From 7f9d2735daa9ce2416605979de721095e84f058d Mon Sep 17 00:00:00 2001 From: swisskyrepo Date: Sat, 24 Dec 2016 17:49:26 +0100 Subject: [PATCH] First working commit - Basic Scans and bugs :) --- Plugin/background.js | 92 ++++++++++++++++++++++++++++++ Plugin/icon.png | Bin 0 -> 16561 bytes Plugin/manifest.json | 35 ++++++++++++ Plugin/popup.html | 65 ++++++++++++++++++++++ Plugin/popup.js | 130 +++++++++++++++++++++++++++++++++++++++++++ README.md | 48 ++++++++++++++++ Screens/SQLi.png | Bin 0 -> 81215 bytes Screens/ServerUP.png | Bin 0 -> 62386 bytes Screens/XSS1.png | Bin 0 -> 166567 bytes Server/launch.sh | 1 + Server/server.py | 104 ++++++++++++++++++++++++++++++++++ Server/server.pyc | Bin 0 -> 3552 bytes 12 files changed, 475 insertions(+) create mode 100644 Plugin/background.js create mode 100755 Plugin/icon.png create mode 100644 Plugin/manifest.json create mode 100644 Plugin/popup.html create mode 100644 Plugin/popup.js create mode 100755 README.md create mode 100755 Screens/SQLi.png create mode 100755 Screens/ServerUP.png create mode 100755 Screens/XSS1.png create mode 100755 Server/launch.sh create mode 100644 Server/server.py create mode 100644 Server/server.pyc diff --git a/Plugin/background.js b/Plugin/background.js new file mode 100644 index 0000000..ebe40b0 --- /dev/null +++ b/Plugin/background.js @@ -0,0 +1,92 @@ +var config_server = "http://127.0.0.1:8000"; + +/** + * Extract the domain from an URL + * @param string(url) - url of the target which will be shorten + */ +function extract_domain(url){ + var domain; + if (url.indexOf("://") > -1) { + domain = url.split('/')[2]; + } + else { + domain = url.split('/')[0]; + } + + //find & remove port number + return domain.split(':')[0]; +} + +/** + * Inspect the source code and send a request to the server for every url + * + * @param string(url) - url of the target + * @param string(deep) - deep of the target, 0 is the actual page + * @param string(impact) - aggressivity of the scan from 0 to 5 + * + */ +function send_target(server, url, deep, impact){ + var http = new XMLHttpRequest(); + infos = server + "/?url=" + url + "&deep="+ deep + "&impact=" + impact + + // Display the informations sent by the scanner + http.onreadystatechange = function() { + if (http.readyState == XMLHttpRequest.DONE) { + http_data = JSON.parse(http.responseText); + + // Notifications and update local storage + if (http_data.xss != '0'){ + chrome.storage.sync.get(['xss'], function(items) { + chrome.storage.sync.set({'xss': items['xss']+1}) + }); + + new Notification('New vulnerability detected !', { + icon: 'icon.png', + body: 'XSS on '+extract_domain(unescape(url)) + })(); + } + + if (http_data.sql != '0'){ + chrome.storage.sync.get(['sql'], function(items) { + chrome.storage.sync.set({'sql': items['sql']+1}) + }); + + new Notification('New vulnerability detected !', { + icon: 'icon.png', + body: 'SQLi on '+extract_domain(unescape(url)) + })(); + } + + if (http_data.lfi != '0'){ + chrome.storage.sync.get(['lfi'], function(items) { + chrome.storage.sync.set({'lfi': items['lfi']+1}) + }); + + new Notification('New vulnerability detected !', { + icon: 'icon.png', + body: 'LFI on '+extract_domain(unescape(url)) + })(); + } + + } + } + http.open("GET", infos, true); + http.send(); +} + +// Set a clean local storage +chrome.storage.sync.set({'xss': 0, 'sql': 0, 'lfi': 0, 'work': 1 }) + +// Launch a scan when the tab change +chrome.tabs.onActivated.addListener(function(activeInfo) { + chrome.tabs.get(activeInfo.tabId, function(tab){ + + // Handle start/stop button + chrome.storage.sync.get(['work'], function(items) { + if(items['work'] == 1){ + send_target(config_server, escape(tab.url), 0, 0); + } + }); + + }); +}); \ No newline at end of file diff --git a/Plugin/icon.png b/Plugin/icon.png new file mode 100755 index 0000000000000000000000000000000000000000..c5f10effd0caede444b1c6287b83577d825b720d GIT binary patch literal 16561 zcmeHPO=uHA6n?WwtHzkLhl1!u5ES)fQ}p0ZW34|$6cuR|t#}YYXrcZbJm^Jw5kUm? zq9>^b?Lkp*MU6IsAS!zC;2&PZgJP4WHMH4ee6JX+ao=W>&Ni941IZ?nd2inL%{Om` zoh0XW?