I-Dalfox – Ukuhlaziywa kwepharamitha & I-XSS Detector Tutorial

6.8K

I-Dalfox Ukuhlaziywa kwepharamitha emangalisayo ne-XSS Scanning Tool.

I-DALFOX Ngokuvamile isho,

Dal = inyanga (Ukuphinyiselwa KwaseKorea ) ; FOX = Thola ama-XSS.

Izici ze-DALFOX:

• Ukuhlaziywa kwepharamitha (Thola ipharamitha ebonisiwe, Thola izinhlamvu zamahhala / ezimbi, Ukukhonjwa kwephuzu lomjovo)
• Ukuhlaziywa Kwe-Static (Hlola unhlokweni omubi njenge-CSP, Izinketho ze-X-Frame, njll.. ngesisekelo sesicelo / impendulo yempendulo)
• Umbuzo wokusebenzisa imali yokulayisha
  • Hlola iphuzu lomjovo ngokusebenzisa ukukhishwa futhi ukhiqize i-Fit Payload.
  • Susa Ukukhokhelwa Okungadingekile Ngokusekelwe ku-Bad Char
• Ukuskena kwe-XSS(Kuboniswe + -Londekile) kanye ne-DOM Base iqinisekisa
• Konke ukukhokha okukhokhelwayo(Yakha-in, Isiko lakho / izimpumputhe) zihlolwe ngokufana ne-encoder.
  • Ukusekelwa kokuphinda kabili i-URL Encoder
  • Ukusekelwa ku-HTML Hex Encoder
• Ipayipi elinobungane (url eyodwa, kusuka kufayela, kusuka ku-io)
• Kanye nezinketho ezahlukahlukene ezidingekayo ekuhlolweni 😀
  • Ukugqekeza okwakhelwe ngaphakathi / ngokwezifiso ukuthola okunye ukuba sengozini
  • Uma utholile, Ngemuva kwesenzo
  • njll..

---

Ukukhetha komhleli:

• Macof - ithuluzi lokukhukhula ekugcineni | Okokufundisa[2020]
• I-NWANIME - Izindlela ezihamba phambili zeNwanime [2020]
• I-CCMaker - Download Ultimate Adobe Piracy Kit[2020]
• I-Losmovies - Iwebhusayithi Ehamba phambili Ye-Movie Yokusakaza

---

Ungayifaka kanjani i-DALFOX?

Kunezindlela ezintathu zokufaka i-DALFOX.

Ungasebenzisa noma ngubani wabo.

1. Ukudla

1. Okokuqala ngqa ukunxusa le ndawo yokugcina.

$ git clone https://github.com/hahwul/dalfox

2. Faka indlela ye-Dalfox Path

$ go install

3. Isebenzisa i-DALFOX

$ ~/go/bin/dalfox

2. Go-Get

1. hamba uyothola i-dalfox!

$ go get -u github.com/hahwul/dalfox

2. Isebenzisa i-DALFOX

$ ~/go/bin/dalfox

3. Ukukhishwa kwenguqulo

1. Vula ikhasi lokukhishwa kwakamuva https://github.com/hahwul/dalfox/releases/latest
2. Landa ukulanda ifayela futhi ukhiphe ifayela elifanelana ne-OS yakho.
3. Ungayibeka esikhondweni sokubulawa futhi uyisebenzise. e.g

$ cp dalfox /usr/bin/

Ukusetshenziswa kwe-DALFOX:

    _..._
  .' .::::.   __   _   _    ___ _ __ __
 :  :::::::: |  \ / \ | |  | __/ \\ V /
 :  :::::::: | o ) o || |_ | _( o )) (
 '. '::::::' |__/|_n_||___||_| \_//_n_\
   '-.::''
Parameter Analysis and XSS Scanning tool based on golang
Finder Of XSS and Dal is the Korean pronunciation of moon. @hahwul


Usage:
  dalfox [command]

Available Commands:
  file        Use file mode(targets list or rawdata)
  help        Help about any command
  pipe        Use pipeline mode
  sxss        Use Stored XSS mode
  update      Update DalFox (Binary patch)
  url         Use single target mode
  version     Show version

Flags:
  -b, --blind string            Add your blind xss (e.g -b hahwul.xss.ht)
      --config string           Using config from file
  -C, --cookie string           Add custom cookie
      --custom-payload string   Add custom payloads from file
  -d, --data string             Using POST Method and add Body data
      --delay int               Milliseconds between send to same host (1000==1s)
      --found-action string     If found weak/vuln, action(cmd) to next
      --grep string             Using custom grepping file (e.g --grep ./samples/sample_grep.json)
  -H, --header string           Add custom headers
  -h, --help                    help for dalfox
      --ignore-return string    Ignore scanning from return code (e.g --ignore-return 302,403,404)
      --only-discovery          Only testing parameter analysis
  -o, --output string           Write to output file
      --output-format string    -o/--output 's format (txt/json/xml)
  -p, --param string            Only testing selected parameters
      --proxy string            Send all request to proxy server (e.g --proxy http://127.0.0.1:8080)
      --silence                 Not printing all logs
      --timeout int             Second of timeout (default 10)
      --user-agent string       Add custom UserAgent
  -w, --worker int              Number of worker (default 40)

$ dalfox [mode] [flags]

Imodi yokuqondisa eyodwa

$ dalfox url http://testphp.vulnweb.com/listproducts.php\?cat\=123\&artist\=123\&asdf\=ff -b https://hahwul.xss.ht

Imodi yokuqondisa okuningi kusuka kufayela

$ dalfox file urls_file --custom-payload ./mypayloads.txt

Imodi yePipeline

$ cat urls_file | dalfox pipe -H "AuthToken: bbadsfkasdfadsf87"

Landa i-Dalfox:

Isiphetho:

I-Dalfox iyithuluzi elimangalisayo ongalisebenzisa.

Uma uthole inani kule ndatshana. Qinisekisa ukuthi ukuphawula phansi ngezansi futhi uqinise umdlandla weqembu lethu.

Ungaphinde unikeze noma yiziphi iziphakamiso noma imibuzo ephathelene naleli thuluzi.

Iqembu lethu lizozama ukuphendula ngokushesha okukhulu.