From b4efc629cc0f0fe967e7671d90a4ad58147ed8a9 Mon Sep 17 00:00:00 2001
From: dror weiss <weissdror354@gmail.com>
Date: Sun, 4 Apr 2021 11:28:35 +0300
Subject: [PATCH] fixxed the issue when the form is using js or redirecting the
 page, the xss might end up in loop

---
 Methods.py     | 18 +++++++++---------
 plugins/xss.py |  4 ++--
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/Methods.py b/Methods.py
index 7244f45..e48a699 100644
--- a/Methods.py
+++ b/Methods.py
@@ -94,26 +94,27 @@ def submit_form(data: Classes.Data, browser: Classes.Browser, inputs: list):
     """
     # In case of multi-threading, we need to make sure that no one is interrupting anyone.
     data.mutex.acquire()
-    # Sending the request.
-    start = time.time()  # Getting time of normal input.
+    # Getting time of normal input.
+    start = time.time()
     # The elements we want to submit.
     elements = list()
     if browser.requests:
         del browser.requests
+    before_submit = browser.page_source  # There are action forms that use js instead of requests.
     for input_tag in inputs:
         if "type" in input_tag.keys() and input_tag['type'] == "hidden":
             continue
         # Using the inserted value.
         if "name" in input_tag.keys():
             # Only if the input has a name attribute.
-            element = browser.find_element_by_name(input_tag["name"])
             try:
+                element = browser.find_element_by_name(input_tag["name"])
                 if input_tag in get_text_inputs(inputs):
                     # You can only send a key to text inputs.
                     element.send_keys(input_tag["value"])
                 elements.append({"element": element,
-                                 "name": input_tag["name"],
-                                 "type": input_tag["type"]})
+                                "name": input_tag["name"],
+                                "type": input_tag["type"]})
             except:
                 # Could not send keys to the form for some reason.
                 continue
@@ -130,17 +131,16 @@ def submit_form(data: Classes.Data, browser: Classes.Browser, inputs: list):
                 continue
             else:
                 break
-        if not len(browser.requests):
+        if not len(browser.requests) and before_submit == browser.page_source:
             # Did not do anything.
             elements[0]["element"].submit()  # Sending the form.
     except Exception as e:
-        if not len(browser.requests):
+        if not len(browser.requests) and before_submit == browser.page_source:
             # Did not do anything.
             raise e
     finally:
         data.mutex.release()
-    run_time = time.time() - start
-    return run_time
+    return time.time() - start
 
 
 def enter_cookies(data: Classes.Data, browser: Classes.Browser, url: str):
diff --git a/plugins/xss.py b/plugins/xss.py
index 529c9c3..1bd819d 100644
--- a/plugins/xss.py
+++ b/plugins/xss.py
@@ -338,8 +338,8 @@ def brute_force_alert(data: Classes.Data, page: Classes.Page, payloads: list):
                 if is_vulnerable:
                     # Page was found to be vulnerable and therefor no need to check.
                     break
-                # Refresh current page to prepare for next iteration.
-                browser.refresh()
+                # Get the current page to prepare for next iteration.
+                browser.get(page.url)
     # Close the webdriver and return results.
     browser.quit()
     return vulnerable_forms