From 27ec3a807fbf2aab033dccdd64c97b0ba1bc22ae Mon Sep 17 00:00:00 2001
From: Ian Gallagher <crash@neg9.org>
Date: Wed, 26 Feb 2014 16:50:58 -0800
Subject: [PATCH 1/3] Increase portability of shebang line   * Use env(1) to
 find python executable instead of hardcoding the path of /usr/bin/python

---
 EyeWitness.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/EyeWitness.py b/EyeWitness.py
index ac948e53..568de4e2 100755
--- a/EyeWitness.py
+++ b/EyeWitness.py
@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python
 
 """
  This script's inspiration was Tim Tomes's web screenshotting script PeepingTom
@@ -406,4 +406,4 @@ def fileNames(url_given):
             page_append.write(link_text)
             page_append.close()
 
-    print "\n[*] Done! Check out the report in the " + report_folder + " folder!"
\ No newline at end of file
+    print "\n[*] Done! Check out the report in the " + report_folder + " folder!"

From 3c25a4bf9d181d5cd6f4bc56a961372a2a437917 Mon Sep 17 00:00:00 2001
From: Ian Gallagher <crash@neg9.org>
Date: Wed, 26 Feb 2014 16:52:09 -0800
Subject: [PATCH 2/3] Fix the column headers (web screenshot/req info were
 swapped)

---
 EyeWitness.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/EyeWitness.py b/EyeWitness.py
index 568de4e2..914a5d86 100755
--- a/EyeWitness.py
+++ b/EyeWitness.py
@@ -214,8 +214,8 @@ def webHeader():
     web_index_head += "<center>Report Generated on " + report_date + " at " + report_time
     web_index_head += "<br><table border=\"1\">\n"
     web_index_head += "<tr>\n"
-    web_index_head += "<th>Web Screenshot</th>\n"
     web_index_head += "<th>Web Request Info</th>\n"
+    web_index_head += "<th>Web Screenshot</th>\n"
     web_index_head += "</tr>\n"
     return web_index_head
 

From dabb0f6473c30b4aabfc28c37869000a242c4c04 Mon Sep 17 00:00:00 2001
From: Ian Gallagher <crash@neg9.org>
Date: Wed, 26 Feb 2014 17:02:28 -0800
Subject: [PATCH 3/3] Add rudimentary XSS protection for request info data   *
 HTML Entity encode header keys and values - these can be malicious data

---
 EyeWitness.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/EyeWitness.py b/EyeWitness.py
index 914a5d86..e75b02e5 100755
--- a/EyeWitness.py
+++ b/EyeWitness.py
@@ -15,6 +15,7 @@
 import sys
 import xml.etree.ElementTree as XMLParser
 import urllib2
+import cgi
 import re
 import logging
 import subprocess
@@ -229,6 +230,10 @@ def fileNames(url_given):
     src_name = pic_name + ".txt"
     pic_name = pic_name + ".png"
     return url_given, src_name, pic_name
+
+def htmlEncode(dangerous_data):
+    encoded = cgi.escape(dangerous_data, quote=True)
+    return encoded
     
 if __name__ == "__main__":
 
@@ -302,7 +307,7 @@ def fileNames(url_given):
 
             try:
                 for key, value in page.headers.items():
-                    web_index += "\n<br><b> " + key.replace("u\'", "") + ":</b> " + value
+                    web_index += "\n<br><b> " + htmlEncode(key.replace("u\'", "")) + ":</b> " + htmlEncode(value)
 
             except AttributeError:
                 web_index += "\n<br><br>Potential blank page or SSL issue with <a href=\"" + url + "\" target=\"_blank\">" + url + "</a>."