本帖最后由 xiaofan321 于 2017-7-6 10:17 编辑
xss 检测工具 支持get/post 可批量
代码放到最下边
使用方法
get 方法调用 xssfind(url,payload)
post 方法调用 xssfind(url,payload,method='post',data='name=test&aa=tet')
payload 来自文件
函数 getquerys用于获取格式化参数
函数 xssfind 用于将每个参数加上payload 并检测
源码如下
# coding=utf-8
import requests
import urlparse
def getquerys(query,payload):
results = []
newquery = query.replace('&','{}&')+'{}'
params = [ x[1] for x in urlparse.parse_qsl(query) ]
# print newquery,params
for param in params:
results.append( newquery.format(*(payload if v == param else '' for v in params)) )
return results
# print getquerys('name=test&aa=tet','xxxx')
def xssfind(url,payload,method='get',data=''):
print 'try ',payload
if method == 'post':
if data == '':
print 'not param to find'
return ''
ndatas = getquerys(data,payload)
for ndata in ndatas:
ndata = dict([dd for dd in urlparse.parse_qsl(ndata)])
req = requests.post(url,data=ndata)
if payload in req.text:
print '[success] payload is:',ndata
else:
urlp = urlparse.urlparse(url)
query = urlp.query
ndatas = getquerys(query,payload)
for ndata in ndatas:
nurl = urlparse.urlunparse([urlp.scheme ,urlp.netloc,urlp.path,urlp.params,ndata,urlp.fragment] )
req = requests.get(nurl)
# req.encoding = 'utf-8'
if payload in req.content:
print '[success] payload is:',ndata
def scan(payloadspath='payloads.txt'):
with open(payloadspath) as f:
payloads = f.read().split('\n')
url = 'http://127.0.0.1/xsstest/level1.php?name=test'
for payload in payloads:
xssfind(url,payload)
# xssfind(url,payload,'post','name=test&aa=tet')
if __name__ == '__main__':
scan()需要修改的参数 scan函数
其中的payload 来自开源工具 BruteXSS
|