Termux ID: Cookie -->

    Social Items

Home / Cookie

XSSSNIPER is an handy xss discovery tool with mass scanning functionalities.

Usage:
Usage: xsssniper.py [options]

Options:
  -h, --help            show this help message and exit
  -u URL, --url=URL     target URL
  --post                try a post request to target url
  --data=POST_DATA      post data to use
  --threads=THREADS     number of threads
  --http-proxy=HTTP_PROXY
                        scan behind given proxy (format: 127.0.0.1:80)
  --tor                 scan behind default Tor
  --crawl               crawl target url for other links to test
  --forms               crawl target url looking for forms to test
  --user-agent=USER_AGENT
                        provide an user agent
  --random-agent        perform scan with random user agents
  --cookie=COOKIE       use a cookie to perform scans
  --dom                 basic heuristic to detect dom xss

Examples:
Scanning a single url with GET params:
$ python xsssniper.py -u "http://target.com/index.php?page=test"
Scanning a single url with POST params:
$ python xsssniper.py -u "http://target.com/index.php" --post --data=POST_DATA
Crawl a single url looking for forms to scan:
$ python xsssniper.py -u "http://target.com" --forms
Mass scan an entire website:
$ python xsssniper.py -u "http://target.com" --crawl
Mass scan an entire website forms included:
$ python xsssniper.py -u "http://target.com" --crawl --forms
Analyze target page javascripts (embedded and linked) to search for common sinks and sources:
$ python xsssniper.py -u "http://target.com" --dom


XSSSNIPER - An Automatic XSS Discovery Tool


This tool can be used to brute discover GET and POST parameters.

Often when you are busting a directory for common files, you can identify scripts (for example test.php) that look like they need to be passed an unknown parameter. This hopefully can help find them.

The -off flag allows you to specify an offset (helps with dynamic pages) so for example, if you were getting alternating response sizes of 4444 and 4448, set the offset to 5 and it will only show the stuff outside the norm

Usage
usage: parameth.py [-h] [-v] [-u URL] [-p PARAMS] [-H HEADER] [-a AGENT]
              [-t THREADS] [-off VARIANCE] [-o OUT] [-P PROXY]
              [-x IGNORE] [-s SIZEIGNORE] [-d DATA] [-i IGMETH]
              [-c COOKIE]***
optional arguments:
-h, --help show this help message and exit
-v, --version Version Information
-u URL, --url URL Target URL
-p PARAMS, --params PARAMS Provide a list of parameters to scan for
-H HEADER, --header HEADER Add a custom header to the requests
-a AGENT, --agent AGENT Specify a user agent
-t THREADS, --threads THREADS Specify the number of threads.
-off VARIANCE, --variance VARIANCE The offset in difference to ignore (if dynamic pages)
-diff DIFFERENCE, --difference DIFFERENCE Percentage difference in response (recommended 95)
-o OUT, --out OUT Specify output file
-P PROXY, --proxy PROXY Specify a proxy in the form http|s://[IP]:[PORT]
-x IGNORE, --ignore IGNORE Specify a status to ignore eg. 404,302...
-s SIZEIGNORE, --sizeignore SIZEIGNORE Ignore responses of specified size
-d DATA, --data DATA Provide default post data (also taken from provided url after ?)
-i IGMETH, --igmeth IGMETH Ignore GET or POST method. Specify g or p
-c COOKIE, --cookie COOKIE Specify Cookies
-T TIMEOUT, --timeout TIMEOUT Specify a timeout in seconds to wait between each request

Adding new params from source:
The following regexes might be useful to parse $_GET or $_POST parameters from source:
$> grep -rioP '$_POST[\s*["']\s*\w+\s*["']\s*]' PHPSOURCE  | grep -oP '$_POST[\s*["']\s*\w+\s*["']\s*]' | sed -e "s/$_POST[\s*["']//g"  -e "s/\s*['"]\s*]//g" | sort -u > /tmp/outfile.txt
$> grep -rioP '$_GET[\s*["']\s*\w+\s*["']\s*]' PHPSOURCE  | grep -oP '$_GET[\s*["']\s*\w+\s*["']\s*]' | sed -e "s/$_GET[\s*["']//g"  -e "s/\s*['"]\s*]//g" | sort -u > /tmp/outfile.txt


parameth - Tool to brute discover GET and POST parameters


XCat is a command line program that aides in the exploitation of blind XPath injection vulnerabilities. It can be used to retrieve the whole XML document being processed by a vulnerable XPath query, read arbitrary files on the hosts filesystem and utilize out of bound HTTP requests to make the server send data directly to xcat.

XCat is built to exploit boolean XPath injections (Where only one bit of data can be extracted in one request) and it requires you to manually identify the exploit first, this does not do that for you. Check out the docs at http://xcat.readthedocs.org/ for more info.

Install:
pip3 install xcat
Note: This requires Python 3.5 and above to run.
> xcat --help

XCat.

Usage:
    xcat <url> <target_parameter> [<parameters>]... (--true-string=<string> | --true-code=<code>) [--method=<method>]
         [--fast] [--oob-ip=<ip> (--oob-port=<port>)] [--stats] [--concurrency=<val>]
         [--features] [--body] [--cookie=<cookie>] [(--shell | --shellcmd=<cmd>)]
    xcat detectip

Options:
    -s, --shell                 Open the psudo-shell for exploring injections
    -S, --shellcmd=<cmd>        Execute a single shell command.
    -m, --method=<method>       HTTP method to use for requests [default: GET]
    -o, --oob-ip=<ip>           Use this IP for OOB injection attacks
    -p, --oob-port=<port>       Use this port for injection attacks
    -x, --concurrency=<val>     Make this many connections to the target server [default: 10]
    -b, --body                  Send the parameters in the request body as form data. Used with POST requests.
    -c, --cookie=<cookie>       A string that will be sent as the Cookie header
    -f, --fast                  Only fetch the first 15 characters of string values
    -t, --true-string=<string>  Interpret this string in the response body as being a truthful request. Negate with '!'
    -tc, --true-code=<code>     Interpret this status code as being truthful. Negate with '!'
    --stats                     Print statistics at the end of the session
More examples and documentation can be found at http://xcat.readthedocs.org/



XCat - Automate XPath Injection Attacks to Retrieve Documents

Subscribe to: Posts (Atom)