yhy0 / Jie

Jie stands out as a comprehensive security assessment and exploitation tool meticulously crafted for web applications. Its robust suite of features encompasses vulnerability scanning, information gathering, and exploitation, elevating it to an indispensable toolkit for both security professionals and penetration testers. 挖洞辅助工具(漏洞扫描、信息收集)

Home Page:https://jie.fireline.fun/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

XSS参数生成以及条件判断可以优化

Peppererer opened this issue · comments

1.所有参数的值都定义为了随机数,但是有一些固定参数是要过滤的,比如submit=submit/submit=login 转换成submit=FD23V1无法复现正常发包,可以改成只单个参数进行测试或者过滤关键字

image

2.SearchInputInResponse中的if input== tagname,改为if strings.ToLower(input) == tagname
因为回显中的tagname会自动转为小写。因此syntaxAnalysis.go中多处涉及tagname的地方也要使用ToLower转化,例如:
微信图片_20230609145819
改为if _item.Details.Value.TagName ==strings.ToLower(flag)