""
  118. self.referer_option = ""
  119. # step 4
  120. self.combo_step4_choose = ""
  121. self.cem_option = ""
  122. # step 5
  123. self.combo_step5_choose = ""
  124. self.scripts_option = ""
  125. self.mothership.add_reporter(self)
  126. # text buffered on wizard startup
  127. wizard_output = wTree.get_object('textview_w_start')
  128. buffer_wizard = wizard_output.get_buffer()
  129. file = self.open_wizard_file("wizard0")
  130. self.text_ascii = file.read()
  131. file.close()
  132. buffer_wizard.set_text(self.text_ascii)
  133. # text buffered on wizard1
  134. wizard1_output = wTree.get_object('textview_w_1')
  135. buffer = wizard1_output.get_buffer()
  136. file = self.open_wizard_file("wizard1")
  137. text_ascii = file.read()
  138. file.close()
  139. buffer.set_text(text_ascii)
  140. # text buffered on wizard2
  141. wizard2_output = wTree.get_object('textview_w_2')
  142. buffer = wizard2_output.get_buffer()
  143. file = self.open_wizard_file("wizard2")
  144. text_ascii = file.read()
  145. file.close()
  146. buffer.set_text(text_ascii)
  147. # text buffered on wizard3
  148. wizard3_output = wTree.get_object('textview_w_3')
  149. buffer = wizard3_output.get_buffer()
  150. file = self.open_wizard_file("wizard3")
  151. text_ascii = file.read()
  152. file.close()
  153. buffer.set_text(text_ascii)
  154. # text buffered on wizard4
  155. wizard4_output = wTree.get_object('textview_w_4')
  156. buffer = wizard4_output.get_buffer()
  157. file = self.open_wizard_file("wizard4")
  158. text_ascii = file.read()
  159. file.close()
  160. buffer.set_text(text_ascii)
  161. # text buffered on wizard5
  162. wizard5_output = wTree.get_object('textview_w_5')
  163. buffer = wizard5_output.get_buffer()
  164. file = self.open_wizard_file("wizard5")
  165. text_ascii = file.read()
  166. file.close()
  167. buffer.set_text(text_ascii)
  168. # text buffered on wizard end
  169. wizard_end_output = wTree.get_object('textview_w_end')
  170. buffer = wizard_end_output.get_buffer()
  171. file = self.open_wizard_file("wizard6")
  172. text_ascii = file.read()
  173. file.close()
  174. buffer.set_text(text_ascii)
  175. # text buffered on wizard about
  176. index_output = wTree.get_object('textview_about')
  177. buffer = index_output.get_buffer()
  178. file = self.open_wizard_file("about")
  179. text_ascii = file.read()
  180. file.close()
  181. buffer.set_text(text_ascii)
  182. self.setup_mozembed()
  183. def open_wizard_file(self, name):
  184. path = self.mothership.get_gtk_directory()
  185. file = open(os.path.join(path, 'docs', name+'.txt'), 'r')
  186. return file
  187. def fill_with_options(self, combobox, options):
  188. model = gtk.ListStore(str)
  189. for option in options:
  190. model.append([option])
  191. combobox.set_active(0)
  192. combobox.set_model(model)
  193. cell = gtk.CellRendererText()
  194. combobox.pack_start(cell, True)
  195. combobox.add_attribute(cell, 'text', 0)
  196. def start_crawl(self, dest_url):
  197. gdk.threads_enter()
  198. self.status.set_text("scanning")
  199. self.status.pulse()
  200. gdk.threads_leave()
  201. self.add_report_text(self._report_crawling, dest_url)
  202. def add_checked(self, dest_url):
  203. self.add_report_text(self._report_success, dest_url)
  204. def add_success(self, dest_url):
  205. self.add_report_text(self._report_vulnerables, dest_url)
  206. totalhits = self.wTree.get_object('totalhits')
  207. totalhits.set_property("label", str(int(totalhits.get_property("label"))+1))
  208. successhits = self.wTree.get_object('successhits')
  209. successhits.set_property("label", str(int(successhits.get_property("label"))+1))
  210. def report_error(self, error_msg):
  211. self.add_report_text(self._report_failed, error_msg)
  212. def mosquito_crashed(self, dest_url, reason):
  213. self.add_report_text(self._report_errors, dest_url+" ["+reason+"]")
  214. def add_failure(self, dest_url):
  215. self.add_report_text(self._report_failed, dest_url)
  216. totalhits = self.wTree.get_object('totalhits')
  217. totalhits.set_property("label", str(int(totalhits.get_property("label"))+1))
  218. failedhits = self.wTree.get_object('failedhits')
  219. failedhits.set_property("label", str(int(failedhits.get_property("label"))+1))
  220. def add_report_text(self, gtkbuffer, text):
  221. gdk.threads_enter()
  222. iter = gtkbuffer.get_end_iter()
  223. gtkbuffer.insert(iter, text+'\n')
  224. gdk.threads_leave()
  225. def setup_mozembed(self):
  226. self.moz = MozChecker(self)
  227. self.mothership.set_webbrowser(self.moz)
  228. def fill_combos(self):
  229. # ui comboboxes
  230. dorker2_options_w = self.wTree.get_object('combobox4')
  231. dorker3_options_w = self.wTree.get_object('combobox6')
  232. crawlerdeep_options_w = self.wTree.get_object('combobox_deep1')
  233. connect_geomap_w = self.wTree.get_object('combobox7')
  234. checkmethod_options_w = self.wTree.get_object('combobox1')
  235. # wizard steps comboboxes
  236. step1_options_w = self.wTree.get_object('combobox_step1')
  237. step2_options_w = self.wTree.get_object('combobox_step2')
  238. step3_options_w = self.wTree.get_object('combobox_step3')
  239. step4_options_w = self.wTree.get_object('combobox_step4')
  240. step5_options_w = self.wTree.get_object('combobox_step5')
  241. # ui comboboxes content
  242. dorker_options = [ 'duck', 'startpage', 'yahoo', 'bing']
  243. crawlerdeep_options = ['1', '2', '3', '4', '5']
  244. checkmethod_options = ['GET', 'POST']
  245. connect_geomap = ['OFF', 'ON']
  246. # wizard comboboxes content
  247. step1_options = ['0', '1', '2']
  248. step2_options = ['0', '1', '2', '3', '4']
  249. step3_options = ['0', '1', '2', '3', '4']
  250. step4_options = ['0', '1', '2', '3', '4', '5']
  251. step5_options = ['0', '1', '2', '3']
  252. # all comboboxes handlered
  253. self.fill_with_options(dorker2_options_w, dorker_options)
  254. self.fill_with_options(dorker3_options_w, dorker_options)
  255. self.fill_with_options(crawlerdeep_options_w, crawlerdeep_options)
  256. self.fill_with_options(connect_geomap_w, connect_geomap)
  257. self.fill_with_options(checkmethod_options_w, checkmethod_options)
  258. self.fill_with_options(step1_options_w, step1_options)
  259. self.fill_with_options(step2_options_w, step2_options)
  260. self.fill_with_options(step3_options_w, step3_options)
  261. self.fill_with_options(step4_options_w, step4_options)
  262. self.fill_with_options(step5_options_w, step5_options)
  263. def on_set_clicked(self, widget):
  264. """
  265. Set your mosquito(s) options
  266. """
  267. # control authmode
  268. auth_none = self.wTree.get_object('auth_none')
  269. auth_cred = self.wTree.get_object('auth_cred')
  270. if auth_cred.get_property('text') == "":
  271. auth_none.set_property('active', True)
  272. commandsenter = self.wTree.get_object('commandsenter')
  273. targetenter = self.wTree.get_object('targetenter')
  274. explorer_enter = self.wTree.get_object('explorer_enter')
  275. if targetenter.get_text() == "" and explorer_enter.get_text() == "":
  276. pass
  277. else:
  278. cmd = self.generate_command()
  279. commandsenter.set_property("text"," ".join(cmd))
  280. app = xsser()
  281. options = app.create_options(cmd)
  282. app.set_options(options)
  283. app.set_reporter(self)
  284. pass
  285. # set visor counters to zero
  286. totalhits = self.wTree.get_object('totalhits')
  287. totalhits.set_property("label", "0")
  288. failedhits = self.wTree.get_object('failedhits')
  289. failedhits.set_property("label", "0")
  290. successhits = self.wTree.get_object('successhits')
  291. successhits.set_property("label", "0")
  292. def end_attack(self):
  293. gdk.threads_enter()
  294. self.status.set_text("idle")
  295. self.status.set_fraction(0.0)
  296. fly_button = self.wTree.get_object('fly')
  297. fly_button.set_label('FLY!!!')
