3

I am working for a project make a XSS scan tool using python.

I have a sample url: http://www.foo.bar/index.php?ids=111

I've found that it has a vulnerability by http://www.foo.bar/index.php?ids="><SCrIpT>alert('XSS')</ScRiPt>

A basic different from normal url and xss url is a alert box has been showed in the browser. But when using python, how can i we see that or detect which url is vulnerability?

There is many XSS tools such as: wapiti, w3af,... But how's it work? What is principal xss scanning?

I've tried python request library:

import requests

xss_url = 'http://www.foo.bar/index.php?ids="><SCrIpT>alert('XSS')</ScRiPt>'
r = requests.get(xss_url);
print r.text

normal_url = 'http://www.foo.bar/index.php?ids=111'
t = requests.get(normal_url);
print t.text

But result of r.text and t.text is the same.

1

I can't look into your problem, as you gave a fake URL for testing XSS. Here's a real URL demonstrating an XSS vulnerabilities:

Using the first task this is a URL that has an XSS vulnerability:

Using requests python library, we can request this page:

>>> import requests
>>> xss_url = http://www.insecurelabs.org/Task/Rule1?query=%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E
>>> r_xss = requests.get(xss_url)
>>> print r_xss.text

<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8" />
    <title></title>
    <link href="/Content/Task.css" rel="stylesheet" type="text/css" />
    <script src="/Scripts/jquery-1.5.1.min.js" type="text/javascript"></script>
    <script src="../../Scripts/Task.js"></script>
</head>
<body>
    <div class="page">
        <section id="main">
            <a href="/Task" class="back">Back to task list</a>

    <h1>Task 1 - between tags</h1>

    <form method="get" action="">
        Search: <input type="text" name="query" value="&lt;script&gt;alert(&#39;XSS&#39;)&lt;/script&gt;"/><input type="submit" value="Search" />
    </form>
    <br /><br />

    <div>
        Searched for <script>alert('XSS')</script> <br />
        Found nothing.
    </div>    
    ...

As you can see right above where I truncated the rest of the HTML content, there is the text Searched for <script>alert('XSS')</script>, which is the XSS vulnerability as it is a fully formed <script>. Note as requests just does the HTTP request (that is just requests the source of the HTML page from the web server without attempting to process or render it) and doesn't execute any javascript, you will not see any alert popup displaying 'XSS'.

If you do any other innocuous request the content will change. I can't look into your example, as you didn't give a real URL. My guess is you are doing something wrong -- do those exact URLs render different source in a web browser?

0

Load the vulnerable url with phantomjs and detect whether that triggers an alert or not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.