Add files via upload

core/config.py

@@ -1,4 +1,4 @@
-changes = '''detection of up to 66 WAFs'''
+changes = '''bug fixes;detection of up to 66 WAFs'''
 
 defaultEditor = 'nano'
 blindPayload = '' # your blind XSS payload

core/fuzzer.py

@@ -40,7 +40,7 @@ def fuzzer(url, params, headers, GET, delay, timeout, WAF, encoding):
                 limit -= 1
                 sleep(1)
             try:
-                requests.get(url, timeout=5, headers=headers)
+                requester(url, params, headers, GET, 0, 10)
                 print ('\n%s Pheww! Looks like sleeping for %s%i%s seconds worked!' % (good, green, (delay + 1) * 2), end)
             except:
                 print ('\n%s Looks like WAF has blocked our IP Address. Sorry!' % bad)

core/wafDetector.py

@@ -35,4 +35,4 @@ def wafDetector(url, params, headers, GET, delay, timeout):
         else:
             return None
     else:
-        return None
+        return None

db/wafSignatures.json

@@ -329,4 +329,4 @@
 		"page" : "<img class=.yunsuologo.",
 		"headers" : "yunsuo_session"
 	}
-}
+}

xsstrike.py

@@ -6,7 +6,7 @@ from core.colors import end, red, white, green, yellow, run, bad, good, info, qu
 
 # Just a fancy ass banner
 print('''%s
-\tXSStrike %sv3.0.2
+\tXSStrike %sv3.0.3
 %s''' % (red, white, end))
 
 try:
@@ -213,10 +213,10 @@ def singleTarget(target, paramData, verbose, encoding):
                     print ('%s Efficiency: %i' % (info, bestEfficiency))
                     print ('%s Confidence: %i' % (info, confidence))
 
-def multiTargets(scheme, host, main_url, form, domURL, verbose, blindXSS, blindPayload):
+def multiTargets(scheme, host, main_url, form, domURL, verbose, blindXSS, blindPayload, headers, delay, timeout):
     signatures = set()
     if domURL and not skipDOM:
-        response = requests.get(domURL).text
+        response = requester(domURL, {}, headers, True, delay, timeout).text
         highlighted = dom(response)
         if highlighted:
             print ('%s Potentially vulnerable objects found at %s' % (good, domURL))
@@ -316,7 +316,7 @@ else:
         for i in range(difference):
             domURLs.append(0)
     threadpool = concurrent.futures.ThreadPoolExecutor(max_workers=threadCount)
-    futures = (threadpool.submit(multiTargets, scheme, host, main_url, form, domURL, verbose, blindXSS, blindPayload) for form, domURL in zip(forms, domURLs))
+    futures = (threadpool.submit(multiTargets, scheme, host, main_url, form, domURL, verbose, blindXSS, blindPayload, headers, delay, timeout) for form, domURL in zip(forms, domURLs))
     for i, _ in enumerate(concurrent.futures.as_completed(futures)):
         if i + 1 == len(forms) or (i + 1) % threadCount == 0:
             print('%s Progress: %i/%i' % (info, i + 1, len(forms)), end='\r')