From 186cb9077d4ed9891d9ba3aa9c54543b3d16e0b3 Mon Sep 17 00:00:00 2001
From: Devin Stokes <rune.dev@gmail.com>
Date: Tue, 30 Apr 2019 14:44:19 -0700
Subject: [PATCH 01/10] Added browser validation

---
 core/browserEngine.py | 35 +++++++++++++++++++++++++++++++++++
 modes/scan.py         | 27 ++++++++-------------------
 2 files changed, 43 insertions(+), 19 deletions(-)
 create mode 100644 core/browserEngine.py

diff --git a/core/browserEngine.py b/core/browserEngine.py
new file mode 100644
index 00000000..34825d71
--- /dev/null
+++ b/core/browserEngine.py
@@ -0,0 +1,35 @@
+import re
+import os
+import sys
+from core.config import xsschecker
+from core.utils import writer
+from selenium import webdriver
+from selenium.webdriver.firefox.options import Options
+from selenium.common.exceptions import UnexpectedAlertPresentException
+from selenium.webdriver.support import expected_conditions as EC
+
+
+def browserEngine(response):
+    options = Options()
+    options.add_argument('--headless')
+    browser = webdriver.Firefox(options=options)
+    response = re.sub(r'<script.*?src=.*?>', '<script src=#>', response, re.I)
+    response = re.sub(r'href=.*?>', 'href=#>', response, re.I)
+    writer(response, 'test.html')
+    browser.get('file://' + sys.path[0] + '/test.html')
+    os.remove('test.html')
+    popUp = False
+    actions = webdriver.ActionChains(browser)
+
+    try:
+        actions.move_by_offset(2, 2)
+        actions.perform()
+        if EC.alert_is_present():
+            popUp = True
+        browser.quit()
+
+
+    except UnexpectedAlertPresentException:
+        popUp = True
+        browser.quit()
+    return popUp
diff --git a/modes/scan.py b/modes/scan.py
index e2030f84..c12f2cdd 100644
--- a/modes/scan.py
+++ b/modes/scan.py
@@ -3,6 +3,7 @@
 from urllib.parse import urlparse, quote, unquote
 
 from core.arjun import arjun
+from core.browserEngine import browserEngine
 from core.checker import checker
 from core.colors import good, bad, end, info, green, red, que
 import core.config
@@ -94,30 +95,18 @@ def scan(target, paramData, encoding, headers, delay, timeout, skipDOM, find, sk
             for vect in vects:
                 if core.config.globalVariables['path']:
                     vect = vect.replace('/', '%2F')
-                loggerVector = vect
                 progress += 1
                 logger.run('Progress: %i/%i\r' % (progress, total))
                 if not GET:
                     vect = unquote(vect)
-                efficiencies = checker(
-                    url, paramsCopy, headers, GET, delay, vect, positions, timeout, encoding)
-                if not efficiencies:
-                    for i in range(len(occurences)):
-                        efficiencies.append(0)
-                bestEfficiency = max(efficiencies)
-                if bestEfficiency == 100 or (vect[0] == '\\' and bestEfficiency >= 95):
-                    logger.red_line()
-                    logger.good('Payload: %s' % loggerVector)
-                    logger.info('Efficiency: %i' % bestEfficiency)
-                    logger.info('Confidence: %i' % confidence)
+                logger.info('Validating in Browser')
+                response = requester(url, paramsCopy, headers, GET, delay, timeout).text
+                success = browserEngine(response)
+                if success:
+                    logger.info('Payload: %s' % vect)
+                    logger.info('Browser Validated: %s' % success)
                     if not skip:
-                        choice = input(
-                            '%s Would you like to continue scanning? [y/N] ' % que).lower()
+                        choice = input('%s Would you like to continue scanning? [y/N] ' % que).lower()
                         if choice != 'y':
                             quit()
-                elif bestEfficiency > minEfficiency:
-                    logger.red_line()
-                    logger.good('Payload: %s' % loggerVector)
-                    logger.info('Efficiency: %i' % bestEfficiency)
-                    logger.info('Confidence: %i' % confidence)
         logger.no_format('')

From 4b9776c641bf754f57af4da30e677dd2ef5a7a14 Mon Sep 17 00:00:00 2001
From: Devin Stokes <rune.dev@gmail.com>
Date: Tue, 30 Apr 2019 14:49:23 -0700
Subject: [PATCH 02/10] Added selenium to requirements.txt