  298. fly_button.set_sensitive(True)
  299. if self._quitting:
  300. pass
  301. else:
  302. gobject.timeout_add(0, self.park_mosquito)
  303. gdk.threads_leave()
  304. def park_mosquito(self):
  305. self._flying.join()
  306. self._flying = None
  307. def on_stop_attack(self):
  308. if self._flying:
  309. self._flying.app.land()
  310. def on_quit(self, widget, data=None):
  311. """
  312. Callback called when the window is destroyed (close button clicked)
  313. """
  314. if self._flying:
  315. print("[Info] Please wait... until all the mosquitoes have returned to the hieve... -> [Exiting!]\n")
  316. self._quitting = True
  317. self.on_stop_attack()
  318. self.do_quit()
  319. else:
  320. print("byezZZZzzzz!\n")
  321. self.do_quit()
  322. def do_quit(self):
  323. self.mothership.land(True)
  324. #if self.moz:
  325. # self.moz.shutdown()
  326. if reactor:
  327. threadpool = reactor.getThreadPool()
  328. threadpool.stop()
  329. reactor.stop()
  330. else:
  331. # doing it here doesnt seem to give time to
  332. # the mothership to land but should be ok
  333. gtk.main_quit()
  334. def start_token_check(self, dest_url):
  335. self.update_counters_label()
  336. def update_counters_label(self):
  337. rem = str(self.moz.remaining())
  338. th_count = str(threading.activeCount()-1)
  339. if self._flying:
  340. work_count = str(len(self._flying.app.pool.workRequests))
  341. app = self._flying.app
  342. crawled = str(len(app.crawled_urls))+"/"+str(app.options.crawling)
  343. else:
  344. work_count = ""
  345. crawled = "X"
  346. pars = [crawled, rem, th_count, work_count]
  347. gdk.threads_enter()
  348. self.counters_label.set_text(" ".join(pars))
  349. if pars[3]:
  350. pars[3] = "\nworks in queue: %s"%(pars[3],)
  351. self.counters_label.set_tooltip_text('crawled during last attack: %s\nremaining checks: %s\nalive threads: %s %s' % tuple(pars))
  352. gdk.threads_leave()
  353. def report_state(self, state, val=-1):
  354. if not gtk:
  355. # exiting..
  356. return
  357. gdk.threads_enter()
  358. self.status.set_text(state)
  359. if val == -1:
  360. self.status.pulse()
  361. else:
  362. self.status.set_fraction(val)
  363. gdk.threads_leave()
  364. self.update_counters_label()
  365. def on_fly_clicked(self, widget):
  366. """
  367. Fly your mosquito(s)
  368. """
  369. fly_button = self.wTree.get_object('fly')
  370. if self._flying:
  371. self.on_stop_attack()
  372. fly_button.set_label('LANDING!!!')
  373. fly_button.set_sensitive(False)
  374. return
  375. self.output.get_buffer().set_property("text", "")
  376. auth_none = self.wTree.get_object('auth_none')
  377. auth_cred = self.wTree.get_object('auth_cred')
  378. if auth_cred.get_property('text') == "":
  379. auth_none.set_property('active', True)
  380. commandsenter = self.wTree.get_object('commandsenter')
  381. cmd = self.generate_command()
  382. commandsenter.set_property("text"," ".join(cmd))
  383. t = XSSerThread(cmd, self.mothership)
  384. t.daemon = True
  385. t.add_reporter(self)
  386. t.set_webbrowser(self.moz)
  387. if self.map:
  388. t.add_reporter(self.map)
  389. self.mothership.add_reporter(self.map)
  390. targetenter = self.wTree.get_object('targetenter')
  391. explorer_enter = self.wTree.get_object('explorer_enter')
  392. if t.app.options == None:
  393. pass
  394. elif targetenter.get_text() == "" and explorer_enter.get_text() == "":
  395. pass
  396. else:
  397. t.start()
  398. self._flying = t
  399. fly_button.set_label('LAND!!!')
  400. # set visor counters to zero
  401. totalhits = self.wTree.get_object('totalhits')
  402. totalhits.set_property("label", "0")
  403. failedhits = self.wTree.get_object('failedhits')
  404. failedhits.set_property("label", "0")
  405. successhits = self.wTree.get_object('successhits')
  406. successhits.set_property("label", "0")
  407. # control on/off 'sensitive' switches
  408. def on_intruder_toggled(self, widget):
  409. """
  410. Active intruder mode
  411. """
  412. intruder = self.wTree.get_object('intruder')
  413. targetenter = self.wTree.get_object('targetenter')
  414. targetall = self.wTree.get_object('targetall')
  415. explorer_enter = self.wTree.get_object('explorer_enter')
  416. combobox4 = self.wTree.get_object('combobox4')
  417. if intruder.get_property('active') == True:
  418. targetenter.set_property('visible', True)
  419. targetall.set_property('visible', True)
  420. explorer_enter.set_property('visible', False)
  421. combobox4.set_property('visible', False)
  422. else:
  423. targetenter.set_property("text", "")
  424. targetenter.set_property('visible', False)
  425. targetall.set_property('visible', False)
  426. explorer_enter.set_property('visible', True)
  427. combobox4.set_property('visible', True)
  428. def on_explorer_toggled(self, widget):
  429. """
  430. Toggle ON/OFF explorer entry
  431. """
  432. explorer = self.wTree.get_object('explorer')
  433. targetenter = self.wTree.get_object('targetenter')
  434. targetall = self.wTree.get_object('targetall')
  435. explorer_enter = self.wTree.get_object('explorer_enter')
  436. combobox4 = self.wTree.get_object('combobox4')
  437. if explorer.get_property('active') == True:
  438. explorer_enter.set_property('visible', True)
  439. targetenter.set_property('visible', False)
  440. targetall.set_property('visible', False)
  441. combobox4.set_property('visible', True)
  442. else:
  443. explorer_enter.set_property("text", "")
  444. explorer_enter.set_property("visible", False)
  445. targetenter.set_property('visible', True)
  446. targetall.set_property('visible', True)
  447. combobox4.set_property('visible', False)
  448. def on_targetall_toggled(self, widget):
  449. """
  450. Autoconfigure XSSer options to perform an automatic XSS pentesting
  451. """
  452. targetall = self.wTree.get_object('targetall')
  453. crawler = self.wTree.get_object('crawler')
  454. crawler2_spin = self.wTree.get_object('combobox5')
  455. localonly1 = self.wTree.get_object('localonly1')
  456. statistics = self.wTree.get_object('statistics')
  457. threads_spin = self.wTree.get_object('threads')
  458. timeout_spin = self.wTree.get_object('timeout')
  459. retries_spin = self.wTree.get_object('retries')
  460. delay_spin = self.wTree.get_object('delay')
  461. followredirects = self.wTree.get_object('followredirects')
  462. no_head = self.wTree.get_object('no-head')
  463. reverse_check = self.wTree.get_object('reverse-check')
  464. automatic_payload = self.wTree.get_object('automatic_payload')
  465. cookie_injection = self.wTree.get_object('cookie_injection')
  466. xas = self.wTree.get_object('xas')
  467. xsr = self.wTree.get_object('xsr')
  468. dom = self.wTree.get_object('dom')
  469. dcp = self.wTree.get_object('dcp')
  470. induced = self.wTree.get_object('induced')
  471. save = self.wTree.get_object('save')
  472. exportxml = self.wTree.get_object('exportxml')
  473. if targetall.get_property('active') == True:
  474. crawler.set_property("active", True)
  475. localonly1.set_property("active", True)
  476. crawler2_spin.set_value(99999)
  477. statistics.set_property("active", True)
  478. threads_spin.set_value(10)
  479. timeout_spin.set_value(60)
  480. retries_spin.set_value(2)
  481. delay_spin.set_value(5)
  482. followredirects.set_property("active", True)
  483. no_head.set_property("active", True)
  484. reverse_check.set_property("active", True)
  485. automatic_payload.set_property("active", True)
  486. cookie_injection.set_property("active", True)
  487. xas.set_property("active", True)
  488. xsr.set_property("active", True)
  489. dom.set_property("active", True)
  490. dcp.set_property("active", True)
  491. induced.set_property("active", True)
  492. save.set_property("active", True)
  493. exportxml.set_property("active", True)
  494. else:
  495. crawler.set_property("active", False)
  496. localonly1.set_property("active", True)
  497. crawler2_spin.set_value(50)
  498. statistics.set_property("active", True)
  499. threads_spin.set_value(5)
  500. timeout_spin.set_value(30)
  501. retries_spin.set_value(1)
  502. delay_spin.set_value(0)
  503. followredirects.set_property("active", False)
  504. no_head.set_property("active", False)
  505. reverse_check.set_property("active", False)
  506. automatic_payload.set_property("active", False)
  507. cookie_injection.set_property("active", False)
  508. xas.set_property("active", False)
  509. xsr.set_property("active", False)
  510. dom.set_property("active", False)
  511. dcp.set_property("active", False)
  512. induced.set_property("active", False)
  513. save.set_property("active", False)
  514. exportxml.set_property("active", False)
  515. def on_torproxy_toggled(self, widget):
  516. """
  517. Sync tor mode with expert visor
  518. """
  519. torproxy = self.wTree.get_object('torproxy')
  520. proxy = self.wTree.get_object('proxy')
  521. if torproxy.get_property('active') == True:
  522. proxy.set_property('text', 'http://127.0.0.1:8118')
  523. else:
  524. proxy.set_property('text', "")
  525. def on_automatic_toggled(self, widget):
  526. """
  527. Sync automatic mode with expert visor
  528. """
  529. automatic = self.wTree.get_object('automatic')
  530. automatic_payload = self.wTree.get_object('automatic_payload')
  531. if automatic.get_property('active') == True:
  532. automatic_payload.set_property('active', True)
  533. else:
  534. automatic_payload.set_property('active', False)
  535. def on_automatic_payload_toggled(self, widget):
  536. """
  537. Syn. automatic_payload mode with other automatic switches
  538. """
  539. automatic = self.wTree.get_object('automatic')
  540. automatic_payload = self.wTree.get_object('automatic_payload')
  541. if automatic_payload.get_property('active') == True:
  542. automatic.set_property('active', True)
  543. else:
  544. automatic.set_property('active', False)
