Zapotek

require 'net/http'
require 'sinatra'
require 'scnr/introspector'

class MyApp < Sinatra::Base

    use SCNR::Introspector, scope: {
      path_start_with: __FILE__
    }

Zapotek

require 'sinatra'
require 'scnr/introspector'

class MyApp < Sinatra::Base

    use SCNR::Introspector, scope: {
      path_start_with: __FILE__
    }

    def process_params( params )

Zapotek

URL = 'https://ginandjuice.shop/catalog'

# Proxy HTTP tragic through Burp/ZAP/whatever.
# Options.http.proxy_host = 'localhost'
# Options.http.proxy_port = 8282

b = Browser.new(
  visible:     true,
  on_request:  proc do |request, _|
      # Inspect or manipulate HTTP traffic in the form of an HTTP::Request.

Zapotek

require 'scnr/introspector'
require 'sinatra/base'

class MyApp < Sinatra::Base
    use SCNR::Introspector, scope: {
      path_start_with: __FILE__
    }

    def noop
    end

Zapotek

$ ./examples/sinatra_xss.rb
 [*] Preparing plugins...
 [*] ... done.

 [*] [HTTP: 200] http://myapp/
 [~] Identified as: linux, ruby, rack
 [~] Analysis resulted in 1 usable paths.
 [*] Harvesting HTTP responses...
 [~] Depending on server responsiveness and network conditions this may take a while.
 [*] XSS: Auditing link input 'v' pointing to: 'http://myapp/'

Zapotek

require 'pry'
require 'scnr/introspector'
require 'scnr/introspector/helpers/output'

include SCNR
include Introspector::Helpers::Output

# Location of the web application environment loader.
APP_PATH = "#{File.expand_path( File.dirname(__FILE__) )}/sinatra_xss.rb"

Zapotek

require 'sinatra/base'

class MyApp < Sinatra::Base

    def noop
    end

    def process_params( params )
        noop
        params.values.join( ' ' )

Zapotek

#!/usr/bin/env ruby

require 'pp'
require_relative 'rest-http-helpers'

# Configure the REST server to use this Agent to provide Instances.
request :put, 'agent/url', 'localhost:1111'

request :post, 'instances', {
  url:    'http://testhtml5.vulnweb.com',

Zapotek

#!/usr/bin/env ruby

require 'pp'
require_relative 'rest-http-helpers'

# Create a new scanner Instance (process) and run a scan with the following options.
request :post, 'instances', {

  # Scan this URL.
  url:    'http://testhtml5.vulnweb.com',

Zapotek

require 'json'
require 'tmpdir'
require 'typhoeus'

def response
  if @last_response.headers['Content-Type'].include? 'json'
    data = JSON.load( @last_response.body )
  else
    data = @last_response.body
  end