---
 requirements.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/requirements.txt b/requirements.txt
index 3c25fb9d..e3584a66 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,3 +1,4 @@
+selenium
 tld
 fuzzywuzzy
 requests

From 0c66cd94cb25cf6d2fd9617507d289946b7d1c4f Mon Sep 17 00:00:00 2001
From: Devin Stokes <rune.dev@gmail.com>
Date: Tue, 30 Apr 2019 17:44:41 -0700
Subject: [PATCH 03/10] Added geckodriver to travis.yml

---
 .travis.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index 934c3bbc..8cc27c66 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -4,6 +4,11 @@ os:
   - linux
 python:
   - 3.6
+before_install:
+  - wget https://github.com/mozilla/geckodriver/releases/download/v0.24.0/geckodriver-v0.24.0-linux64.tar.gz
+  - mkdir geckodriver
+  - tar -xzf geckodriver-v0.24.0-linux64.tar.gz -C geckodriver
+  - export PATH=$PATH:$PWD/geckodriver
 install:
   - pip install -r requirements.txt
   - pip install flake8

From dada14f3e80687ed7664820423e5360684df6f81 Mon Sep 17 00:00:00 2001
From: Devin Stokes <rune.dev@gmail.com>
Date: Tue, 30 Apr 2019 17:52:44 -0700
Subject: [PATCH 04/10] make the browser static so we don't have to initialize
 it each execution.

---
 core/browserEngine.py | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/core/browserEngine.py b/core/browserEngine.py
index 34825d71..c8c4c567 100644
--- a/core/browserEngine.py
+++ b/core/browserEngine.py
@@ -1,18 +1,17 @@
 import re
 import os
 import sys
-from core.config import xsschecker
 from core.utils import writer
 from selenium import webdriver
 from selenium.webdriver.firefox.options import Options
 from selenium.common.exceptions import UnexpectedAlertPresentException
 from selenium.webdriver.support import expected_conditions as EC
 
+options = Options()
+options.add_argument('--headless')
+browser = webdriver.Firefox(options=options)
 
 def browserEngine(response):
-    options = Options()
-    options.add_argument('--headless')
-    browser = webdriver.Firefox(options=options)
     response = re.sub(r'<script.*?src=.*?>', '<script src=#>', response, re.I)
     response = re.sub(r'href=.*?>', 'href=#>', response, re.I)
     writer(response, 'test.html')
@@ -28,7 +27,6 @@ def browserEngine(response):
             popUp = True
         browser.quit()
 
-
     except UnexpectedAlertPresentException:
         popUp = True
         browser.quit()

From c03c085eeb70a245569900f5db51f441fdb0aa2b Mon Sep 17 00:00:00 2001
From: Devin Stokes <rune.dev@gmail.com>
Date: Tue, 30 Apr 2019 18:09:30 -0700
Subject: [PATCH 05/10] Removed browser quit arguments and made a method out of
 it to be called externally

---
 core/browserEngine.py | 9 +++++++--
 modes/scan.py         | 4 +++-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/core/browserEngine.py b/core/browserEngine.py
index c8c4c567..b8d3e2a5 100644
--- a/core/browserEngine.py
+++ b/core/browserEngine.py
@@ -11,6 +11,12 @@
 options.add_argument('--headless')
 browser = webdriver.Firefox(options=options)
 
+
+def killBrowser():
+    if browser is not None:
+        browser.quit()
+
+
 def browserEngine(response):
     response = re.sub(r'<script.*?src=.*?>', '<script src=#>', response, re.I)
     response = re.sub(r'href=.*?>', 'href=#>', response, re.I)
@@ -25,9 +31,8 @@ def browserEngine(response):
         actions.perform()
         if EC.alert_is_present():
             popUp = True
-        browser.quit()
 
     except UnexpectedAlertPresentException:
         popUp = True
-        browser.quit()
+
     return popUp
diff --git a/modes/scan.py b/modes/scan.py
index c12f2cdd..2bd75db7 100644
--- a/modes/scan.py
+++ b/modes/scan.py
@@ -3,7 +3,7 @@
 from urllib.parse import urlparse, quote, unquote
 
 from core.arjun import arjun
-from core.browserEngine import browserEngine
+from core.browserEngine import browserEngine, killBrowser
 from core.checker import checker
 from core.colors import good, bad, end, info, green, red, que
 import core.config
@@ -108,5 +108,7 @@ def scan(target, paramData, encoding, headers, delay, timeout, skipDOM, find, sk
                     if not skip:
                         choice = input('%s Would you like to continue scanning? [y/N] ' % que).lower()
                         if choice != 'y':
+                            killBrowser()
                             quit()
         logger.no_format('')
+    killBrowser()

