Payloads

Author: MindPatch

scanners/src/payloads.rs

@@ -1,16 +1,14 @@
 pub fn get_jsvalue() -> Vec<String> {
         vec![
                 "document.cookie".to_string(),
-                "document.location".to_string(),
-                "1".to_string(),
             ]
 }
 
 pub fn get_jscmd() -> Vec<String> {
         vec![
-                "<img src=x onerror=$JS_FUNC$`$JS_CMD$`>".to_string(),
-                "<h1 $JS_FUNC$`$JS_CMD$`>".to_string(),
-                "<h1 $JS_FUNC$($JS_CMD)".to_string(),
+            "alert".to_string(),
+            "prompt".to_string(),
+            "confirm".to_string(),
             ]
 }
 

scanners/src/scan/xss/bypass.rs

@@ -126,7 +126,7 @@ impl<'a> PayloadGen<'a> {
                                 qoutes.repeat(i),
                                 attr_param,
                                 js_cmd,
-                                " vd".repeat(i)
+                                " vd ".repeat(i)
                             )
                         },
                         search: format!(r#"*[{}="{}"]"#, attr_param, js_cmd),
@@ -136,6 +136,7 @@ impl<'a> PayloadGen<'a> {
         });
         payloads
     }
+
     pub fn attrname_payloads(&self) -> Vec<OrderPayload> {
         let mut payloads: Vec<OrderPayload> = Vec::new();
         self.payloads.attr.iter().for_each(|attr| {