multiple tamper scripts now implemented (issue #149), checks if the status code is a 404 before saying it's XSS vulnerable (issue #147)

etc/checksum/md5sum.md5

@@ -52,15 +52,15 @@ aa7268a8f085734a6c577c86440f7a1b  ./lib/attacks/sqlmap_scan/sqlmap_opts.py
 d41d8cd98f00b204e9800998ecf8427e  ./lib/attacks/whois_lookup/__init__.py
 9b2bd4904ec2385eb38a3b6cd59dbc99  ./lib/attacks/whois_lookup/whois.py
 3917cdce61918f3992fc682105367ce8  ./lib/attacks/admin_panel_finder/__init__.py
-b50e4b7fb9fdef374c00b7ab0ef913e9  ./lib/attacks/xss_scan/__init__.py
+ceb1b278b0861c976dfecc91cb64e53d  ./lib/attacks/xss_scan/__init__.py
 27358f26bda30d7356143c3ea1fa99c5  ./lib/attacks/nmap_scan/__init__.py
 21faf4679cdeaa731029a48f8963d6e7  ./lib/attacks/nmap_scan/nmap_opts.py
 1faa2b5dfad6eb538bbfe42942d2a9da  ./lib/core/errors.py
 d41d8cd98f00b204e9800998ecf8427e  ./lib/core/__init__.py
-2f50a33a4695078b48b22a19ed44fc1e  ./lib/core/settings.py
+5bf175699e0114429fcf0bbcf2c81649  ./lib/core/settings.py
 a32f8f2a054ab687361bda8557ff63d4  ./lib/header_check/__init__.py
 d41d8cd98f00b204e9800998ecf8427e  ./var/google_search/__init__.py
-a5cd3c512cd77855423ca1e3f06d5667  ./var/google_search/search.py
+36aa8f176e853ab0d0748689c863d5f4  ./var/google_search/search.py
 d41d8cd98f00b204e9800998ecf8427e  ./var/__init__.py
 d41d8cd98f00b204e9800998ecf8427e  ./var/auto_issue/__init__.py
 dadca85c232153021ba9ff253d8ee1d9  ./var/auto_issue/github.py

lib/attacks/xss_scan/__init__.py

@@ -31,13 +31,22 @@ def __tamper_payload(payload, tamper_type, warning=True, **kwargs):
     """
     add the tamper to the payload from the given tamper type
     """
+    verbose = kwargs.get("verbose", False)
     acceptable = list_tamper_scripts()
-    if tamper_type in acceptable:
-        tamper_name = "lib.tamper_scripts.{}_encode"
-        tamper_script = importlib.import_module(tamper_name.format(tamper_type))
-        return tamper_script.tamper(payload, warning=warning)
-    else:
-        raise InvalidTamperProvided()
+    tamper_list = tamper_type.split(",")
+    for tamper in tamper_list:
+        if warning:
+            if verbose:
+                lib.core.settings.logger.debug(lib.core.settings.set_color(
+                    "tampering payload with '{}'...".format(tamper), level=10
+                ))
+        if tamper in acceptable:
+            tamper_name = "lib.tamper_scripts.{}_encode"
+            tamper_script = importlib.import_module(tamper_name.format(tamper))
+            payload = tamper_script.tamper(payload, warning=warning)
+        else:
+            raise InvalidTamperProvided()
+    return payload
 
 
 def __load_payloads(filename="{}/etc/text_files/xss_payloads.txt"):
@@ -47,7 +56,7 @@ def __load_payloads(filename="{}/etc/text_files/xss_payloads.txt"):
     with open(filename.format(os.getcwd())) as payloads: return payloads.readlines()
 
 
-def create_urls(url, payload_list, tamper=None):
+def create_urls(url, payload_list, tamper=None, verbose=False):
     """
     create the tampered URL's, write them to a temporary file and read them from there
     """
@@ -58,9 +67,9 @@ def create_urls(url, payload_list, tamper=None):
             if tamper:
                 try:
                     if i < 1:
-                        payload = __tamper_payload(payload, tamper_type=tamper, warning=True)
+                        payload = __tamper_payload(payload, tamper_type=tamper, warning=True, verbose=verbose)
                     else:
-                        payload = __tamper_payload(payload, tamper_type=tamper, warning=False)
+                        payload = __tamper_payload(payload, tamper_type=tamper, warning=False, verbose=verbose)
                 except InvalidTamperProvided:
                     lib.core.settings.logger.error(lib.core.settings.set_color(
                         "you provided and invalid tamper script, acceptable tamper scripts are: {}...".format(
@@ -102,14 +111,16 @@ def scan_xss(url, agent=None, proxy=None):
     config_proxy = lib.core.settings.proxy_string_to_dict(proxy)
     config_headers = {"connection": "close", "user-agent": user_agent}
     xss_request = requests.get(url, proxies=config_proxy, headers=config_headers)
+    status = xss_request.status_code
     html_data = xss_request.content
     query = find_xss_script(url)
     for db in lib.core.settings.DBMS_ERRORS.keys():
         for item in lib.core.settings.DBMS_ERRORS[db]:
             if re.findall(item, html_data):
                 return "sqli", db
-    if query in html_data:
-        return True, None
+    if status != 404:
+        if query in html_data:
+            return True, None
     return False, None
 
 
@@ -137,7 +148,7 @@ def main_xss(start_url, proxy=None, agent=None, **kwargs):
     lib.core.settings.logger.info(lib.core.settings.set_color(
         "payloads will be written to a temporary file and read from there..."
     ))
-    filename = create_urls(start_url, payloads, tamper=tamper)
+    filename = create_urls(start_url, payloads, tamper=tamper, verbose=verbose)
     lib.core.settings.logger.info(lib.core.settings.set_color(
             "loaded URL's have been saved to '{}'...".format(filename), level=25
         ))

lib/core/settings.py

@@ -55,7 +55,7 @@ CLONE = "https://github.com/ekultek/zeus-scanner.git"
 ISSUE_LINK = "https://github.com/ekultek/zeus-scanner/issues"
 
 # current version <major.minor.commit.patch ID>
-VERSION = "1.2.11".format(PATCH_ID)
+VERSION = "1.2.12".format(PATCH_ID)
 
 # colors to output depending on the version
 VERSION_TYPE_COLORS = {"dev": 33, "stable": 92, "other": 30}

var/google_search/search.py

@@ -642,8 +642,14 @@ def search_multiple_pages(query, link_amount, verbose=False, **kwargs):
         request_issue_creation()
         shutdown()
 
-    logger.info(set_color(
-        "a total of {} URL(s) found out of the requested {}...".format(len(retval), link_amount), level=25
-    ))
-    write_to_log_file(retval, URL_LOG_PATH, "url-log-{}.log")
-    return list(retval) if len(retval) != 0 else None
+    if len(retval) > 0:
+        logger.info(set_color(
+            "a total of {} URL(s) found out of the requested {}...".format(len(retval), link_amount), level=25
+        ))
+        write_to_log_file(retval, URL_LOG_PATH, "url-log-{}.log")
+        return list(retval)
+    else:
+        logger.warning(set_color(
+            "did not find any links with given query '{}' writing to blacklist...".format(query), level=30
+        ))
+        write_to_log_file(query, BLACKLIST_FILE_PATH, ".blacklist")