toxssin is an open-source penetration testing (https://www.kitploit.com/search/label/Penetration%20Testing) tool that automates the process of exploiting Cross-Site Scripting (XSS) vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool (toxin.js). This project started as (and still is) a research-based creative endeavor to explore the exploitability depth that an XSS vulnerability (https://www.kitploit.com/search/label/Vulnerability) may introduce by using vanilla JavaScript, trusted certificates (https://www.kitploit.com/search/label/Certificates) and cheap tricks.Disclaimer: The project is quite fresh and has not been widely tested. Video Presentation
Find screenshots here (https://github.com/t3l3machus/toxssin/blob/main/Screenshots). Capabilities By default, toxssin intercepts: cookies (if HttpOnly not present), keystrokes, paste events, input change events, file selections, form submissions, server responses, table data (static as well as updates), Most importantly, toxssin: attempts to maintain XSS persistence while the user browses the website by intercepting http requests & responses and re-writing the document, supports session management, meaning that, you can use it to exploit reflected as well as stored XSS, supports custom JS script execution against sessions, automatically logs every session. Installation & Usage git clone https://github.com/t3l3machus/toxssin
cd ./toxssin
pip3 install -r requirements.txt
To start toxssin.py, you will need to supply ssl certificate and private key files. If you don't own a domain with a trusted certificate, you can issue and use self-signed certificates with the following command (although this won't take you far): openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365
It is strongly recommended to run toxssin with a trusted certificate (see How to get a Valid Certificate (https://github.com/t3l3machus/toxssin#How-to-get-a-Valid-Certificate) in this document). That said, you can start the toxssin server like this: # python3 toxssin.py -u https://your.domain.com -c /your/certificate.pem -k /your/privkey.pem
Visit the project's wiki (https://github.com/t3l3machus/toxssin/wiki) for additional information. XSS Exploitation Obstacles In my experience, there are 4 major obstacles when it comes to Cross-Site Scripting attacks attempting to include external JS scripts: the "Mixed Content" error, which can be resolved by serving the JavaScript payload via https (even with a self-signed certificate). the "NET::ERR_CERT_AUTHORITY_INVALID" error, which indicates that the server's certificate is untrusted / expired and can be bypassed by using a certificate issued by a trusted Authority. Cross-origin resource sharing (CORS), which is handled appropriately by the toxssin server. Content-Security-Policy header with the script-src set to specific domain(s) only will block scripts with cross-domain src from loading. Toxssin relies on the eval() function to deliver its poison, so, if the website has a CSP and the unsafe-eval source expression is not specified in the script-src directive, the attack will most likely fail (i'm working on a second poison delivery method to work around this). Note: The "Mixed Content" error can of course occur when the target website is hosted via http and the JavaScript payload via https. This limits the scope of toxssin to https only webistes, as (by default) toxssin is started with ssl only. How to get a Valid Certificate First, you need to own a domain name. The fastest and most economic way to get one (in my knowledge) is via a cheap domain registrar service (e.g. https://www.namecheap.com/). Search for a random string domain name (e.g. "fvcm98duf") and check the less popular TLDs, like .xyz, as they will probably cost around 3$ per year. After you purchase a domain name, you can use
___________________________
@hacking_Attack
@Hacking_Video
Find screenshots here (https://github.com/t3l3machus/toxssin/blob/main/Screenshots). Capabilities By default, toxssin intercepts: cookies (if HttpOnly not present), keystrokes, paste events, input change events, file selections, form submissions, server responses, table data (static as well as updates), Most importantly, toxssin: attempts to maintain XSS persistence while the user browses the website by intercepting http requests & responses and re-writing the document, supports session management, meaning that, you can use it to exploit reflected as well as stored XSS, supports custom JS script execution against sessions, automatically logs every session. Installation & Usage git clone https://github.com/t3l3machus/toxssin
cd ./toxssin
pip3 install -r requirements.txt
To start toxssin.py, you will need to supply ssl certificate and private key files. If you don't own a domain with a trusted certificate, you can issue and use self-signed certificates with the following command (although this won't take you far): openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365
It is strongly recommended to run toxssin with a trusted certificate (see How to get a Valid Certificate (https://github.com/t3l3machus/toxssin#How-to-get-a-Valid-Certificate) in this document). That said, you can start the toxssin server like this: # python3 toxssin.py -u https://your.domain.com -c /your/certificate.pem -k /your/privkey.pem
Visit the project's wiki (https://github.com/t3l3machus/toxssin/wiki) for additional information. XSS Exploitation Obstacles In my experience, there are 4 major obstacles when it comes to Cross-Site Scripting attacks attempting to include external JS scripts: the "Mixed Content" error, which can be resolved by serving the JavaScript payload via https (even with a self-signed certificate). the "NET::ERR_CERT_AUTHORITY_INVALID" error, which indicates that the server's certificate is untrusted / expired and can be bypassed by using a certificate issued by a trusted Authority. Cross-origin resource sharing (CORS), which is handled appropriately by the toxssin server. Content-Security-Policy header with the script-src set to specific domain(s) only will block scripts with cross-domain src from loading. Toxssin relies on the eval() function to deliver its poison, so, if the website has a CSP and the unsafe-eval source expression is not specified in the script-src directive, the attack will most likely fail (i'm working on a second poison delivery method to work around this). Note: The "Mixed Content" error can of course occur when the target website is hosted via http and the JavaScript payload via https. This limits the scope of toxssin to https only webistes, as (by default) toxssin is started with ssl only. How to get a Valid Certificate First, you need to own a domain name. The fastest and most economic way to get one (in my knowledge) is via a cheap domain registrar service (e.g. https://www.namecheap.com/). Search for a random string domain name (e.g. "fvcm98duf") and check the less popular TLDs, like .xyz, as they will probably cost around 3$ per year. After you purchase a domain name, you can use
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.
