kn0wm4d

from flask import Flask

APP = Flask(__name__)

@APP.after_request
def add_header(response):
    url = 'http://localhost'
    response.headers['Server'] = 'ESF'
    response.headers['X-XSS-Protection'] = "1; mode=block"
    response.headers['Strict-Transport-Security'] = 'max-age=15724800; includeSubdomains'

kn0wm4d

from selenium import webdriver
from selenium.webdriver.chrome.options import Options
from selenium.webdriver.common.action_chains import ActionChains
from selenium.webdriver.common.keys import Keys
from selenium.webdriver.common.desired_capabilities import DesiredCapabilities
import time

PROXY = 'https://127.0.0.1:8080'

options = Options()

kn0wm4d

import requests, base64
import urllib

headers = {'Cookie':'password=secret; session=eyJ1c2VybmFtZSI6ImFkbWluIn0.DmVf_g.D1xbdFk0MZu9Ek_guHqz9RsEQeo'}
cmds = requests.get('https://raw.githubusercontent.com/xmendez/wfuzz/master/wordlist/Injections/SQL.txt').text.split('\n')

class color:
    CBLINK = '\033[5m'
    HEADER = '\033[95m'
    OKBLUE = '\033[94m'

kn0wm4d

alert('xss');

kn0wm4d

#
# ZAP is an HTTP/HTTPS proxy for assessing web application security.
#
# Copyright 2017 ZAP Development Team
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0

kn0wm4d

# FUNCIONAMIENTO BÁSICO FLASK + CELERY

@app.route('/example', methods=['GET', 'POST']) esto iniciará la funcion example
@login_required  # Limita acceso a usuarios logueados
def example():
    if request.method == 'POST':        
        # validaciones del form en request.form['param']
        param1 = request.form['param1']
        # objeto current_user contiene los atributos de la clase User() (en models.py)
        try: