xssfork作为sicklescan的一个功能模块,其开发主要目的是用于检测xss漏洞。 传统的xss探测工具,一般都是采用 payload in response的方式,即在发送一次带有payload的http请求后,通过检测响应包中payload的完整性来判断,这种方式缺陷,很多。
第一:不能准确地检测dom类xss
第二:用类似于requests之类的库不能真正的模拟浏览器
第三:网页js无法交互
怎么解决?如果能够用浏览器代替这个模块,去自动hook是最好的。所幸,我了解到phantomjs,当然现在google浏览器也支持headless模式,类似的,你也可以采用google浏览器去做检测。
对于这类fuzz过程,基本都是预先准备好一些payload,然后加载执行。对于这类io型密集的扫描模型,后端使用多线程就比较适用,但是由于phantomjs你可以理解为一个无界面的浏览器,在加载的时候,其缺陷也比较明显,比较吃内存,用它来发包自然不像requests库轻量。
##新建扫描任务
需要向服务传递两个参数,1.key(主要用于验证身份);2.检测参数
###创建任务 1.get反射型类型
1 2 3 |
req = requests.post('http://127.0.0.1:2333/xssfork/create_task/7T2o22NcQSLGk75',data=json.dumps({'url':'http://10.211.55.13/xss/example1.php?name=hacker', ), headers={'Content-Type':'application/json'}) return req.content |
2.post反射类型
1 2 3 |
req = requests.post('http://127.0.0.1:2333/xssfork/create_task/7T2o22NcQSLGk75',data=json.dumps({'url':'http://10.211.55.13/xss/post_xss.php', 'data':'name=233'), headers={'Content-Type':'application/json'}) return req.content |
3.get反射型类型,需要验证cookie
1 2 3 |
req = requests.post('http://127.0.0.1:2333/xssfork/create_task/7T2o22NcQSLGk75',data=json.dumps({'url':'http://10.211.55.13/xss/example1.php?name=hacker', 'cookie':'usid=admin'), headers={'Content-Type':'application/json'}) return req.content |
4.post反射型类型,需要验证cookie
1 2 3 |
req = requests.post('http://127.0.0.1:2333/xssfork/create_task/7T2o22NcQSLGk75',data=json.dumps({'url':'http://10.211.55.13/xss/post_xss.php', 'data':'name=2333', 'cookie': 'usid=admin'), headers={'Content-Type':'application/json'}) return req.content |
5.get储存型,需要验证cookie
1 2 3 |
req = requests.post('http://127.0.0.1:2333/xssfork/create_task/7T2o22NcQSLGk75',data=json.dumps({'url':'http://10.211.55.13/xss/example1.php?name=hacker', 'cookie':'usid=admin', 'destination': 'http://10.211.55.13/output.php'), headers={'Content-Type':'application/json'}) return req.content |
4.post储存型,需要验证cookie
1 2 3 |
req = requests.post('http://127.0.0.1:2333/xssfork/create_task/7T2o22NcQSLGk75',data=json.dumps({'url':'http://10.211.55.13/xss/example1.php?name=hacker', 'data':'name=2333', 'cookie':'usid=admin', 'destination': 'http://10.211.55.13/output.php'), headers={'Content-Type':'application/json'}) return req.content |
返回码
1 2 |
{"status": "success", "task_id": "1"} |
调用者可以获取到任务id,以便于启动检测。 #启动任务
1 2 3 4 |
import requests req = requests.get('http://127.0.0.1:2333/xssfork/start_task/tM0Xnl0qD6nsHku/%s' % (task_id)) print req.content |
返回码
1 2 |
{"status": "success", "msg": "task will start"} |
#查看状态
1 2 3 4 |
import requests req = requests.get('http://127.0.0.1:2333/xssfork/task_status/tM0Xnl0qD6nsHku/%s' % (task_id)) print req.content |
返回码分为4种,分别如下:
1.任务不存在
1 2 |
{"status": -1, "msg": "task isn’t existed"} |
2.任务创建了,但是未启动
1 2 |
{"status": 0, "msg": "task isn't started"} |
3.任务正在作业中,未完成
1 2 |
{"status": 1, "msg": "task is working"} |
4.任务作业完成
1 2 |
{"status":2, "msg": "task has been done"} |
#获取结果
1 2 3 |
req = requests.get('http://127.0.0.1:2333/xssfork/task_result/7T2o22NcQSLGk75/%s' % (task_id)) print req.content |
返回分为两种
1.检测到漏洞,并且返回payload
1 2 |
{"payload": "{'url': "http://10.211.55.13/xss/example1.php?name=%22<xss></xss>//", 'data': null}"} |
2.未检测到漏洞
1 2 |
{"payload": null} |
#结束任务
1 2 3 |
req = requests.get('http://127.0.0.1:2333/xssfork/kill_task/7T2o22NcQSLGk75/%s' % (task_id)) print req.content |
返回结果可能有4种 1.结束任务失败,因为任务不存在
1 2 |
{"status": "false", "msg": "task isn’t existed"} |
2.结束任务失败,因为任务根本没启动
1 2 |
{"status": "false", "msg": "task isn't started"} |
3.结束任务失败,因为任务本已经结束,不需要强制杀死
1 2 |
{"status": "false", "msg": "task has been done"} |
4.结束任务成功,任务原本是处于运行中的状态
1 2 |
{"status": "success", "msg": "task will be killed"} |
#完整的例子 1.一次带有cookie验证的post xss 漏洞示例代码
1 2 3 4 5 6 7 8 9 10 |
<?php if (isset($_COOKIE['usid']) && isset($_POST['id'])) { if ($_COOKIE['usid']=="admin") { echo $_POST['id']; } } ?> |
客户端代码
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 |
#! /usr/bin/env python # coding=utf-8 import json import time import requests def creat_task(url, data, cookie): json_data = json.dumps({'url': url, 'data': data, 'cookie': cookie}) req = requests.post('http://127.0.0.1:2333/xssfork/create_task/7T2o22NcQSLGk75', data=json_data, headers={'Content-Type':'application/json'}) return req.content def start_task(task_id): req = requests.get('http://127.0.0.1:2333/xssfork/start_task/7T2o22NcQSLGk75/{}'.format(task_id)) return req.content def get_task_status(task_id): req = requests.get('http://127.0.0.1:2333/xssfork/task_status/7T2o22NcQSLGk75/{}'.format(task_id)) return req.content def get_task_result(task_id): req = requests.get('http://127.0.0.1:2333/xssfork/task_result/7T2o22NcQSLGk75/{}'.format(task_id)) return req.content def running(task_id): time.sleep(5) task_status = int(json.loads(get_task_status(task_id)).get('status')) return task_status in [0, 1] if __name__ == "__main__": url = "http://10.211.55.3/xsstest/cookie_xss_post.php" data = "id=1" cookie = "usid=admin" task_id = json.loads(creat_task(url, data, cookie)).get('task_id') start_task(task_id) while running(task_id): print "the task is working" print get_task_result(task_id) <span style="font-size: 12pt;"><strong>开源地址 <a href="https://github.com/bsmali4/xssfork">https://github.com/bsmali4/xssfork</a> 记得不要吝啬你的star</strong></span> |
本文由 安全周 作者:SecJack 发表,转载请注明来源!
您必须[登录] 才能发表留言!