  545. def on_crawler_toggled(self, widget):
  546. """
  547. Toggle ON/OFF crawling on main visor
  548. """
  549. crawler = self.wTree.get_object('crawler')
  550. combobox5 = self.wTree.get_object('combobox5')
  551. combobox_deep1 = self.wTree.get_object('combobox_deep1')
  552. localonly1 = self.wTree.get_object('localonly1')
  553. if crawler.get_property('active') == True:
  554. combobox5.set_property('visible', True)
  555. combobox_deep1.set_property('visible', True)
  556. localonly1.set_property('visible', True)
  557. else:
  558. connection_none = self.wTree.get_object('connection_none')
  559. connection_none.set_property('active', True)
  560. combobox5.set_property("visible", False)
  561. combobox_deep1.set_property('visible', False)
  562. localonly1.set_property('visible', False)
  563. def on_get_toggled(self, widget):
  564. """
  565. Toggle ON/OFF payloading entry for GET
  566. """
  567. get = self.wTree.get_object('get')
  568. hbox41 = self.wTree.get_object('hbox41')
  569. if get.get_property('active') == True:
  570. hbox41.set_property('visible', True)
  571. else:
  572. hbox41.set_property("visible", False)
  573. def on_post_toggled(self, widget):
  574. """
  575. Toggle ON/OFF payloading entry for POST
  576. """
  577. post = self.wTree.get_object('post')
  578. hbox41 = self.wTree.get_object('hbox41')
  579. if post.get_property('active') == True:
  580. hbox41.set_property('visible', True)
  581. else:
  582. hbox41.set_property('visible', False)
  583. def on_followredirects_toggled(self, widget):
  584. """
  585. Toggle ON/OFF follow redirects entry
  586. """
  587. followredirects = self.wTree.get_object('followredirects')
  588. follow_limit = self.wTree.get_object('follow-limit')
  589. hbox8 = self.wTree.get_object('hbox8')
  590. if followredirects.get_property('active') == True:
  591. hbox8.set_property('visible', True)
  592. follow_limit.set_value(50)
  593. else:
  594. hbox8.set_property('visible', False)
  595. follow_limit.set_value(0)
  596. def on_alive_toggled(self, widget):
  597. """
  598. Toggle ON/OFF alive checker
  599. """
  600. alive = self.wTree.get_object('alive')
  601. alive_limit = self.wTree.get_object('alive-limit')
  602. hbox58 = self.wTree.get_object('hbox58')
  603. hbox77 = self.wTree.get_object('hbox77')
  604. if alive.get_property('active') == True:
  605. hbox58.set_property('visible', True)
  606. hbox77.set_property('visible', False)
  607. alive_limit.set_value(5)
  608. else:
  609. hbox58.set_property('visible', False)
  610. hbox77.set_property('visible', True)
  611. alive_limit.set_value(0)
  612. def on_auth_none_toggled(self, widget):
  613. auth_cred = self.wTree.get_object('auth_cred')
  614. auth_cred.set_property('text', "")
  615. def on_auth_basic_toggled(self, widget):
  616. hbox17 = self.wTree.get_object('hbox17')
  617. auth_basic = self.wTree.get_object('auth_basic')
  618. if auth_basic.get_property('active') == True:
  619. hbox17.set_property('visible', True)
  620. else:
  621. hbox17.set_property('visible', False)
  622. def on_auth_digest_toggled(self, widget):
  623. hbox17 = self.wTree.get_object('hbox17')
  624. auth_digest = self.wTree.get_object('auth_digest')
  625. if auth_digest.get_property('active') == True:
  626. hbox17.set_property('visible', True)
  627. else:
  628. hbox17.set_property('visible', False)
  629. def on_auth_gss_toggled(self, widget):
  630. hbox17 = self.wTree.get_object('hbox17')
  631. auth_digest = self.wTree.get_object('auth_gss')
  632. if auth_digest.get_property('active') == True:
  633. hbox17.set_property('visible', True)
  634. else:
  635. hbox17.set_property('visible', False)
  636. def on_auth_ntlm_toggled(self, widget):
  637. hbox17 = self.wTree.get_object('hbox17')
  638. auth_digest = self.wTree.get_object('auth_ntlm')
  639. if auth_digest.get_property('active') == True:
  640. hbox17.set_property('visible', True)
  641. else:
  642. hbox17.set_property('visible', False)
  643. def on_finalnone_toggled(self, widget):
  644. payload_entry = self.wTree.get_object('payload_entry')
  645. payload_entry.set_property('text', "")
  646. def on_normalfinal_toggled(self, widget):
  647. hbox25 = self.wTree.get_object('hbox25')
  648. normalfinal = self.wTree.get_object('normalfinal')
  649. if normalfinal.get_property('active') == True:
  650. hbox25.set_property('visible', True)
  651. else:
  652. hbox25.set_property('visible', False)
  653. def on_remotefinal_toggled(self, widget):
  654. hbox25 = self.wTree.get_object('hbox25')
  655. remotefinal = self.wTree.get_object('remotefinal')
  656. if remotefinal.get_property('active') == True:
  657. hbox25.set_property('visible', True)
  658. else:
  659. hbox25.set_property('visible', False)
  660. # wizard helper buttons
  661. def on_startwizard_clicked(self, widget):
  662. self.output_wizard.set_buffer(self._wizard_buffer)
  663. step_view_start = self.wTree.get_object('vbox_start')
  664. step_view_start.set_property("visible", False)
  665. step_view1 = self.wTree.get_object('vbox_step1')
  666. step_view1.set_property("visible", True)
  667. commandsenter = self.wTree.get_object('commandsenter')
  668. commandsenter.set_property("text", "xsser")
  669. target_enter = self.wTree.get_object('targetenter')
  670. target_enter.set_property("text", "")
  671. explorer_enter = self.wTree.get_object('explorer_enter')
  672. explorer_enter.set_property("text", "")
  673. combo_choose1 = self.wTree.get_object('combobox_step1')
  674. combo_choose2 = self.wTree.get_object('combobox_step2')
  675. combo_choose3 = self.wTree.get_object('combobox_step3')
  676. combo_choose4 = self.wTree.get_object('combobox_step4')
  677. combo_choose5 = self.wTree.get_object('combobox_step5')
  678. #wizard auto-way options
  679. combo_choose1.set_active(2)
  680. combo_choose2.set_active(4)
  681. combo_choose3.set_active(3)
  682. combo_choose4.set_active(5)
  683. combo_choose5.set_active(3)
  684. combobox6 = self.wTree.get_object('combobox6')
  685. combobox6.set_active(0)
  686. combobox_deep1 = self.wTree.get_object('combobox_deep1')
  687. combobox_deep1.set_active(0)
  688. verbose = self.wTree.get_object('verbose')
  689. automatic = self.wTree.get_object('automatic')
  690. explorer = self.wTree.get_object('explorer')
  691. crawler = self.wTree.get_object('crawler')
  692. torproxy = self.wTree.get_object('torproxy')
  693. verbose.set_property("active", False)
  694. automatic.set_property("active", False)
  695. explorer.set_property("active", False)
  696. crawler.set_property("active", False)
  697. torproxy.set_property("active", False)
  698. self.target_option = ""
  699. self.file_option = None
  700. self.dork_option = ""
  701. self.dorkengine_option = ""
  702. def on_combobox_step1_changed(self, widget):
  703. combo_choose = self.wTree.get_object('combobox_step1')
  704. vbox_step = self.wTree.get_object('vbox_step')
  705. hboxurl = self.wTree.get_object('hboxurl')
  706. vboxdork = self.wTree.get_object('vboxdork')
  707. next1 = self.wTree.get_object('next1')
  708. if combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '0':
  709. vbox_step.set_property("visible", False)
  710. next1.set_property("visible", False)
  711. if combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '1':
  712. vbox_step.set_property("visible", True)
  713. hboxurl.set_property("visible", True)
  714. vboxdork.set_property("visible", False)
  715. next1.set_property("visible", True)
  716. elif combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '2':
  717. vbox_step.set_property("visible", True)
  718. hboxurl.set_property("visible", False)
  719. vboxdork.set_property("visible", True)
  720. next1.set_property("visible", True)
  721. def on_previous1_clicked(self, widget):
  722. step_view1 = self.wTree.get_object('vbox_step1')
  723. step_view1.set_property("visible", False)
  724. step_view_start = self.wTree.get_object('vbox_start')
  725. step_view_start.set_property("visible", True)
  726. alert_step1_url = self.wTree.get_object('alert_step1_url')
  727. alert_step1_url.set_property("visible", False)
  728. alert_step1_dork = self.wTree.get_object('alert_step1_dork')
  729. alert_step1_dork.set_property("visible", False)
  730. combo_choose = self.wTree.get_object('combobox_step1')
  731. step1_entry_url = self.wTree.get_object('step1_entry_url')
  732. step1_entry_dork = self.wTree.get_object('step1_entry_dork')
  733. step1_entry_url.set_property("text", "")
  734. step1_entry_dork.set_property("text", "")
  735. self.combo_step1_choose = ""
  736. self.target_option = ""
  737. self.dork_option = ""
  738. def on_next1_clicked(self, widget):
  739. step_view1 = self.wTree.get_object('vbox_step1')
  740. step_view2 = self.wTree.get_object('vbox_step2')
  741. combo_choose = self.wTree.get_object('combobox_step1')
  742. step1_entry_url = self.wTree.get_object('step1_entry_url')
  743. step1_entry_dork = self.wTree.get_object('step1_entry_dork')
  744. step1_entry_dorkengine = self.wTree.get_object('combobox6')
  745. alert_step1_url = self.wTree.get_object('alert_step1_url')
  746. alert_step1_dork = self.wTree.get_object('alert_step1_dork')
  747. if step1_entry_url.get_text() == '' and (combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '1'):
  748. alert_step1_url.set_property("visible", True)
  749. step_view1.set_property("visible", True)
  750. step_view2.set_property("visible", False)
  751. elif step1_entry_dork.get_text() == '' and (combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '2'):
  752. alert_step1_dork.set_property("visible", True)
  753. step_view1.set_property("visible", True)
  754. step_view2.set_property("visible", False)
  755. else:
  756. alert_step1_url.set_property("visible", False)
  757. alert_step1_dork.set_property("visible", False)
  758. step_view1.set_property("visible", False)
