Merge pull request #61 from knassar702/v0.9.3

MindPatch · web-flow · commit 662954d8cdd7 · 2022-06-13T23:33:06.000+02:00
V0.9.3
diff --git a/.gitignore b/.gitignore
@@ -141,4 +141,8 @@ cython_debug/
 
 .vscode
 *.out
+# TESTING 
+urls.out
+run_tool.sh
 data.json
+demo*
diff --git a/Dockerfile b/Dockerfile
@@ -0,0 +1,6 @@
+FROM python:3.9-slim
+WORKDIR /scant3r
+COPY . .
+RUN pip install --no-cache-dir .
+ENTRYPOINT ["scant3r"]
+CMD ["-h"]
diff --git a/README.md b/README.md
@@ -37,42 +37,27 @@
 
 ### What's this?
 this is a module-based web automation tool that I made for saving my scripting
-time by providing some utilises that everybody needs in his automation script
-instead of focusing on ( logger, parsers, output function , cmd args, multi-threading) ,
+time by providing some utilizes that every web pentester needs in his automation script
+instead of focusing on ( logger, parsers, output function, cmd args, multi-threading),
 just write the logic of your scanning idea with scant3r utils without caring
-about these things, you can find callback/parsing/logging utils and output functions, Also we will adding Restful API soon <br>
-what if you need to add new Command option to scant3r for your script? <br>
-easy without writing any code just open `conf/opts.yaml` file and you will find all options of scant3r so you can change and add what you want;D
-
-
-```yaml
-# conf/opts.yaml
-exit_after:
-  - option: 
-    - '-e' # SHORT
-    - "--exit-after" # LONG
-  - type: int # TYPE OF VALUE
-  - default: 500 # DEFAULT
-  - save_content: true # SHOUD I SAVE THE CONTENT OF THIS OPTION ?
-  - help: "Exit after get this number of errors" # HELP MESSAGE
-  - exec: "dict_args['exit_after'] = int(value)" # HOW TO SAVE IT IN OPTS DICT
-```
+about these things, you can find callback/parsing/logging utils and output functions, Also we will add Restful API soon <br>
+what if you need to add a new Command option to scant3r for your script? <br>
+easy without writing any code just open the `conf/opts.YAML file and you will find all options of scant3r so you can change and add what you want;D
+
 
 ### why should I use it ?
-the short answer is to save your time, you as a security guy you don't need to
+the short answer is to save your time, as a security guy you don't need to
 learn more about " how to write a perfect CLI script " you just need to
 understand the logic of your script <br> if you need to write something like SSRF
 CVE scanner, instead of searching "How can I call interact.sh", "how to fix this
 code issue", "how can I parse this' <br> and after getting the answer you will get
 some cool errors in your code and you will find yourself needing more time to
-search and fix these bugs
-
-![image](.src/sweaty-sweaty-speedrunner.gif)
+search and fix these bugs <br>
 
-you as a security guy this is a waste of time for you, so this project will help to
+this is a waste of time for you, so this project will help to
 save more and more, just take a look at the examples modules and read the
 official documentation (unavailable yet), or just open an issue with a
-Feature request and we will write your script by our hands
+Feature request and we will write your script with our hands
 
 ### Modules
 
@@ -81,6 +66,7 @@ this the modules we providing for our community for you need new module open an
 
