From 1a632cbd174f62ad2884d4af1e7244e4ec5d757f Mon Sep 17 00:00:00 2001 From: DanMcInerney Date: Fri, 25 Jul 2014 06:28:24 -0400 Subject: [PATCH] lots of cleanup --- .gitignore | 2 +- formatted_vulns | 772 +++++++++++++++++++++++++++++++++ xsscrapy/pipelines.py | 28 +- xsscrapy/settings.py | 2 +- xsscrapy/spiders/xss_spider.py | 181 +++++--- 5 files changed, 911 insertions(+), 74 deletions(-) create mode 100644 formatted_vulns diff --git a/.gitignore b/.gitignore index 6d62fec..75c86bb 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ *.pyc -vulnerable-urls.txt +*.txt diff --git a/formatted_vulns b/formatted_vulns new file mode 100644 index 0000000..35cb5cb --- /dev/null +++ b/formatted_vulns @@ -0,0 +1,772 @@ + +URL: http://danmcinerney.org/tests/form.html +Unfiltered: "()=<> +Type: form +Injection point: form field names: message, link, email + +URL: http://danmcinerney.org/tests/form.html +Unfiltered: JaVAscRIPT:prompt(99) +Type: form +Injection point: form field names: message, link, email + +URL: http://danmcinerney.org/tests/form.html +Unfiltered: JaVAscRIPT:prompt(99) +Type: form +Injection point: form field names: message, link, email + +URL: http://danmcinerney.org/tests/form.html +Unfiltered: "()=<> +Type: form +Injection point: form field names: message, link, email + +URL: http://danmcinerney.org/tests/form.html +Unfiltered: "()=<> +Type: form +Injection point: form field names: message, link, email + +URL: http://danmcinerney.org/tests/form.html +Unfiltered: JaVAscRIPT:prompt(99) +Type: form +Injection point: form field names: message, link, email + +URL: http://danmcinerney.org/tests/form.html +Unfiltered: "()=<> +Type: form +Injection point: form field names: message, link, email + +URL: http://danmcinerney.org/tests/form.html +Unfiltered: JaVAscRIPT:prompt(99) +Type: form +Injection point: form field names: message, link, email + +URL: http://danmcinerney.org/tests/form.html +Unfiltered: JaVAscRIPT:prompt(99) +Type: form +Injection point: form field names: message, link, email + +URL: http://danmcinerney.org/tests/form.html +Unfiltered: "()=<> +Type: form +Injection point: form field names: message, link, email + +URL: http://danmcinerney.org/tests/form.html +Unfiltered: JaVAscRIPT:prompt(99) +Type: form +Injection point: form field names: message, link, email + +URL: http://danmcinerney.org/tests/form.html +Unfiltered: "()=<> +Type: form +Injection point: form field names: message, link, email + +URL: http://danmcinerney.org/tests/form.html +Unfiltered: "()=<> +Type: form +Injection point: form field names: message, link, email + +URL: http://danmcinerney.org/tests/form.html +Unfiltered: JaVAscRIPT:prompt(99) +Type: form +Injection point: form field names: message, link, email + +URL: http://danmcinerney.org/tests/form.html +Unfiltered: "()=<> +Type: form +Injection point: form field names: message, link, email + +URL: http://danmcinerney.org/tests/form.html +Unfiltered: JaVAscRIPT:prompt(99) +Type: form +Injection point: form field names: message, link, email + +URL: http://danmcinerney.org/tests/form.html +Unfiltered: JaVAscRIPT:prompt(99) +Type: form +Injection point: form field names: message, link, email + +URL: http://danmcinerney.org/tests/form.html +Unfiltered: "()=<> +Type: form +Injection point: form field names: message, link, email + +URL: http://danmcinerney.org/tests/form.html +Unfiltered: "()=<> +Type: form +Injection point: form field names: message, link, email +Line: Your unfiltered email address is: 9zqjx"()=<>9zqjx
+ +URL: http://danmcinerney.org/tests/form.html +Unfiltered: JaVAscRIPT:prompt(99) +Type: form +Injection point: form field names: message, link, email +Line: Your filtered email address is: 9zqjxJaVAscRIPT:prompt(99)9zqjx
+Line: Your unfiltered email address is: 9zqjxJaVAscRIPT:prompt(99)9zqjx
+Line: Your message: 9zqjxJaVAscRIPT:prompt(99)9zqjx
+Line: Your htmlspecialchars() link: Your Link
+ +URL: https://de.wikipedia.org/wiki/GM_Uzbekistan +Unfiltered: "> + +URL: https://www.concrete5.org/community/forums/ +Unfiltered: "()=<> +Payload: "()=<> +Type: form +Injection point: form field names: sort, answerFilter, posterUser, poster, forum[], submit_search, forumSelectAll, search_keywords +Line: 9zqjx" /> + +URL: https://www.yahoo.com/ +Unfiltered: " +Payload: '"(){}[]; +Type: form +Injection point: form field names: p +Line:
View: All Items |
<... +Line: _r.put('opv4-31jsid',new vjo.darwin.comp.overlaypanel.harrow.OverlayPanelWithHArrow({"yof":12,"styles":["ov-ptr ov-pls","ov-ptr ov-pls","ov-ptr ov-prs","ov-ptr ov-prs"],"OS":{"value":2,"id":2,"name":"... +Line: _r.put('21PreviewLayer',$o17(0,false,-30,400,"21PreviewLayer","PreviewLayerjsid","PreviewLayer")); _r.put('24',new vjo.darwin.domain.finding.component.previewlayer.link.PreviewLayer({"dsOverlay":false... + +URL: http://stores.ebay.com/earlybirdsavings/_i.html?_sasi=1 +Unfiltered: h +Payload: h%28%29%3D%3C%3E +Type: url +Injection point: _sasi +Line: //-->
View: All Items |
