Burpsuite-Parser
view release on metacpan or search on metacpan
t/test1.xml view on Meta::CPAN
<?xml version="1.0"?>
<!DOCTYPE issues [
<!ELEMENT issues (issue*)>
<!ATTLIST issues burpVersion CDATA "">
<!ATTLIST issues exportTime CDATA "">
<!ELEMENT issue (serialNumber, type, name, host, path, location, severity, confidence, issueBackground?, remediationBackground?, issueDetail?, remediationDetail?, requestresponse*)>
<!ELEMENT serialNumber (#PCDATA)>
<!ELEMENT type (#PCDATA)>
<!ELEMENT name (#PCDATA)>
<!ELEMENT host (#PCDATA)>
<!ELEMENT path (#PCDATA)>
<!ELEMENT location (#PCDATA)>
<!ELEMENT severity (#PCDATA)>
<!ELEMENT confidence (#PCDATA)>
<!ELEMENT issueBackground (#PCDATA)>
<!ELEMENT remediationBackground (#PCDATA)>
<!ELEMENT issueDetail (#PCDATA)>
<!ELEMENT remediationDetail (#PCDATA)>
<!ELEMENT requestresponse (request?, response?)>
<!ELEMENT request (#PCDATA)>
<!ELEMENT response (#PCDATA)>
]>
<issues burpVersion="1.2.17" exportTime="Mon Oct 12 07:27:01 PDT 2009">
<issue>
<serialNumber>7417499774799336448</serialNumber>
<type>3145984</type>
<name>Cleartext submission of password</name>
<host>http://192.168.163.128</host>
<path><![CDATA[/beef/]]></path>
<location><![CDATA[/beef/]]></location>
<severity>High</severity>
<confidence>Certain</confidence>
<issueBackground><![CDATA[Passwords submitted over an unencrypted connection are vulnerable to capture by an attacker who is suitably positioned on the network. This includes any malicious party located on the user's own network, within their ISP...
<remediationBackground><![CDATA[The application should use transport-level encryption (SSL or TLS) to protect all sensitive communications passing between the client and the server. Communications that should be protected include the login mechan...
<issueDetail><![CDATA[The page contains a form with the following action URL, which is submitted over clear-text HTTP:<ul><li>http://192.168.163.128<wbr>/beef/</li></ul>The form contains the following password field:<ul><li>passwd</li></ul>]]></i...
<requestresponse>
<request><![CDATA[GET /beef/ HTTP/1.1
Host: 192.168.163.128
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
]]></request>
<response><![CDATA[HTTP/1.1 200 OK
Date: Mon, 12 Oct 2009 14:26:53 GMT
Server: Apache/2.2.9 (Ubuntu) PHP/5.2.6-bt0 with Suhosin-Patch mod_perl/2.0.4 Perl/v5.10.0
X-Powered-By: PHP/5.2.6-bt0
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 3194
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<link rel="stylesheet" type="text/css" href="css/firefox/menu.css"> <link rel="stylesheet" type="text/css" href="css/firefox/style.css">
<title>Browser Exploit Framework</title>
<link rel="icon" href="favicon.ico" type="image/x-icon">
<script src="js/prototype.js" type="text/javascript"></script>
<script src="js/scriptaculous.js" type="text/javascript"></script>
<script src="js/common.js" type="text/javascript"></script>
<script>
// ---[ BEEF_ERROR
function beef_error(error_string) {
new Effect.Shake('beef_icon');
alert(error_string);
}
// ---[ SUBMIT_CONFIG
function submit_config(config, passwd) {
new Ajax.Updater('config_results', 'submit_config.php?config=' + config + '&passwd=' + passwd, {asynchronous:true});
}
</script>
</head>
<body>
<!-- SIDEBAR -->
<div id="sidebar">
<!-- BEEF HEADER - LINK AND IMAGE-->
<div id="header">
<center><a href=http://www.bindshell.net/tools/beef/>Browser Exploitation Framework</a></center>
<h1><div id="beef_icon"><img src="images/beef.gif" onclick="new Effect.Shake('sidebar');"></div> BeEF</h1>
</div>
<!-- Security -->
<div id="sidebar_autorun">
<div id="header" onclick="new Effect.Pulsate('zombiesdyn');">
<h2>Security</h2>
</div>
<div id="content">
<!-- DYNAMIC ZOMBIE SECTION -->
<div id="autorun_dyn">BeEF has no security by design <br><br></div>
<div id="autorun_dyn">Default password is <b>BeEFConfigPass</b> <br><br></div>
<div id="autorun_dyn">Edit 'pw.php' in BeEF root to alter the password</div>
</div>
</div>
<!-- INSTALL -->
<div id="sidebar_autorun">
<div id="header" onclick="new Effect.Pulsate('zombiesdyn');">
<!--<h2>Installation</h2>-->
</div>
<div id="content">
<!-- DYNAMIC ZOMBIE SECTION -->
