DOX XSS Aktif Tarama Kuralı

DOM XSS açıklarının tespiti için bir Aktif Tarama kuralı.

It launches browser windows and sends attack payloads to all of the relevant DOM elements.
As it launches browser windows it will take significantly longer than other (non browser based) rules.

This version supports Firefox (the default) and Chrome. They can be run with GUI or headless (default), it can be changed with the rule rules.domxss.browserid, via the Options 'Rule configuration' panel, with values firefox, firefox-headless, chrome and chrome-headless.

Strengths and Thresholds

The following Attack Strengths are supported, and related directly to the number of attack payloads used for URL fragment and form input field injections (eg: http://example.com/index.html?foo=bar#injection):

LOW: 1 attack payloads
MEDIUM: 3 attack payloads
YÜKSEK: 6 saldırı yükü
INSANE: 9 attack payloads

The scanner will also attempt URL/query parameter injections which are not impacted by the selected strength.

Kural, yalnızca LOW Uyarı eşiği kullanılmadığı sürece, düğüm başına bir DOM XSS güvenlik açığını bildirir; bu durumda belirtilen yüklerin tümünü denemeye devam eder.

Exclusions

The rule will block the browser it launches from accessing any URLs that are excluded by:

Global Exclusions
Context Exclusions, if invoked with the relevant context

Latest code: DomXssScanRule.java