<... +Line: _r.put('opv4-31jsid',new vjo.darwin.comp.overlaypanel.harrow.OverlayPanelWithHArrow({"yof":12,"styles":["ov-ptr ov-pls","ov-ptr ov-pls","ov-ptr ov-prs","ov-ptr ov-prs"],"OS":{"value":2,"id":2,"name":"... +Line: _r.put('21PreviewLayer',$o18(0,false,-30,400,"21PreviewLayer","PreviewLayerjsid","PreviewLayer")); _r.put('24',new vjo.darwin.domain.finding.component.previewlayer.link.PreviewLayer({"dsOverlay":false... + +URL: http://stores.ebay.com/earlybirdsavings/_i.html?_sasi=1 +Unfiltered: h +Payload: h()=<> +Type: url +Injection point: _sasi +Line: //-->
View: All Items |
<... +Line: _r.put('opv4-31jsid',new vjo.darwin.comp.overlaypanel.harrow.OverlayPanelWithHArrow({"yof":12,"styles":["ov-ptr ov-pls","ov-ptr ov-pls","ov-ptr ov-prs","ov-ptr ov-prs"],"OS":{"value":2,"id":2,"name":"... +Line: _r.put('21PreviewLayer',$o12(0,false,-30,400,"21PreviewLayer","PreviewLayerjsid","PreviewLayer")); _r.put('24',new vjo.darwin.domain.finding.component.previewlayer.link.PreviewLayer({"dsOverlay":false... + +URL: http://stores.ebay.com/earlybirdsavings/Motors-/_i.html?_dmd=2&_fsub=8705005018&_sid=152659078&_sop=10&_trksid=p4634.c0.m322 +Unfiltered: h +Payload: h%28%29%3D%3C%3E +Type: url +Injection point: _sop +Line: //-->
View: All Items |
+Type: url +Injection point: rt +Line:
+ +URL: http://www.ebay.com/gsr/i.html?_nkw=+blades&rt=nc +Unfiltered: h()= +Payload: h()=<> +Type: url +Injection point: _nkw +Line: Search results for 9zqjxh()= 9zqjx buying guides +Line: +Line: +Line:
0 guides found for 9zqjxh()= 9zqjx
+ +URL: http://www.ebay.com/itm/Uncanny-X-men-503-CGC-Graded-9-8-Previews-Sketch-Edition-Fraction-Brubaker-Land-/380957411109 +Unfiltered: '"(){}; +Payload: '"(){}[]; +Type: form +Injection point: form field names: _nkw, submit +Line:
View: All Items
Refine your search for 9zqjx" () = 9zqjx +Line: 0 results found for 9zqjx" () = 9zqjx +Line: +Line: +Line: +Line: raptor.require("search.layers.FollowSearchLink").bindToLink({config:'{}', emailDefault:false, linkSelector:"e1-35", trksid: "p2045573.m2651", srchName: "9zqjx\" () = 9zqjx", saveUrl:"http://www.ebay... + +URL: http://elportal.att.net/ +Unfiltered: "()=<> +Payload: "()=<> +Type: form +Injection point: form field names: memberID +Line: + +URL: http://elportal.att.net/ +Unfiltered: '"(){}[]; +Payload: '"(){}[]; +Type: form +Injection point: form field names: memberID +Line: + +URL: http://www.att.net/products1 +Unfiltered: '"(){}[]; +Payload: '"(){}[]; +Type: form +Injection point: form field names: source, memberID, wtExtndSource +Line: + +URL: http://www.att.net/products1 +Unfiltered: '"(){}[]; +Payload: '"(){}[]; +Type: form +Injection point: form field names: source, memberID, wtExtndSource +Line: + +URL: http://www.att.net/webdirectory +Unfiltered: '"(){}[]; +Payload: '"(){}[]; +Type: form +Injection point: form field names: source, memberID, wtExtndSource +Line: + +URL: http://www.att.net/addons +Unfiltered: '"(){}[]; +Payload: '"(){}[]; +Type: form +Injection point: form field names: source, memberID, wtExtndSource +Line: + +URL: http://www.att.net/products1 +Unfiltered: "()=<> +Payload: "()=<> +Type: form +Injection point: form field names: source, memberID, wtExtndSource +Line: + +URL: http://www.att.net/addons +Unfiltered: "()=<> +Payload: "()=<> +Type: form +Injection point: form field names: source, memberID, wtExtndSource +Line: + +URL: http://www.att.net/products1 +Unfiltered: '"(){}[]; +Payload: '"(){}[]; +Type: form +Injection point: form field names: source, memberID, wtExtndSource +Line: + +URL: http://elportal.att.net/ +Unfiltered: '"(){}[]; +Payload: '"(){}[]; +Type: form +Injection point: form field names: memberID +Line: + +URL: http://www.att.net/addons +Unfiltered: '"(){}[]; +Payload: '"(){}[]; +Type: form +Injection point: form field names: source, memberID, wtExtndSource +Line: + +URL: http://www.att.net/webdirectory +Unfiltered: '"(){}[]; +Payload: '"(){}[]; +Type: form +Injection point: form field names: source, memberID, wtExtndSource +Line: + +URL: http://danmcinerney.org/headers.php +Unfiltered: ()=<> +Payload: ()=<> +Type: header +Injection point: User-Agent +Line: User-Agent: 9zqjx()=<>9zqjx
+ +URL: http://danmcinerney.org/headers.php +Unfiltered: ()=<> +Payload: ()=<> +Type: header +Injection point: Referer +Line: Referer: 9zqjx()=<>9zqjx
+ +URL: http://danmcinerney.org/tests/form.html +Unfiltered: JaVAscRIPT:prompt(99) +Payload: JaVAscRIPT:prompt(99) +Type: form +Injection point: form field names: message, link, email +Line: Your filtered email address is: 9zqjxJaVAscRIPT:prompt(99)9zqjx
+Line: Your unfiltered email address is: 9zqjxJaVAscRIPT:prompt(99)9zqjx
+Line: Your message: 9zqjxJaVAscRIPT:prompt(99)9zqjx
+Line: Your htmlspecialchars() link: Your Link
+ +URL: http://danmcinerney.org/tests/form.html +Unfiltered: "()=<> +Payload: "()=<> +Type: form +Injection point: form field names: message, link, email +Line: Your unfiltered email address is: 9zqjx"()=<>9zqjx
+ +URL: https://musopen.org/ +Unfiltered: " +Payload: '"(){}[]; +Type: form +Injection point: form field names: q +Line:

