marz-hunter/xss.py

## xss.py
from burp import IBurpExtender
from burp import IHttpListener
from burp import IProxyListener
from burp import IExtensionHelpers
from burp import IScannerListener
from burp import IExtensionStateListener
from burp import IParameter
from java.io import PrintWriter
from java.net import URLEncoder
from burp import ITab
from threading import Thread
from burp import IHttpListener
from burp import IMessageEditorController
from java.awt import Component;
from java.io import PrintWriter;
from java.awt.event import MouseAdapter
from java.awt.event import ItemListener
from javax.swing import RowFilter
from java.util import ArrayList;
from java.util import List;
from javax.swing import JScrollPane;
from javax.swing import JSplitPane;
from javax.swing import JTabbedPane;
from javax.swing import JCheckBox
from javax.swing import JTable
from javax.swing import JButton
from javax.swing import JTextArea
from javax.swing import JToggleButton
from javax.swing import JPanel
from javax.swing import JLabel
from javax.swing import SwingUtilities;
from javax.swing import BoxLayout
from javax.swing.table import AbstractTableModel;
from threading import Lock
from java.awt import Color

import re
import threading


class BurpExtender(IBurpExtender, IHttpListener, IProxyListener, IScannerListener, IExtensionStateListener, ITab, IMessageEditorController, AbstractTableModel):

    def registerExtenderCallbacks(self, callbacks):
        # set our extension name
        self._callbacks = callbacks
        self.ATTRIBUTE_QUOTES = "(\".*\")|(\'.*\')"
        callbacks.setExtensionName("Rexsser")
        # obtain our output stream
        self._stdout = PrintWriter(callbacks.getStdout(), True)
        self._helpers = callbacks.getHelpers()
        # register ourselves as an HTTP listener

        self._log = ArrayList()
        self._lock = Lock()

        # main split pane
        self._splitpane = JSplitPane(JSplitPane.VERTICAL_SPLIT)

        # table of log entries
        logTable = Table(self)
        scrollPane = JScrollPane(logTable)
        self.logTable = logTable
        self._splitpane.setLeftComponent(scrollPane)


        splane = JSplitPane(JSplitPane.HORIZONTAL_SPLIT)
        btn = JToggleButton("Turn on/off")
        self._btn = btn
        panel  = JPanel()
        panel1 = JPanel()

        chxbox =  JCheckBox("In Scope Only")
        self.chxbox = chxbox
        panel1.add(self._btn)
        panel1.add(chxbox)
        panel.add(panel1)

        panel2 = JPanel()
        panel2.setLayout(BoxLayout(panel2, BoxLayout.Y_AXIS))
        textarea = JTextArea("text/html\napplication/json")
        textarea.setRows(5)
        textarea.setColumns(5)
        textarea.setLineWrap(1);
        panel2.add(JLabel("Content Types: "))
        panel2.add(textarea)
        panel.add(panel2)
        self.content_types = textarea

        panel3 = JPanel()

        panel3.add(JLabel("Status Codes: "))
        txtarea = JTextArea("200,500")
        txtarea.setRows(3)
        txtarea.setLineWrap(1)
        self.status_codes = txtarea
        panel3.add(txtarea)
        panel3.setLayout(BoxLayout(panel3, BoxLayout.Y_AXIS))
        panel.add(panel3)

        panel.setLayout(BoxLayout(panel,BoxLayout.Y_AXIS))
        tabs = JTabbedPane()
        splane.setLeftComponent(panel)

        self._requestViewer = callbacks.createMessageEditor(self, False)
        self._responseViewer = callbacks.createMessageEditor(self, False)
        tabs.addTab("Request", self._requestViewer.getComponent())
        tabs.addTab("Response", self._responseViewer.getComponent())
        splane.setRightComponent(tabs)

        self._splitpane.setRightComponent(splane)

        # customize our UI components
        callbacks.customizeUiComponent(self._splitpane)
        callbacks.customizeUiComponent(logTable)
        callbacks.customizeUiComponent(scrollPane)
        callbacks.customizeUiComponent(splane)

