20 | ';alert('XSS');//
--------------------------------------------------------------------------------
/xss_finder /src/How_to.txt:
--------------------------------------------------------------------------------
1 | What to do in Config File:
2 |
3 | [genera]
4 | -Change the base URL to your website name with out the protocol (no http/https)
5 | -Leave "expected_xss_responses" blank to test for the payload being used
6 | -Please enter the form key parameter name in "form_key" (this script only work if there is one for key parameter name consistent thorough out the website)
7 | -multi threading some time leads to false positive , so better leave it to 1 (trade off accuracy over speed)
8 |
9 | [files]
10 | -after reading all the URL(s), parameter from command line in POST url everything is stored in "sites" file
11 | -in GET url case everything is stored in "get_sites" files
12 | -payload are define in "payloads" file
13 |
14 | [login]
15 | -"login_email" will contain your email id to be used while loggin you in
16 | -"login_password" will beyour password for the above email id
17 | -"login_url" would be the POST/GEt url where the email id and password have to be submitted with form key token for successful login
18 | -"formkey_url" would be the GET Url for the page from where the script has to fetch for key token.
19 |
20 |
--------------------------------------------------------------------------------
/xss_finder /src/cfghlp.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 |
3 |
4 | import ConfigParser
5 |
6 | # -------------------------------------
7 | class ConfigHelper:
8 | # -------------------------------------
9 |
10 | _configObj = None
11 |
12 | # -------------------------------------
13 | def __init__(self, configFile=None, debug=False):
14 | # -------------------------------------
15 |
16 | self._configObj = ConfigParser.SafeConfigParser()
17 | self._configObj.read(configFile)
18 |
19 | if debug == True:
20 | for section in self._configObj.sections():
21 | for option in self._configObj.options(section):
22 | print '[%s] %s = %s' % (section,option,self._configObj.get(section,option))
23 |
24 | # -------------------------------------
25 | def getSections(self):
26 | # -------------------------------------
27 |
28 | return self._configObj.sections()
29 |
30 | # -------------------------------------
31 | def getOptions(self,section):
32 | # -------------------------------------
33 |
34 | if section not in self._configObj.sections():
35 | return None
36 | else:
37 | return self._configObj.options(section)
38 |
39 | # -------------------------------------
40 | def get(self,section,option):
41 | # -------------------------------------
42 |
43 | if section not in self._configObj.sections() or option not in self._configObj.options(section):
44 | return None
45 | else:
46 | return self._configObj.get(section,option)
47 |
--------------------------------------------------------------------------------
/xss_finder /src/cli_param.py:
--------------------------------------------------------------------------------
1 | __author__ = 'mohd.siddiqui'
2 | import sys, re, urllib2, json, time, cookielib, urllib
3 | from datetime import datetime
4 | #from threadpool import *
5 | from cfghlp import ConfigHelper
6 |
7 |
8 |
9 | fk_url = str(raw_input("\nType the URL of page where the form is: "))
10 | ssl = fk_url[:5]
11 | #print ssl
12 | if ssl == "https":
13 | set_ssl = "true"
14 | else:
15 | set_ssl = "false"
16 |
17 | post_url = str(raw_input("\nType in th post URl: "))
18 | try:
19 | no_of_params = int(raw_input("\nEnter the no. of parameters that will be submitted(integer only): "))
20 | except ValueError:
21 | print "\nYou had to enter a no. please re run the script and be carefull \n"
22 | sys.exit(0)
23 | #print no_of_params
24 | a_param = 0
25 | params = dict()
26 | while a_param < no_of_params:
27 | #print a_param
28 | key = str(raw_input("\n Enter the param: "))
29 | value = str(raw_input("\n Enter the corresponding value: "))
30 | params[key] = value
31 | a_param = a_param + 1
32 | p = json.dumps(params, sort_keys=True, indent=4)
33 |
34 | login_dict = {}
35 | login_dict = {"request": {}, "response": {}}
36 | #print login_dict
37 | #login_dict["req"]={}
38 | login_dict["request"]["mode"] = 'POST'
39 | login_dict["request"]["fk_url"] = fk_url
40 | login_dict["request"]["use_ssl"] = set_ssl
41 | login_dict["request"]["params"] = params
42 | login_dict["request"]["post_url"] = post_url
43 | #print login_dict
44 | login_dict["response"]["mode"] = "GET"
45 | login_dict["response"]["url"] = fk_url
46 | login_dict["response"]["params"] = ""
47 |
48 | s = json.dumps(login_dict)
49 | f = open("sites", 'a')
50 | f.write(s + "\n")
51 | f.close()
52 |
--------------------------------------------------------------------------------
/Readme.txt:
--------------------------------------------------------------------------------
1 | Hey Everyone,
2 |
3 | I am releasing my script to check XSS (Cross Site Scripting) in any given Url.
