search

hhucn / webvulnscan

automated web application vulnerability scanner
MIT License
38 stars 27 forks source link

Simplify EtreeParser #22

Closed phihag closed 10 years ago

phihag commented 11 years ago

EtreeParser doesn't care about the URL, it should be simply given a warn or log method.

rliebig commented 11 years ago

It seems that there is an Issue under Python 3 with the modifications: https://travis-ci.org/hhucn/webvulnscan/jobs/10446465#L149

phihag commented 11 years ago

The modification was unrelated to this issue (which is about the logging framework), but the errors under Python 3 are now fixed.

rliebig commented 11 years ago

I just tried webvulnscan against vulnsrv, this was the output:

Warning: http://localhost:8666/reset HTML Error Unclosed tag <meta>
Warning: http://localhost:8666/mac/login HTML Error Unclosed tag <meta>
Warning: http://localhost:8666/clientauth/secret HTML Error Unclosed tag <meta>
Warning: http://localhost:8666/xss/send HTML Error Unclosed tag <meta> on/msg?id=1 Incorrect Unicode handling in URL 
<other vulnerabilities>

However, the w3c wiki shows examples where the <meta>-Syntax is allowed. I'm not sure if this is behavior is wanted.

phihag commented 11 years ago

Are you sure that you're using the newest version of vulnsrv? I cannot reproduce these errors.

rliebig commented 11 years ago

Sorry, I didn't notice that there was a update.