diff --git a/lib/attacks/xss_scan/__init__.py b/lib/attacks/xss_scan/__init__.py index 37be45d..2ddb424 100644 --- a/lib/attacks/xss_scan/__init__.py +++ b/lib/attacks/xss_scan/__init__.py @@ -44,15 +44,13 @@ def scan_xss(url, agent=None, proxy=None): xss_request = requests.get(url, proxies=config_proxy, headers=config_headers) html_data = xss_request.content query = find_xss_script(url) - if str(query).lower() in str(html_data).lower(): - return True - else: - for db in DBMS_ERRORS.keys(): - for item in DBMS_ERRORS[db]: - dbms_regex = re.compile(item) - if dbms_regex.search(html_data): - return "sqli" - return False + for db in DBMS_ERRORS.keys(): + for item in DBMS_ERRORS[db]: + if re.findall(item, html_data): + return "sqli", db + if query in html_data: + return True, None + return False, None def main_xss(start_url, verbose=False, proxy=None, agent=None): @@ -69,9 +67,8 @@ def main_xss(start_url, verbose=False, proxy=None, agent=None): "payloads will be written to a temporary file and read from there..." )) filename = create_urls(start_url, payloads) - if verbose: - logger.debug(set_color( - "loaded URL's have been saved to '{}'...".format(filename), level=10 + logger.info(set_color( + "loaded URL's have been saved to '{}'...".format(filename) )) logger.info(set_color( "testing for XSS vulnerabilities on host '{}'...".format(start_url) @@ -82,25 +79,28 @@ def main_xss(start_url, verbose=False, proxy=None, agent=None): )) success = set() with open(filename) as urls: - for url in urls.readlines(): + for i, url in enumerate(urls.readlines(), start=1): url = url.strip() result = scan_xss(url, proxy=proxy, agent=agent) payload = find_xss_script(url) - logger.info(set_color( - "trying payload '{}'...".format(payload) - )) - if result: + if verbose: + logger.info(set_color( + "trying payload '{}'...".format(payload) + )) + if result[0] != "sqli" and result[0] is True: success.add(url) if verbose: logger.debug(set_color( "payload '{}' appears to be usable...".format(payload), level=10 )) - elif result is "sqli": - logger.error(set_color( - "loaded URL '{}' threw a DBMS error and appears to be SQLi vulnerable, test for SQL injection".format( - url - ), level=30 - )) + elif result[0] is "sqli": + if i <= 1: + logger.error(set_color( + "loaded URL '{}' threw a DBMS error and appears to be injectable, test for SQL injection, " + "backend DBMS appears to be '{}'...".format( + url, result[1] + ), level=40 + )) else: if verbose: logger.debug(set_color( @@ -108,4 +108,12 @@ def main_xss(start_url, verbose=False, proxy=None, agent=None): start_url, payload ), level=10 )) - create_tree(start_url, list(success)) \ No newline at end of file + if len(success) != 0: + logger.info(set_color( + "possible XSS scripts to be used:" + )) + create_tree(start_url, list(success)) + else: + logger.error(set_color( + "host '{}' does not appear to be vulnerable to XSS attacks...".format(start_url) + )) \ No newline at end of file diff --git a/lib/settings.py b/lib/settings.py index 3a92cb4..01de0a2 100644 --- a/lib/settings.py +++ b/lib/settings.py @@ -22,7 +22,7 @@ except NameError: # clone link CLONE = "https://github.com/ekultek/zeus-scanner.git" # current version -VERSION = "1.0.19" +VERSION = "1.0.19.8e6fa" # colors to output depending on the version VERSION_TYPE_COLORS = {"dev": 33, "stable": 92, "other": 30} # version string formatting