utils/vulnerability_scanner.py - master - manokuzCS/Web_Scanner_SQL_XSS_CSRF

utils/vulnerability_scanner.py
150 строк5 KB
Manokuz
Fixes and add a CLI mode
28 окт 2025, 12:33
28 окт 2025, 12:3358fec7d
import requests
from urllib.parse import urlparse
from bs4 import BeautifulSoup, Tag
from typing import Optional

SQLI_PAYLOADS = [
    "'", "\"", "' OR '1'='1", "\" OR \"1\"=\"1", "' OR 1=1 --", "\" OR 1=1 --"
]

XSS_PAYLOADS = [
    "<script>alert('XSS')</script>", "\" onmouseover=\"alert('XSS')", "'><img src=x onerror=alert('XSS')>"
]

COMMON_CSRF_TOKENS = ["csrfmiddlewaretoken", "authenticity_token", "_csrf", "__RequestVerificationToken"]


def is_valid_url(url: str) -> bool:
    """Проверяет валидность URL"""
    if not url:
        return False
    
    try:
        parsed = urlparse(url)
        return all([parsed.scheme, parsed.netloc]) and parsed.scheme in ['http', 'https']
    except (ValueError, KeyError, AttributeError):
        return False


def sanitize_url(url: str) -> Optional[str]:
    """Очищает и валидирует URL"""
    if not url:
        return None
    
    url = url.strip()
    if not url.startswith(('http://', 'https://')):
        url = 'http://' + url
    
    return url if is_valid_url(url) else None


def scan_sql_injection(url: str) -> bool:
    """Проверяет наличие SQL-инъекций."""
    try:
        sanitized_url = sanitize_url(url)
        if not sanitized_url:
            return False
            
        vulnerable = False
        for payload in SQLI_PAYLOADS:
            test_url = f"{sanitized_url}?id={payload}"
            try:
                response = requests.get(test_url, timeout=5, allow_redirects=False)
                if response.status_code == 200:
                    errors = [
                        "you have an error in your sql syntax", 
                        "warning: mysql", 
                        "unclosed quotation", 
                        "syntax error",
                        "mysql_fetch_array",
                        "mysql_fetch_object",
                        "mysql_num_rows",
                        "mysql_result",
                        "mysql_query",
                        "mysql_connect"
                    ]
                    if response.text and any(error in response.text.lower() for error in errors):
                        vulnerable = True
                        break
            except (requests.RequestException, requests.Timeout):
                continue
        return vulnerable
    except (requests.RequestException, ValueError, KeyError, AttributeError, OSError):
        return False


def scan_xss(url: str) -> bool:
    """Проверяет наличие XSS-уязвимостей."""
    try:
        sanitized_url = sanitize_url(url)
        if not sanitized_url:
            return False
            
        vulnerable = False
        for payload in XSS_PAYLOADS:
            test_url = f"{sanitized_url}?q={payload}"
            try:
                response = requests.get(test_url, timeout=5, allow_redirects=False)
                if response.status_code == 200 and payload in response.text:
                    vulnerable = True
                    break
            except (requests.RequestException, requests.Timeout):
                continue
        return vulnerable
    except (requests.RequestException, ValueError, KeyError, AttributeError, OSError):
        return False


def scan_csrf(url: str) -> bool:
    """Проверяет наличие CSRF-уязвимостей на формах."""
    try:
        sanitized_url = sanitize_url(url)
        if not sanitized_url:
            return False
            
        response = requests.get(sanitized_url, timeout=5, allow_redirects=False)
        if response.status_code != 200:
            return False
            
        soup = BeautifulSoup(response.text, "html.parser")
        forms = soup.find_all("form")
        
        for form in forms:
            inputs = form.find_all("input")
            tokens: list[Tag] = []
            for i in inputs:
                    name = i.get("name")
                    if isinstance(name, str) and name.lower() in COMMON_CSRF_TOKENS:
                        tokens.append(i)
            if not tokens and inputs:  # Форма есть, но нет CSRF-токенов
                return True
        return False
    except (requests.RequestException, requests.Timeout, requests.ConnectionError):
        return False
    except (requests.RequestException, ValueError, KeyError, AttributeError, OSError):
        return False


def full_scan(url: str) -> dict[str, bool | str]:
    """Полный скан всех основных уязвимостей."""
    try:
        if not sanitize_url(url):
            return {
                "sql_injection": False,
                "xss": False,
                "csrf": False,
                "error": "Invalid URL"
            }
        
        return {
            "sql_injection": scan_sql_injection(url),
            "xss": scan_xss(url),
            "csrf": scan_csrf(url)
        }
    except (requests.RequestException, ValueError, KeyError, AttributeError, OSError) as e:
        return {
            "sql_injection": False,
            "xss": False,
            "csrf": False,
            "error": f"Scan failed: {str(e)}"
        }