  759. step_view2.set_property("visible", True)
  760. self.combo_step1_choose = combo_choose.get_model().get_value(combo_choose.get_active_iter(),0)
  761. self.target_option = step1_entry_url.get_text()
  762. self.dork_option = step1_entry_dork.get_text()
  763. self.dorkengine_option = step1_entry_dorkengine.get_model().get_value(step1_entry_dorkengine.get_active_iter(),0)
  764. def on_combobox_step2_changed(self, widget):
  765. combo_choose = self.wTree.get_object('combobox_step2')
  766. vbox_step2 = self.wTree.get_object('vbox_step2_payload')
  767. step2_entry_payload = self.wTree.get_object('step2_entry_payload')
  768. alert_step2 = self.wTree.get_object('alert_step2')
  769. next2 = self.wTree.get_object('next2')
  770. if combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '0':
  771. vbox_step2.set_property("visible", False)
  772. alert_step2.set_property("visible", False)
  773. next2.set_property("visible", False)
  774. step2_entry_payload.set_property("text", "")
  775. if combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '1':
  776. vbox_step2.set_property("visible", True)
  777. alert_step2.set_property("visible", False)
  778. next2.set_property("visible", True)
  779. step2_entry_payload.set_property("text", "")
  780. elif combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '2':
  781. vbox_step2.set_property("visible", True)
  782. next2.set_property("visible", True)
  783. alert_step2.set_property("visible", False)
  784. step2_entry_payload.set_property("text", "")
  785. elif combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '3':
  786. vbox_step2.set_property("visible", False)
  787. next2.set_property("visible", True)
  788. alert_step2.set_property("visible", False)
  789. elif combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '4':
  790. vbox_step2.set_property("visible", False)
  791. next2.set_property("visible", True)
  792. alert_step2.set_property("visible", False)
  793. def on_previous2_clicked(self, widget):
  794. step_view2 = self.wTree.get_object('vbox_step2')
  795. step_view2.set_property("visible", False)
  796. step_view1 = self.wTree.get_object('vbox_step1')
  797. step_view1.set_property("visible", True)
  798. alert_step2 = self.wTree.get_object('alert_step2')
  799. alert_step2.set_property("visible", False)
  800. step1_entry_url = self.wTree.get_object('step1_entry_url')
  801. step1_entry_url.set_property("text", "")
  802. step1_entry_dork = self.wTree.get_object('step1_entry_dork')
  803. step1_entry_dork.set_property("text", "")
  804. self.combo_step2_choose = ""
  805. self.target_option = ""
  806. self.dork_option = ""
  807. combo_choose = self.wTree.get_object('combobox_step2')
  808. step2_entry_payload = self.wTree.get_object('step2_entry_payload')
  809. step2_entry_payload.set_property("text", "")
  810. self.combo_step2_choose = ""
  811. self.payload_option = ""
  812. def on_next2_clicked(self, widget):
  813. step_view2 = self.wTree.get_object('vbox_step2')
  814. step_view3 = self.wTree.get_object('vbox_step3')
  815. combo_choose = self.wTree.get_object('combobox_step2')
  816. step2_entry_payload = self.wTree.get_object('step2_entry_payload')
  817. alert_step2 = self.wTree.get_object('alert_step2')
  818. if step2_entry_payload.get_text() == '' and (combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '1' or combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '2') :
  819. alert_step2.set_property("visible", True)
  820. step_view2.set_property("visible", True)
  821. step_view3.set_property("visible", False)
  822. else:
  823. alert_step2.set_property("visible", False)
  824. step_view2.set_property("visible", False)
  825. step_view3.set_property("visible", True)
  826. self.combo_step2_choose = combo_choose.get_model().get_value(combo_choose.get_active_iter(),0)
  827. self.payload_option = step2_entry_payload.get_text()
  828. def on_combobox_step3_changed(self, widget):
  829. combo_choose = self.wTree.get_object('combobox_step3')
  830. vbox_step3 = self.wTree.get_object('vbox_st')
  831. step3_entry_proxy = self.wTree.get_object('step3_entry_proxy')
  832. alert_step3 = self.wTree.get_object('alert_step3')
  833. next3 = self.wTree.get_object('next3')
  834. if combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '0':
  835. vbox_step3.set_property("visible", False)
  836. alert_step3.set_property("visible", False)
  837. next3.set_property("visible", False)
  838. step3_entry_proxy.set_property("text", "")
  839. if combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '1':
  840. vbox_step3.set_property("visible", True)
  841. alert_step3.set_property("visible", False)
  842. next3.set_property("visible", True)
  843. step3_entry_proxy.set_property("text", "")
  844. elif combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '2':
  845. vbox_step3.set_property("visible", False)
  846. next3.set_property("visible", True)
  847. alert_step3.set_property("visible", False)
  848. elif combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '3':
  849. vbox_step3.set_property("visible", False)
  850. next3.set_property("visible", True)
  851. alert_step3.set_property("visible", False)
  852. elif combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '4':
  853. vbox_step3.set_property("visible", False)
  854. next3.set_property("visible", True)
  855. alert_step3.set_property("visible", False)
  856. def on_previous3_clicked(self, widget):
  857. step_view3 = self.wTree.get_object('vbox_step3')
  858. step_view3.set_property("visible", False)
  859. step_view2 = self.wTree.get_object('vbox_step2')
  860. step_view2.set_property("visible", True)
  861. alert_step3 = self.wTree.get_object('alert_step3')
  862. alert_step3.set_property("visible", False)
  863. combo_choose = self.wTree.get_object('combobox_step3')
  864. step3_entry_proxy = self.wTree.get_object('step3_entry_proxy')
  865. step3_entry_proxy.set_property("text", "")
  866. self.combo_step3_choose = ""
  867. self.proxy_option = ""
  868. self.useragent_option = ""
  869. self.referer_option = ""
  870. def on_next3_clicked(self, widget):
  871. step_view3 = self.wTree.get_object('vbox_step3')
  872. step_view4 = self.wTree.get_object('vbox_step4')
  873. combo_choose = self.wTree.get_object('combobox_step3')
  874. step3_entry_proxy = self.wTree.get_object('step3_entry_proxy')
  875. alert_step3 = self.wTree.get_object('alert_step3')
  876. if step3_entry_proxy.get_text() == '' and combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '1':
  877. alert_step3.set_property("visible", True)
  878. step_view3.set_property("visible", True)
  879. step_view4.set_property("visible", False)
  880. else:
  881. alert_step3.set_property("visible", False)
  882. step_view3.set_property("visible", False)
  883. step_view4.set_property("visible", True)
  884. self.combo_step3_choose = combo_choose.get_model().get_value(combo_choose.get_active_iter(),0)
  885. self.proxy_option = step3_entry_proxy.get_text()
  886. if combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '2':
  887. self.proxy_option = "http://127.0.0.1:8118"
  888. def on_combobox_step4_changed(self, widget):
  889. combo_choose = self.wTree.get_object('combobox_step4')
  890. vbox_step4 = self.wTree.get_object('vboxstep4')
  891. step4_entry_cem = self.wTree.get_object('step4_entry_cem')
  892. alert_step4 = self.wTree.get_object('alert_step4')
  893. next4 = self.wTree.get_object('next4')
  894. if combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '0':
  895. vbox_step4.set_property("visible", False)
  896. alert_step4.set_property("visible", False)
  897. next4.set_property("visible", False)
  898. step4_entry_cem.set_property("text", "")
  899. elif combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '1':
  900. vbox_step4.set_property("visible", False)
  901. alert_step4.set_property("visible", False)
  902. next4.set_property("visible", True)
  903. elif combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '2':
  904. vbox_step4.set_property("visible", False)
  905. alert_step4.set_property("visible", False)
  906. next4.set_property("visible", True)
  907. elif combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '3':
  908. vbox_step4.set_property("visible", False)
  909. alert_step4.set_property("visible", False)
  910. next4.set_property("visible", True)
  911. elif combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '4':
  912. vbox_step4.set_property("visible", True)
  913. next4.set_property("visible", True)
  914. elif combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '5':
  915. vbox_step4.set_property("visible", False)
  916. next4.set_property("visible", True)
  917. alert_step4.set_property("visible", False)
  918. def on_previous4_clicked(self, widget):
  919. step_view4 = self.wTree.get_object('vbox_step4')
  920. step_view4.set_property("visible", False)
  921. step_view3 = self.wTree.get_object('vbox_step3')
  922. step_view3.set_property("visible", True)
  923. alert_step4 = self.wTree.get_object('alert_step4')
  924. alert_step4.set_property("visible", False)
  925. combo_choose = self.wTree.get_object('combobox_step4')
  926. step4_entry_cem = self.wTree.get_object('step4_entry_cem')
  927. step4_entry_cem.set_property("text", "")
  928. self.combo_step4_choose = ""
  929. self.cem_option = ""
  930. def on_next4_clicked(self, widget):
  931. step_view4 = self.wTree.get_object('vbox_step4')
  932. step_view5 = self.wTree.get_object('vbox_step5')
  933. combo_choose = self.wTree.get_object('combobox_step4')
  934. step4_entry_cem = self.wTree.get_object('step4_entry_cem')
  935. alert_step4 = self.wTree.get_object('alert_step4')
  936. if step4_entry_cem.get_text() == '' and combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '4':
  937. alert_step4.set_property("visible", True)
  938. step_view4.set_property("visible", True)