From b20c24a438c53efee6a97ffdf956113d8a1c4a6e Mon Sep 17 00:00:00 2001
From: Devin Stokes <rune.dev@gmail.com>
Date: Tue, 30 Apr 2019 18:17:13 -0700
Subject: [PATCH 06/10] update travis

---
 .travis.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index 8cc27c66..323fa59b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,5 +1,9 @@
 language: python
 cache: pip
+env:
+  - MOZ_HEADLESS=1
+addons:
+  firefox: latest
 os:
   - linux
 python:

From 16e0dd25b5d3ec9fd7b139ddaa4900e7b2265b59 Mon Sep 17 00:00:00 2001
From: Devin Stokes <rune.dev@gmail.com>
Date: Tue, 30 Apr 2019 19:19:00 -0700
Subject: [PATCH 07/10] Updated naming in browserEngine.py

Refactored methods in browserEngine to be more readable

Fixed logging methods used when adding the browserEngine (ie. info/debug/good/etc)
---
 core/browserEngine.py | 42 +++++++++++++++++++++++++++++++++---------
 modes/scan.py         | 12 ++++++------
 2 files changed, 39 insertions(+), 15 deletions(-)

diff --git a/core/browserEngine.py b/core/browserEngine.py
index b8d3e2a5..7437e869 100644
--- a/core/browserEngine.py
+++ b/core/browserEngine.py
@@ -1,27 +1,34 @@
 import re
 import os
 import sys
+
+from core.log import setup_logger
 from core.utils import writer
 from selenium import webdriver
 from selenium.webdriver.firefox.options import Options
 from selenium.common.exceptions import UnexpectedAlertPresentException
 from selenium.webdriver.support import expected_conditions as EC
 
-options = Options()
-options.add_argument('--headless')
-browser = webdriver.Firefox(options=options)
+logger = setup_logger(__name__)
+
 
+def init_browser():
+    global browser
+    options = Options()
+    options.add_argument('--headless')
+    browser = webdriver.Firefox(options=options)
+    logger.debug('Browser initialized')
 
-def killBrowser():
+
+def kill_browser():
     if browser is not None:
         browser.quit()
+        logger.debug('Killed browser')
 
 
-def browserEngine(response):
-    response = re.sub(r'<script.*?src=.*?>', '<script src=#>', response, re.I)
-    response = re.sub(r'href=.*?>', 'href=#>', response, re.I)
-    writer(response, 'test.html')
-    browser.get('file://' + sys.path[0] + '/test.html')
+def browser_engine(response):
+    _write_response_to_file(response)
+    navigate_to('file://' + sys.path[0] + '/test.html')
     os.remove('test.html')
     popUp = False
     actions = webdriver.ActionChains(browser)
@@ -31,8 +38,25 @@ def browserEngine(response):
         actions.perform()
         if EC.alert_is_present():
             popUp = True
+            logger.good('Found alert during browser validation')
 
     except UnexpectedAlertPresentException:
         popUp = True
+        logger.good('Found alert during browser validation')
 
     return popUp
+
+
+def _write_response_to_file(response):
+    response = re.sub(r'<script.*?src=.*?>', '<script src=#>', response, re.I)
+    response = re.sub(r'href=.*?>', 'href=#>', response, re.I)
+    writer(response, 'test.html')
+
+
+def navigate_to(uri):
+    if browser is None:
+        init_browser()
+        browser.get(uri)
+
+
+init_browser()
diff --git a/modes/scan.py b/modes/scan.py
index 2bd75db7..37d48b3b 100644
--- a/modes/scan.py
+++ b/modes/scan.py
@@ -3,7 +3,7 @@
 from urllib.parse import urlparse, quote, unquote
 
 from core.arjun import arjun
-from core.browserEngine import browserEngine, killBrowser
+from core.browserEngine import browser_engine, kill_browser
 from core.checker import checker
 from core.colors import good, bad, end, info, green, red, que
 import core.config
@@ -101,14 +101,14 @@ def scan(target, paramData, encoding, headers, delay, timeout, skipDOM, find, sk
                     vect = unquote(vect)
                 logger.info('Validating in Browser')
                 response = requester(url, paramsCopy, headers, GET, delay, timeout).text
-                success = browserEngine(response)
+                success = browser_engine(response)
                 if success:
-                    logger.info('Payload: %s' % vect)
-                    logger.info('Browser Validated: %s' % success)
+                    logger.good('Payload: %s' % vect)
+                    logger.good('Browser Validated: %s' % success)
                     if not skip:
                         choice = input('%s Would you like to continue scanning? [y/N] ' % que).lower()
                         if choice != 'y':
-                            killBrowser()
+                            kill_browser()
                             quit()
         logger.no_format('')
-    killBrowser()
+    kill_browser()