 | module         | Short description                                           |
 | :------------- | :-------------                                               |
+| **xss** | xss scanner for the ( ATTR_NAME, ATTR_VALUE , Comments, TAG_NAME ) |
 | **req_callback**     | Finds Out-of-band Resources parameters |
 | **ssti**       | Finds Server-side Template injection                                         |
 | **firebase**   | checks for public firebase databases (write/read) permission  |
@@ -148,9 +134,14 @@ wiki: https://github.com/knassar702/scant3r/wiki
 ```
 
 
+### Start
+```bash
+$ echo "http://testphp.vulnweb.com/listproducts.php?cat=1" | scant3r -m all 
+```
+
 ## TODO-Features
 * [ ] Restful API
-* [ ]  re-write the core utils in Rust by using pyo3 
+* [ ] re-write the core utils in Rust by using pyo3 
 * [ ] Command line Modules ( with yaml file )
 * [ ] Custom scanning map
 * [ ] Selenium Modules
diff --git a/scant3r/conf/logo.txt b/scant3r/conf/logo.txt
@@ -5,4 +5,4 @@
 [/yellow][green]/___/\__/\_,_/_//_/\__/____/_/[/green]
 
 [bold green][+][/bold green] Coded by: Khaled Nassar @knassar702
-[bold green][+][/bold green] Version: 0.9.2
+[bold green][+][/bold green] Version: 0.9.3
diff --git a/scant3r/conf/opts.yaml b/scant3r/conf/opts.yaml
@@ -18,6 +18,7 @@ callback_time:
   - save_content: true
   - help: "Callback timeout"
   - exec: "dict_args['callback_time'] = int(value)"
+
 convert_body:
   - option:
     - "-c"
@@ -105,7 +106,7 @@ methods:
     - '-M'
     - '--method'
   - type: string
-  - default: 'GET,POST'
+  - default: 'GET'
   - save_content: true
   - help: 'Methods Allowed on your target'
   - exec: | 
diff --git a/scant3r/core/data.py b/scant3r/core/data.py
@@ -6,42 +6,114 @@
 base_dir = Path(__file__).resolve().parent.parent
 
 # interact.sh public servers
-INTERACT_SERVERS = [
+INTERACT_SERVERS = (
     "interact.sh",
     "oast.pro",
     "oast.live",
     "oast.site",
     "oast.online",
     "oast.me",
-]
-
+)
 LOGGING_FORMAT = "%(name)-12s: %(levelname)-8s %(message)s"
 LOGGING_FILE = os.path.join(Path.home(), ".scant3r.log")
 CLEAR_LOGGING_FILE = True
 
 
 # ENABLED Modules ( after using `-m all` option)
-ENABLED_MODS = ["ssti", "firebase", "req_callback"]
+ENABLED_MODS = ("ssti", "firebase", "req_callback", "xss")
 
 # CLI
 LOGO = open(f"{base_dir}/conf/logo.txt", "r").read()
 console = Console()
 FIREBASE_URL = "https://%s.firebaseio.com"
 
-# PAYLOADS
-SQLI_PAYLOADS = Path(f"{base_dir}/db/txt/sqli.txt").read_text().splitlines()
-SQL_ERRORS = Path(f"{base_dir}/db/txt/sqli_errors.txt").read_text().splitlines()
+# SQLI PAYLOADS
+SQLI_PAYLOADS = tuple(Path(f"{base_dir}/db/txt/sqli.txt").read_text().splitlines())
+SQL_ERRORS = tuple(Path(f"{base_dir}/db/txt/sqli_errors.txt").read_text().splitlines())
+
+PATH_TRAVERSAL = tuple(
+    Path(f"{base_dir}/db/txt/traversal.txt").read_text().splitlines()
+)
+TLD = tuple(Path(f"{base_dir}/db/txt/tld.txt").read_text().splitlines())
+
+# RCE PAYLOADS
+RCE_PAYLOADS_PWD = tuple(Path(f"{base_dir}/db/txt/pwd.txt").read_text().splitlines())
+RCE_PAYLOADS_PASSWD = tuple(
+    Path(f"{base_dir}/db/txt/passwd.txt").read_text().splitlines()
+)
+
+SSTI = tuple(Path(f"{base_dir}/db/txt/ssti.txt").read_text().splitlines())
+SSRF_PARAMS = tuple(
+    Path(f"{base_dir}/db/txt/ssrf_parameters.txt").read_text().splitlines()
+)
+
+# XSS WORDLIST
+XSS_JS_FUNC = tuple(Path(f"{base_dir}/db/txt/js_func.txt").read_text().splitlines())
+XSS_JS_VALUE = tuple(Path(f"{base_dir}/db/txt/js_value.txt").read_text().splitlines())
+
+XSS_TAGS = tuple(Path(f"{base_dir}/db/txt/xss.txt").read_text().splitlines())
+XSS_ATTR = tuple(Path(f"{base_dir}/db/txt/xss_attr.txt").read_text().splitlines())
 
-PATH_TRAVERSAL = Path(f"{base_dir}/db/txt/traversal.txt").read_text().splitlines()
-TLD = Path(f"{base_dir}/db/txt/tld.txt").read_text().splitlines()
+CSP_LIST = (
+    ".doubleclick.net",
+    ".googleadservices.com",
+    "cse.google.com",
+    "accounts.google.com",
+    "*.google.com",
+    "www.blogger.com",