  939. step_view5.set_property("visible", False)
  940. else:
  941. alert_step4.set_property("visible", False)
  942. step_view4.set_property("visible", False)
  943. step_view5.set_property("visible", True)
  944. self.combo_step4_choose = combo_choose.get_model().get_value(combo_choose.get_active_iter(),0)
  945. self.cem_option = step4_entry_cem.get_text()
  946. def on_combobox_step5_changed(self, widget):
  947. combo_choose = self.wTree.get_object('combobox_step5')
  948. vbox_step5 = self.wTree.get_object('vboxstep5')
  949. step5_entry_scripts = self.wTree.get_object('step5_entry_scripts')
  950. alert_step5 = self.wTree.get_object('alert_step5')
  951. next5 = self.wTree.get_object('next5')
  952. if combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '0':
  953. vbox_step5.set_property("visible", False)
  954. alert_step5.set_property("visible", False)
  955. next5.set_property("visible", False)
  956. step5_entry_scripts.set_property("text", "")
  957. elif combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '1':
  958. vbox_step5.set_property("visible", False)
  959. alert_step5.set_property("visible", False)
  960. next5.set_property("visible", True)
  961. elif combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '2':
  962. vbox_step5.set_property("visible", True)
  963. alert_step5.set_property("visible", False)
  964. next5.set_property("visible", True)
  965. elif combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '3':
  966. vbox_step5.set_property("visible", False)
  967. alert_step5.set_property("visible", False)
  968. next5.set_property("visible", True)
  969. def on_previous5_clicked(self, widget):
  970. step_view5 = self.wTree.get_object('vbox_step5')
  971. step_view5.set_property("visible", False)
  972. step_view4 = self.wTree.get_object('vbox_step4')
  973. step_view4.set_property("visible", True)
  974. alert_step5 = self.wTree.get_object('alert_step5')
  975. alert_step5.set_property("visible", False)
  976. combo_choose = self.wTree.get_object('combobox_step5')
  977. step5_entry_scripts = self.wTree.get_object('step5_entry_scripts')
  978. step5_entry_scripts.set_property("text", "")
  979. self.combo_step5_choose = ""
  980. self.scripts_option = ""
  981. def on_next5_clicked(self, widget):
  982. step_view5 = self.wTree.get_object('vbox_step5')
  983. step_view5.set_property("visible", False)
  984. step_view_end = self.wTree.get_object('vbox_end')
  985. step_view_end.set_property("visible", True)
  986. combo_choose = self.wTree.get_object('combobox_step5')
  987. step5_entry_scripts = self.wTree.get_object('step5_entry_scripts')
  988. alert_step5 = self.wTree.get_object('alert_step5')
  989. if step5_entry_scripts.get_text() == '' and combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == '2':
  990. alert_step5.set_property("visible", True)
  991. step_view5.set_property("visible", True)
  992. step_view_end.set_property("visible", False)
  993. else:
  994. alert_step5.set_property("visible", False)
  995. step_view5.set_property("visible", False)
  996. step_view_end.set_property("visible", True)
  997. self.combo_step5_choose = combo_choose.get_model().get_value(combo_choose.get_active_iter(),0)
  998. self.scripts_option = step5_entry_scripts.get_text()
  999. # building end form
  1000. end_entry_target = self.wTree.get_object('end_entry_target')
  1001. end_entry_shadow = self.wTree.get_object('end_entry_shadow')
  1002. end_entry_connection = self.wTree.get_object('end_entry_connection')
  1003. end_entry_bypasser = self.wTree.get_object('end_entry_bypasser')
  1004. end_entry_exploit = self.wTree.get_object('end_entry_exploit')
  1005. # step 1
  1006. if self.combo_step1_choose == "1":
  1007. end_entry_target.set_property("text", "URL: " + self.target_option)
  1008. if self.combo_step1_choose == "2":
  1009. end_entry_target.set_property("text", ("Dork: " + self.dork_option + " // Engine: " + self.dorkengine_option))
  1010. # step 2
  1011. if self.combo_step2_choose == "1":
  1012. end_entry_connection.set_property("text", ("Type: GET " + " // Payload: " + self.payload_option))
  1013. if self.combo_step2_choose == "2":
  1014. end_entry_connection.set_property("text", ("Type: POST " + " // Payload: " + self.payload_option))
  1015. if self.combo_step2_choose == "3":
  1016. end_entry_connection.set_property("text", "Type: Crawler")
  1017. if self.combo_step2_choose == "4":
  1018. end_entry_connection.set_property("text", "Type: AUTO")
  1019. # step 3
  1020. if self.combo_step3_choose == "1":
  1021. shadow_proxy = end_entry_shadow.set_property("text", self.proxy_option)
  1022. shadow_useragent = end_entry_shadow.set_property("text", self.useragent_option)
  1023. shadow_referer = end_entry_shadow.set_property("text", self.referer_option)
  1024. proxy = "PROXY listening on: " + self.proxy_option
  1025. end_entry_shadow.set_property("text", proxy)
  1026. if self.useragent_option != "":
  1027. end_entry_shadow.set_property("text", proxy + " + UA spoofing")
  1028. if self.referer_option != "":
  1029. end_entry_shadow.set_property("text", proxy + " + UA spoofing + RF spoofing")
  1030. else:
  1031. end_entry_shadow.set_property("text", proxy + " + UA spoofing(by default)")
  1032. if self.referer_option != "":
  1033. end_entry_shadow.set_property("text", proxy + " + UA spoofing(by default)+ RF spoofing")
  1034. if self.referer_option != "":
  1035. end_entry_shadow.set_property("text", proxy + " + RF spoofing")
  1036. if self.combo_step3_choose == "2":
  1037. proxy = "PROXY listening on: " + self.proxy_option
  1038. end_entry_shadow.set_property("text", proxy)
  1039. if self.combo_step3_choose == "3":
  1040. end_entry_shadow.set_property("text", "NO PROXY + UA spoofing(by default)")
  1041. if self.combo_step3_choose == "4":
  1042. end_entry_shadow.set_property("text", "DIRECT + UA spoofing(by default)")
  1043. # step 4
  1044. if self.combo_step4_choose == "1":
  1045. end_entry_bypasser.set_property("text", "Encode: Nothing")
  1046. if self.combo_step4_choose == "2":
  1047. end_entry_bypasser.set_property("text", "Encode: Hexadecimal")
  1048. if self.combo_step4_choose == "3":
  1049. end_entry_bypasser.set_property("text", "Encode: mix 'String.FromCharCode()' and 'Unescape()'")
  1050. if self.combo_step4_choose == "4":
  1051. end_entry_bypasser.set_property("text", self.cem_option)
  1052. if self.combo_step4_choose == "5":
  1053. end_entry_bypasser.set_property("text", "Encode: Nothing")
  1054. # step 5
  1055. if self.combo_step5_choose == "1":
  1056. end_entry_exploit.set_property("text", "Code: Classic 'XSS' alert box")
  1057. if self.combo_step5_choose == "2":
  1058. end_entry_exploit.set_property("text", self.scripts_option)
  1059. if self.combo_step5_choose == "3":
  1060. end_entry_exploit.set_property("text", "Code: Classic 'XSS' alert box")
  1061. def on_previous6_clicked(self, widget):
  1062. step_view_end = self.wTree.get_object('vbox_end')
  1063. step_view_end.set_property("visible", False)
  1064. step_view5 = self.wTree.get_object('vbox_step5')
  1065. step_view5.set_property("visible", True)
  1066. alert_step5 = self.wTree.get_object('alert_step5')
  1067. alert_step5.set_property("visible", False)
  1068. combo_choose = self.wTree.get_object('combobox_step5')
  1069. step5_entry_scripts = self.wTree.get_object('step5_entry_scripts')
  1070. step5_entry_scripts.set_property("text", "")
  1071. self.combo_step5_choose = ""
  1072. self.scripts_option = ""
  1073. def on_cancel_template_clicked(self, widget):
  1074. step_view_end = self.wTree.get_object('vbox_end')
  1075. step_view_end.set_property("visible", False)
  1076. step_view_start = self.wTree.get_object('vbox_start')
  1077. step1_entry_url = self.wTree.get_object('step1_entry_url')
  1078. step1_entry_dork = self.wTree.get_object('step1_entry_dork')
  1079. step2_entry_payload = self.wTree.get_object('step2_entry_payload')
  1080. step3_entry_proxy = self.wTree.get_object('step3_entry_proxy')
  1081. step4_entry_cem = self.wTree.get_object('step4_entry_cem')
  1082. step5_entry_scripts = self.wTree.get_object('step5_entry_scripts')
  1083. step_view_start.set_property("visible", True)
  1084. # reseting wizard options
  1085. # step 1
  1086. self.target_option = ""
  1087. self.dork_option = ""
  1088. self.dorkengine_option = ""
  1089. self.combo_step1_choose = ""
  1090. step1_entry_url.set_property("text", "")
  1091. step1_entry_dork.set_property("text", "")
  1092. # step 2
  1093. self.payload_option = ""
  1094. self.combo_step2_choose = ""
  1095. step2_entry_payload.set_property("text", "")
  1096. # step 3
  1097. self.combo_step3_choose = ""
  1098. self.proxy_option = ""
  1099. self.useragent_option = ""
  1100. self.referer_option = ""
  1101. step3_entry_proxy.set_property("text", "")
  1102. # step 4
  1103. self.combo_step4_choose = ""
  1104. self.cem_option = ""
  1105. step4_entry_cem.set_property("text", "")
  1106. # step 5
  1107. self.combo_step5_choose = ""
  1108. self.scripts_option = ""
  1109. step5_entry_scripts.set_property("text", "")
  1110. # remove parameters on autocompleter
  1111. commandsenter = self.wTree.get_object('commandsenter')
  1112. commandsenter.set_property("text", "xsser")
  1113. # clean all buffers
  1114. self.output_wizard.set_buffer(self._wizard_buffer)
  1115. def on_accept_template_clicked(self, widget):
  1116. """
  1117. Fly your mosquito(s) from wizard
  1118. """
  1119. # clean startup wizard buffer
  1120. step_view_end = self.wTree.get_object('vbox_end')
  1121. step_view_end.set_property("visible", False)
  1122. step_view_start = self.wTree.get_object('vbox_start')
  1123. step_view_start.set_property("visible", True)
  1124. fly_button = self.wTree.get_object('fly')
  1125. if self._flying:
  1126. self.on_stop_attack()
  1127. fly_button.set_label('LANDING!!!')
