XSS Radar: detects parameters and fuzzes for finding XSS vulnerability

by do son · Published · Updated

XSS Radar

XSS Radar is a tool that detects parameters and fuzzes them for cross-site scripting vulnerabilities.
It’s also the first tool developed by the Bug Bounty Forum community!

How do I install it?

At present, we’re only supporting the widely used Google Chrome. We hope to support Firefox in the future.

First, git clone https://github.com/bugbountyforum/XSS-Radar

Visit chrome://extensions/

Enable Developer Mode via the checkbox

Select "Load Unpacked Extension"

Finally, locate and select the extension folder

 

How do I use it?

Visit a target page, open the extension and select Fuzz!

Contexts and tests

We’ve developed contexts – and their respective tests – in a fully modular fashion. By doing so, we’ve made it easy to contribute new methodologies to Radar’s Scanner module.

Contexts are found in contexts.js (inside extension/src/payloads/). Upon fuzzing, the Scanner searches for applicable contexts on the target and deploys the right payloads. For instance, link-based XSS bugs often rely on injection within the href attribute, so we’ve added a context which specifically matches against these:

{

    'type': 'a', // link/anchor type

    'matches': ['href'], // URI attribute

    'file': 'link.js' // payload file

}

Tests are found within the playground subdirectory. The XSS Playground contains a variety of cross-site scripting scenarios designed to support the development and ensure Radar’s effectiveness. At present, we test for classic vectors, JavaScript injection, tag breakouts, and templating vulnerabilities.

Payloads

We’ve integrated the following reflected payload classes. These can be found in extension/src/payloads.

  • AngularJS template injection
    • All versions with a vulnerable Expression Sandbox are supported
  • Link-based URIs
  • Script injections
  • Generic tag strings

Demo

Source: Github

Tags: XSSXSS-Radar