No description, website, or topics provided.
Clone or download
Latest commit 88d9bc7 Jan 9, 2018
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
extension Update angular.js Jan 2, 2018
playground Radar name update/tweaks on Playground Jun 13, 2017
.gitignore .gitignore Jun 8, 2017
CONTRIBUTING.md Edit contrib description Jun 15, 2017
ISSUE_TEMPLATE.md Minor tweaks to issue template Jun 15, 2017
LICENSE.md Switch from plaintext to Markdown Jun 13, 2017
README.md Add link to XSS wiki entry. Jun 20, 2017

README.md

Cross-site scripting discovery
A Chrome extension for fast and easy XSS fuzzing

GitHub issues Twitter


XSS Radar is a tool that detects parameters and fuzzes them for cross-site scripting vulnerabilities.
It's also the first tool developed by the Bug Bounty Forum community!

How do I install it?

At present, we're only supporting the widely used Google Chrome. XSS Radar takes the form of a browser extension, so we hope to support Firefox in the future.

  1. First, git clone https://github.com/bugbountyforum/XSS-Radar
  2. Visit chrome://extensions/
  3. Enable Developer Mode via the checkbox
  4. Select "Load Unpacked Extension"
  5. Finally, locate and select the inner extension folder

How do I use it?

Visit a target page, open the extension and select Fuzz!

Screenshot of extension Fuzz window

Contexts and tests

We've developed contexts – and their respective tests – in a fully modular fashion. By doing so, we've made it easy to contribute new methodologies to Radar's Scanner module.

Contexts are found in contexts.js (inside extension/src/payloads/). Upon fuzzing, the Scanner searches for applicable contexts on the target and deploys the right payloads. For instance, link-based XSS bugs often rely on injection within the href attribute, so we've added a context which specifically matches against these:

{
    'type': 'a', // link/anchor type
    'matches': ['href'], // URI attribute
    'file': 'link.js' // payload file
}

Tests are found within the playground subdirectory. The XSS Playground contains a variety of cross-site scripting scenarios designed to support development and ensure Radar's effectiveness. At present, we test for classic vectors, JavaScript injection, tag breakouts, and templating vulnerabilities.

Payloads

We've integrated the following reflected payload classes. These can be found in extension/src/payloads.

  • AngularJS template injection
    • All versions with a vulnerable Expression Sandbox are supported
  • Link-based URIs
  • Script injections
  • Generic tag strings

Contributors

XSS Radar is a Bug Bounty Forum project with the following contributors. It's community-driven, and we truly appreciate your contributions!

  • Ibram Marzouk
  • Anshuman Bhartiya
  • Rafal Janicki
  • Jack Cable
  • Filipe Reis
  • gradius
  • Olivier beg
  • Yasin Soliman

FAQ

Can I use my own payloads?

Yes, you can add your own payloads in extension/src/payloads.

What types of XSS does XSS Radar detect?

XSS Radar detects reflected XSS. Self-XSS, DOM based XSS and stored XSS cannot be detected with this extension.