certbot (Let's Encrypt) to get a trusted certificate in 5 minutes or less: Append an A record to your Domain's DNS settings so that it points to your server ip, Follow certbots official instructions (https://certbot.eff.org/instructions). Tip: Don't install and run certbot on your own, you might get unexpected errors. Stick with the instructions. Changelog 2022-06-19 - Added the exec prompt command (you can now execute custom JS scripts against a session).
2022-06-23 - I added two simple, dirty scripts as templates for testing the exec prompt command. I also fixed the cmd prompt's backward history access and made some improvements. Future The idea is to make it sharper, more reliable and expand its capabilities. Currently, i'm working on improving file captures.
Download Toxssin (https://github.com/t3l3machus/toxssin)
___________________________
@hacking_Attack
@Hacking_Video
2022-06-23 - I added two simple, dirty scripts as templates for testing the exec prompt command. I also fixed the cmd prompt's backward history access and made some improvements. Future The idea is to make it sharper, more reliable and expand its capabilities. Currently, i'm working on improving file captures.
Download Toxssin (https://github.com/t3l3machus/toxssin)
___________________________
@hacking_Attack
@Hacking_Video
certbot.eff.org
Certbot Instructions
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
Toxssin - An XSS Exploitation Command-Line Interface And Payload Generator
https://blogger.googleusercontent.com/img/a/AVvXsEhrpuM_fn19iK6x050q5CR92yf8f9nwmwAIJCZfaruivV5I1gdgm_T1HuILTHzF7yg6wjhcraLXVg6qNGblQekqjcGmaIgvvIag8CQiwv3Icg_CKuVK6fuQF1Wxyko4CTSxdE7wzhfKm7YgA4Jh1T1l45anYQAUQRZbIhQ9OCfOs0j7bWETTmVhMNfT=w628-h640 toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting (XSS) vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool (toxin.js).
This project started as (and still is) a research-based creative endeavor to explore the exploitability depth that an XSS vulnerability may introduce by using vanilla JavaScript, trusted certificates and cheap tricks.
Disclaimer: The project is quite fresh and has not been widely tested. Video PresentationFind screenshots here. CapabilitiesBy default, toxssin intercepts:
* cookies (if HttpOnly not present),
* keystrokes,
* paste events,
* input change events,
* file selections,
* form submissions,
* server responses,
* table data (static as well as updates),
Most importantly, toxssin:
* attempts to maintain XSS persistence while the user browses the website by intercepting http requests & responses and re-writing the document,
* supports session management, meaning that, you can use it to exploit reflected as well as stored XSS,
* supports custom JS script execution against sessions,
* automatically logs every session. Installation & Usage
If you don't own a domain with a trusted certificate, you can issue and use self-signed certificates with the following command (although this won't take you far):
1. the "Mixed Content" error, which can be resolved by serving the JavaScript payload via https (even with a self-signed certificate).
2. the "NET::ERR_CERT_AUTHORITY_INVALID" error, which indicates that the server's certificate is untrusted / expired and can be bypassed by using a certificate issued by a trusted Authority.
3. Cross-origin resource sharing (CORS), which is handled appropriately by the toxssin server.
4.
Note: The "Mixed Content" error can of course occur when the target website is hosted via http and the JavaScript payload via https. This limits the scope of toxssin to https only webistes, as (by default) toxssin is started with ssl only. How to get a Valid CertificateFirst, you need to own a domain name. The fastest and most economic way to get one (in my knowledge) is via a cheap domain registrar service (e.g. https://www.namecheap.com[...]