$|Ofupj^c^V+ty?#64B9~Pk5QrvvuDIfY4KVh$|~X3jr2ETkD2B zr-X<`V=-*w6^{Xr0gnNXf&Z2P;S{+95D*G&#`b$bh;<<4e7w$eYVT@0DMvAuuNc!H z_Hz@4haVs?47qr5M1Twimx0fB4c)CN?y?G6NEt^m4vSRkU9o725+K9j7IbzO84eb6 zR#l%%nF7PuE)t0+c5&GfKqH?sj2DIwwB6FKR`p!QfEQoX;A@4PC(#E{r{x z1?Zc|Ukp%|08DsWd_pubcG^_?3}Y39!yCDPSpw2Id7LxStv;QV$GDhT0)!B2IV0Wb zg@9%*W|n{&0kb(H-Rcnwo5WcHaQ@q_5IT`yhsCcHNbgI4uEk1SS~?r(259fI{HWAQ zRsp3t0?|1=;3=@pJpd6k0#!#q$&6Kpfk!~a$Kf*WQR?dKAN4rrT`HaeTq0H*x1IvD z87h|o^%UR|vD&!x6rjyexfH0U0GEi>#_h~iz=6+!^ZD-rI2?|dONK{)GX^{bIOEAl ztG56jowO^XP2bt(R8?+01Sq`Y z-rb>0{uHKK0?1=uJHS*qppk!>z+2(ua8jYO0Xp|pSkx0h!FAwG&vFwYoiz+uj6AX0 zp-}t3Npyz*nhH&2kkHwW;4fK>FM_XEEB$;Y?hruUOCfL#cEu@xCBO`YB!0`H(2thyv#2Ql@USHqHVKZaTLUUinjIFFfTWq7F%%?h zu&@Mt%Vg6PA38+=e9vS@Iae$JKg?VlRlwP4Q=c$%Fl5RY7cfhJ0CC}cIs@i3E=gRF z<2n7D^&kQ6@^VvGctU;ibIn71^ z69)Tn8jQXk8AC_l?CG<2c8C+RRDcRWf1($c;Dn6z6{m*4QQzG0jdIO z(Xv|h3AE1BQip&66CPf3Gp59s^up&BN*2gjOlR>#I0r+dyK#^WUqJ(cnr)~ l2HvcGLc5!7^uGX#KwfWHv9hc2(MfXGwrNM}?UqAle*wn^MSuVR literal 0 HcmV?d00001 diff --git a/Plugin/manifest.json b/Plugin/manifest.json new file mode 100644 index 0000000..edf7d2e --- /dev/null +++ b/Plugin/manifest.json @@ -0,0 +1,35 @@ +{ + "manifest_version": 2, + + // Extension's informations + "name": "Damn Website Scanner", + "description": "This extension will crawl a website to check for common vulnerabilities", + "version": "1.0", + + "browser_action": { + "default_icon": "icon.png", + "default_popup": "popup.html" + }, + + // Permissions of the extension + "permissions": [ + "activeTab", + "tabs", + "notifications", + "storage" + ], + + // Script files + "content_scripts": [ + { + "matches": [""], + "js": ["popup.js"] + } + ], + + // Background script to catch new/updated tab + "background": { + "scripts": ["background.js"] + } + +} diff --git a/Plugin/popup.html b/Plugin/popup.html new file mode 100644 index 0000000..ea189b2 --- /dev/null +++ b/Plugin/popup.html @@ -0,0 +1,65 @@ + + + + Damn Website Scanner + + + + + + +

Damn Website Scanner

+ +
+ http://limited.url + +
    +
  • 0 Cross Site Scripting
    • +
  • 0 Injection SQL
    • +
  • 0 Local File Inclusion
    • +
+ + Total : 0 vulnerability found +
+ + + STOP + EXPORT +
Status Server
+ + \ No newline at end of file diff --git a/Plugin/popup.js b/Plugin/popup.js new file mode 100644 index 0000000..404df82 --- /dev/null +++ b/Plugin/popup.js @@ -0,0 +1,130 @@ +var config_server = "http://127.0.0.1:8000"; + +/** + * Get the current tab. + * @param {function(string)} callback - called when the tab is found. + */ +function getCurrentTab(callback) { + // Query filter to be passed to chrome.tabs.query - see + // https://developer.chrome.com/extensions/tabs#method-query + var queryInfo = { + active: true, + currentWindow: true + }; + + chrome.tabs.query(queryInfo, function(tabs) { + // chrome.tabs.query invokes the callback with a list of tabs that match the + // query. When the popup is opened, there is certainly a window and at least + // one tab, so we can safely assume that |tabs| is a non-empty array. + // A window can only have one active tab at a time, so the array consists of + // exactly one tab. + var tab = tabs[0]; + + // A tab is a plain object that provides information about the tab. + // See https://developer.chrome.com/extensions/tabs#type-Tab + var url = tab.url; + + // tab.url is only available if the "activeTab" permission is declared. + // If you want to see the URL of other tabs (e.g. after removing active:true + // from |queryInfo|), then the "tabs" permission is required to see their + // "url" properties. + console.assert(typeof url == 'string', 'tab.url should be a string'); + + callback(tab); + }); +} + + +/** + * Extract the domain from an URL + * @param