4 | Its a simple script with event driven menu where you can test all your GET and POST urls.
5 | I wrote the whole code in python but to make it simple for everyone to run it I wrote a small shell script which you just need to run (follow instruction) and it will take care of everything from taking inputs to testing. I tried minimum human intervention .
6 | You just run the script go have a cup of coffee and it will do the rest of work and will inform you if it finds anything suspicious.
7 | The reason I started with XSS is because its most common vulnerability in our website as well as in all other websites as well.
8 |
9 | How to use the script:
10 |
11 | 1) Unzip the attached file and change your current working directory to the folder you have unzipped in command prompt.
12 | 2) Please read the "How_to" file for making config changes.
13 | 3) In command prompt type "sh xss.sh"
14 | 4) It will take you through a event driven menu to get the URL you want to test
15 | 5) Then it will start testing the given URL ( It can take upto 1 - 5 minutes depending upon the no. of parameters and payload )
16 | 6) If any of the parameter in URL is vulnerable then you will see it in command prompt else you will see "Nothing Found " message .
17 |
18 | Some dependencies/configuration:
19 | 1)xss.cfg file contains basic configuration please make required changes there before running the script.
20 |
21 | Hope this will make your life easier and will add extra layer of security ,so that everything can be tested with this first before being pushed to prod.
22 |
23 | Note:I would be releasing its web version soon with many changes.
24 |
25 | #Contact info:"m.shadab.sidd@gmail.com"
26 |
--------------------------------------------------------------------------------
/xss_finder /src/Readme.txt:
--------------------------------------------------------------------------------
1 | Hey Everyone,
2 |
3 | I am releasing my script to check XSS (Cross Site Scripting) in any given Url.
4 | Its a simple script with event driven menu where you can test all your GET and POST urls.
5 | I wrote the whole code in python but to make it simple for everyone to run it I wrote a small shell script which you just need to run (follow instruction) and it will take care of everything from taking inputs to testing. I tried minimum human intervention .
6 | You just run the script go have a cup of coffee and it will do the rest of work and will inform you if it finds anything suspicious.
7 | The reason I started with XSS is because its most common vulnerability in our website as well as in all other websites as well.
8 |
9 | How to use the script:
10 |
11 | 1) Unzip the attached file and change your current working directory to the folder you have unzipped in command prompt.
12 | 2) Please read the "How_to" file for making config changes.
13 | 3) In command prompt type "sh xss.sh"
14 | 4) It will take you through a event driven menu to get the URL you want to test
15 | 5) Then it will start testing the given URL ( It can take upto 1 - 5 minutes depending upon the no. of parameters and payload )
16 | 6) If any of the parameter in URL is vulnerable then you will see it in command prompt else you will see "Nothing Found " message .
17 |
18 | Some dependencies/configuration:
19 | 1)xss.cfg file contains basic configuration please make required changes there before running the script.
20 |
21 | Hope this will make your life easier and will add extra layer of security ,so that everything can be tested with this first before being pushed to prod.
22 |
23 | Note:I would be releasing its web version soon with many changes.
