browser

Documentation

Index

• func Available() bool
• func FormatConfidence(executed bool) string
• func FormatSeverity(executed bool) string
• type DOMFinding
• type DOMScanner
  • func (s *DOMScanner) ScanCSPT(targetURL string, params []string) []DOMFinding
  • func (s *DOMScanner) ScanCSTI(targetURL string, params []string) []DOMFinding
  • func (s *DOMScanner) ScanDOMClobbering(targetURL string, params []string) []DOMFinding
  • func (s *DOMScanner) ScanDOMXSS(targetURL string, params []string) []DOMFinding
  • func (s *DOMScanner) ScanPostMessage(targetURL string) []DOMFinding
  • func (s *DOMScanner) SetAuth(headers []string, cookies string)

Functions

func Available

func Available() bool

Available checks if chromium is accessible

func FormatConfidence

func FormatConfidence(executed bool) string

FormatConfidence returns confidence string

func FormatSeverity

func FormatSeverity(executed bool) string

FormatSeverity returns severity based on whether XSS executed

Types

type DOMFinding

type DOMFinding struct {
	URL      string
	Param    string
	Sink     string
	Payload  string
	Executed bool
}

DOMFinding represents a client-side XSS finding

type DOMScanner

type DOMScanner struct {
	// contains filtered or unexported fields
}

DOMScanner performs headless browser DOM XSS detection

func (*DOMScanner) ScanCSPT

func (s *DOMScanner) ScanCSPT(targetURL string, params []string) []DOMFinding

ScanCSPT tests for Client-Side Path Traversal: a ../ payload in a parameter that influences a client-side fetch/XHR URL.

func (*DOMScanner) ScanCSTI

func (s *DOMScanner) ScanCSTI(targetURL string, params []string) []DOMFinding

ScanCSTI tests for Client-Side Template Injection (AngularJS, Vue mustache). It injects template expressions and checks whether they are evaluated in the rendered DOM (49 from 7*7) or whether sandbox-escape execution fires.

func (*DOMScanner) ScanDOMClobbering

func (s *DOMScanner) ScanDOMClobbering(targetURL string, params []string) []DOMFinding

ScanDOMClobbering tests whether injected HTML id/name attributes can clobber JavaScript global variables (a sanitizer-bypass primitive).

func (*DOMScanner) ScanDOMXSS

func (s *DOMScanner) ScanDOMXSS(targetURL string, params []string) []DOMFinding

ScanDOMXSS launches headless chromium and tests for DOM-based XSS

func (*DOMScanner) ScanPostMessage

func (s *DOMScanner) ScanPostMessage(targetURL string) []DOMFinding

ScanPostMessage tests for postMessage handlers that do not validate origin. It dispatches a forged-origin message and observes whether a sink fires.

func (*DOMScanner) SetAuth

func (s *DOMScanner) SetAuth(headers []string, cookies string)

SetAuth configures headers and cookies propagated into the browser so DOM scanning works against authenticated pages.