search

hahwul / XSpear

🔱 Powerfull XSS Scanning and Parameter analysis tool&gem
MIT License
1.19k stars 224 forks source link

Qeury이 없는 경우 에러로 노출 #13

Closed hahwul closed 5 years ago

hahwul commented 5 years ago 
[*] creating a test query.
[*] test query generation is complete. [184 query]
[*] starting test and analysis. [10 threads]
[-] [23:36:29] 'error' Not reflected `XsPeaR
[-] [23:36:29] 'error' Not reflected ;XsPeaR
[-] [23:36:29] 'error' Not reflected >XsPeaR
[-] [23:36:29] 'error' not reflected rEfe6
hahwul commented 5 years ago

makeQuery 중 StandardError에서 패턴 넣어주고 있었음

rescue StandardError
  result.push("inject": 'url',"param":"error", "type": type, "query": '', "pattern": pattern, "desc": desc, "category": category, "callback": callback)
end
hahwul commented 5 years ago

hidden parameter 고려해서 넣은 것 같긴한데, 후에 적용해도 별로인 구조라서 제거