24 |
25 | #Contact info:"m.shadab.sidd@gmail.com"
26 |
27 |
28 |
--------------------------------------------------------------------------------
/xss_finder /src/xss.sh:
--------------------------------------------------------------------------------
1 | #!/bin/sh
2 | filename="sites";
3 | echo '\n\n What do you want to test ?'
4 | echo '\n1. GET urls (URLs were params are in url )\n'
5 | echo '2. POST urls ()\n'
6 | echo ' Your Choice'
7 | read test
8 |
9 | if [ $test -eq '2' ]
10 | then
11 | size=$(ls -l $filename | awk '{ print $5 }')
12 | #echo $size
13 | if [ $size -gt '0' ]
14 | then
15 | echo '\nThere is already some URL to test in "sites" file \n1.Do you want to test them \n2. Do you want to test a new URL ?\n'
16 | read input
17 | if [ $input -eq '1' ]
18 | then
19 | python check_domain.py
20 | a=$?
21 | if [ $a -eq '1' ]
22 | then
23 | python post_xss.py
24 | else
25 | #python cli_param.py
26 | exit 1
27 | fi
28 | elif [ $input -eq '2' ]
29 | then
30 | #echo 'Do you want to enter parameters in CLI mode or want to edit '
31 | echo '\n\nRunning the configuration file and removing the previous content copying all your previous content to old_sites file'
32 | cat sites>>old_sites
33 | > sites
34 | python cli_param.py
35 | #python post_xss.py
36 | #exit 1
37 | else
38 | echo '\n Wrong Input'
39 | fi
40 | elif [ $size -eq '0' ]
41 | then
42 | echo 'Running the configuration file as there is nothing to test '
43 | python check_domain.py
44 | python cli_param.py
45 | #python test_xss.py
46 | fi
47 |
48 | elif [ $test -eq '1' ]
49 | then
50 | python get_xss.py
51 | exit 1
52 | else
53 | echo '\nWrong input re-run the script\n'
54 | fi
55 | python post_xss.py
--------------------------------------------------------------------------------
/xss_finder /src/threadpool.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 |
3 | from Queue import Queue
4 | from threading import Thread
5 |
6 | # -------------------------------------
7 | class ThreadPoolWorker(Thread):
8 | # -------------------------------------
9 |
10 | tasks_queue = None
11 |
12 | # -------------------------------------
13 | def __init__(self, tasks_queue):
14 | # -------------------------------------
15 |
16 | # Init
17 | Thread.__init__(self)
18 |
19 | self.tasks_queue = tasks_queue
20 |
21 | # Start daemon thread
22 | self.daemon = True
23 | self.start()
24 |
25 | # -------------------------------------
26 | def __del__(self):
27 | # -------------------------------------
28 |
29 | pass
30 |
31 | # -------------------------------------
32 | def run(self):
33 | # -------------------------------------
34 |
35 | # Endless loop
36 | while True:
37 | # Fetch item from queue
38 | func, args, kargs = self.tasks_queue.get()
39 |
40 | # Execute task
41 | #func(*args, **kargs)
42 | try:
43 | func(*args, **kargs)
44 | except Exception, e:
45 | print 'Args',func, args, kargs
46 | print 'Exception',e
47 |
48 | # Mark task as completed (remove from queue)
49 | self.tasks_queue.task_done()
50 |
51 | # -------------------------------------
52 | class ThreadPool:
53 | # -------------------------------------
54 |
55 | num_threads = None
56 | tasks_queue = None
57 |
58 | DEFAULT_NUM_THREADS = 5
59 |
60 | # -------------------------------------
61 | def __init__(self, num_threads=DEFAULT_NUM_THREADS):
62 | # -------------------------------------
63 |
64 | # Init
65 | self.num_threads = num_threads
66 | self.tasks_queue = Queue(num_threads)
67 |
68 | # Create 'num_threads' worker threads
69 | for i in range(num_threads):
70 | ThreadPoolWorker(self.tasks_queue)
71 |
72 | # -------------------------------------
73 | def enqueue(self, func, *args, **kargs):
74 | # -------------------------------------
75 |
76 | # Add a task to the queue
77 | self.tasks_queue.put((func, args, kargs))
78 |
79 | # -------------------------------------
80 | def wait(self):
81 | # -------------------------------------
82 |
83 | # Wait for completion of all the tasks in the queue
84 | self.tasks_queue.join()
85 |
86 | # -------------------------------------
87 | if __name__ == '__main__':
88 | # -------------------------------------
89 |
90 | print 'Error : This python script cannot be run as a standalone program.'
