thomaspatzke / burp-missingscannerchecks Goto Github PK

README says, "All checks can be enabled separately in an own extension tab and a default config can be stored." But that is not true (in my case at least). In the UI for this extension the "Active Scanner Checks" checkbox is grayed out (and defaults to enabled).

Typo: behaviour should behavior

Browser XXS filter misconfiguration

Issue
No X-XSS-Protection header was set in the response. This means that the browser uses default behaviour that detection of a cross-site scripting attack never prevents rendering.

Seems like it rescans and attaches it without checking for existence :)

X-XSS-Protection is deprecated and counter productive.

• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
• https://owasp.org/www-project-secure-headers/#x-xss-protection

So it should either be suppressed or the check reversed to ensure it is not set.

On line 308 you check that headersXXP[0][0].group(1) is equal to 1 and then check if the same thing is not equal to "block", rather than checking the actual mode value against "block". So effectively, as long as the X-XSS header is set to 1, the "mode" is not actually checked, and an issue will appear stating that the X-XSS protection header is active but not running in block mode.

The fix is to change the second headersXXP[0][0].group(1) to headersXXP[0][0].group(2), so the entire line should read:

elif len(headersXXP) == 1 and int(headersXXP[0][0].group(1)) == 1 and headersXXP[0][0].group(2) != "block":

It's a great extension otherwise! Use it all the time, hence how I found this bug.

Edited to correct a few errors in my explanation.