Store and display the payload url that fired

rs-loves-bugs · Mar 6, 2023 · 5acab8b · 5acab8b
1 parent 00301e6
commit 5acab8b
Show file tree

Hide file tree

Showing 7 changed files with 58 additions and 12 deletions.
diff --git a/api.js b/api.js
@@ -524,6 +524,7 @@ async function set_up_api_server(app) {
                 "user_agent": payload.user_agent,
                 "cookies": payload.cookies,
                 "title": payload.title,
+                "payload_url": payload.payload_url,
                 "origin": payload.origin,
                 "screenshot_id": payload.screenshot_id,
                 "was_iframe": payload.was_iframe,

diff --git a/app.js b/app.js
@@ -186,6 +186,10 @@ async function get_app_server() {
             "path": {
                 "type": "string",
                 "default": ""
+            },
+            "payload_url": {
+                "type": "string",
+                "default": ""
             }
     	}
     };
@@ -219,7 +223,13 @@ async function get_app_server() {
 
         try {
 
-            const secrets_response = await fetch('http://xsshunterexpress-trufflehog:8000/trufflehog', {
+            if ('TRUFFLEHOG_URL' in process.env) {
+                trufflehog_url = process.env.TRUFFLEHOG_URL
+              } else {
+                trufflehog_url = 'http://xsshunterexpress-trufflehog:8000/trufflehog'
+              }
+
+            const secrets_response = await fetch(trufflehog_url, {
                 method: 'POST',
                 headers: {
                     'Accept': 'application/json, text/plain, */*',
@@ -352,6 +362,7 @@ async function get_app_server() {
                 user_agent: req.body['user-agent'],
                 cookies: req.body.cookies,
                 title: req.body.title,
+                payload_url: req.body.payload_url,
                 secrets: JSON.parse(JSON.stringify(secret_data_result)),
                 origin: req.body.origin,
                 screenshot_id: payload_fire_image_id,
@@ -367,7 +378,6 @@ async function get_app_server() {
             }
         }
 
-
         // Check for correlated request
         const correlated_request_rec = await InjectionRequests.findOne({
             where: {
@@ -410,7 +420,6 @@ async function get_app_server() {
 
 	});
 
-
     // Set up /health handler so the user can
     // do uptime checks and appropriate alerting.
     app.get('/health', async (req, res) => {
@@ -436,11 +445,14 @@ async function get_app_server() {
         res.set("Access-Control-Max-Age", "86400");
 
         if(req.get('host') != process.env.XSS_HOSTNAME) {
-            //console.debug(req.get('host'));
             return res.redirect("/app/");
         }
 
-        const userPath = req.originalUrl.split("/")[1];
+        if(req.originalUrl.includes(".map")) {
+            return res.status(404);
+        }
+
+        const userPath = req.originalUrl.split("/").join("").split("?")[0];
         const user = await Users.findOne({ where: { 'path': userPath } });
 
         if (user === null){
@@ -466,6 +478,8 @@ async function get_app_server() {
 
             xssURI = `https://${process.env.XSS_HOSTNAME}`
         }
+
+        const payload_url = `https://${process.env.XSS_HOSTNAME}${req.originalUrl}`
 
         res.send(XSS_PAYLOAD.replace(
             /\[HOST_URL\]/g,
@@ -482,6 +496,9 @@ async function get_app_server() {
         ).replace(
             '[CHAINLOAD_REPLACE_ME]',
             JSON.stringify(chainload_uri)
+        ).replace(
+            '[PAYLOAD_URL_REPLACE_ME]',
+            JSON.stringify(payload_url)
         ).replace(
             '[PROBE_ID]',
             JSON.stringify(req.params.probe_id)

diff --git a/database.js b/database.js
@@ -253,6 +253,12 @@ PayloadFireResults.init({
 		allowNull: true,
 		unique: false
 	},
+	//payload url
+	payload_url: {
+		type: Sequelize.TEXT,
+		allowNull: true,
+		unique: false
+	},
 }, {
 	sequelize,
 	modelName: 'payload_fire_results',
@@ -380,14 +386,15 @@ InjectionRequests.init({
 
 async function database_init() {
 	const force = false;
+	const alter = {drop: false};
 
 	// Set up database schema
 	await Promise.all([
-		PayloadFireResults.sync({ force: force }),
-		Users.sync({ force: force }),
-		Secrets.sync({ force: force }),
-		CollectedPages.sync({ force: force }),
-		InjectionRequests.sync({ force: force }),
+		PayloadFireResults.sync({ force: force, alter: alter }),
+		Users.sync({ force: force, alter: alter }),
+		Secrets.sync({ force: force, alter: alter }),
+		CollectedPages.sync({ force: force, alter: alter }),
+		InjectionRequests.sync({ force: force, alter: alter  }),
 	]);
 }
 

diff --git a/env.example b/env.example
@@ -25,6 +25,7 @@ POSTGRES_DB=xsshunterexpress
 POSTGRES_PASSWORD=xsshunterexpress
 POSTGRES_USER=xsshunterexpress
 SCREENSHOTS_DIR=/app/payload-fire-images
+TRUFFLEHOG_URL=http://xsshunterexpress-trufflehog:8000/trufflehog
 
 SENTRY_DSN=
 SENTRY_ENABLED=false

diff --git a/front-end/src/pages/Settings.vue b/front-end/src/pages/Settings.vue
@@ -64,7 +64,7 @@
                         </card>
                         <card>
                             <h4 class="card-title">Custom Webhook</h4>
-                            <h6 class="card-subtitle mb-2 text-muted">Custom webhook</h6>
+                            <h6 class="card-subtitle mb-2 text-muted">When a payload fires XSSHunter will send a post request to this URL.</h6>
                             <p class="card-text">
                                 <base-input v-model:value="custom_webhook" type="text" placeholder="..."></base-input>
                             </p>
@@ -317,4 +317,3 @@ textarea {
   resize: none;
 }
 </style>
-
diff --git a/front-end/src/pages/XSSPayloadFireReports.vue b/front-end/src/pages/XSSPayloadFireReports.vue
@@ -83,6 +83,19 @@
                                             </div>
                                             <hr />
                                         </div>
+                                        <div>
+                                            <div>
+                                                <p class="report-section-label mr-2">Payload URL</p>
+                                                <small slot="helperText" class="form-text text-muted report-section-description">
+                                                    The src URL of the payload that fired.
+                                                </small>
+                                            </div>
+                                            <div class="m-2 mt-4">
+                                                <pre v-if="report.payload_url">{{report.payload_url}}</pre>
+                                                <pre v-else><i>None</i></pre>
+                                            </div>
+                                            <hr />
+                                        </div>
                                         <div>
                                             <div>
                                                 <p class="report-section-label mr-2">IP Address</p>

diff --git a/probe.js b/probe.js