        # add the custom tab to Burp's UI
        callbacks.addSuiteTab(self)
        callbacks.registerHttpListener(self)

        return

    def getTabCaption(self):
        return "Rexsser"

    def getUiComponent(self):
        return self._splitpane


    def getRowCount(self):
        try:
            return self._log.size()
        except:
            return 0

    def getColumnCount(self):
        return 4

    def getColumnName(self, columnIndex):
        if columnIndex == 0:
            return "Detail"
        if columnIndex == 1:
            return "Parameter"
        if columnIndex == 2:
            return "URL"
        if columnIndex == 3:
            return "WAF Status"
        return ""

    def getValueAt(self, rowIndex, columnIndex):
        logEntry = self._log.get(rowIndex)
        if columnIndex == 0:
            return logEntry._detail
        if columnIndex == 1:
            return logEntry._parameter
        if columnIndex == 2:
            return logEntry._url
        if columnIndex == 3:
            return logEntry._waf
        return ""


    def getHttpService(self):
        return self._currentlyDisplayedItem.getHttpService()

    def getRequest(self):
        return self._currentlyDisplayedItem.getRequest()

    def getResponse(self):
        return self._currentlyDisplayedItem.getResponse()

    def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo):
        if messageIsRequest:
            return
        if not self._btn.isSelected():
            return
        code = self._helpers.analyzeResponse(messageInfo.getResponse()).getStatusCode()
        content_type = self._helpers.analyzeResponse(messageInfo.getResponse()).getStatedMimeType()
        statuscodes = self.status_codes.getText().split(",")
        content_types = self.content_types.getText().split("\n")

        cts = [x.split("/")[1].upper() for x in content_types]
        print(content_type+str(cts))
        if not str(code) in statuscodes:
            return
        if not content_type in cts:
            return
        self.toolFlag = toolFlag
        patt = "var (\w+).*=.*(.*)"
        payloads = ["fixedvaluehopefullyexists","random1'ss","random2\"ss","dumm</script>ss","<h1>duteer</h1>ss"]
        for payload in payloads:
            if self._callbacks.getToolName(toolFlag) == "Proxy":
                    self.processTestcases(patt, messageInfo, payload)

    def issues(self, messageInfo, detail, param, waf):
        self._lock.acquire()
        row = self._log.size()
        self._log.add(LogEntry(param, self._callbacks.saveBuffersToTempFiles(messageInfo), self._helpers.analyzeRequest(messageInfo).getUrl(), detail, waf))
        self.fireTableRowsInserted(row, row)
        self._lock.release()


    def processTestcases(self, patt, messageInfo, payload):
        irequest = self._helpers.analyzeRequest(messageInfo)
        url = irequest.getUrl()
        response = messageInfo.getResponse()
        httpservice = messageInfo.getHttpService()
        inject = URLEncoder.encode(payload, "UTF-8")
        inScopeOnly = self.chxbox.isSelected()
        if inScopeOnly and not self._callbacks.isInScope(url):
            return
        if True:
        #patt = "var (\w+).*=.*('|\")(.*)('|\")"
            words = []
            x = re.findall(patt, self._helpers.bytesToString(response))
            for y in x:
                    words.append(y[0])
            sortedwords = list(set(words))
            requestString  = self._helpers.bytesToString(messageInfo.getRequest())
            if 'GET /' in requestString:
                mthd = 'GET'
            elif 'POST /' in requestString:
                mthd = 'POST'
            else:
                mthd = 'GET'
            if len(sortedwords) > 0:
                for word in sortedwords:
                    if mthd == 'GET':
                        param = self._helpers.buildParameter(word, inject , IParameter.PARAM_URL)
                    elif mthd == 'POST':
                        param = self._helpers.buildParameter(word, inject, IParameter.PARAM_BODY)
                    else:
                        param = self._helpers.buildParameter(word, inject , IParameter.PARAM_URL)
                    newrequest  = self._helpers.addParameter(messageInfo.getRequest(), param)
                    t = threading.Thread(target=self.makeRequest,args=[messageInfo.getHttpService(), newrequest, word, payload])
                    t.daemon = True
                    t.start()


