Scan target for XSS vulnerabilities.
(self, target: Target)
| 57 | |
| 58 | async def run(self, target: Target) -> ScanResult: |
| 59 | """Scan target for XSS vulnerabilities.""" |
| 60 | result = self.create_result(target) |
| 61 | |
| 62 | url = self._build_url(target) |
| 63 | self.logger.info(f"Starting XSS scan on {url}") |
| 64 | |
| 65 | vulnerabilities = [] |
| 66 | |
| 67 | try: |
| 68 | async with HTTPClient() as client: |
| 69 | # Get the page first to find parameters |
| 70 | response = await client.get(url) |
| 71 | parsed = urlparse(str(response.url)) |
| 72 | params = parse_qs(parsed.query) |
| 73 | |
| 74 | if not params: |
| 75 | # No query parameters, try common ones |
| 76 | params = {"q": [""], "search": [""], "id": [""], "page": [""]} |
| 77 | |
| 78 | for param_name in params.keys(): |
| 79 | for payload in self.payloads: |
| 80 | test_url = self._inject_payload(url, param_name, payload) |
| 81 | |
| 82 | try: |
| 83 | test_response = await client.get(test_url) |
| 84 | |
| 85 | # Check if payload is reflected |
| 86 | if self._check_reflection(test_response.text, payload): |
| 87 | vuln = { |
| 88 | "type": "Reflected XSS", |
| 89 | "url": test_url, |
| 90 | "parameter": param_name, |
| 91 | "payload": payload, |
| 92 | "evidence": self._extract_evidence(test_response.text, payload), |
| 93 | } |
| 94 | vulnerabilities.append(vuln) |
| 95 | self.logger.warning(f"Potential XSS found: {param_name}") |
| 96 | break # One payload is enough per param |
| 97 | |
| 98 | except Exception as e: |
| 99 | self.logger.debug(f"Error testing payload: {e}") |
| 100 | |
| 101 | result.raw_data["tested_parameters"] = list(params.keys()) |
| 102 | result.raw_data["vulnerabilities"] = vulnerabilities |
| 103 | |
| 104 | if vulnerabilities: |
| 105 | result.add_finding( |
| 106 | title="XSS Vulnerabilities Detected", |
| 107 | description=f"Found {len(vulnerabilities)} potential XSS vulnerability/vulnerabilities", |
| 108 | severity=Severity.HIGH, |
| 109 | data={"vulnerabilities": vulnerabilities}, |
| 110 | references=["https://owasp.org/www-community/attacks/xss/"], |
| 111 | ) |
| 112 | else: |
| 113 | result.add_finding( |
| 114 | title="No XSS Vulnerabilities Found", |
| 115 | description=f"Tested {len(params)} parameter(s) with {len(self.payloads)} payload(s)", |
| 116 | severity=Severity.INFO, |
no test coverage detected