___________________________
@hacking_Attack
@Hacking_Video
Toxssin - An XSS Exploitation Command-Line Interface And Payload Generator
https://blogger.googleusercontent.com/img/a/AVvXsEhrpuM_fn19iK6x050q5CR92yf8f9nwmwAIJCZfaruivV5I1gdgm_T1HuILTHzF7yg6wjhcraLXVg6qNGblQekqjcGmaIgvvIag8CQiwv3Icg_CKuVK6fuQF1Wxyko4CTSxdE7wzhfKm7YgA4Jh1T1l45anYQAUQRZbIhQ9OCfOs0j7bWETTmVhMNfT=w628-h640 toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting (XSS) vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool (toxin.js).
This project started as (and still is) a research-based creative endeavor to explore the exploitability depth that an XSS vulnerability may introduce by using vanilla JavaScript, trusted certificates and cheap tricks.
Disclaimer: The project is quite fresh and has not been widely tested. Video PresentationFind screenshots here. CapabilitiesBy default, toxssin intercepts:
* cookies (if HttpOnly not present),
* keystrokes,
* paste events,
* input change events,
* file selections,
* form submissions,
* server responses,
* table data (static as well as updates),
Most importantly, toxssin:
* attempts to maintain XSS persistence while the user browses the website by intercepting http requests & responses and re-writing the document,
* supports session management, meaning that, you can use it to exploit reflected as well as stored XSS,
* supports custom JS script execution against sessions,
* automatically logs every session. Installation & Usage
git clone https://github.com/t3l3machus/toxssin
cd ./toxssin
pip3 install -r requirements.txt To start toxssin.py, you will need to supply ssl certificate and private key files.If you don't own a domain with a trusted certificate, you can issue and use self-signed certificates with the following command (although this won't take you far):
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 It is strongly recommended to run toxssin with a trusted certificate (see How to get a Valid Certificate in this document). That said, you can start the toxssin server like this: # python3 toxssin.py -u https://your.domain.com -c /your/certificate.pem -k /your/privkey.pem Visit the project's wiki for additional information. XSS Exploitation ObstaclesIn my experience, there are 4 major obstacles when it comes to Cross-Site Scripting attacks attempting to include external JS scripts:1. the "Mixed Content" error, which can be resolved by serving the JavaScript payload via https (even with a self-signed certificate).
2. the "NET::ERR_CERT_AUTHORITY_INVALID" error, which indicates that the server's certificate is untrusted / expired and can be bypassed by using a certificate issued by a trusted Authority.
3. Cross-origin resource sharing (CORS), which is handled appropriately by the toxssin server.
4.
Content-Security-Policyheader with the script-srcset to specific domain(s) only will block scripts with cross-domain src from loading. Toxssin relies on the eval()function to deliver its poison, so, if the website has a CSP and the unsafe-evalsource expression is not specified in the script-srcdirective, the attack will most likely fail (i'm working on a second poison delivery method to work around this).Note: The "Mixed Content" error can of course occur when the target website is hosted via http and the JavaScript payload via https. This limits the scope of toxssin to https only webistes, as (by default) toxssin is started with ssl only. How to get a Valid CertificateFirst, you need to own a domain name. The fastest and most economic way to get one (in my knowledge) is via a cheap domain registrar service (e.g. https://www.namecheap.com[...]
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Toxssin - An XSS Exploitation Command-Line Interface And Payload Generator
Hacking Articles Tips Tricks Videos Tutorials
KitPloit - PenTest Tools! Toxssin - An XSS Exploitation Command-Line Interface And Payload Generator https://blogger.googleusercontent.com/img/a/AVvXsEhrpuM_fn19iK6x050q5CR92yf8f9nwmwAIJCZfaruivV5I1gdgm_T1HuILTHzF7yg6wjhcraLXVg6qNGblQekqjcGmaIgvvIag8CQiw…
/). Search for a random string domain name (e.g. "fvcm98duf") and check the less popular TLDs, like .xyz, as they will probably cost around 3$ per year.
After you purchase a domain name, you can use certbot (Let's Encrypt) to get a trusted certificate in 5 minutes or less:
1. Append an A record to your Domain's DNS settings so that it points to your server ip,
2. Follow certbots official instructions.
Tip: Don't install and run certbot on your own, you might get unexpected errors. Stick with the instructions. Changelog
___________________________
@hacking_Attack
@Hacking_Video
After you purchase a domain name, you can use certbot (Let's Encrypt) to get a trusted certificate in 5 minutes or less:
1. Append an A record to your Domain's DNS settings so that it points to your server ip,
2. Follow certbots official instructions.
Tip: Don't install and run certbot on your own, you might get unexpected errors. Stick with the instructions. Changelog
2022-06-19- Added the exec prompt command (you can now execute custom JS scripts against a session). 2022-06-23- I added two simple, dirty scripts as templates for testing the exec prompt command. I also fixed the cmd prompt's backward history access and made some improvements. FutureThe idea is to make it sharper, more reliable and expand its capabilities. Currently, i'm working on improving file captures. Download Toxssin___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Advent of Cyber 3 (2021): Day 18 Write-up [TryHackMe]
https://cdn-images-1.medium.com/max/600/1*SRe9N2evKwzQdmtn1pcUvQ.png
Welcome to Day 18 of Advent of Cyber 3 write-up.
Continue reading on DevOps.dev »
___________________________
@hacking_Attack
@Hacking_Video
Advent of Cyber 3 (2021): Day 18 Write-up [TryHackMe]
https://cdn-images-1.medium.com/max/600/1*SRe9N2evKwzQdmtn1pcUvQ.png
Welcome to Day 18 of Advent of Cyber 3 write-up.
Continue reading on DevOps.dev »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Advent of Cyber 3 (2021): Day 18 Write-up [TryHackMe]
Welcome to Day 18 of Advent of Cyber 3 write-up.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Advent of Cyber 3 (2021): Day 19 Write-up [TryHackMe]
https://cdn-images-1.medium.com/max/600/1*gb2A_Oq9x_AfTHw-9ULWug.jpeg
Welcome to Day 19 of Advent of Cyber 3 write-up.
Continue reading on DevOps.dev »
___________________________
@hacking_Attack
@Hacking_Video
Advent of Cyber 3 (2021): Day 19 Write-up [TryHackMe]
https://cdn-images-1.medium.com/max/600/1*gb2A_Oq9x_AfTHw-9ULWug.jpeg
Welcome to Day 19 of Advent of Cyber 3 write-up.
Continue reading on DevOps.dev »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Advent of Cyber 3 (2021): Day 19 Write-up [TryHackMe]
Welcome to Day 19 of Advent of Cyber 3 write-up.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
The number of companies caught up in recent hacks keeps growing
https://cdn-images-1.medium.com/max/800/0*G-AW_Uuz7bh-Dp7I.png
“Authy, LastPass, and DoorDash became a victim of a cyber attack, recently”
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
The number of companies caught up in recent hacks keeps growing
https://cdn-images-1.medium.com/max/800/0*G-AW_Uuz7bh-Dp7I.png
“Authy, LastPass, and DoorDash became a victim of a cyber attack, recently”
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
The number of companies caught up in recent hacks keeps growing
“Authy, LastPass, and DoorDash became a victim of a cyber attack, recently”
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Bandit Level (1–10) : OverTheWire
https://cdn-images-1.medium.com/max/1236/1*9s25lEeu-QFYGQaxBfIKaw.png
CTF Practice : Solution and explanation
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Bandit Level (1–10) : OverTheWire
https://cdn-images-1.medium.com/max/1236/1*9s25lEeu-QFYGQaxBfIKaw.png
CTF Practice : Solution and explanation
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Bandit Level (1–10) : OverTheWire
CTF Practice : Solution and explanation
Redline Stealer
https://medium.com/@rangerwooz/redline-stealer-89623ceff9f5?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@rangerwooz/redline-stealer-89623ceff9f5?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Redline Stealer
The Redline Stealer
The Redline StealerContinue reading on Medium » (https://medium.com/@rangerwooz/redline-stealer-89623ceff9f5?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Redline Stealer
The Redline Stealer
Server Side Request Forgery (SSRF) Attacks
https://medium.com/@rajeevranjancom/server-side-request-forgery-ssrf-attacks-e8bdc5e17a68?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@rajeevranjancom/server-side-request-forgery-ssrf-attacks-e8bdc5e17a68?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Server Side Request Forgery (SSRF) Attacks
Server-side request forgery (SSRF) attacks exploit software vulnerabilities that could allow an attacker to trick the server-side…
Server-side request forgery (SSRF) attacks exploit software vulnerabilities that could allow an attacker to trick the server-side…Continue reading on Medium » (https://medium.com/@rajeevranjancom/server-side-request-forgery-ssrf-attacks-e8bdc5e17a68?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Server Side Request Forgery (SSRF) Attacks
Server-side request forgery (SSRF) attacks exploit software vulnerabilities that could allow an attacker to trick the server-side…
Unsubscribe any user’s e-mail notifications via IDOR
https://sagarsajeev.medium.com/unsubscribe-any-users-e-mail-notifications-via-idor-2c2e05b79dac?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://sagarsajeev.medium.com/unsubscribe-any-users-e-mail-notifications-via-idor-2c2e05b79dac?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Unsubscribe any user’s e-mail notifications via IDOR
IDOR allows attacker to unsubscribe any user from the Websites email service.