    def makeRequest(self, httpservice, requestBytes, word, payload):
        #useHttps = 1 if httpservice.getProtocol() == 'https' else 0
        #print(self._helpers.bytesToString(requestBytes))
        bRequestResponse  = self._callbacks.makeHttpRequest(httpservice, requestBytes)
        tResp = bRequestResponse.getResponse()
        status = self._helpers.analyzeResponse(tResp).getStatusCode()
        url = self._helpers.analyzeRequest(bRequestResponse).getUrl()
        response = self._helpers.bytesToString(tResp)
        if status != 302:
            if status == 200:
                waf = "Allowed"
            else:
                waf = "Unknown"
            if payload in response:
                if payload  == 'fixedvaluehopefullyexists':
                    str1 = word+" is a valid parameter"
                    str2 = self.definesContext(payload, response)
                    self.issues(bRequestResponse, str2+" "+str1, word, waf)
                if payload == 'random1\'ss':
                    str1 = word+" single quote reflection allowed"
                    str2 = self.definesContext(payload, response)
                    self.issues(bRequestResponse, str2+" "+str1, word, waf)
                if payload == 'random2"ss':
                    str1 = word+" Double quote allowed"
                    str2 = self.definesContext(payload, response)
                    self.issues(bRequestResponse, str2+" "+str1, word, waf)
                if payload == 'dumm</script>ss':
                    str1 = word+" Script tags allowed"
                    str2 = self.definesContext(payload, response)
                    self.issues(bRequestResponse, str2+" "+str1, word, waf)
                if payload == '<h1>duteer</h1>ss':
                    str1 = word+" HTML tags allowed"
                    str2 = self.definesContext(payload, response)
                    self.issues(bRequestResponse, str2+" "+str1, word, waf)
            else:
                pass
        if status == 403:
            self.issues(bRequestResponse, "", word, "Blocked")


    def definesContext(self, reflection, html):
        indx = html.find(reflection)
        q = html[indx-1]
        q2 = html[indx+len(reflection)]
        if q in reflection and q =='"':
            return "[Vulnerable][attribute][\"]"
        if q in reflection and q =="'":
            return "[Vulnerable][attribute][']"
        else:
            return "[Possible]"

class Mouseclick(MouseAdapter):
    def __init__(self, extender):
        self._extender = extender

    def mouseReleased(self, evt):
        if evt.button == 3:
            self._extender.menu.show(evt.getComponent(), evt.getX(), evt.getY())

class TabTableFilter(ItemListener):
    def __init__(self, extender):
        self._extender = extender

    def itemStateChanged(self, e):
        self._extender.tableSorter.sort()


class Table(JTable):
    def __init__(self, extender):
        self._extender = extender
        self.setModel(extender)
        self.getColumnModel().getColumn(0).setPreferredWidth(50)
        self.getColumnModel().getColumn(1).setPreferredWidth(50)
        self.getColumnModel().getColumn(2).setPreferredWidth(800)
        self.getColumnModel().getColumn(3).setPreferredWidth(50)
        self.setRowSelectionAllowed(True)

    def changeSelection(self, row, col, toggle, extend):

        # show the log entry for the selected row
        logEntry = self._extender._log.get(row)
        self._extender._requestViewer.setMessage(logEntry._requestResponse.getRequest(), True)
        self._extender._responseViewer.setMessage(logEntry._requestResponse.getResponse(), False)
        self._extender._currentlyDisplayedItem = logEntry._requestResponse

        JTable.changeSelection(self, row, col, toggle, extend)

    def prepareRenderer(self, renderer, row, col):
        comp = JTable.prepareRenderer(self, renderer, row, col)
        value = self.getValueAt(self._extender.logTable.convertRowIndexToModel(row), col)

        if col == 0:
            if "Vulnerable" in value:
                comp.setBackground(Color(255, 153, 153))
                comp.setForeground(Color.BLACK)
            elif "Possible" in value:
                comp.setBackground(Color(255, 204, 153))
                comp.setForeground(Color.BLACK)
            else:
                comp.setBackground(Color(204, 255, 153))
                comp.setForeground(Color.BLACK)
        else:
            comp.setForeground(Color.BLACK)
            comp.setBackground(Color.WHITE)

        selectedRow = self._extender.logTable.getSelectedRow()
        if selectedRow == row:
            comp.setBackground(Color(201, 215, 255))
            comp.setForeground(Color.BLACK)
        return comp


