'''
Created on Aug 5, 2011

@author: v0mit
'''
import urllib, urllib2, random, sys, urlparse
from BeautifulSoup import BeautifulSoup
from BeautifulSoup import BeautifulStoneSoup

if len(sys.argv) == 3:
    url = sys.argv[1]
    log_file = sys.argv[2]

elif len(sys.argv) == 2:
    url = sys.argv[1]
    log_file = "vulnerable.txt"

else:
    print("Usage: pyxsser.py <target> <output>")


header = """
______      __   _______ _____
| ___ \     \ \ / /  ___/  ___|
| |_/ /_   _ \ V /\ `--.\ `--.  ___ _ __
|  __/| | | |/   \ `--. \`--. \/ _ \ '__|
| |   | |_| / /^\ |\__/ /\__/ /  __/ |
\_|    \__, \/   \|____/\____/ \___|_|
        __/ |
       |___/        v0.1
[email protected]
"""
print(header)

injection_str = ""
for x in range(0,8):
    injection_str += random.choice("abcdefghi1234567890")

encoded_injection_str = urllib.urlencode({"":";!--\"<%s>=&{()}" % injection_str})
#encoded_injection_str = "=lol"

class _http_handler():
    def __init__(self):
        self.opener = urllib2.build_opener(urllib2.HTTPCookieProcessor())
        urllib2.install_opener(self.opener)

    def request(self, url, data=None):

        req = urllib2.Request(url)
        req.add_header('User-Agent','Mozilla/5.0 (Windows; U; Windows NT 5.2; en-GB; rv:1.8.1.18) Gecko/20081029 Firefox/2.0.0.18')

        if data != None:
            data = urllib.urlencode(data)
            try:
                response = self.opener.open(req,data)
            except urllib2.URLError as errno:
                print(err)
                print("[!]urllib2.URLError({0})\n".format(errno))

                return

            return response.read()
        else:
            try:
                response = self.opener.open(req)
            except urllib2.URLError as errno:
                print("[!]urllib2.URLError({0})\n".format(errno))

                return

            except ValueError as errno:
                print("[!]ValueError({0}\n".format(errno))

                return

            return response.read()

def get_forms(url):
    h = _http_handler()
    data = h.request(url)
    if data == None:
        return None

    soup = BeautifulSoup(data)
    forms = soup.findAll("form", attrs={"method":"get"})
    forms += soup.findAll("form", attrs={"method":"post"})
    valid_forms = []
    for form in forms:
        action = form.get("action")
        if action != None:
            inputs = form.findAll("input", attrs={"type":"text"})
            names = []
            for input in inputs:
                name = input.get("name")
                if input != None:
                    names.append(str(name))

            valid_forms.append([str(action), names])

    return valid_forms

def generate_links(forms):
    urls = []
    for form in forms:
        for para in range(0, len(form[1])):
            if form[0] == "#":
                new_url = url
            else:
                new_url = form[0]
            if not new_url.endswith("?"):
                new_url += "?"

            buff = ""
            for x in form[1][:para]:
                buff += "&{0}=1".format(x)

            buff += "&{0}{1}".format(form[1][para], encoded_injection_str)

            for x in form[1][para+1:]:
                buff += "&{0}=1".format(x)
            new_url += buff[1:]
            urls.append(urlparse.urljoin(url,new_url))

    return urls


forms =  get_forms(url)
if forms == None:
    print("Cannot continue, could not open site to parse.")
    sys.exit(0)
urls = generate_links(forms)

vulnerable = []
for url in urls:
    print("[+]Testing:{0}".format(url))
    h = _http_handler()
    data = h.request(url)

    if data == None:
        continue

    if injection_str in data:
        print("[!]Possible XSS found!")
        print("[+]URL:{0}\n".format(url))
        vulnerable.append(url)

print("\n[+]Scann completed.")

if not len(vulnerable):
    print("[+]Nothing found.")
    sys.exit(0)

try:
    out = open(log_file, "wb")
except IOError as errno:
    print("\n[!]IOError: [0}".format(errno))
    sys.exit(0)

for url in vulnerable:
    out.write("{0}\n".format(url))

out.close()

print("[+]Report saved to: {0}".format(log_file))