Fix origin / domain terminology (#1688)

This commit is contained in:
zinduolis
2024-10-23 16:07:17 +10:00
parent 89ed6cce8e
commit a5a8196792
173 changed files with 571 additions and 643 deletions

View File

@@ -31,7 +31,7 @@ module BeEF
# the URI of the XssRays handler where rays should come back if the vulnerability is verified
beefurl = BeEF::Core::Server.instance.url
cross_domain = xs.cross_domain
cross_origin = xs.cross_origin
timeout = xs.clean_timeout
ws = BeEF::Core::Websocket::Websocket.instance
@@ -47,7 +47,7 @@ module BeEF
// Browser Exploitation Framework (BeEF) - https://beefproject.com
// See the file \'doc/COPYING\' for copying permission
//', '')
add_to_body xs.id, hb.session, beefurl, cross_domain, timeout
add_to_body xs.id, hb.session, beefurl, cross_origin, timeout
if config.get('beef.extension.evasion.enable')
evasion = BeEF::Extension::Evasion::Evasion.instance
@@ -58,18 +58,18 @@ module BeEF
# If we use XHR-polling, add the component to the main hook file
else
build_missing_beefjs_components 'beef.net.xssrays'
add_to_body xs.id, hb.session, beefurl, cross_domain, timeout
add_to_body xs.id, hb.session, beefurl, cross_origin, timeout
end
print_debug("[XSSRAYS] Adding XssRays to the DOM. Scan id [#{xs.id}], started at [#{xs.scan_start}], cross domain [#{cross_domain}], clean timeout [#{timeout}].")
print_debug("[XSSRAYS] Adding XssRays to the DOM. Scan id [#{xs.id}], started at [#{xs.scan_start}], cross origin [#{cross_origin}], clean timeout [#{timeout}].")
end
def add_to_body(id, session, beefurl, cross_domain, timeout)
def add_to_body(id, session, beefurl, cross_origin, timeout)
config = BeEF::Core::Configuration.instance
req = %{
beef.execute(function() {
beef.net.xssrays.startScan('#{id}', '#{session}', '#{beefurl}', #{cross_domain}, #{timeout});
beef.net.xssrays.startScan('#{id}', '#{session}', '#{beefurl}', #{cross_origin}, #{timeout});
});
}

View File

@@ -10,4 +10,4 @@ beef:
name: 'XSSRays'
authors: ["antisnatchor"]
clean_timeout: 3000
cross_domain: true
cross_origin: true

View File

@@ -67,7 +67,7 @@ module BeEF
)
xssrays_detail.save
print_info("[XSSRAYS] Scan id [#{xssrays_scan.id}] received ray [ip:#{hooked_browser.ip}], hooked domain [#{hooked_browser.domain}]")
print_info("[XSSRAYS] Scan id [#{xssrays_scan.id}] received ray [ip:#{hooked_browser.ip}], hooked origin [#{hooked_browser.domain}]")
print_debug("[XSSRAYS] Ray info: \n #{request.query_string}")
end

View File

@@ -17,7 +17,7 @@ module BeEF
halt 403 unless BeEF::Core::Rest.permitted_source?(request.ip)
CLEAN_TIMEOUT = config.get('beef.extension.xssrays.clean_timeout') || 3_000
CROSS_DOMAIN = config.get('beef.extension.xssrays.cross_domain') || true
CROSS_ORIGIN = config.get('beef.extension.xssrays.cross_origin') || true
HB = BeEF::Core::Models::HookedBrowser
XS = BeEF::Core::Models::Xssraysscan
@@ -118,12 +118,12 @@ module BeEF
return
end
# set Cross-domain settings
cross_domain = params[:cross_domain].to_s
cross_domain = if cross_domain == ''
CROSS_DOMAIN
# set Cross-origin settings
cross_origin = params[:cross_origin].to_s
cross_origin = if cross_origin == ''
CROSS_ORIGIN
else
cross_domain != 'false'
cross_origin != 'false'
end
# set clean timeout settings
@@ -134,8 +134,8 @@ module BeEF
hooked_browser_id: hooked_browser.id,
scan_start: Time.now,
domain: hooked_browser.domain,
# check also cross-domain URIs found by the crawler
cross_domain: cross_domain,
# check also cross-origin URIs found by the crawler
cross_origin: cross_origin,
# how long to wait before removing the iFrames from the DOM (5000ms default)
clean_timeout: clean_timeout
)
@@ -143,8 +143,8 @@ module BeEF
print_info(
"[XSSRays] Starting XSSRays [ip:#{hooked_browser.ip}], " \
"hooked domain [#{hooked_browser.domain}], " \
"cross-domain: #{cross_domain}, " \
"hooked origin [#{hooked_browser.domain}], " \
"cross-origin: #{cross_origin}, " \
"clean timeout: #{clean_timeout}"
)
@@ -181,7 +181,7 @@ module BeEF
scan_start: scan.scan_start,
scan_finish: scan.scan_finish,
domain: scan.domain,
cross_domain: scan.cross_domain,
cross_origin: scan.cross_origin,
clean_timeout: scan.clean_timeout,
is_started: scan.is_started,
is_finished: scan.is_finished