class LogEntry:
    def __init__(self, parameter, requestResponse, url, detail, waf):
        self._parameter = parameter
        self._requestResponse = requestResponse
        self._url = url
        self._detail = detail
        self._waf = waf
	from burp import IBurpExtender
	from burp import IHttpListener
	from burp import IProxyListener
	from burp import IExtensionHelpers
	from burp import IScannerListener
	from burp import IExtensionStateListener
	from burp import IParameter
	from java.io import PrintWriter
	from java.net import URLEncoder
	from burp import ITab
	from threading import Thread
	from burp import IHttpListener
	from burp import IMessageEditorController
	from java.awt import Component;
	from java.io import PrintWriter;
	from java.awt.event import MouseAdapter
	from java.awt.event import ItemListener
	from javax.swing import RowFilter
	from java.util import ArrayList;
	from java.util import List;
	from javax.swing import JScrollPane;
	from javax.swing import JSplitPane;
	from javax.swing import JTabbedPane;
	from javax.swing import JCheckBox
	from javax.swing import JTable
	from javax.swing import JButton
	from javax.swing import JTextArea
	from javax.swing import JToggleButton
	from javax.swing import JPanel
	from javax.swing import JLabel
	from javax.swing import SwingUtilities;
	from javax.swing import BoxLayout
	from javax.swing.table import AbstractTableModel;
	from threading import Lock
	from java.awt import Color

	import re
	import threading



	class BurpExtender(IBurpExtender, IHttpListener, IProxyListener, IScannerListener, IExtensionStateListener, ITab, IMessageEditorController, AbstractTableModel):

	def registerExtenderCallbacks(self, callbacks):
	# set our extension name
	self._callbacks = callbacks
	self.ATTRIBUTE_QUOTES = "(\".\")\|(\'.\')"
	callbacks.setExtensionName("Rexsser")
	# obtain our output stream
	self._stdout = PrintWriter(callbacks.getStdout(), True)
	self._helpers = callbacks.getHelpers()
	# register ourselves as an HTTP listener

	self._log = ArrayList()
	self._lock = Lock()

	# main split pane
	self._splitpane = JSplitPane(JSplitPane.VERTICAL_SPLIT)

	# table of log entries
	logTable = Table(self)
	scrollPane = JScrollPane(logTable)
	self.logTable = logTable
	self._splitpane.setLeftComponent(scrollPane)


	splane = JSplitPane(JSplitPane.HORIZONTAL_SPLIT)
	btn = JToggleButton("Turn on/off")
	self._btn = btn
	panel = JPanel()
	panel1 = JPanel()

	chxbox = JCheckBox("In Scope Only")
	self.chxbox = chxbox
	panel1.add(self._btn)
	panel1.add(chxbox)
	panel.add(panel1)

	panel2 = JPanel()
	panel2.setLayout(BoxLayout(panel2, BoxLayout.Y_AXIS))
	textarea = JTextArea("text/html\napplication/json")
	textarea.setRows(5)
	textarea.setColumns(5)
	textarea.setLineWrap(1);
	panel2.add(JLabel("Content Types: "))
	panel2.add(textarea)
	panel.add(panel2)
	self.content_types = textarea

	panel3 = JPanel()

	panel3.add(JLabel("Status Codes: "))
	txtarea = JTextArea("200,500")
	txtarea.setRows(3)
	txtarea.setLineWrap(1)
	self.status_codes = txtarea
	panel3.add(txtarea)
	panel3.setLayout(BoxLayout(panel3, BoxLayout.Y_AXIS))
	panel.add(panel3)

	panel.setLayout(BoxLayout(panel,BoxLayout.Y_AXIS))
	tabs = JTabbedPane()
	splane.setLeftComponent(panel)

	self._requestViewer = callbacks.createMessageEditor(self, False)
	self._responseViewer = callbacks.createMessageEditor(self, False)
	tabs.addTab("Request", self._requestViewer.getComponent())
	tabs.addTab("Response", self._responseViewer.getComponent())
	splane.setRightComponent(tabs)

	self._splitpane.setRightComponent(splane)

	# customize our UI components
	callbacks.customizeUiComponent(self._splitpane)
	callbacks.customizeUiComponent(logTable)
	callbacks.customizeUiComponent(scrollPane)
	callbacks.customizeUiComponent(splane)