<!-- <div id="autorun_dyn">BeEF has not been installed</div> -->
</div>
</div>
t/test1.xml view on Meta::CPAN
<a href="small/uu.gif"><img class="blackico" src="small/uu.gif"
/><img class="whiteico" src="small/uu.gif" /> small/uu.gif</a>
<br /><a href="small/uu.png"><img class="blackico" src="small/uu.png"
/><img class="whiteico" src="small/uu.png" /> small/uu.png</a></td>
</tr>
<tr><td colspan="4">This can stand for uuencoded data.</td>
</tr>
<tr>
<td width="25%">
<a href="world1.gif"><img class="blackico" src="world1.gif"
/><img class="whiteico" src="world1.gif" /> world1.gif</a>
<br /><a href="world1.png"><img class="blackico" src="world1.png"
/><img class="whiteico" src="world1.png" /> world1.png</a></td>
<td width="25%">
<a href="world2.gif"><img class="blackico" src="world2.gif"
/><img class="whiteico" src="world2.gif" /> world2.gif</a>
<br /><a href="world2.png"><img class="blackico" src="world2.png"
/><img class="whiteico" src="world2.png" /> world2.png</a></td>
</tr>
<tr><td colspan="4">These can represent 3D worlds or other 3D formats.</td>
</tr>
</table>
</body>
</html>
]]></response>
</requestresponse>
</issue>
<issue>
<serialNumber>2712758913220520960</serialNumber>
<type>8389120</type>
<name>HTML does not specify charset</name>
<host>http://192.168.163.128</host>
<path><![CDATA[/beef/]]></path>
<location><![CDATA[/beef/]]></location>
<severity>Information</severity>
<confidence>Certain</confidence>
<issueBackground><![CDATA[If a web response states that it contains HTML content but does not specify a character set, then the browser may analyse the HTML and attempt to determine which character set it appears to be using. Even if the majority...
<remediationBackground><![CDATA[For every response containing HTML content, the application should include within the Content-type header a directive specifying a standard recognised character set, for example <b>charset=ISO-8859-1</b>.]]></remed...
<requestresponse>
<request><![CDATA[GET /beef/ HTTP/1.1
Host: 192.168.163.128
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
]]></request>
<response><![CDATA[HTTP/1.1 200 OK
Date: Mon, 12 Oct 2009 14:26:53 GMT
Server: Apache/2.2.9 (Ubuntu) PHP/5.2.6-bt0 with Suhosin-Patch mod_perl/2.0.4 Perl/v5.10.0
X-Powered-By: PHP/5.2.6-bt0
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 3194
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<link rel="stylesheet" type="text/css" href="css/firefox/menu.css"> <link rel="stylesheet" type="text/css" href="css/firefox/style.css">
<title>Browser Exploit Framework</title>
<link rel="icon" href="favicon.ico" type="image/x-icon">
<script src="js/prototype.js" type="text/javascript"></script>
<script src="js/scriptaculous.js" type="text/javascript"></script>
<script src="js/common.js" type="text/javascript"></script>
<script>
// ---[ BEEF_ERROR
function beef_error(error_string) {
new Effect.Shake('beef_icon');
alert(error_string);
}
// ---[ SUBMIT_CONFIG
function submit_config(config, passwd) {
new Ajax.Updater('config_results', 'submit_config.php?config=' + config + '&passwd=' + passwd, {asynchronous:true});
}
</script>
</head>
<body>
<!-- SIDEBAR -->
<div id="sidebar">
<!-- BEEF HEADER - LINK AND IMAGE-->
<div id="header">
<center><a href=http://www.bindshell.net/tools/beef/>Browser Exploitation Framework</a></center>
<h1><div id="beef_icon"><img src="images/beef.gif" onclick="new Effect.Shake('sidebar');"></div> BeEF</h1>
</div>
<!-- Security -->
<div id="sidebar_autorun">
<div id="header" onclick="new Effect.Pulsate('zombiesdyn');">
<h2>Security</h2>
</div>
<div id="content">
<!-- DYNAMIC ZOMBIE SECTION -->
<div id="autorun_dyn">BeEF has no security by design <br><br></div>
<div id="autorun_dyn">Default password is <b>BeEFConfigPass</b> <br><br></div>
<div id="autorun_dyn">Edit 'pw.php' in BeEF root to alter the password</div>
</div>
</div>
<!-- INSTALL -->
<div id="sidebar_autorun">
<div id="header" onclick="new Effect.Pulsate('zombiesdyn');">
<!--<h2>Installation</h2>-->
</div>
<div id="content">
<!-- DYNAMIC ZOMBIE SECTION -->
<!-- <div id="autorun_dyn">BeEF has not been installed</div> -->
</div>
</div>
t/test1.xml view on Meta::CPAN
