diff --git a/js_analyzer.py b/js_analyzer.py index 4f2e5bc..c6a97dc 100644 --- a/js_analyzer.py +++ b/js_analyzer.py @@ -250,10 +250,28 @@ def analyze_response(self, message_info): try: req_info = self._helpers.analyzeRequest(message_info) url = str(req_info.getUrl()) + headers = req_info.getHeaders() + host_header = None + origin_header = None + referer_header = None + for header in headers: + if header.lower().startswith('host:'): + host_header = header.split(':', 1)[1].strip() + if header.lower().startswith('origin:'): + origin_header = header.split(':', 1)[1].strip() + if header.lower().startswith('referer:'): + referer_header = header.split(':', 1)[1].strip() + if not host_header: + host_header = "Unknown" + if not origin_header: + origin_header = "Unknown" + if not referer_header: + referer_header = "Unknown" source_name = url.split('/')[-1].split('?')[0] if '/' in url else url if len(source_name) > 40: source_name = source_name[:40] + "..." - except: + except Exception as e: + self._log("Error getting request info: " + str(e)) url = "Unknown" source_name = "Unknown" @@ -274,7 +292,7 @@ def analyze_response(self, message_info): for match in pattern.finditer(body): value = match.group(1).strip() if self._is_valid_endpoint(value): - finding = self._add_finding("endpoints", value, source_name) + finding = self._add_finding("endpoints", value, source_name, host_header, origin_header, referer_header) if finding: new_findings.append(finding) @@ -283,7 +301,7 @@ def analyze_response(self, message_info): for match in pattern.finditer(body): value = match.group(1).strip() if match.lastindex else match.group(0).strip() if self._is_valid_url(value): - finding = self._add_finding("urls", value, source_name) + finding = self._add_finding("urls", value, source_name, host_header, origin_header, referer_header) if finding: new_findings.append(finding) @@ -293,7 +311,7 @@ def analyze_response(self, message_info): value = match.group(1).strip() if self._is_valid_secret(value): masked = value[:10] + "..." + value[-4:] if len(value) > 20 else value - finding = self._add_finding("secrets", masked, source_name) + finding = self._add_finding("secrets", masked, source_name, host_header, origin_header, referer_header) if finding: new_findings.append(finding) @@ -301,7 +319,7 @@ def analyze_response(self, message_info): for match in EMAIL_PATTERN.finditer(body): value = match.group(1).strip() if self._is_valid_email(value): - finding = self._add_finding("emails", value, source_name) + finding = self._add_finding("emails", value, source_name, host_header, origin_header, referer_header) if finding: new_findings.append(finding) @@ -309,7 +327,7 @@ def analyze_response(self, message_info): for match in FILE_PATTERNS.finditer(body): value = match.group(1).strip() if self._is_valid_file(value): - finding = self._add_finding("files", value, source_name) + finding = self._add_finding("files", value, source_name, host_header, origin_header, referer_header) if finding: new_findings.append(finding) @@ -319,8 +337,8 @@ def analyze_response(self, message_info): self.panel.add_findings(new_findings, source_name) else: self._log("No new findings") - - def _add_finding(self, category, value, source): + + def _add_finding(self, category, value, source, host_header, origin_header, referer_header): """Add a finding if not duplicate.""" key = category + ":" + value if key in self.seen_values: @@ -331,6 +349,9 @@ def _add_finding(self, category, value, source): "category": category, "value": value, "source": source, + "host": host_header, + "origin": origin_header, + "referer": referer_header } self.all_findings.append(finding) return finding diff --git a/ui/results_panel.py b/ui/results_panel.py index b965e0d..b09dda8 100644 --- a/ui/results_panel.py +++ b/ui/results_panel.py @@ -111,7 +111,7 @@ def _init_ui(self): panel = JPanel(BorderLayout()) # 2 columns: Value, Source - columns = ["Value", "Source"] + columns = ["Value", "Source", "Host", "Origin", "Referer"] model = NonEditableTableModel(columns, 0) self.models[key] = model @@ -122,6 +122,9 @@ def _init_ui(self): # Set column widths table.getColumnModel().getColumn(0).setPreferredWidth(500) table.getColumnModel().getColumn(1).setPreferredWidth(150) + table.getColumnModel().getColumn(2).setPreferredWidth(150) + table.getColumnModel().getColumn(3).setPreferredWidth(150) + table.getColumnModel().getColumn(4).setPreferredWidth(150) self.tables[key] = table @@ -144,6 +147,9 @@ def add_findings(self, new_findings, source_name): self.findings[category].append({ "value": finding.get("value", ""), "source": finding.get("source", source_name), + "host": finding.get("host", ""), + "origin": finding.get("origin", ""), + "referer": finding.get("referer", ""), }) self._refresh_tables() @@ -175,6 +181,9 @@ def _refresh_tables(self): model.addRow([ item.get("value", ""), item.get("source", ""), + item.get("host", ""), + item.get("origin", ""), + item.get("referer", ""), ]) count += 1