diff --git a/index.php b/index.php index 4bb3e3e..95aa37f 100755 --- a/index.php +++ b/index.php @@ -25,6 +25,11 @@ 'enabled' => false, 'webhook_url' => 'https://hooks.slack.com/services/xxxxxxxx/yyyyyyyy/zzzzzzzzzzzzzzzzz', ], + 'telegram' => [ + 'enabled' => false, + 'bot' => '', + 'id' => '', + ], ], ]; @@ -69,7 +74,7 @@ public static function report_sqlite( $config, $t_datas ) { $db->query( "INSERT INTO bxss (id, created_at, datas) VALUES('".$t_datas['id']."', '".$t_datas['date']."', '".base64_encode(json_encode($t_datas))."')" ); } - public static function report_slack( $config, $t_datas ) { + public static function report_slack( $config, $t_datas) { $log = '*'.str_repeat('-',10).' '.$t_datas['date'].' '.str_repeat('-',50)."*\n\n"; if( isset($t_datas['screenshot']) ) { $screenshot = $t_datas['screenshot']; @@ -111,6 +116,43 @@ public static function report_slack( $config, $t_datas ) { curl_setopt( $c, CURLOPT_RETURNTRANSFER, true ); curl_exec( $c ); } + public static function report_telegram( $config, $t_datas) { + $log = "Howdy! Blind xss found\n"; + $log .= "".str_repeat('-',10).' '.$t_datas['date'].' '.str_repeat('-',50)."\n\n"; + if( isset($t_datas['screenshot']) ) { + $screenshot = $t_datas['screenshot']; + unset($t_datas['screenshot']); + } + if( isset($t_datas['document_html']) ) { + $document_html = $t_datas['document_html']; + unset( $t_datas['document_html'] ); + $document_save = $t_datas['document_save']; + unset( $t_datas['document_save'] ); + } + unset( $t_datas['id'] ); + unset( $t_datas['date'] ); + foreach( $t_datas as $k=>$v ) { + $log .= strtoupper( $k )."\n"; + $log .= ''.trim($v)."\n\n"; + } + if( isset($screenshot) ) { + $log .= "SCREENSHOT\n"; + $log .= "" . $screenshot . ""; + } + if( isset($document_html) ) { + $log .= "DOCUMENT\n"; + $log .= "" . $document_save . ""; + } + $t_json = []; + $t_json['text'] = $log; + $c = curl_init(); + curl_setopt( $c, CURLOPT_URL, "https://api.telegram.org/bot" . $config['bot'] . "/sendMessage?chat_id=" . $config["id"] . "&parse_mode=HTML" ); + curl_setopt( $c, CURLOPT_POST, true ); + curl_setopt( $c, CURLOPT_HTTPHEADER, ['Content-type: application/json'] ); + curl_setopt( $c, CURLOPT_POSTFIELDS, json_encode($t_json) ); + curl_setopt( $c, CURLOPT_RETURNTRANSFER, true ); + curl_exec( $c ); + } public static function save_html( $path, $id, $content ) { $path_abs = dirname($_SERVER['SCRIPT_FILENAME']).'/'.trim($path,'/'); if( !is_dir($path_abs) ) { @@ -173,7 +215,7 @@ public static function save_screenshot( $path, $id, $content ) { foreach( $_config['report'] as $method=>$config ) { $function = 'report_'.$method; if( method_exists('Reporting',$function) && isset($config['enabled']) && $config['enabled'] ) { - Reporting::$function( $config, $t_datas ); + Reporting::$function( $config, $t_datas); } }