created five new tamper scripts for XSS payloads

lib/core/settings.py

@@ -22,7 +22,7 @@ except NameError:
 # clone link
 CLONE = "https://github.com/ekultek/zeus-scanner.git"
 # current version <major.minor.commit.patch ID>
-VERSION = "1.0.35"
+VERSION = "1.0.36"
 # colors to output depending on the version
 VERSION_TYPE_COLORS = {"dev": 33, "stable": 92, "other": 30}
 # version string formatting

lib/tamper_scripts/appendnull_encode.py

@@ -0,0 +1,2 @@
+def tamper(payload, **kwargs):
+    return "{}%00".format(payload.strip())

lib/tamper_scripts/enclosebrackets_encode.py

@@ -0,0 +1,24 @@
+import string
+
+from lib.core.settings import (
+    logger,
+    set_color
+)
+
+
+def tamper(payload, warning=True, **kwargs):
+    if warning:
+        logger.warning(set_color(
+            "enclosing brackets is meant to be used as an obfuscation "
+            "against an already valid vulnerable site...", level=30
+        ))
+
+    to_enclose = string.digits
+    retval = ""
+    for char in payload:
+        if char in to_enclose:
+            char = "['{}']".format(char)
+            retval += char
+        else:
+            retval += char
+    return retval

lib/tamper_scripts/obfuscateordinal_encode.py

@@ -0,0 +1,22 @@
+from lib.core.settings import (
+    logger,
+    set_color
+)
+
+
+def tamper(payload, warning=True, **kwargs):
+    if warning:
+        logger.warning(set_color(
+            "obfuscating the payloads by ordinal equivalents may increase the risk "
+            "of false positives...", level=30
+        ))
+
+    retval = ""
+    danger_characters = "%&<>/\\;'\""
+    for char in payload:
+        if char in danger_characters:
+            char = "%{}".format(ord(char) * 10 / 7)
+            retval += char
+        else:
+            retval += char
+    return retval

lib/tamper_scripts/space2comment_encode.py

@@ -0,0 +1,10 @@
+def tamper(payload, **kwargs):
+    retval = ""
+    encoder = "/**/"
+    for char in payload:
+        if char == " ":
+            char = encoder
+            retval += char
+        else:
+            retval += char
+    return retval

lib/tamper_scripts/space2null_encode.py

@@ -0,0 +1,10 @@
+def tamper(payload, **kwargs):
+    retval = ""
+    encoder = "%00"
+    for char in payload:
+        if char == " ":
+            char = encoder
+            retval += char
+        else:
+            retval += char
+    return retval

zeus.py

@@ -607,10 +607,17 @@ if __name__ == "__main__":
             ))
             time.sleep(2)
             subprocess.call("python zeus.py --help", shell=True)
-    except IOError:
-        logger.fatal(set_color(
-            "provided file does not exist, make sure you have the full path...", level=50
-        ))
+    except IOError as e:
+        if "Invalid URL" in str(e):
+            logger.exception(set_color(
+                "URL provided is not valid, schema appears to be missing...", level=50
+            ))
+            request_issue_creation()
+            shutdown()
+        else:
+            logger.fatal(set_color(
+                "provided file does not exist, make sure you have the full path...", level=50
+            ))
     except KeyboardInterrupt:
         logger.error(set_color(
             "user aborted process...", level=40