  1128. fly_button.set_sensitive(False)
  1129. return
  1130. self._report_errors.set_text('')
  1131. self._report_vulnerables.set_text('')
  1132. self._report_success.set_text('')
  1133. self._report_failed.set_text('')
  1134. self._report_crawling.set_text('')
  1135. self.output_wizard.set_buffer(self.output.get_buffer())
  1136. commandsenter = self.wTree.get_object('commandsenter')
  1137. cmd = self.generate_command()
  1138. commandsenter.set_property("text"," ".join(cmd))
  1139. t = XSSerThread(cmd, self.mothership)
  1140. t.add_reporter(self)
  1141. t.set_webbrowser(self.moz)
  1142. if self.map:
  1143. t.add_reporter(self.map)
  1144. self.mothership.add_reporter(self.map)
  1145. t.start()
  1146. self._flying = t
  1147. fly_button.set_label('LAND!!!')
  1148. step1_entry_url = self.wTree.get_object('step1_entry_url')
  1149. step1_entry_dork = self.wTree.get_object('step1_entry_dork')
  1150. step2_entry_payload = self.wTree.get_object('step2_entry_payload')
  1151. step3_entry_proxy = self.wTree.get_object('step3_entry_proxy')
  1152. step4_entry_cem = self.wTree.get_object('step4_entry_cem')
  1153. step5_entry_scripts = self.wTree.get_object('step5_entry_scripts')
  1154. step_view_start.set_property("visible", True)
  1155. # reseting wizard options
  1156. # step 1
  1157. self.target_option = ""
  1158. self.dork_option = ""
  1159. self.dorkengine_option = ""
  1160. self.combo_step1_choose = ""
  1161. step1_entry_url.set_property("text", "")
  1162. step1_entry_dork.set_property("text", "")
  1163. # step 2
  1164. self.payload_option = ""
  1165. self.combo_step2_choose = ""
  1166. step2_entry_payload.set_property("text", "")
  1167. # step 3
  1168. self.combo_step3_choose = ""
  1169. self.proxy_option = ""
  1170. self.useragent_option = ""
  1171. self.referer_option = ""
  1172. # step 4
  1173. self.combo_step4_choose = ""
  1174. self.cem_option = ""
  1175. step4_entry_cem.set_property("text", "")
  1176. # step 5
  1177. self.combo_step5_choose = ""
  1178. self.scripts_option = ""
  1179. step5_entry_scripts.set_property("text", "")
  1180. # remove parameters on autocompleter
  1181. commandsenter = self.wTree.get_object('commandsenter')
  1182. commandsenter.set_property("text", "xsser")
  1183. def on_combobox7_changed(self, widget):
  1184. """
  1185. Generate Geoip
  1186. """
  1187. combo_choose = self.wTree.get_object('combobox7')
  1188. image_geomap = self.wTree.get_object('image_geomap')
  1189. vbox9 = self.wTree.get_object('vbox9')
  1190. if combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == 'OFF':
  1191. self.map.set_property("visible", False)
  1192. vbox9.set_property("visible", False)
  1193. if self._flying:
  1194. self._flying.remove_reporter(self.map)
  1195. self.mothership.remove_reporter(self.map)
  1196. elif combo_choose.get_model().get_value(combo_choose.get_active_iter(),0) == 'ON':
  1197. vbox9.set_property("visible", True)
  1198. if not self.map:
  1199. image_geomap.realize()
  1200. drawarea = GlobalMap(self, image_geomap.get_pixbuf(), self._flying)
  1201. vbox = image_geomap.get_parent()
  1202. vbox.remove(image_geomap)
  1203. eventbox = gtk.EventBox()
  1204. eventbox.add(drawarea)
  1205. vbox.pack_end(eventbox, True, True, 0)
  1206. eventbox.show()
  1207. drawarea.show()
  1208. self.map = drawarea
  1209. if self._flying:
  1210. self.mothership.add_reporter(self.map)
  1211. self._flying.add_reporter(self.map)
  1212. self.map.set_property("visible", True)
  1213. def on_update_clicked(self, widget):
  1214. """
  1215. Search for latest XSSer version
  1216. """
  1217. webbrowser.open("https://github.com/epsylon/xsser")
  1218. def on_reportbug_clicked(self, widget):
  1219. """
  1220. Report bugs, ideas...
  1221. """
  1222. webbrowser.open("https://lists.sourceforge.net/lists/listinfo/xsser-users")
  1223. def on_donate_clicked(self, widget):
  1224. """
  1225. Donate something
  1226. """
  1227. webbrowser.open("https://03c8.net")
  1228. def generate_command(self):
  1229. command = ["xsser"]
  1230. # set automatic audit a entire target
  1231. # get target from url
  1232. target_all = self.wTree.get_object('targetall')
  1233. target_entry = self.wTree.get_object('targetenter')
  1234. if target_all.get_active() == False:
  1235. pass
  1236. else:
  1237. if target_entry.get_text() == "":
  1238. pass
  1239. else:
  1240. command.append("--all")
  1241. command.append(target_entry.get_text())
  1242. # get target from url
  1243. target_entry = self.wTree.get_object('targetenter')
  1244. if target_all.get_active() == True:
  1245. pass
  1246. else:
  1247. if target_entry.get_text() == "":
  1248. pass
  1249. else:
  1250. command.append("-u")
  1251. command.append(target_entry.get_text())
  1252. # get explorer test mode
  1253. explorer = self.wTree.get_object('explorer')
  1254. if explorer.get_active() == False:
  1255. pass
  1256. else:
  1257. explorer_enter = self.wTree.get_object('explorer_enter')
  1258. dork_engine = self.wTree.get_object('combobox4')
  1259. if explorer_enter.get_text() == "":
  1260. pass
  1261. else:
  1262. command.append("-d")
  1263. command.append(explorer_enter.get_text())
  1264. command.append("--De")
  1265. command.append(dork_engine.get_model().get_value(dork_engine.get_active_iter(),0))
  1266. # get crawler test mode (common crawling c=50 Cw=3)
  1267. crawler = self.wTree.get_object('crawler')
  1268. combobox5 = self.wTree.get_object('combobox5')
  1269. combobox_deep1 = self.wTree.get_object('combobox_deep1')
  1270. localonly1 = self.wTree.get_object('localonly1')
  1271. if crawler.get_active() == False:
  1272. pass
  1273. else:
  1274. command.append("-c")
  1275. command.append(str(int(combobox5.get_value())))
  1276. command.append("--Cw")
  1277. iter = combobox_deep1.get_active_iter()
  1278. command.append(combobox_deep1.get_model().get_value(iter, 0))
  1279. if localonly1.get_active() == True:
  1280. command.append("--Cl")
  1281. # get statistics
  1282. target_entry = self.wTree.get_object('statistics')
  1283. if target_entry.get_active() == False:
  1284. pass
  1285. else:
  1286. command.append("-s")
  1287. # get verbose
  1288. target_entry = self.wTree.get_object('verbose')
  1289. if target_entry.get_active() == False:
  1290. pass
  1291. else:
  1292. command.append("-v")
  1293. # use GET connections
  1294. target_entry = self.wTree.get_object('get')
  1295. if target_entry.get_active() == False:
  1296. pass
  1297. else:
  1298. target_entry = self.wTree.get_object('connection_parameters')
  1299. if target_entry.get_text() == "":
  1300. pass
  1301. else:
  1302. command.append("-g")
  1303. command.append(target_entry.get_text())
  1304. # use POST connections
  1305. target_entry = self.wTree.get_object('post')
  1306. if target_entry.get_active() == False:
  1307. pass
  1308. else:
  1309. target_entry = self.wTree.get_object('connection_parameters')
  1310. if target_entry.get_text() == "":
  1311. pass
  1312. else:
  1313. command.append("-p")
  1314. command.append(target_entry.get_text())
  1315. # use checker system HEAD
  1316. target_entry = self.wTree.get_object('no-head')
  1317. if target_entry.get_active() == False:
  1318. pass
  1319. else:
  1320. command.append("--head")
  1321. # use checker system HASH
  1322. target_entry = self.wTree.get_object('hashing')
  1323. if target_entry.get_active() == False:
  1324. pass
  1325. else:
  1326. command.append("--hash")
  1327. # use checker system HEURISTIC
  1328. target_entry = self.wTree.get_object('heuristic')
  1329. if target_entry.get_active() == False:
  1330. pass
  1331. else:
  1332. command.append("--heuristic")
  1333. # get USER-AGENT
  1334. target_entry = self.wTree.get_object('useragent')
  1335. command.append("--user-agent")
  1336. command.append(target_entry.get_text())
  1337. # get REFERER
  1338. target_entry = self.wTree.get_object('referer')
  1339. if target_entry.get_text() == "":
  1340. pass
  1341. else:
  1342. command.append("--referer")
  1343. command.append(target_entry.get_text())
  1344. # get COOKIE
  1345. target_entry = self.wTree.get_object('cookie')
  1346. if target_entry.get_text() == "":
  1347. pass
  1348. else:
  1349. command.append("--cookie")
  1350. command.append(target_entry.get_text())
  1351. # get Authentication BASIC
  1352. target_entry = self.wTree.get_object('auth_basic')
  1353. if target_entry.get_active() == False:
  1354. pass
  1355. else:
  1356. command.append("--auth-type")
  1357. command.append("basic")
  1358. # get Authentication DIGEST
  1359. target_entry = self.wTree.get_object('auth_digest')
