Function ScanCSS

pkg/techniques.go:1149–1292

()

}

func ScanCSS() reportResult {
	var repResult reportResult
	repResult.Technique = "CSS poisoning"

	webStruct, err := GetWebsite(Config.Website.Url.String(), false, false) // get body without cachebuster. TODO use response w/o cachebuster from recon, so it doesn't have to be fetched again
	if err != nil {
		msg := fmt.Sprintf("Error while fetching css files %s: %s\n", Config.Website.Url.String(), err.Error())
		Print(msg, Red)
		repResult.ErrorMessages = append(repResult.ErrorMessages, msg)
		return repResult
	}
	bodyReader := strings.NewReader(webStruct.Body) // use body without cachebuster, so the css files can be found
	tokenizer := html.NewTokenizer(bodyReader)

	var urls []string

	eof := false
	for !eof {
		tokentype := tokenizer.Next()

		switch tokentype {
		case html.StartTagToken, html.SelfClosingTagToken:

			token := tokenizer.Token()

			if token.Data == "link" {
				for _, a := range token.Attr {
					if a.Key == "href" {
						if !strings.HasSuffix(a.Val, ".css") && !strings.Contains(a.Val, ".css?") {
							break
						}
						tempURL := addDomain(a.Val, Config.Website.Domain)
						if tempURL != "" {
							urls = append(urls, tempURL)
						}
						break
					}
				}
			}
		// When EOF is reached a html.ErrorToken appears
		case html.ErrorToken:
			err := tokenizer.Err()
			if err == io.EOF {
				eof = true
				break
			}
			msg := fmt.Sprintf("error tokenizing HTML: %+v", tokenizer.Err())
			Print(msg, Yellow)
		}
	}

	if len(urls) == 0 {
		msg := "No CSS files were found.\n"
		PrintVerbose(msg, Yellow, 1)

		return repResult
	}
	msg := fmt.Sprintf("Testing the following CSS files for poisoning\n%s\n", urls)