+    "*.blogger.com",
+    "translate.yandex.net",
+    "api-metrika.yandex.ru",
+    "api.vk.comm",
+    "*.vk.com",
+    "*.yandex.ru",
+    "*.yandex.net",
+    "app-sjint.marketo.com",
+    "app-e.marketo.com",
+    "*.marketo.com",
+    "detector.alicdn.com",
+    "suggest.taobao.com",
+    "ount.tbcdn.cn",
+    "bebezoo.1688.com",
+    "wb.amap.com",
+    "a.sm.cn",
+    "api.m.sm.cn",
+    "*.taobao.com",
+    "*.tbcdn.cn",
+    "*.1688.com",
+    "*.amap.com",
+    "*.sm.cn",
+    "mkto.uber.com",
+    "*.uber.com",
+    "ads.yap.yahoo.com",
+    "mempf.yahoo.co.jp",
+    "suggest-shop.yahooapis.jp",
+    "www.aol.com",
+    "df-webservices.comet.aol.com",
+    "api.cmi.aol.com",
+    "ui.comet.aol.com",
+    "portal.pf.aol.com",
+    "*.yahoo.com",
+    "*.yahoo.jp",
+    "*.yahooapis.jp",
+    "*.aol.com",
+    "search.twitter.com",
+    "*.twitter.com",
+    "twitter.com",
+    "ajax.googleapis.com",
+    "*.googleapis.com",
+)
 
-RCE_PAYLOADS_PWD = Path(f"{base_dir}/db/txt/pwd.txt").read_text().splitlines()
-RCE_PAYLOADS_PASSWD = Path(f"{base_dir}/db/txt/passwd.txt").read_text().splitlines()
 
-SSTI = Path(f"{base_dir}/db/txt/ssti.txt").read_text().splitlines()
-SSRF_PARAMS = Path(f"{base_dir}/db/txt/ssrf_parameters.txt").read_text().splitlines()
-XSS_JS_FUNC = Path(f"{base_dir}/db/txt/js_func.txt").read_text().splitlines()
-XSS_JS_VALUE = Path(f"{base_dir}/db/txt/js_value.txt").read_text().splitlines()
-XSS_TAGS = Path(f"{base_dir}/db/txt/xss.txt").read_text().splitlines()
-XSS_ATTR = Path(f"{base_dir}/db/txt/xss_attr.txt").read_text().splitlines()
-# BLIND_XSS_PAYLOADS = Path(f"{base_dir}/db/txt/bxss.txt", "r").read_text().splitlines()
+BLOCK_CONTENT_TYPE = (
+    "application/json",
+    "application/javascript",
+    "text/javascript",
+    "text/plain",
+    "text/css",
+    "image/jpeg",
+    "image/png",
+    "image/bmp",
+    "image/gif",
+    "application/rss+xml",
+)
diff --git a/scant3r/core/utils.py b/scant3r/core/utils.py
@@ -16,9 +16,7 @@ def random_str(num: int) -> str:
     geCr15
     """
     num = int(num)
-    return "".join(
-        random.choice(string.ascii_uppercase + string.digits) for _ in range(num)
-    )
+    return "".join(random.choice(string.ascii_uppercase) for _ in range(num))
 
 
 # Print the request in the console. Arg the request. Return a string. Empty string if no request
diff --git a/scant3r/db/txt/js_func.txt b/scant3r/db/txt/js_func.txt
@@ -1 +1,12 @@
+parent['con'+'firm']
+parent['prom'+'pt']
+parent['ale'+'rt']
+globalThis[(+{}+[])[+!![]]+(![]+[])[!+[]+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]]
 alert
+prompt
+confirm
+this[/*foo*/'alert'/*bar*/]
+this[/*foo*/'print'/*bar*/]
+window[/*foo*/'confirm'/*bar*/]
+self[/*foo*/'prompt'/*bar*/]
+window['ale'+'rt']
diff --git a/scant3r/db/txt/js_value.txt b/scant3r/db/txt/js_value.txt
@@ -1 +1,4 @@
-42
+1
+33
+(+{}+[])[+!![]]
+/XSS/.source
diff --git a/scant3r/db/txt/xss.txt b/scant3r/db/txt/xss.txt
@@ -2,4 +2,7 @@
 ">ScanT3r<svg/onload=confirm(/ScanT3r/)>web"
 "><img src=x OnMouseEnter=(confirm)(1)>ScanT3r
 "><div onpointermove="alert(45)">MOVE HERE</div>'
+<iMg src=a oNerrOr=$JS_FUNC$($JS_CMD$)>
+<img src=x onerror=$JS_FUNC$`$JS_CMD$`>
+<svg/onload=$JS_FUNC$`$JS_CMD$`>
 <x/oncopy=brrrr>
diff --git a/scant3r/db/txt/xss_attr.txt b/scant3r/db/txt/xss_attr.txt
@@ -1 +1,13 @@
-onerror
+onmouseover
+onmouseenter
+onmouseleave
+onmouseout
+onclick
+onmousedown
+onmouseup
+ontouchstart
+ontouchend
+ontouchmove
+onpointerenter
+onpointerleave
+onpointerover
diff --git a/scant3r/modules/req_callback/__init__.py b/scant3r/modules/req_callback/__init__.py
@@ -7,10 +7,10 @@
 from scant3r.core.utils import dump_request, dump_response, insert_to_params_urls
 from scant3r.modules.scan import Scan
 
-proto = [
+proto = (
     "http",
     "https",
-]
+)
 
 
 class Main(Scan):
@@ -23,7 +23,7 @@ def start(self) -> Dict[str, str]:
             callback = Interactsh()
             for protocole in proto:
                 new_url = insert_to_params_urls(