91 |
--------------------------------------------------------------------------------
/xss_finder /src/get_xss.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 |
3 |
4 |
5 | # Imports
6 | import sys, re, urllib2, urlparse, json, time, httplib,cookielib,urllib
7 | from threadpool import *
8 |
9 |
10 | # Config
11 | DEBUG = True
12 | MAX_THREAD_COUNT = 10
13 | SITES_FILENAME = 'sites'
14 | PAYLOADS_FILENAME = 'get_payload'
15 | SCHEME_DELIMITER = '://'
16 | #XSS_RESPONSE = "alert('XSS')"
17 |
18 | cj = cookielib.CookieJar()
19 | opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
20 |
21 | intt=0
22 | # -------------------------------------
23 | def attack(url, payload):
24 | # -------------------------------------
25 |
26 | t_start = time.time()
27 | print "..."
28 | return_dict = dict()
29 | return_dict['url'] = url
30 | #return_dict['url_data'] = data
31 | return_dict['vulnerability'] = False
32 | #post_url='http://test.com' # the url in which XSS test needs to be done and it is different from url where we posted params
33 | try:
34 | return_dict['method'] = 'GET'
35 | XSS_RESPONSE=payload
36 | #print "payload--->", payload
37 | attack= urllib2.urlopen(url).read()
38 | #print "\nURL being hit :", url
39 | index = attack.find(XSS_RESPONSE)
40 | buffer = 20
41 | print_url=url.replace("<","<")
42 | attack = attack.split("\n");
43 | len(attack)
44 | #print "\nurl->\n",url
45 | if index != -1:
46 | return_dict[' vulnerability'] = True
47 | print "\nThis url seems vulnerable\n\n",print_url
48 | return_dict['vulnerability_data'] = line.strip()
49 | #print "payload found\n", attack[index-buffer:index+len(XSS_RESPONSE)+buffer]
50 | intt=intt+1
51 | print intt
52 | # break
53 |
54 | #print "here"
55 | t_end = time.time()
56 | return_dict['time'] = round((t_end - t_start), 2)
57 |
58 | except KeyboardInterrupt, ke:
59 | sys.exit(0)
60 | except Exception, e:
61 | return_dict['exception'] = str(e)
62 |
63 |
64 | # -------------------------------------
65 | if __name__ == '__main__':
66 | # -------------------------------------
67 |
68 | # Init
69 | t_global_start = time.time()
70 |
71 | sites_file = open(SITES_FILENAME)
72 | payloads_file = open(PAYLOADS_FILENAME)
73 | threadpool = ThreadPool(MAX_THREAD_COUNT)
74 |
75 | # Load SITES and PAYLOADS files
76 | sites = []
77 | input = str(raw_input("\nEnter the URLS you want to test\n"))
78 | sites = []
79 | sites = input
80 | print "\nWorking..."
