From 9d97a6765acb27d8bd379d1de93145ecce587ff3 Mon Sep 17 00:00:00 2001
From: ekultek <thomas.perkins23@icloud.com>
Date: Tue, 10 Oct 2017 17:59:01 -0500
Subject: [PATCH] created five new tamper scripts for XSS payloads

---
 lib/core/settings.py                          |  2 +-
 lib/tamper_scripts/appendnull_encode.py       |  2 ++
 lib/tamper_scripts/enclosebrackets_encode.py  | 24 +++++++++++++++++++
 lib/tamper_scripts/obfuscateordinal_encode.py | 22 +++++++++++++++++
 lib/tamper_scripts/space2comment_encode.py    | 10 ++++++++
 lib/tamper_scripts/space2null_encode.py       | 10 ++++++++
 zeus.py                                       | 15 ++++++++----
 7 files changed, 80 insertions(+), 5 deletions(-)
 create mode 100644 lib/tamper_scripts/appendnull_encode.py
 create mode 100644 lib/tamper_scripts/enclosebrackets_encode.py
 create mode 100644 lib/tamper_scripts/obfuscateordinal_encode.py
 create mode 100644 lib/tamper_scripts/space2comment_encode.py
 create mode 100644 lib/tamper_scripts/space2null_encode.py

diff --git a/lib/core/settings.py b/lib/core/settings.py
index 1491c6a..7a00c98 100644
--- a/lib/core/settings.py
+++ b/lib/core/settings.py
@@ -22,7 +22,7 @@ except NameError:
 # clone link
 CLONE = "https://github.com/ekultek/zeus-scanner.git"
 # current version <major.minor.commit.patch ID>
-VERSION = "1.0.35"
+VERSION = "1.0.36"
 # colors to output depending on the version
 VERSION_TYPE_COLORS = {"dev": 33, "stable": 92, "other": 30}
 # version string formatting
diff --git a/lib/tamper_scripts/appendnull_encode.py b/lib/tamper_scripts/appendnull_encode.py
new file mode 100644
index 0000000..2221663
--- /dev/null
+++ b/lib/tamper_scripts/appendnull_encode.py
@@ -0,0 +1,2 @@
+def tamper(payload, **kwargs):
+    return "{}%00".format(payload.strip())
\ No newline at end of file
diff --git a/lib/tamper_scripts/enclosebrackets_encode.py b/lib/tamper_scripts/enclosebrackets_encode.py
new file mode 100644
index 0000000..3c5e633
--- /dev/null
+++ b/lib/tamper_scripts/enclosebrackets_encode.py
@@ -0,0 +1,24 @@
+import string
+
+from lib.core.settings import (
+    logger,
+    set_color
+)
+
+
+def tamper(payload, warning=True, **kwargs):
+    if warning:
+        logger.warning(set_color(
+            "enclosing brackets is meant to be used as an obfuscation "
+            "against an already valid vulnerable site...", level=30
+        ))
+
+    to_enclose = string.digits
+    retval = ""
+    for char in payload:
+        if char in to_enclose:
+            char = "['{}']".format(char)
+            retval += char
+        else:
+            retval += char
+    return retval
\ No newline at end of file
diff --git a/lib/tamper_scripts/obfuscateordinal_encode.py b/lib/tamper_scripts/obfuscateordinal_encode.py
new file mode 100644
index 0000000..e2dbfb8
--- /dev/null
+++ b/lib/tamper_scripts/obfuscateordinal_encode.py
@@ -0,0 +1,22 @@
+from lib.core.settings import (
+    logger,
+    set_color
+)
+
+
+def tamper(payload, warning=True, **kwargs):
+    if warning:
+        logger.warning(set_color(
+            "obfuscating the payloads by ordinal equivalents may increase the risk "
+            "of false positives...", level=30
+        ))
+
+    retval = ""
+    danger_characters = "%&<>/\\;'\""
+    for char in payload:
+        if char in danger_characters:
+            char = "%{}".format(ord(char) * 10 / 7)
+            retval += char
+        else:
+            retval += char
+    return retval
\ No newline at end of file
diff --git a/lib/tamper_scripts/space2comment_encode.py b/lib/tamper_scripts/space2comment_encode.py
new file mode 100644
index 0000000..dea9bc1
--- /dev/null
+++ b/lib/tamper_scripts/space2comment_encode.py
@@ -0,0 +1,10 @@
+def tamper(payload, **kwargs):
+    retval = ""
+    encoder = "/**/"
+    for char in payload:
+        if char == " ":
+            char = encoder
+            retval += char
+        else:
+            retval += char
+    return retval
\ No newline at end of file
diff --git a/lib/tamper_scripts/space2null_encode.py b/lib/tamper_scripts/space2null_encode.py
new file mode 100644
index 0000000..0659c31
--- /dev/null
+++ b/lib/tamper_scripts/space2null_encode.py
@@ -0,0 +1,10 @@
+def tamper(payload, **kwargs):
+    retval = ""
+    encoder = "%00"
+    for char in payload:
+        if char == " ":
+            char = encoder
+            retval += char
+        else:
+            retval += char
+    return retval
\ No newline at end of file
diff --git a/zeus.py b/zeus.py
index b1f0ae8..3842ecf 100755
--- a/zeus.py
+++ b/zeus.py
@@ -607,10 +607,17 @@ if __name__ == "__main__":
             ))
             time.sleep(2)
             subprocess.call("python zeus.py --help", shell=True)
-    except IOError:
-        logger.fatal(set_color(
-            "provided file does not exist, make sure you have the full path...", level=50
-        ))
+    except IOError as e:
+        if "Invalid URL" in str(e):
+            logger.exception(set_color(
+                "URL provided is not valid, schema appears to be missing...", level=50
+            ))
+            request_issue_creation()
+            shutdown()
+        else:
+            logger.fatal(set_color(
+                "provided file does not exist, make sure you have the full path...", level=50
+            ))
     except KeyboardInterrupt:
         logger.error(set_color(
             "user aborted process...", level=40