  1360. if target_entry.get_active() == False:
  1361. pass
  1362. else:
  1363. command.append("--auth-type")
  1364. command.append("digest")
  1365. # get Authentication GSS
  1366. target_entry = self.wTree.get_object('auth_gss')
  1367. if target_entry.get_active() == False:
  1368. pass
  1369. else:
  1370. command.append("--auth-type")
  1371. command.append("gss")
  1372. # get Authentication NTLM
  1373. target_entry = self.wTree.get_object('auth_ntlm')
  1374. if target_entry.get_active() == False:
  1375. pass
  1376. else:
  1377. command.append("--auth-type")
  1378. command.append("ntlm")
  1379. # get Authentication Credentials
  1380. target_entry = self.wTree.get_object('auth_cred')
  1381. if target_entry.get_text() == "":
  1382. pass
  1383. else:
  1384. command.append("--auth-cred")
  1385. command.append(target_entry.get_text())
  1386. # get PROXY
  1387. proxy = self.wTree.get_object('proxy')
  1388. if proxy.get_text() == "":
  1389. pass
  1390. else:
  1391. command.append("--proxy")
  1392. command.append(proxy.get_text())
  1393. if proxy.get_text() == "http://127.0.0.1:8118":
  1394. torproxy = self.wTree.get_object('torproxy')
  1395. torproxy.set_property('active', True)
  1396. else:
  1397. torproxy.set_property('active', False)
  1398. # get IGNORE-PROXY
  1399. target_entry = self.wTree.get_object('ignore-proxy')
  1400. if target_entry.get_active() == False:
  1401. pass
  1402. else:
  1403. command.append("--ignore-proxy")
  1404. # get DROP-COOKIE
  1405. target_entry = self.wTree.get_object('drop-cookie')
  1406. if target_entry.get_active() == False:
  1407. pass
  1408. else:
  1409. command.append("--drop-cookie")
  1410. # get XFORW
  1411. target_entry = self.wTree.get_object('xforw')
  1412. if target_entry.get_active() == False:
  1413. pass
  1414. else:
  1415. command.append("--xforw")
  1416. # get XCLIENT
  1417. target_entry = self.wTree.get_object('xclient')
  1418. if target_entry.get_active() == False:
  1419. pass
  1420. else:
  1421. command.append("--xclient")
  1422. # get TCP-NODELAY
  1423. target_entry = self.wTree.get_object('tcp-nodelay')
  1424. if target_entry.get_active() == False:
  1425. pass
  1426. else:
  1427. command.append("--tcp-nodelay")
  1428. # get REVERSE-CHECK
  1429. target_entry = self.wTree.get_object('reverse-check')
  1430. if target_entry.get_active() == False:
  1431. pass
  1432. else:
  1433. command.append("--reverse-check")
  1434. # get DISCARD CODE
  1435. target_entry = self.wTree.get_object('discode')
  1436. if target_entry.get_text() == "":
  1437. pass
  1438. else:
  1439. command.append("--discode")
  1440. command.append(target_entry.get_text())
  1441. # get FOLLOWREDIRECTS
  1442. target_entry = self.wTree.get_object('followredirects')
  1443. if target_entry.get_active() == False:
  1444. pass
  1445. else:
  1446. command.append("--follow-redirects")
  1447. # get FOLLOW-LIMIT
  1448. target_entry = self.wTree.get_object('follow-limit')
  1449. if target_entry.get_value() == 0:
  1450. pass
  1451. else:
  1452. command.append("--follow-limit")
  1453. command.append(str(int(target_entry.get_value())))
  1454. # get ISALIVE
  1455. target_entry = self.wTree.get_object('alive-limit')
  1456. if target_entry.get_value() == 0:
  1457. pass
  1458. else:
  1459. command.append("--alive")
  1460. command.append(str(int(target_entry.get_value())))
  1461. # get CHECK-AT-URL
  1462. target_entry = self.wTree.get_object('checkaturl')
  1463. check_method = self.wTree.get_object('combobox1')
  1464. check_data = self.wTree.get_object('checkatdata')
  1465. if target_entry.get_text() == "":
  1466. pass
  1467. else:
  1468. command.append("--checkaturl")
  1469. command.append(target_entry.get_text())
  1470. command.append("--checkmethod")
  1471. command.append(check_method.get_model().get_value(checkmethod.get_active_iter(),0))
  1472. if check_data.get_text() == "":
  1473. pass
  1474. else:
  1475. command.append("--checkatdata")
  1476. command.append(check_data.get_text())
  1477. # get THREADS
  1478. target_entry = self.wTree.get_object('threads')
  1479. if target_entry.get_value() == 0:
  1480. pass
  1481. else:
  1482. command.append("--threads")
  1483. command.append(str(int(target_entry.get_value())))
  1484. # get TIMEOUT
  1485. target_entry = self.wTree.get_object('timeout')
  1486. command.append("--timeout")
  1487. command.append(str(int(target_entry.get_value())))
  1488. # get RETRIES
  1489. target_entry = self.wTree.get_object('retries')
  1490. command.append("--retries")
  1491. command.append(str(int(target_entry.get_value())))
  1492. # get DELAY
  1493. target_entry = self.wTree.get_object('delay')
  1494. command.append("--delay")
  1495. command.append(str(int(target_entry.get_value())))
  1496. # get Extra Headers
  1497. target_entry = self.wTree.get_object('extra_headers')
  1498. if target_entry.get_text() == "":
  1499. pass
  1500. else:
  1501. command.append("--headers")
  1502. command.append(target_entry.get_text())
  1503. # get Payload
  1504. target_entry = self.wTree.get_object('enterpayload')
  1505. if target_entry.get_text() == "":
  1506. pass
  1507. else:
  1508. command.append("--payload")
  1509. command.append(target_entry.get_text())
  1510. # get Automatic Payload test
  1511. target_entry = self.wTree.get_object('automatic_payload')
  1512. if target_entry.get_active() == False:
  1513. pass
  1514. else:
  1515. command.append("--auto")
  1516. # get Bypasser: StringFromCharCode()
  1517. target_entry = self.wTree.get_object('by_sfcc')
  1518. if target_entry.get_active() == False:
  1519. pass
  1520. else:
  1521. command.append("--Str")
  1522. # get Bypasser: Unescape()
  1523. target_entry = self.wTree.get_object('by_unescape')
  1524. if target_entry.get_active() == False:
  1525. pass
  1526. else:
  1527. command.append("--Une")
  1528. # get Bypasser: Hexadecimal
  1529. target_entry = self.wTree.get_object('by_hex')
  1530. if target_entry.get_active() == False:
  1531. pass
  1532. else:
  1533. command.append("--Hex")
  1534. # get Bypasser: Hexadecimal with semicolons
  1535. target_entry = self.wTree.get_object('by_hes')
  1536. if target_entry.get_active() == False:
  1537. pass
  1538. else:
  1539. command.append("--Hes")
  1540. # get Bypasser: Dword
  1541. target_entry = self.wTree.get_object('by_dword')
  1542. if target_entry.get_active() == False:
  1543. pass
  1544. else:
  1545. command.append("--Dwo")
  1546. # get Bypasser: Octal
  1547. target_entry = self.wTree.get_object('by_octal')
  1548. if target_entry.get_active() == False:
  1549. pass
  1550. else:
  1551. command.append("--Doo")
  1552. # get Bypasser: Decimal
  1553. target_entry = self.wTree.get_object('by_decimal')
  1554. if target_entry.get_active() == False:
  1555. pass
  1556. else:
  1557. command.append("--Dec")
  1558. # get Bypasser: CEM
  1559. target_entry = self.wTree.get_object('enter_cem')
  1560. if target_entry.get_text() == "":
  1561. pass
  1562. else:
  1563. command.append("--Cem")
  1564. command.append(target_entry.get_text())
  1565. # get Technique: Cookie Injection
  1566. target_entry = self.wTree.get_object('cookie_injection')
  1567. if target_entry.get_active() == False:
  1568. pass
  1569. else:
  1570. command.append("--Coo")
  1571. # get Technique: Cross Site Agent Scripting
  1572. target_entry = self.wTree.get_object('xas')
  1573. if target_entry.get_active() == False:
  1574. pass
  1575. else:
  1576. command.append("--Xsa")
  1577. # get Technique: Cross Site Referer Scripting
  1578. target_entry = self.wTree.get_object('xsr')
  1579. if target_entry.get_active() == False:
  1580. pass
  1581. else:
  1582. command.append("--Xsr")
  1583. # get Technique: Document Object Model injections
  1584. target_entry = self.wTree.get_object('dom')
  1585. if target_entry.get_active() == False:
  1586. pass
  1587. else:
  1588. command.append("--Dom")
  1589. # get Technique: Data Control Protocol injections
  1590. target_entry = self.wTree.get_object('dcp')
  1591. if target_entry.get_active() == False:
  1592. pass
  1593. else:
  1594. command.append("--Dcp")
  1595. # get Technique: HTTP Response Splitting Induced code
  1596. target_entry = self.wTree.get_object('induced')
  1597. if target_entry.get_active() == False:
  1598. pass
  1599. else:
  1600. command.append("--Ind")
  1601. # get Technique: Use Anchor Stealth
  1602. target_entry = self.wTree.get_object('anchor')
  1603. if target_entry.get_active() == False:
  1604. pass
  1605. else:
  1606. command.append("--Anchor")
  1607. # get Technique: PHP IDS bug (0.6.5)
  1608. target_entry = self.wTree.get_object('phpids')