-                    self.opts["url"], f"{protocole}://{callback.domain}"
+                    self.opts["url"], f"{protocole}://{callback.domain}",True
                 )
                 response = self.send_request(method, new_url)
                 if response.__class__.__name__ == "Response":
@@ -39,12 +39,12 @@ def start(self) -> Dict[str, str]:
                             "payload": f"{protocole}://{callback.domain}",
                             "callback": callback_results,
                         }
-                        report_msg = [
+                        report_msg = (
                             "\n",
                             ":satellite: Out-of-band resource load",
                             f":dart: The Effected URL: {response.url}",
                             f":syringe: The Used Payload: [bold red]{protocole}://{callback.domain} [/bold red]",
                             f":mag: Callback log: [bold yellow] {callback_results} [/bold yellow]",
-                        ]
+                        )
                         self.show_report(*report_msg)
         return report
diff --git a/scant3r/modules/xss/__init__.py b/scant3r/modules/xss/__init__.py
@@ -11,7 +11,6 @@
     dump_response,
     insert_to_params_urls,
     random_str,
-    urlencoder,
 )
 from scant3r.modules.scan import Scan
 
@@ -61,17 +60,10 @@ def start(self) -> Dict[str, str]:
                                             "url": response.url,
                                             "request": dump_request(response),
                                             "response": dump_response(response),
-                                            "payload": urlencoder(payload),
+                                            "payload": payload,
                                             "matching": payload_search,
                                         }
                                     )
-                                    report_msg = [
-                                        "\n",
-                                        ":fire: Reflected Cross-site scripting",
-                                        f":dart: The Effected URL: {response.url}",
-                                        f":page_facing_up: XSS Location: {xss_location.value}",
-                                        f":syringe: The Used Payload: [bold red] {urlencoder(payload)} [/bold red]",
-                                    ]
                                     the_location = ""
                                     for m in re.finditer(payload, raw_response):
                                         length = (m.end() + m.start()) - len(
@@ -88,7 +80,15 @@ def start(self) -> Dict[str, str]:
                                                 raw_response[m.start() : m.end()],
                                                 "html",
                                             )
-                                    report_msg.append(the_location)
-                                    self.show_report(*report_msg)
+                                    self.show_report(
+                                        *(
+                                            "\n",
+                                            ":fire: Reflected Cross-site scripting",
+                                            f":dart: The Effected URL: {response.url}",
+                                            f":page_facing_up: XSS Location: {xss_location.value}",
+                                            f":syringe: The Used Payload: [bold red] {payload} [/bold red]",
+                                            the_location,
+                                        )
+                                    )
                                     break
         return report
diff --git a/scant3r/modules/xss/payload_gen.py b/scant3r/modules/xss/payload_gen.py
diff --git a/setup.py b/setup.py

-Original file line number
+Diff line change
@@ @@ -1 +1,4 @@ @@
 -42
 +1
 +33
 +(+{}+[])[+!![]]
 +/XSS/.source