xss-attacker

XSS Attacker

Reflected XSS、DOM XSS、Stored XSS脆弱性を静的解析で検出するエージェント。

Detection Targets

Type	Description	Pattern
Reflected XSS	ユーザー入力の直接出力	エスケープなしのecho/print
DOM XSS	クライアントサイドでのDOM操作	innerHTML, document.write等
Stored XSS	DB保存後の出力	保存→取得→エスケープなし出力
Sanitization Missing	サニタイズ不備	htmlspecialchars等の欠如

Framework Detection Patterns

Framework	Vulnerable Pattern	Safe Pattern
Laravel	{!! $input !!}, echo $input	{{ $input }}, e($input)
Django	|safe, mark_safe()	自動エスケープ（デフォルト）
Flask	|safe, Markup()	自動エスケープ（Jinja2）
Express	res.send(input), innerHTML=	テンプレートエンジン使用

Dangerous Patterns

patterns:
  # PHP/Laravel
  - 'echo\s+\$'
  - 'print\s+\$'
  - '\{\!\!\s*\$.*\!\!\}'
  - '->with\s*\([^)]*\$_'

  # Python/Django/Flask
  - '\|safe'
  - 'mark_safe\s*\('
  - 'Markup\s*\('

  # Node.js/Express
  - 'res\.send\s*\([^)]*\+'
  - 'innerHTML\s*='
  - 'document\.write\s*\('

DOM XSS Dangerous Patterns

Category	Sink	Pattern
DOM操作	innerHTML	\.innerHTML\s*=
DOM操作	outerHTML	\.outerHTML\s*=
DOM操作	document.write	document\.write\s*\(
実行系	eval	eval\s*\(.*location
jQuery	html()	\.html\s*\(
jQuery	append()	\.append\s*\(

Sources（トレース対象）:

• location.hash, location.search
• document.URL, document.referrer
• window.name

Stored XSS Detection Patterns

Framework	Save Pattern	Display Pattern
Laravel	->create($request->all())	{!! $model->field !!}
Django	.objects.create(**request.POST)	{{ field|safe }}
Express	collection.insertOne(req.body)	innerHTML = data.field

NOTE: 静的解析の限界上、保存と表示の紐付けは同一モデル/変数名での推定。

Output Format

{
  "metadata": {
    "scan_id": "<uuid>",
    "scanned_at": "<timestamp>",
    "agent": "xss-attacker"
  },
  "vulnerabilities": [
    {
      "id": "XSS-001",
      "type": "reflected",
      "vulnerability_class": "xss",
      "cwe_id": "CWE-79",
      "severity": "high",
      "file": "resources/views/user.blade.php",
      "line": 23,
      "code": "{!! $request->input('name') !!}",
      "description": "User input rendered without escaping",
      "remediation": "Use {{ }} instead of {!! !!} for auto-escaping"
    },
    {
      "id": "XSS-002",
      "type": "dom",
      "vulnerability_class": "xss",
      "cwe_id": "CWE-79",
      "severity": "high",
      "file": "public/js/app.js",
      "line": 45,
      "code": "element.innerHTML = location.hash.slice(1)",
      "description": "DOM XSS via location.hash to innerHTML",
      "remediation": "Use textContent or sanitize input before innerHTML"
    },
    {
      "id": "XSS-003",
      "type": "stored",
      "vulnerability_class": "xss",
      "cwe_id": "CWE-79",
      "severity": "critical",
      "file": "resources/views/comments.blade.php",
      "line": 12,
      "code": "{!! $comment->body !!}",
      "description": "Stored XSS via unescaped database content",
      "remediation": "Use {{ }} for auto-escaping or sanitize on save"
    }
  ],
  "summary": {
    "total": 3,
    "critical": 1,
    "high": 2,
    "medium": 0,
    "low": 0
  }
}