#!/usr/bin/env bash
#=============================================================================
# Sentinela ? Intelligent Linux Security Framework
# ids/xss.sh ? Detección de Cross-Site Scripting (XSS)
#=============================================================================
#
# Detecta patrones XSS en URI, parámetros, User-Agent y Referer.
#
# Tipos cubiertos:
# - Reflected XSS (parámetros GET)
# - Stored XSS (logs de POST)
# - DOM-based XSS (fragmentos de URL)
# - Universal XSS (protocolos)
#
# Vectores cubiertos:
# - <script> tags
# - Event handlers (onerror, onload, onclick, etc.)
# - javascript: pseudo-protocol
# - SVG with onload
# - data: URIs
# - vbscript:
# - expression() CSS
# - <img>, <body>, <input>, <iframe> vectors
# - Angular expressions
# - React dangerouslySetInnerHTML
#=============================================================================
# shellcheck source=lib/common.sh
source "${SENTINELA_DIR}/lib/common.sh"
#=============================================================================
# Patrones XSS
#=============================================================================
XSS_PATTERNS=(
# Tags script
'<script[^>]*>'
'<script>'
'</script>'
# Event handlers HTML
'onerror\s*='
'onload\s*='
'onclick\s*='
'onmouseover\s*='
'onfocus\s*='
'onblur\s*='
'onchange\s*='
'onsubmit\s*='
'onreset\s*='
'onkeypress\s*='
'onkeydown\s*='
'onkeyup\s*='
'ondblclick\s*='
'onmousedown\s*='
'onmouseup\s*='
'onmousemove\s*='
'onmouseout\s*='
'onmouseenter\s*='
'onmouseleave\s*='
# JavaScript pseudo-protocol
'javascript:'
'javascript\t:'
'java\s*script:'
# SVG vectors
'<svg[^>]*>'
'<svg/onload'
# Data URIs
'data:text/html'
'data:application/xhtml'
'data:image/svg'
# VBScript
'vbscript:'
'vbscript\t:'
# CSS expressions
'expression\('
'-moz-binding'
# iFrame
'<iframe[^>]*>'
'<frame[^>]*>'
# Otras tags peligrosas
'<embed[^>]*>'
'<object[^>]*>'
'<applet[^>]*>'
'<meta[^>]*http-equiv'
'<link[^>]*href'
'<base[^>]*href'
'<form[^>]*action'
'<isindex[^>]*>'
# Angular
'ng-app'
'ng-csp'
'{{[a-z]'
# React
'dangerouslySetInnerHTML'
# XSS polyglots
'jaVasCript:'
'\\x3C'
'\\x3E'
'\\u003C'
'\\u003E'
# Bypass de filtros
'\\x22'
'\\x27'
'\\x60'
'%uff1c'
'%uff1e'
'%u003c'
'%u003e'
'%f0%9f%98%80'
# Objetos de window
'alert\('
'confirm\('
'prompt\('
'document\.cookie'
'document\.location'
'document\.write'
'window\.location'
'window\.eval'
'window\.execScript'
'fromCharCode'
'String\.fromCharCode'
'eval\('
'setTimeout\('
'setInterval\('
# XS-Search / XS-Leaks
'//[^/]+/\*'
)
#=============================================================================
# Verificar si una línea contiene XSS
#=============================================================================
xss_check() {
local text="$1"
local decoded_text
# Decodificar URL encoding
decoded_text=$(echo "${text}" | python3 -c "import sys,urllib.parse; print(urllib.parse.unquote(sys.stdin.read()))" 2>/dev/null || echo "${text}")
for pattern in "${XSS_PATTERNS[@]}"; do
if echo "${decoded_text}" | grep -qiP "${pattern}"; then
echo "${pattern}"
return 0
fi
done
return 1
}
#=============================================================================
# Analizar URI en busca de XSS
#=============================================================================
xss_analyze_uri() {
local uri="$1"
local decoded_uri
# Doble decodificación (para bypass)
decoded_uri=$(echo "${uri}" | python3 -c "import sys,urllib.parse; print(urllib.parse.unquote(urllib.parse.unquote(sys.stdin.read())))" 2>/dev/null || echo "${uri}")
xss_check "${decoded_uri}"
return $?
}
#=============================================================================
# Analizar User-Agent (XSS via UA)
#=============================================================================
xss_analyze_ua() {
local ua="$1"
xss_check "${ua}"
return $?
}
#=============================================================================
# Analizar Referer
#=============================================================================
xss_analyze_referer() {
local referer="$1"
xss_check "${referer}"
return $?
}
|
Download