  1609. if target_entry.get_active() == False:
  1610. pass
  1611. else:
  1612. command.append("--Phpids0.6.5")
  1613. # get Technique: PHP IDS bug (0.7.0)
  1614. target_entry = self.wTree.get_object('phpids070')
  1615. if target_entry.get_active() == False:
  1616. pass
  1617. else:
  1618. command.append("--Phpids0.7")
  1619. # get Technique: Imperva
  1620. target_entry = self.wTree.get_object('imperva')
  1621. if target_entry.get_active() == False:
  1622. pass
  1623. else:
  1624. command.append("--Imperva")
  1625. # get Technique: WebKnight (4.1)
  1626. target_entry = self.wTree.get_object('webknight')
  1627. if target_entry.get_active() == False:
  1628. pass
  1629. else:
  1630. command.append("--Webknight")
  1631. # get Technique: F5 Big Ip
  1632. target_entry = self.wTree.get_object('f5bigip')
  1633. if target_entry.get_active() == False:
  1634. pass
  1635. else:
  1636. command.append("--F5bigip")
  1637. # get Technique: Barracuda
  1638. target_entry = self.wTree.get_object('barracuda')
  1639. if target_entry.get_active() == False:
  1640. pass
  1641. else:
  1642. command.append("--Barracuda")
  1643. # get Technique: Apache modsec
  1644. target_entry = self.wTree.get_object('modsec')
  1645. if target_entry.get_active() == False:
  1646. pass
  1647. else:
  1648. command.append("--Modsec")
  1649. # get Technique: QuickDefense
  1650. target_entry = self.wTree.get_object('quickdefense')
  1651. if target_entry.get_active() == False:
  1652. pass
  1653. else:
  1654. command.append("--Quickdefense")
  1655. # get Technique: Firefox
  1656. target_entry = self.wTree.get_object('firefox')
  1657. if target_entry.get_active() == False:
  1658. pass
  1659. else:
  1660. command.append("--Firefox")
  1661. # get Technique: Chrome
  1662. target_entry = self.wTree.get_object('chrome')
  1663. if target_entry.get_active() == False:
  1664. pass
  1665. else:
  1666. command.append("--Chrome")
  1667. # get Technique: IExplorer
  1668. target_entry = self.wTree.get_object('iexplorer')
  1669. if target_entry.get_active() == False:
  1670. pass
  1671. else:
  1672. command.append("--Iexplorer")
  1673. # get Technique: Opera
  1674. target_entry = self.wTree.get_object('opera')
  1675. if target_entry.get_active() == False:
  1676. pass
  1677. else:
  1678. command.append("--Opera")
  1679. # get Final code: Normal Payload
  1680. target_entry = self.wTree.get_object('normalfinal')
  1681. if target_entry.get_active() == False:
  1682. pass
  1683. else:
  1684. target_entry = self.wTree.get_object('payload_entry')
  1685. if target_entry.get_text() == "":
  1686. pass
  1687. else:
  1688. command.append("--Fp")
  1689. command.append(target_entry.get_text())
  1690. # get Final code: Remote Payload
  1691. target_entry = self.wTree.get_object('remotefinal')
  1692. if target_entry.get_active() == False:
  1693. pass
  1694. else:
  1695. target_entry = self.wTree.get_object('payload_entry')
  1696. if target_entry.get_text() == "":
  1697. pass
  1698. else:
  1699. command.append("--Fr")
  1700. command.append(target_entry.get_text())
  1701. # get Final code: DOS client side
  1702. target_entry = self.wTree.get_object('dosclient')
  1703. if target_entry.get_active() == False:
  1704. pass
  1705. else:
  1706. command.append("--Dos")
  1707. # get Final code: DOS Server side
  1708. target_entry = self.wTree.get_object('dosserver')
  1709. if target_entry.get_active() == False:
  1710. pass
  1711. else:
  1712. command.append("--Doss")
  1713. # get Final code: Base 64 POC
  1714. target_entry = self.wTree.get_object('b64')
  1715. if target_entry.get_active() == False:
  1716. pass
  1717. else:
  1718. command.append("--B64")
  1719. # get Final code: OnMouseMove event ()
  1720. target_entry = self.wTree.get_object('onmouse')
  1721. if target_entry.get_active() == False:
  1722. pass
  1723. else:
  1724. command.append("--Onm")
  1725. # get Final code: Iframe tag
  1726. target_entry = self.wTree.get_object('iframe')
  1727. if target_entry.get_active() == False:
  1728. pass
  1729. else:
  1730. command.append("--Ifr")
  1731. # get SAVE results option
  1732. target_entry = self.wTree.get_object('save')
  1733. if target_entry.get_active() == False:
  1734. pass
  1735. else:
  1736. command.append("--save")
  1737. # get Export xml option
  1738. target_entry = self.wTree.get_object('exportxml')
  1739. if target_entry.get_active() == False:
  1740. pass
  1741. else:
  1742. command.append("--xml")
  1743. command.append("xsser-test:" + str(datetime.datetime.now()) + ".xml")
  1744. # generate wizard commands
  1745. # step 1
  1746. if self.target_option != "":
  1747. command.append("-u")
  1748. command.append(self.target_option)
  1749. elif self.dork_option != "":
  1750. command.append("-d")
  1751. command.append(self.dork_option)
  1752. command.append("--De")
  1753. command.append(self.dorkengine_option)
  1754. # step 2
  1755. if self.combo_step2_choose == "1":
  1756. if self.payload_option != "":
  1757. command.append("-g")
  1758. command.append(self.payload_option)
  1759. elif self.combo_step2_choose == "2":
  1760. if self.payload_option != "":
  1761. command.append("-p")
  1762. command.append(self.payload_option)
  1763. elif self.combo_step2_choose == "3":
  1764. command.append("-c")
  1765. command.append("50")
  1766. command.append("--Cw")
  1767. command.append("3")
  1768. elif self.combo_step2_choose == "4":
  1769. command.append("-c")
  1770. command.append("20")
  1771. command.append("--Cw")
  1772. command.append("2")
  1773. command.append("--auto")
  1774. command.append("--Cl")
  1775. # step 3
  1776. step3_entry_proxy = self.wTree.get_object('step3_entry_proxy')
  1777. useragent = self.wTree.get_object('useragent')
  1778. if self.combo_step3_choose == "1":
  1779. command.append("--proxy")
  1780. command.append(step3_entry_proxy.get_text())
  1781. if useragent.get_text() == "Googlebot/2.1 (+http://www.google.com/bot.html)":
  1782. pass
  1783. else:
  1784. command.append("--user-agent")
  1785. command.append("Googlebot/2.1 (+http://www.google.com/bot.html)")
  1786. command.append("--referer")
  1787. command.append("http://127.0.0.1")
  1788. if self.combo_step3_choose == "2":
  1789. command.append("--proxy")
  1790. command.append("http://127.0.0.1:8118")
  1791. if self.combo_step3_choose == "3":
  1792. if useragent.get_text() == "Googlebot/2.1 (+http://www.google.com/bot.html)":
  1793. pass
  1794. else:
  1795. command.append("--user-agent")
  1796. command.append("Googlebot/2.1 (+http://www.google.com/bot.html)")
  1797. command.append("--referer")
  1798. command.append("http://127.0.0.1")
  1799. if self.combo_step3_choose == "4":
  1800. pass
  1801. # step 4
  1802. if self.combo_step4_choose == "1":
  1803. pass
  1804. if self.combo_step4_choose == "2":
  1805. command.append("--Hex")
  1806. if self.combo_step4_choose == "3":
  1807. command.append("--Mix")
  1808. if self.combo_step4_choose == "4":
  1809. command.append("--Cem")
  1810. command.append(self.cem_option)
  1811. if self.combo_step4_choose == "5":
  1812. command.append("--Str")
  1813. # step 5
  1814. if self.combo_step5_choose == "1":
  1815. pass
  1816. if self.combo_step5_choose == "2":
  1817. command.append("--payload")
  1818. command.append(self.scripts_option)
  1819. if self.combo_step5_choose == "3":
  1820. pass
  1821. # propagate the silent flag
  1822. if '--silent' in sys.argv:
  1823. command.append('--silent')
  1824. return command
  1825. def post(self, msg):
  1826. """
  1827. Callback called by xsser when it has output for the user
  1828. """
  1829. gdk.threads_enter()
  1830. self.post_ui(msg)
  1831. gdk.threads_leave()
  1832. def post_ui(self, msg):
  1833. """
  1834. Post a message to the interface in the interface thread
  1835. """
  1836. buffer = self.output.get_buffer()
  1837. iter = buffer.get_end_iter()
  1838. buffer.insert(iter, msg+'\n')
  1839. class XSSerThread(Thread):
  1840. def __init__ (self, cmd, mothership):
  1841. Thread.__init__(self)
  1842. self.app = xsser(mothership)
  1843. self._cmd = cmd
  1844. options = self.app.create_options(cmd)
  1845. self.app.set_options(options)
  1846. def set_webbrowser(self, browser):
  1847. self.app.set_webbrowser(browser)
  1848. def remove_reporter(self, reporter):
  1849. self.app.remove_reporter(reporter)
  1850. def add_reporter(self, reporter):
  1851. self.app.add_reporter(reporter)
  1852. def run(self):
  1853. self.app.run(self._cmd[1:])
  1854. if __name__ == "__main__":
  1855. uifile = "xsser.ui"
  1856. controller = Controller(uifile)
  1857. reactor.run()