	# add the custom tab to Burp's UI
	callbacks.addSuiteTab(self)
	callbacks.registerHttpListener(self)

	return

	def getTabCaption(self):
	return "Rexsser"

	def getUiComponent(self):
	return self._splitpane


	def getRowCount(self):
	try:
	return self._log.size()
	except:
	return 0

	def getColumnCount(self):
	return 4

	def getColumnName(self, columnIndex):
	if columnIndex == 0:
	return "Detail"
	if columnIndex == 1:
	return "Parameter"
	if columnIndex == 2:
	return "URL"
	if columnIndex == 3:
	return "WAF Status"
	return ""

	def getValueAt(self, rowIndex, columnIndex):
	logEntry = self._log.get(rowIndex)
	if columnIndex == 0:
	return logEntry._detail
	if columnIndex == 1:
	return logEntry._parameter
	if columnIndex == 2:
	return logEntry._url
	if columnIndex == 3:
	return logEntry._waf
	return ""


	def getHttpService(self):
	return self._currentlyDisplayedItem.getHttpService()

	def getRequest(self):
	return self._currentlyDisplayedItem.getRequest()

	def getResponse(self):
	return self._currentlyDisplayedItem.getResponse()

	def processHttpMessage(self, toolFlag, messageIsRequest, messageInfo):
	if messageIsRequest:
	return
	if not self._btn.isSelected():
	return
	code = self._helpers.analyzeResponse(messageInfo.getResponse()).getStatusCode()
	content_type = self._helpers.analyzeResponse(messageInfo.getResponse()).getStatedMimeType()
	statuscodes = self.status_codes.getText().split(",")
	content_types = self.content_types.getText().split("\n")

	cts = [x.split("/")[1].upper() for x in content_types]
	print(content_type+str(cts))
	if not str(code) in statuscodes:
	return
	if not content_type in cts:
	return
	self.toolFlag = toolFlag
	patt = "var (\w+).=.(.*)"
	payloads = ["fixedvaluehopefullyexists","random1'ss","random2\"ss","dumm</script>ss","<h1>duteer</h1>ss"]
	for payload in payloads:
	if self._callbacks.getToolName(toolFlag) == "Proxy":
	self.processTestcases(patt, messageInfo, payload)

	def issues(self, messageInfo, detail, param, waf):
	self._lock.acquire()
	row = self._log.size()
	self._log.add(LogEntry(param, self._callbacks.saveBuffersToTempFiles(messageInfo), self._helpers.analyzeRequest(messageInfo).getUrl(), detail, waf))
	self.fireTableRowsInserted(row, row)
	self._lock.release()



	def processTestcases(self, patt, messageInfo, payload):
	irequest = self._helpers.analyzeRequest(messageInfo)
	url = irequest.getUrl()
	response = messageInfo.getResponse()
	httpservice = messageInfo.getHttpService()
	inject = URLEncoder.encode(payload, "UTF-8")
	inScopeOnly = self.chxbox.isSelected()
	if inScopeOnly and not self._callbacks.isInScope(url):
	return
	if True:
	#patt = "var (\w+).=.('\|\")(.*)('\|\")"
	words = []
	x = re.findall(patt, self._helpers.bytesToString(response))
	for y in x:
	words.append(y[0])
	sortedwords = list(set(words))
	requestString = self._helpers.bytesToString(messageInfo.getRequest())
	if 'GET /' in requestString:
	mthd = 'GET'
	elif 'POST /' in requestString:
	mthd = 'POST'
	else:
	mthd = 'GET'
	if len(sortedwords) > 0:
	for word in sortedwords:
	if mthd == 'GET':
	param = self._helpers.buildParameter(word, inject , IParameter.PARAM_URL)
	elif mthd == 'POST':
	param = self._helpers.buildParameter(word, inject, IParameter.PARAM_BODY)
	else:
	param = self._helpers.buildParameter(word, inject , IParameter.PARAM_URL)
	newrequest = self._helpers.addParameter(messageInfo.getRequest(), param)
	t = threading.Thread(target=self.makeRequest,args=[messageInfo.getHttpService(), newrequest, word, payload])
	t.daemon = True
	t.start()



