removed sponsor

Fix syntax for Python 3.12

README.md

@@ -60,6 +60,19 @@ Apart from that, XSStrike has crawling, fuzzing, parameter discovery, WAF detect
 - Powered by [Photon](https://github.com/s0md3v/Photon), [Zetanize](https://github.com/s0md3v/zetanize) and [Arjun](https://github.com/s0md3v/Arjun)
 - Payload Encoding
 
+### Installation
+Enter the following commands one by one in terminal:
+```
+git clone https://github.com/s0md3v/XSStrike
+cd XSStrike
+pip install -r requirements.txt --break-system-packages
+```
+
+Now, XSStrike can be used at any time as follows:
+```
+python xsstrike.py
+```
+
 ### Documentation
 - [Usage](https://github.com/s0md3v/XSStrike/wiki/Usage)
 - [Compatibility & Dependencies](https://github.com/s0md3v/XSStrike/wiki/Compatibility-&-Dependencies)

core/dom.py

@@ -7,8 +7,8 @@ if len(end) < 1:
 
 def dom(response):
     highlighted = []
-    sources = r'''document\.(URL|documentURI|URLUnencoded|baseURI|cookie|referrer)|location\.(href|search|hash|pathname)|window\.name|history\.(pushState|replaceState)(local|session)Storage'''
-    sinks = r'''eval|evaluate|execCommand|assign|navigate|getResponseHeaderopen|showModalDialog|Function|set(Timeout|Interval|Immediate)|execScript|crypto.generateCRMFRequest|ScriptElement\.(src|text|textContent|innerText)|.*?\.onEventName|document\.(write|writeln)|.*?\.innerHTML|Range\.createContextualFragment|(document|window)\.location'''
+    sources = r'''\b(?:document\.(URL|documentURI|URLUnencoded|baseURI|cookie|referrer)|location\.(href|search|hash|pathname)|window\.name|history\.(pushState|replaceState)(local|session)Storage)\b'''
+    sinks = r'''\b(?:eval|evaluate|execCommand|assign|navigate|getResponseHeaderopen|showModalDialog|Function|set(Timeout|Interval|Immediate)|execScript|crypto.generateCRMFRequest|ScriptElement\.(src|text|textContent|innerText)|.*?\.onEventName|document\.(write|writeln)|.*?\.innerHTML|Range\.createContextualFragment|(document|window)\.location)\b'''
     scripts = re.findall(r'(?i)(?s)<script[^>]*>(.*?)</script>', response)
     sinkFound, sourceFound = False, False
     for script in scripts:
@@ -24,7 +24,7 @@ def dom(response):
                     for part in parts:
                         for controlledVariable in allControlledVariables:
                             if controlledVariable in part:
-                                controlledVariables.add(re.search(r'[a-zA-Z$_][a-zA-Z0-9$_]+', part).group().replace('$', '\$'))
+                                controlledVariables.add(re.search(r'[a-zA-Z$_][a-zA-Z0-9$_]+', part).group().replace('$', '\\$'))
                 pattern = re.finditer(sources, newLine)
                 for grp in pattern:
                     if grp:
@@ -33,7 +33,7 @@ def dom(response):
                             if len(parts) > 1:
                                for part in parts:
                                     if source in part:
-                                        controlledVariables.add(re.search(r'[a-zA-Z$_][a-zA-Z0-9$_]+', part).group().replace('$', '\$'))
+                                        controlledVariables.add(re.search(r'[a-zA-Z$_][a-zA-Z0-9$_]+', part).group().replace('$', '\\$'))
                             line = line.replace(source, yellow + source + end)
                 for controlledVariable in controlledVariables:
                     allControlledVariables.add(controlledVariable)

core/jsContexter.py

@@ -8,7 +8,7 @@ def jsContexter(script):
     broken = script.split(xsschecker)
     pre = broken[0]
     #  remove everything that is between {..}, "..." or '...'
-    pre = re.sub(r'(?s)\{.*?\}|(?s)\(.*?\)|(?s)".*?"|(?s)\'.*?\'', '', pre)
+    pre = re.sub(r'(?s)\{.*?\}|\(.*?\)|".*?"|\'.*?\'', '', pre)
     breaker = ''
     num = 0
     for char in pre:  # iterate over the remaining characters

core/requester.py

@@ -47,8 +47,6 @@ def requester(url, data, headers, GET, delay, timeout):
         logger.warning('WAF is dropping suspicious requests.')
         logger.warning('Scanning will continue after 10 minutes.')
         time.sleep(600)
-    except requests.exceptions.ConnectionError as e:
-        logger.error('Error Connecting to Host')
-        logger.error('Scanning will continue after 2 minutes')
-        time.sleep(120)
+    except Exception as e:
+        logger.warning('Unable to connect to the target.')
         return requests.Response()