xhtml

README

compare比较规则记录

属性

比较内容：数量，key，value 是否继续比较：false 特殊属性:style，

text

比较内容：data 是否继续比较：false

tag

比较内容：data 是否继续比较：false

注释

比较内容：data 是否继续比较：false

问题

script 标签内检测，例：example7.php example8.php特殊情况 example9.php自己x自己，没意义

NewXssFuzz方法提取get和post参数 多个参数如何fuzz：GenFuzzParams

script处检查不严谨

所有回显位置

属性、text、comment、path

所有绕过方式

大小写、双写、单引号，双引号，无引号、a标签伪协议、/代替属性的空格、 <img/src=x onerror=alert(1)>，，

构造payload

属性（单引号、双引号、没引号），文本（script标签）

后端行为猜测

直接插入文本（闭合标签内文本、闭合属性）

过滤

php后端htmlspecialchars

特殊位置绕过方式 属性可以html实体编码，

参考文献 https://www.freebuf.com/vuls/256239.html https://www.ddosi.org/xss-bypass/#%E6%B2%A1%E6%9C%89%E8%BF%87%E6%BB%A4%E5%99%A8%E8%A7%84%E9%81%BF%E7%9A%84%E5%9F%BA%E6%9C%AC_XSS_%E6%B5%8B%E8%AF%95 https://github.com/payloadbox/xss-payload-list https://github.com/ethicalhackersrepo/Xss-payloads

Documentation

Index

• Constants
• Variables
• func AddElement2Set(arr *[]string, e string)
• func GenPayload(testStr string, ends []string) []string
• func GenerateXPath(node *html.Node) string
• func IsEscaped(s string) bool
• func MatchBetween(srcBody interface{}, start string, end string, max int) (int, string)
• func Node2Raw(node *html.Node) string
• func RandSafeString(n int) string
• func RandStrFromCharSet(charSet string, n int) string
• func RandomUpperAndLower(s string) string
• func WalkNode(node *html.Node, handler func(node *html.Node)) error
• func Walker(h interface{}, handler func(node *html.Node)) error
• type DiffInfo
  • func CompareHtml(htmlRaw1 interface{}, htmlRaw2 interface{}) ([]*DiffInfo, error)
• type MatchNodeInfo
  • func FindNodeFromHtml(htmlRaw interface{}, matchStr string) []*MatchNodeInfo
  • func (m *MatchNodeInfo) IsAttr() bool
  • func (m *MatchNodeInfo) IsCOMMENT() bool
  • func (m *MatchNodeInfo) IsText() bool
• type MatchType
• type OutputPosType

Constants

const (
	StructLarger  = "node1 contains node2"
	StructSmaller = "node2 contains node1"
)

Variables

var Exports = map[string]interface{}{
	"Walker":              Walker,
	"CompareHtml":         CompareHtml,
	"GenerateXPath":       GenerateXPath,
	"Find":                FindNodeFromHtml,
	"RandomUpperAndLower": RandomUpperAndLower,
	"MatchBetween":        MatchBetween,
}

Functions

func AddElement2Set

func AddElement2Set(arr *[]string, e string)

func GenPayload

func GenPayload(testStr string, ends []string) []string

func GenerateXPath

func GenerateXPath(node *html.Node) string

func IsEscaped

func IsEscaped(s string) bool

func MatchBetween

func MatchBetween(srcBody interface{}, start string, end string, max int) (int, string)

func Node2Raw

func Node2Raw(node *html.Node) string

func RandSafeString

func RandSafeString(n int) string

func RandStrFromCharSet

func RandStrFromCharSet(charSet string, n int) string

func RandomUpperAndLower

func RandomUpperAndLower(s string) string

func WalkNode

func WalkNode(node *html.Node, handler func(node *html.Node)) error

func Walker

func Walker(h interface{}, handler func(node *html.Node)) error

Types

type DiffInfo

type DiffInfo struct {
	OriginRaw string
	FuzzRaw   string
	XpathPos  string
	Reason    string
	Type      OutputPosType
	Node      *html.Node
}

func CompareHtml

func CompareHtml(htmlRaw1 interface{}, htmlRaw2 interface{}) ([]*DiffInfo, error)

type MatchNodeInfo

type MatchNodeInfo struct {
	Xpath     string
	TagName   string
	MatchNode *html.Node
	MatchText string

	Key, Val, Quote string
	// contains filtered or unexported fields
}

func FindNodeFromHtml

func FindNodeFromHtml(htmlRaw interface{}, matchStr string) []*MatchNodeInfo

func (*MatchNodeInfo) IsAttr

func (m *MatchNodeInfo) IsAttr() bool

func (*MatchNodeInfo) IsCOMMENT

func (m *MatchNodeInfo) IsCOMMENT() bool

func (*MatchNodeInfo) IsText

func (m *MatchNodeInfo) IsText() bool

type MatchType

type MatchType string

const (
	TEXT    MatchType = "TEXT"
	COMMENT MatchType = "COMMENT"
	ATTR    MatchType = "ATTR"
)

type OutputPosType

type OutputPosType string

const (
	Tag       OutputPosType = "Tag"
	Text      OutputPosType = "Text"
	Attr      OutputPosType = "Attr"
	AttrHref  OutputPosType = "AttrHref"
	AttrOnxxx OutputPosType = "AttrOnxxx"
)