81 | payloads = []
82 | for payload in payloads_file:
83 | payloads.append(payload[:-1])
84 |
85 | # Loop through sites
86 |
87 | # Extract Base URL and Parameters from site
88 | parse_url = urlparse.urlparse(sites)
89 | base_url = '%s%s%s%s' % (parse_url.scheme, SCHEME_DELIMITER, parse_url.netloc, parse_url.path)
90 | #print base_url
91 | param_parse_list = urlparse.urlparse(sites)[4].split('&')
92 | param_dict = dict()
93 | for param_parse_entry in param_parse_list:
94 | tmp = param_parse_entry.split('=')
95 | param_dict[tmp[0]] = tmp[1]
96 |
97 | # Loop through payloads
98 | for payload in payloads:
99 | # Loop through parameters
100 | #print payload
101 | for k1, v1 in iter(sorted(param_dict.iteritems())):
102 | # Build GET param string and POST param dict
103 | get_params = ''
104 | post_params = dict()
105 |
106 | for k2, v2 in iter(sorted(param_dict.iteritems())):
107 | if k1 == k2:
108 | get_params += '%s=%s&' % (k2, payload)
109 | post_params[k2] = payload
110 | else:
111 | get_params += '%s=%s&' % (k2, v2)
112 | post_params[k2] = v2
113 |
114 | get_params = get_params[:-1]
115 | #print get_params
116 | # Enqueue GET attack
117 | get_attack_url = '%s?%s' % (base_url, get_params)
118 | threadpool.enqueue(attack, get_attack_url, payload)
119 |
120 | #attack(get_attack_url, payload)
121 |
122 |
123 |
124 | # Wait for threadpool
125 | threadpool.wait()
126 |
127 | # Exit
128 | t_global_end = time.time()
129 | #if DEBUG:
130 | #print "int->",int
131 | if(intt == 0):
132 | print "\n\tNothing Found! \n"
133 |
134 | print 'Time taken : %.2f seconds' % (t_global_end - t_global_start)
135 |
--------------------------------------------------------------------------------
/xss_finder /src/get_regg.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 |
3 |
4 |
5 | # Imports
6 | import sys, re, urllib2, urlparse, json, time, httplib,cookielib,urllib
7 | #from threadpool import *
8 |
9 | i=0
10 | # Config
11 | DEBUG = True
12 | MAX_THREAD_COUNT = 1
13 | SITES_FILENAME = str(sys.argv[1])
14 | #print SITES_FILENAME
15 | #sys.exit()
16 | PAYLOADS_FILENAME = 'get_payload'
17 | SCHEME_DELIMITER = '://'
18 | XSS_RESPONSE = "alert('XSS')"
19 |
20 | cj = cookielib.CookieJar()
21 | opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
22 |
23 | intt=0
24 | # -------------------------------------
25 | def attack(url, payload):
26 | # -------------------------------------
27 |
28 | t_start = time.time()
29 | #print "in attak"
30 | return_dict = dict()
31 | return_dict['url'] = url
32 | #print "..."
33 | #return_dict['url_data'] = data
34 | return_dict['vulnerability'] = False
35 | #print "\n url",url
36 | #print "\n payload" ,payload
37 | #print "going to try\n"
38 | #post_url='http://site.com ' # the url in which XSS test needs to be done and it is different from url where we posted params
39 | try:
40 | return_dict['method'] = 'GET'
41 | XSS_RESPONSE=payload
42 | #print "payload--->", payload
43 | attack= urllib2.urlopen(url).read()
44 | #print "\nURL being hit :",url
45 | print_url=url.replace("<","<")
46 | print "\nURL being hit :",print_url
47 | #print XSS_RESPONSE
48 | index = attack.find(XSS_RESPONSE)
49 |
50 | buffer = 20
51 |
52 | attack = attack.split("\n");
53 | len(attack)
54 | #print "\nurl->\n",url
55 | if index != -1:
56 | intt +=1
57 | return_dict[' vulnerability'] = True
58 | print "\n\n--------------------------------------------------------------------------"
59 | print "\nThis url seems vulnerable\n\n",url
60 | print "--------------------------------------------------------------------------\n\n"
61 | #return_dict['vulnerability_data'] = line.strip()
62 | #print "payload found\n", attack[index-buffer:index+len(XSS_RESPONSE)+buffer]
63 |
64 | #print intt
65 | # break
66 |
67 | #print "here"
68 | t_end = time.time()
69 | return_dict['time'] = round((t_end - t_start), 2)
70 |
71 | except KeyboardInterrupt, ke:
72 | sys.exit(0)
73 | except Exception, e:
74 | return_dict['exception'] = str(e)
75 |
76 |
77 | # -------------------------------------
78 | if __name__ == '__main__':
79 | # -------------------------------------
80 | print "