gbrindisi / xsssniper Goto Github PK

When executed without use the binary python, just using the Shebang specification in the file xsssniper.py, it throws an error like this:

$ python xsssniper.py --help
[X] Please install hgapi module:
   $ pip install 

$ ./xsssniper.py --help
./xsssniper.py: line 4: try:: command not found
./xsssniper.py: line 6: except: command not found
Warning: unknown mime-type for "\n[X] Please install hgapi module:" -- using "application/octet-stream"
Error: no such file "\n[X] Please install hgapi module:"
Warning: unknown mime-type for "   $ pip install \n" -- using "application/octet-stream"
Error: no such file "   $ pip install \n"
./xsssniper.py: line 11: syntax error near unexpected token `from'
./xsssniper.py: line 11: `from optparse import OptionParser'

The error was fixed just with a single character in the Shebang specification:

$ diff xsssniper.py xsssniper.py.fork 
1c1
< #/usr/bin/env python

---
> #!/usr/bin/env python

Removed after switching from hg to git.

The randoms generated seed for the taint may result as a valid html attribute like href, src, etc.

https://github.com/gbrindisi/xsssniper/blob/master/core/payload.py#L14

Must blacklist common attributes names.

As discussed in private email HTTP proxy functionality is not working. I have tested this with Burp and OWASP ZAP HTTP proxies with Git revision 73. I used these commands and no traffic is shown in logs of the proxy application:

xsssniper.py --http-proxy=127.0.0.1:8080 -u https://public-firing-range.appspot.com/
xsssniper.py --http-proxy=http://127.0.0.1:8080 -u https://public-firing-range.appspot.com/
xsssniper.py --http-proxy="http://127.0.0.1:8080" -u https://public-firing-range.appspot.com/

how to fix this install mechanize module

why is good syntax for argument --cookie=?
i need example for COOKIE_DATA format.. ./xsssniper.py -u "blah.blah" --cookie=<how to write keys and values?>
thx

Eventually package xsssniper to have a simpler installation.

Ideally:

pip install xsssniper

File "xsssniper.py", line 29
"""
^
SyntaxError: Missing parentheses in call to 'print'. Did you mean print("""

Everytime I scan a site on XSSniper, it says right next to Remaining Targets, Crawl Errors, and next to Remaining URLS, it says Scan Errors.

Is there a glitch in XSSSniper or those websites just don't have an XSS vulnerability?

Currently if mechanize is missing xsssniper will say:

[X] Please install mechanize module:
    http://wwwsearch.sourceforge.net/mechanize/

But if lxml is missing it will say:

Traceback (most recent call last):
  File "xsssniper.py", line 6, in <module>
    from core.engine import Engine
  File "/home/hsalo/xsssniper/core/engine.py", line 24, in <module>
    from core.domscanner import DOMScanner
  File "/home/hsalo/xsssniper/core/domscanner.py", line 11, in <module>
    from lxml import etree
ImportError: No module named lxml

Maybe xsssniper should also give pip install -commands rather than per project URLs, but that is design decision. Also the import errors are checked several times. Is there a reason for that?

Should we migrate this project to Python 3? I do not think Python 2 support is must have. Could you tell me your opinion about this? Does some distro use xsssniper without Python 3?