Did you mean: 9zqjx 9zqjx

+ +URL: https://musopen.org/ +Unfiltered: " +Payload: '"(){}[]; +Type: form +Injection point: form field names: q +Line:

Did you mean: 9zqjx quot 9zqjx

+ +URL: http://musopen.tumblr.com +Unfiltered: JaVAscRIPT:prompt(99) +Payload: JaVAscRIPT:prompt(99) +Type: form +Injection point: form field names: q +Line: Musopen News | Search results for: 9zqjxJaVAscRIPT:prompt(99)9zqjx +Line: +Line:

Search results for 9zqjxJaVAscRIPT:prompt(99)9zqjx

+Line:

I’m sorry, but we couldn't find anything matching "9zqjxJaVAscRIPT:prompt(99)9zqjx". Suggestions:

+ +URL: http://oar.yuku.com/topic/15516 +Unfiltered: "()=<> +Payload: "()=<> +Type: form +Injection point: form field names: q, submit +Line: 9zqjx"> +Line:

Search Results For: 9zqjx"()=<>9zqjx

+ +URL: http://oar.yuku.com/reply/485104/Rockville-LP-songs-played-on-summer-tour +Unfiltered: "()=<> +Payload: "()=<> +Type: form +Injection point: form field names: vno, login, password +Line:

Yuku free message boards

9zqjx"> + +URL: http://skindesignsalon.yuku.com/login/loginnow/Login-to-Yuku.html +Unfiltered: "()=<> +Payload: "()=<> +Type: form +Injection point: form field names: vno, login, password +Line: