gbrindisi / xsssniper Goto Github PK
View Code? Open in Web Editor NEWAn automatic XSS discovery tool
Home Page: http://brindi.si/g/
An automatic XSS discovery tool
Home Page: http://brindi.si/g/
why is good syntax for argument --cookie=?
i need example for COOKIE_DATA format.. ./xsssniper.py -u "blah.blah" --cookie=<how to write keys and values?>
thx
Everytime I scan a site on XSSniper, it says right next to Remaining Targets, Crawl Errors, and next to Remaining URLS, it says Scan Errors.
Is there a glitch in XSSSniper or those websites just don't have an XSS vulnerability?
Should we migrate this project to Python 3? I do not think Python 2 support is must have. Could you tell me your opinion about this? Does some distro use xsssniper without Python 3?
how to fix this install mechanize module
As discussed in private email HTTP proxy functionality is not working. I have tested this with Burp and OWASP ZAP HTTP proxies with Git revision 73. I used these commands and no traffic is shown in logs of the proxy application:
xsssniper.py --http-proxy=127.0.0.1:8080 -u https://public-firing-range.appspot.com/
xsssniper.py --http-proxy=http://127.0.0.1:8080 -u https://public-firing-range.appspot.com/
xsssniper.py --http-proxy="http://127.0.0.1:8080" -u https://public-firing-range.appspot.com/
Removed after switching from hg to git.
When executed without use the binary python
, just using the Shebang specification in the file xsssniper.py
, it throws an error like this:
$ python xsssniper.py --help
[X] Please install hgapi module:
$ pip install
$ ./xsssniper.py --help
./xsssniper.py: line 4: try:: command not found
./xsssniper.py: line 6: except: command not found
Warning: unknown mime-type for "\n[X] Please install hgapi module:" -- using "application/octet-stream"
Error: no such file "\n[X] Please install hgapi module:"
Warning: unknown mime-type for " $ pip install \n" -- using "application/octet-stream"
Error: no such file " $ pip install \n"
./xsssniper.py: line 11: syntax error near unexpected token `from'
./xsssniper.py: line 11: `from optparse import OptionParser'
The error was fixed just with a single character in the Shebang specification:
$ diff xsssniper.py xsssniper.py.fork
1c1
< #/usr/bin/env python
---
> #!/usr/bin/env python
Currently if mechanize is missing xsssniper will say:
[X] Please install mechanize module:
http://wwwsearch.sourceforge.net/mechanize/
But if lxml is missing it will say:
Traceback (most recent call last):
File "xsssniper.py", line 6, in <module>
from core.engine import Engine
File "/home/hsalo/xsssniper/core/engine.py", line 24, in <module>
from core.domscanner import DOMScanner
File "/home/hsalo/xsssniper/core/domscanner.py", line 11, in <module>
from lxml import etree
ImportError: No module named lxml
Maybe xsssniper should also give pip install -commands rather than per project URLs, but that is design decision. Also the import errors are checked several times. Is there a reason for that?
Eventually package xsssniper to have a simpler installation.
Ideally:
pip install xsssniper
The randoms generated seed for the taint may result as a valid html attribute like href
, src
, etc.
https://github.com/gbrindisi/xsssniper/blob/master/core/payload.py#L14
Must blacklist common attributes names.
File "xsssniper.py", line 29
"""
^
SyntaxError: Missing parentheses in call to 'print'. Did you mean print("""
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.