From 2c3b1e167680d471f8e15f99c27904d53d89320a Mon Sep 17 00:00:00 2001
From: Devin Stokes <rune.dev@gmail.com>
Date: Wed, 1 May 2019 07:27:08 -0700
Subject: [PATCH 08/10] Removed logging from browserEngine

---
 core/browserEngine.py | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/core/browserEngine.py b/core/browserEngine.py
index 7437e869..d78ba44b 100644
--- a/core/browserEngine.py
+++ b/core/browserEngine.py
@@ -9,21 +9,17 @@
 from selenium.common.exceptions import UnexpectedAlertPresentException
 from selenium.webdriver.support import expected_conditions as EC
 
-logger = setup_logger(__name__)
-
 
 def init_browser():
     global browser
     options = Options()
     options.add_argument('--headless')
     browser = webdriver.Firefox(options=options)
-    logger.debug('Browser initialized')
 
 
 def kill_browser():
     if browser is not None:
         browser.quit()
-        logger.debug('Killed browser')
 
 
 def browser_engine(response):
@@ -38,11 +34,9 @@ def browser_engine(response):
         actions.perform()
         if EC.alert_is_present():
             popUp = True
-            logger.good('Found alert during browser validation')
 
     except UnexpectedAlertPresentException:
         popUp = True
-        logger.good('Found alert during browser validation')
 
     return popUp
 

From 1d22590cd5fb69f2d6a220fcb797915a2f259c7a Mon Sep 17 00:00:00 2001
From: Devin Stokes <rune.dev@gmail.com>
Date: Wed, 1 May 2019 07:28:12 -0700
Subject: [PATCH 09/10] Removed extra logging from scan.py

---
 modes/scan.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/modes/scan.py b/modes/scan.py
index 37d48b3b..047d23af 100644
--- a/modes/scan.py
+++ b/modes/scan.py
@@ -99,12 +99,10 @@ def scan(target, paramData, encoding, headers, delay, timeout, skipDOM, find, sk
                 logger.run('Progress: %i/%i\r' % (progress, total))
                 if not GET:
                     vect = unquote(vect)
-                logger.info('Validating in Browser')
                 response = requester(url, paramsCopy, headers, GET, delay, timeout).text
                 success = browser_engine(response)
                 if success:
                     logger.good('Payload: %s' % vect)
-                    logger.good('Browser Validated: %s' % success)
                     if not skip:
                         choice = input('%s Would you like to continue scanning? [y/N] ' % que).lower()
                         if choice != 'y':

From 8e00a32511d41a9b23e44e7d43cefbe814ea07c0 Mon Sep 17 00:00:00 2001
From: Devin Stokes <rune.dev@gmail.com>
Date: Wed, 1 May 2019 09:11:52 -0700
Subject: [PATCH 10/10] Move browser initialization out of browserEngine and
 put it in to scan.py

---
 core/browserEngine.py | 2 +-
 modes/scan.py         | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/core/browserEngine.py b/core/browserEngine.py
index d78ba44b..8d923363 100644
--- a/core/browserEngine.py
+++ b/core/browserEngine.py
@@ -53,4 +53,4 @@ def navigate_to(uri):
         browser.get(uri)
 
 
-init_browser()
+
diff --git a/modes/scan.py b/modes/scan.py
index 047d23af..09744735 100644
--- a/modes/scan.py
+++ b/modes/scan.py
@@ -3,7 +3,7 @@
 from urllib.parse import urlparse, quote, unquote
 
 from core.arjun import arjun
-from core.browserEngine import browser_engine, kill_browser
+from core.browserEngine import browser_engine, kill_browser, init_browser
 from core.checker import checker
 from core.colors import good, bad, end, info, green, red, que
 import core.config
@@ -33,6 +33,9 @@ def scan(target, paramData, encoding, headers, delay, timeout, skipDOM, find, sk
     logger.debug('Scan target: {}'.format(target))
     response = requester(target, {}, headers, GET, delay, timeout).text
 
+    # initialize browser
+    init_browser()
+
     if not skipDOM:
         logger.run('Checking for DOM vulnerabilities')
         highlighted = dom(response)