text: #!/usr/bin/python
  # Cross-Site Tracer v1.3 by 1N3
  # https://crowdshield.com
  #
  # ABOUT: A python script to check remote web servers for Cross-Site Tracing, Cross-Frame Scripting/Clickjacking and Host Header Injection vulnerabilities. For more robust mass scanning, you can create a list of domains or IP addresses to iterate through by doing 'for a in `cat targets.txt`; do ./xsstracer.py $a 80; done;'
  #
  # USAGE: xsstracer.py <IP/host> <port>
  #
  
  import socket, time, sys, getopt, httplib
  
  class bcolors:
      HEADER = '\033[95m'
      OKBLUE = '\033[94m'
      OKGREEN = '\033[92m'
      WARNING = '\033[93m'
      FAIL = '\033[91m'
      ENDC = '\033[0m'
      BOLD = '\033[1m'
      UNDERLINE = '\033[4m'
  
  def main(argv):
  	argc = len(argv)
  
  	if argc <= 2:
  		print bcolors.OKBLUE + "	__  ______ _____ " + bcolors.ENDC
  		print bcolors.OKBLUE + "	\ \/ / ___|_   _|" + bcolors.ENDC
  		print bcolors.OKBLUE + "	 \  /\___ \ | |  " + bcolors.ENDC
  		print bcolors.OKBLUE + "	 /  \ ___) || |  " + bcolors.ENDC
  		print bcolors.OKBLUE + "	/_/\_|____/ |_|  " + bcolors.ENDC
  		print ""
  		print bcolors.OKBLUE + "+ -- --=[Cross-Site Tracer by 1N3 v1.3" + bcolors.ENDC
  		print bcolors.OKBLUE + "+ -- --=[" + bcolors.UNDERLINE + "https://crowdshield.com" + bcolors.ENDC
          	print bcolors.OKBLUE + "+ -- --=[usage: %s <host> <port>" % (argv[0]) + bcolors.ENDC
          	sys.exit(0)
  
  	target = argv[1] # SET TARGET
  	port = argv[2] # SET PORT
  
  	if port == 443:
  		print "Using HTTPS"
  		headers = {
  			'User-Agent': 'XSS Tracer v1.3 by 1N3 @ https://crowdshield.com',
  			'Content-Type': 'application/x-www-form-urlencoded',
  		}
  
  		conn = httplib.HTTPSConnection(host)
  		conn.request("GET", "/", "", headers)
  		response = conn.getresponse()
  		data = response.read()
  
  		print 'Response: ', response.status, response.reason
  		print 'Data:'
  		print data
  
  	else:
  		buffer1 = "TRACE / HTTP/1.1"
  		buffer2 = "Test: <script>alert(1);</script>"
  		buffer3 = "Host: " + target
  
  		buffer4 = "GET / HTTP/1.1"
  
  		print ""
  		print bcolors.OKBLUE + "	__  ______ _____ " + bcolors.ENDC
  		print bcolors.OKBLUE + "	\ \/ / ___|_   _|" + bcolors.ENDC
  		print bcolors.OKBLUE + "	 \  /\___ \ | |  " + bcolors.ENDC
  		print bcolors.OKBLUE + "	 /  \ ___) || |  " + bcolors.ENDC
  		print bcolors.OKBLUE + "	/_/\_|____/ |_|  " + bcolors.ENDC
  		print ""
  		print bcolors.OKBLUE + "+ -- --=[Cross-Site Tracer v1.3 by 1N3 @ CrowdShield" + bcolors.ENDC
  		print bcolors.OKBLUE + "+ -- --=[Target: " + target + ":" + port + bcolors.ENDC
  
  		s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  		result=s.connect_ex((target,int(port)))
  		s.settimeout(1.0)
  
  		if result == 0:
  			s.send(buffer1 + "\n")
  			s.send(buffer2 + "\n")
  			s.send(buffer3 + "\n\n")
  			data1 = s.recv(1024)
  			s.close()
  
  			script = "alert"
  			xframe = "X-Frame-Options"
  			#hsts = "Strict-Transport-Security"
  
  			# TEST FOR XST
  			if script.lower() in data1.lower():
  				print bcolors.FAIL + "+ -- --=[Site vulnerable to Cross-Site Tracing!" + bcolors.ENDC
  
  			else:
  				print bcolors.OKGREEN + "+ -- --=[Site not vulnerable to Cross-Site Tracing!" + bcolors.ENDC
  
  			# TEST FOR HOST HEADER INJECTION
  			frame_inject = "crowdshield"
  			buffer1 = "GET / HTTP/1.1"
  			buffer2 = "Host: http://crowdshield.com"
  
  			s3=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  			result=s3.connect_ex((target,int(port)))
  			s3.settimeout(1.0)
  			s3.send(buffer1 + "\n")
  			s3.send(buffer2 + "\n\n")
  			data3 = s3.recv(1024)
  			s3.close()
  
  			if frame_inject.lower() in data3.lower():
  				print bcolors.FAIL + "+ -- --=[Site vulnerable to Host Header Injection!" + bcolors.ENDC
  
  			else:
  				print bcolors.OKGREEN + "+ -- --=[Site not vulnerable to Host Header Injection!" + bcolors.ENDC
  
  			# TEST FOR CLICKJACKING AND CFS
  			s2=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  			result=s2.connect_ex((target,int(port)))
  			s2.settimeout(1.0)
  			s2.send(buffer4 + "\n")
  			s2.send(buffer3 + "\n\n")
  			data2 = s2.recv(1024)
  			s2.close()
  
  			if xframe.lower() in data2.lower():
  				print bcolors.OKGREEN + "+ -- --=[Site not vulnerable to Cross-Frame Scripting!" + bcolors.ENDC
  				print bcolors.OKGREEN + "+ -- --=[Site not vulnerable to Clickjacking!" + bcolors.ENDC
  
  			else:
  				print bcolors.FAIL + "+ -- --=[Site vulnerable to Cross-Frame Scripting!" + bcolors.ENDC
  				print bcolors.FAIL + "+ -- --=[Site vulnerable to Clickjacking!" + bcolors.ENDC
  		
  			# DISPLAY HEADERS
  			print ""
  			print bcolors.WARNING + data1 + bcolors.ENDC
  			print bcolors.WARNING + data2 + bcolors.ENDC
  			print ""
  			print ""
  
  		else:
  			print bcolors.WARNING + "+ -- --=[Port is closed!" + bcolors.ENDC
  
  main(sys.argv)
  
  