this.version = '0.1',
this.authors = 'Wade Alcorn <wade@bindshell.net>',
this.enabled = false,
this.module = '',
this.code = ''
},
// params: string to be displayed in sidebar, base64 encode code
enable: function(module_name, code) {
this.code = code;
var params = 'data='+code;
new Ajax.Updater('module_status', 'send_cmds.php?action=autorun', {method:'post',parameters:params,asynchronous:false});
this.enabled = true;
this.module = module_name;
$('autorun_dyn').innerHTML = this.module + ' Module Enabled';
},
disable: function() {
var params = 'data=disable';
new Ajax.Updater('module_status', 'send_cmds.php?action=autorun', {method:'post',parameters:params,asynchronous:false});
this.enabled = false;
this.module = '';
this.status = 'Disabled';
$('autorun_dyn').innerHTML = this.status;
}
}]]></response>
</requestresponse>
</issue>
<issue>
<serialNumber>4408084536896053248</serialNumber>
<type>4195072</type>
<name>Password field submitted using GET method</name>
<host>http://192.168.163.128</host>
<path><![CDATA[/beef/]]></path>
<location><![CDATA[/beef/]]></location>
<severity>Low</severity>
<confidence>Certain</confidence>
<issueBackground><![CDATA[The application uses the GET method to submit passwords, which are transmitted within the query string of the requested URL. Sensitive information within URLs may be logged in various locations, including the user's brow...
<remediationBackground><![CDATA[All forms submitting passwords should use the POST method. To achieve this, you should specify the method attribute of the FORM tag as <b>method="POST"</b>. It may also be necessary to modify the corresponding serv...
<issueDetail><![CDATA[The page contains a form with the following action URL, which is submitted using the GET method:<ul><li>http://192.168.163.128<wbr>/beef/</li></ul>The form contains the following password field:<ul><li>passwd</li></ul>]]></i...
<requestresponse>
<request><![CDATA[GET /beef/ HTTP/1.1
Host: 192.168.163.128
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
]]></request>
<response><![CDATA[HTTP/1.1 200 OK
Date: Mon, 12 Oct 2009 14:26:53 GMT
Server: Apache/2.2.9 (Ubuntu) PHP/5.2.6-bt0 with Suhosin-Patch mod_perl/2.0.4 Perl/v5.10.0
X-Powered-By: PHP/5.2.6-bt0
Vary: Accept-Encoding
Content-Type: text/html
Content-Length: 3194
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<link rel="stylesheet" type="text/css" href="css/firefox/menu.css"> <link rel="stylesheet" type="text/css" href="css/firefox/style.css">
<title>Browser Exploit Framework</title>
<link rel="icon" href="favicon.ico" type="image/x-icon">
<script src="js/prototype.js" type="text/javascript"></script>
<script src="js/scriptaculous.js" type="text/javascript"></script>
<script src="js/common.js" type="text/javascript"></script>
<script>
// ---[ BEEF_ERROR
function beef_error(error_string) {
new Effect.Shake('beef_icon');
alert(error_string);
}
// ---[ SUBMIT_CONFIG
function submit_config(config, passwd) {
new Ajax.Updater('config_results', 'submit_config.php?config=' + config + '&passwd=' + passwd, {asynchronous:true});
}
</script>
</head>
<body>
<!-- SIDEBAR -->
<div id="sidebar">
<!-- BEEF HEADER - LINK AND IMAGE-->
<div id="header">
<center><a href=http://www.bindshell.net/tools/beef/>Browser Exploitation Framework</a></center>
<h1><div id="beef_icon"><img src="images/beef.gif" onclick="new Effect.Shake('sidebar');"></div> BeEF</h1>
</div>
<!-- Security -->
<div id="sidebar_autorun">
<div id="header" onclick="new Effect.Pulsate('zombiesdyn');">
<h2>Security</h2>
</div>
<div id="content">
<!-- DYNAMIC ZOMBIE SECTION -->
<div id="autorun_dyn">BeEF has no security by design <br><br></div>
<div id="autorun_dyn">Default password is <b>BeEFConfigPass</b> <br><br></div>
<div id="autorun_dyn">Edit 'pw.php' in BeEF root to alter the password</div>
</div>
</div>
<!-- INSTALL -->
<div id="sidebar_autorun">
<div id="header" onclick="new Effect.Pulsate('zombiesdyn');">
<!--<h2>Installation</h2>-->
</div>
<div id="content">
<!-- DYNAMIC ZOMBIE SECTION -->
<!-- <div id="autorun_dyn">BeEF has not been installed</div> -->
</div>
</div>
( run in 0.441 second using v1.01-cache-2.11-cpan-acf6aa7dc9e )