	def makeRequest(self, httpservice, requestBytes, word, payload):
	#useHttps = 1 if httpservice.getProtocol() == 'https' else 0
	#print(self._helpers.bytesToString(requestBytes))
	bRequestResponse = self._callbacks.makeHttpRequest(httpservice, requestBytes)
	tResp = bRequestResponse.getResponse()
	status = self._helpers.analyzeResponse(tResp).getStatusCode()
	url = self._helpers.analyzeRequest(bRequestResponse).getUrl()
	response = self._helpers.bytesToString(tResp)
	if status != 302:
	if status == 200:
	waf = "Allowed"
	else:
	waf = "Unknown"
	if payload in response:
	if payload == 'fixedvaluehopefullyexists':
	str1 = word+" is a valid parameter"
	str2 = self.definesContext(payload, response)
	self.issues(bRequestResponse, str2+" "+str1, word, waf)
	if payload == 'random1\'ss':
	str1 = word+" single quote reflection allowed"
	str2 = self.definesContext(payload, response)
	self.issues(bRequestResponse, str2+" "+str1, word, waf)
	if payload == 'random2"ss':
	str1 = word+" Double quote allowed"
	str2 = self.definesContext(payload, response)
	self.issues(bRequestResponse, str2+" "+str1, word, waf)
	if payload == 'dumm</script>ss':
	str1 = word+" Script tags allowed"
	str2 = self.definesContext(payload, response)
	self.issues(bRequestResponse, str2+" "+str1, word, waf)
	if payload == '<h1>duteer</h1>ss':
	str1 = word+" HTML tags allowed"
	str2 = self.definesContext(payload, response)
	self.issues(bRequestResponse, str2+" "+str1, word, waf)
	else:
	pass
	if status == 403:
	self.issues(bRequestResponse, "", word, "Blocked")


	def definesContext(self, reflection, html):
	indx = html.find(reflection)
	q = html[indx-1]
	q2 = html[indx+len(reflection)]
	if q in reflection and q =='"':
	return "[Vulnerable][attribute][\"]"
	if q in reflection and q =="'":
	return "[Vulnerable][attribute][']"
	else:
	return "[Possible]"

	class Mouseclick(MouseAdapter):
	def __init__(self, extender):
	self._extender = extender

	def mouseReleased(self, evt):
	if evt.button == 3:
	self._extender.menu.show(evt.getComponent(), evt.getX(), evt.getY())

	class TabTableFilter(ItemListener):
	def __init__(self, extender):
	self._extender = extender

	def itemStateChanged(self, e):
	self._extender.tableSorter.sort()


	class Table(JTable):
	def __init__(self, extender):
	self._extender = extender
	self.setModel(extender)
	self.getColumnModel().getColumn(0).setPreferredWidth(50)
	self.getColumnModel().getColumn(1).setPreferredWidth(50)
	self.getColumnModel().getColumn(2).setPreferredWidth(800)
	self.getColumnModel().getColumn(3).setPreferredWidth(50)
	self.setRowSelectionAllowed(True)

	def changeSelection(self, row, col, toggle, extend):

	# show the log entry for the selected row
	logEntry = self._extender._log.get(row)
	self._extender._requestViewer.setMessage(logEntry._requestResponse.getRequest(), True)
	self._extender._responseViewer.setMessage(logEntry._requestResponse.getResponse(), False)
	self._extender._currentlyDisplayedItem = logEntry._requestResponse

	JTable.changeSelection(self, row, col, toggle, extend)

	def prepareRenderer(self, renderer, row, col):
	comp = JTable.prepareRenderer(self, renderer, row, col)
	value = self.getValueAt(self._extender.logTable.convertRowIndexToModel(row), col)

	if col == 0:
	if "Vulnerable" in value:
	comp.setBackground(Color(255, 153, 153))
	comp.setForeground(Color.BLACK)
	elif "Possible" in value:
	comp.setBackground(Color(255, 204, 153))
	comp.setForeground(Color.BLACK)
	else:
	comp.setBackground(Color(204, 255, 153))
	comp.setForeground(Color.BLACK)
	else:
	comp.setForeground(Color.BLACK)
	comp.setBackground(Color.WHITE)

	selectedRow = self._extender.logTable.getSelectedRow()
	if selectedRow == row:
	comp.setBackground(Color(201, 215, 255))
	comp.setForeground(Color.BLACK)
	return comp


	class LogEntry:
	def __init__(self, parameter, requestResponse, url, detail, waf):
	self._parameter = parameter
	self._requestResponse = requestResponse
	self._url = url
	self._detail = detail
	self._waf = waf