string(url) - url of the target which will be shorten + */ +function extract_domain(url){ + var domain; + if (url.indexOf("://") > -1) { + domain = url.split('/')[2]; + } + else { + domain = url.split('/')[0]; + } + + //find & remove port number + return domain.split(':')[0]; +} + + +/** + * Return the status of the server + */ +function status_server(config_server){ + // Create a new HTTP request + var http = new XMLHttpRequest(); + http.onreadystatechange = function() { + + if (http.readyState == XMLHttpRequest.DONE) { + + // If the server is up it responds with "pong" + if("pong" == http.responseText){ + document.getElementById('status').textContent = "Server is UP !"; + document.getElementById('status').style = "color:green"; + } + else{ + document.getElementById('status').textContent = "Server is DOWN !"; + document.getElementById('status').style = "color:red"; + } + } + } + http.open("GET", config_server+"/ping", true); + http.send(); +} + + +/** + * Plugin form - Update and display the informations + */ +document.addEventListener('DOMContentLoaded', function() { + + getCurrentTab(function(tab) { + + // Display local storage + chrome.storage.sync.get(['xss','sql','lfi'], function(items) { + document.getElementById("xss").textContent = items['xss'] + " Cross Site Scripting"; + document.getElementById("sql").textContent = items['sql'] + " Injection SQL"; + document.getElementById("lfi").textContent = items['lfi'] + " Local File Inclusion"; + document.getElementById("total").textContent = "Total : "+ (items['lfi']+items['xss']+items['sql']) +" vulnerability found"; + }); + + // Display infos (URL - Server's availability) + document.getElementById('url').textContent = 'Inspecting : ' + extract_domain(tab.url); + status_server(config_server); + + // Start or Stop the extension + document.getElementById("stop").addEventListener('click', () => { + if(document.getElementById("stop").textContent == "STOP"){ + document.getElementById("stop").textContent = "START"; + document.getElementById("stop").style = "background-image: -webkit-linear-gradient(top,#99EA46,#71D43C);"; + chrome.storage.sync.set({'work': 0}); + } + else{ + document.getElementById("stop").textContent = "STOP"; + document.getElementById("stop").style = "background-image: -webkit-linear-gradient(top,#EA464A,#D43C40);"; + chrome.storage.sync.set({'work': 1}); + } + }); + + // Second button ... + document.getElementById("export").addEventListener('click', () => { + function confirmation() { + //document.getElementById("debug").textContent = http_data.list; + alert('Not available yet..') + } + chrome.tabs.executeScript({code: '(' + confirmation + ')();'}, (results) => { + document.getElementById('status').textContent = results[0]; + }); + }); + + }); + +}); + + diff --git a/README.md b/README.md new file mode 100755 index 0000000..23882c9 --- /dev/null +++ b/README.md @@ -0,0 +1,48 @@ +# Damn Web Scanner +Another web vulnerabilities scanner, this extension works on Chrome and Opera +The extension is working in the background and will notify you if it finds any vulnerability + +Currently it scans for: +- SQL Injection +- Cross Site Scripting +- Local File Inclusion + +**Warning 1 :** Do not use this extension for illegal purpose, the main goal of it is to simplify the life of bug hunters. +**Warning 2 :** It's a BETA version, many improvements will come don't worry + +## New features +- Detect if the server is up +- Start/Stop button + +## TODO +- Get vuln list in localstorage (list) +- ScanSQLTime/ScanSQLUnion +- Should detect and work with POST requests +- Export function for vulnerabilities +- Add some functions from https://sergeybelove.ru/one-button-scan/result/3004e0b978f19e58e3239087d119742779e1efbc/ +- Deep and impact : args['url'],args['deep'],args['impact'] +- Improve XSS vector - should work in JS context and onxxxx context: ">>" >
@gmail.com\'-->" >">/\'">" >">/\'">