OWASP Xenotix XSS Exploit Framework

OWASP Xenotix XSS Exploit Framework is an advanced Cross Site Scripting (XSS) vulnerability detection and exploitation framework. Xenotix provides Zero False Positive XSS Detection by performing the Scan within the browser engines where in real world, payloads get reflected. Xenotix Scanner Module is incorporated with 3 intelligent fuzzers to reduce the scan time and produce better results. If you really don't like the tool logic, then leverage the power of Xenotix API to make the tool work like you wanted it to be. It is claimed to have the world’s 2nd largest XSS Payloads of about 4800+ distinctive XSS Payloads. It is incorporated with a feature rich Information Gathering module for target Reconnaissance. The Exploit Framework includes real world offensive XSS exploitation modules for Penetration Testing and Proof of Concept creation. Say no to alert pop-ups in PoC. Pen testers can now create appealing Proof of Concepts within few clicks.

<paypal>OWASP Xenotix XSS Exploit Framework</paypal>

LICENSING

OWASP Xenotix XSS Exploit Framework is free to use. It is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

PRESENTATIONS

DEFCON DCG Banglore 2013

Presentation: OWASP Xenotix XSS Exploit Framework v4

BlackHat Europe Arsenal 2013

Presentation: OWASP Xenotix XSS Exploit Framework v3

Nulcon Goa 2013

Presentation: OWASP Xenotix XSS Exploit Framework v3

ClubHack 2012

Presentation: OWASP Xenotix XSS Exploit Framework v2

PROJECT LEADER

Ajin Abraham | @ajinabraham

PROJECT WEBSITE

http://xenotix.in

AWARDS

Top 5th Security Tool of 2014

Top 5th Security Tool of 2013

Recommended by CSPF

QUICK DOWNLOAD

NEWS AND EVENTS

[19 Mar 2014] Xenotix XSS Exploit Framework V6.2 is Released
[14 Jan 2015] Top 5th Security tool of 2014, voted by ToolsWatch Readers
[14 Sept 2014] Xenotix XSS Exploit Framework V6 is Released
[14 Feb 2014] Xenotix XSS Exploit Framework V5 is Released
[16 Dec 2013] Top 5th Security tool of 2013, voted by ToolsWatch Readers
[10 Nov 2013] OWASP Xenotix in ISSA Journal
[01 Nov 2013] Toolsmith Tool of the Month

RELATED PROJECTS

CLASSIFICATIONS

SCANNER MODULES

GET Request Fuzzer
POST Request Fuzzer
Advanced Request Fuzzer
OAuth 1.0a Request Scanner
DOM Scanner
- DOM XSS Analyzer
- Local DOM XSS Analyzer
Hidden Parameter Detector

INFORMATION GATHERING MODULES

WAF Fingerprinting
Victim Fingerprinting
- IP to Location
- IP to GeoLocation
Network
- Network IP (WebRTC)
- Ping Scan
- Port Scan
- Internal Network Scan
Browser
- Fingerprinting
- Features Detector
- HSTS+ CSP Visited Sites Grabber

EXPLOITATION MODULES

Send Message
Cookie Thief
Keylogger
HTML5 DDoSer
Load File
Grab Page Screenshot
JavaScript Shell
Reverse HTTP WebShell
Metasploit Browser Exploit
Social Engineering
- Phisher
- Tabnabbing
- Live WebCam Screenshot
- Download Spoofer
- Geolocation HTML5 API
- Java Applet Drive-By (Windows)
- Java Applet Drive-By Reverse Shell (Windows)
- HTA Network Configuration (Windows, IE)
- HTA Drive-By (Windows, IE)
- HTA Drive-By Reverse Shell (Windows, IE)
Firefox Addons
- Reverse TCP Shell Addon (Windows, Persistent)
- Reverse TCP Shell Addon (Linux, Persistent)
- Session Stealer Addon (Persistent)
- Keylogger Addon (Persistent)
- DDoSer Addon (Persistent)
- Linux Credential File Stealer Addon (Persistent)
- Drop and Execute Addon (Persistent)

AUXILIARY MODULES

WebKit Developer Tools
Encoder/Decoder
JavaScript Encoders
- JSFuck 6 Char Encoder
- jjencode Encoder
- aaencode Encoder
JavaScript Beautifier
Hash Calculator
Hash Detector
View Injected JavaScript
View XSS Payloads

XENOTIX SCRIPTING ENGINE

Xenotix API
IronPython Scripting Support
Trident and Gecko Web Engine Support

NULLCON GOA 2013

CLUBHACK 2012

Xenotix POST Request Scanner	Xenotix Information Gathering Modules
Xenotix Exploitation Modules	Xenotix Scripting Engine

IMPORTANT

Antivirus Solutions may detect it as a threat. However it is due to the features in the exploitation framework.

Latest Release

SHA256: 68096d574aacf51cea46708d473d5c6b13d3b5039c8f3587d2325c9bdefdcbc1

WHAT'S NEW!

V6.2 Changes

Added more Payloads
New Info Gathering Module HSTS+CSP Visited Sites Detection
Bug Fix Hash Calculator
Bug Fix - Get Fuzzer
Bug Fix IP2Geolocation

V6.1 Changes

Bug Fixes
Updated QuickPHP Server
Local DOM XSS Analyzer

V6 Changes

Intelli Fuzzer
Context Based Fuzzer
Blind Fuzzer
HTA Network Configuration
HTA Drive-By
HTA Drive-By Reverse Shell
JSFuck 6 Char Encoder
jjencode Encoder
aaencode Encoder
IP to Location
IP to GeoLocation
IP Hinting
Download Spoofer
HTML5 Geolocation API
Reverse TCP Shell Addon (Linux)
OAuth 1.0a Request Scanner
4800+ Payloads
SSL Error Fixed

V5 Changes

Xenotix Scripting Engine
Xenotix API
V4.5 Bug Fixes
GET Network IP (Information Gathering)
QR Code Generator for Xenotix xook
HTML5 WebCam Screenshot(Exploitation Module)
HTML5 Get Page Screenshot (Exploitation Module)
Find Feature in View Source.
Improved Payload Count to 1630
Name Changes

V4.5 Changes

JavaScript Beautifier
Pause and Resume support for Scan
Jump to Payload
Cookie Support for POST Request
Cookie Support and Custom Headers for Header Scanner
Added TRACE method Support
Improved Interface
Better Proxy Support
WAF Fingerprinting
Load Files <exploitation module>
Hash Calculator
Hash Detector

The Ultimate XSS Protection Cheat Sheet for Developers is a compilation of information available on XSS Protection from various organization, researchers, websites, and from our own experience. This document follows a simple language and justifying explanations that helps a developer to implement the correct XSS defense and to build a secure web application that prevents XSS vulnerability and Post XSS attacks. It will also discuss about the existing methods or functions provided by various programming languages to mitigate XSS vulnerability. This document will be updated regularly in order to include updated and correct in information in the domain of XSS Protection.

VIEW: THE ULTIMATE XSS PROTECTION CHEAT SHEET FOR DEVELOPERS

Xenotix Hoodies

Purchase

Buy Xenotix Hoodies from Paypal BUY NOW

Involvement in the development of Xenotix is highly encouraged!

Here are some of the ways you can help:

Support Us

Twitter Page: Xenotix on Twitter
Facebook Page: Xenotix on Facebook
Official Page: [Xenotix @ OpenSecurity]

Feedback & Queries

Do you have any issues with it?
Do you find any design flows or errors?
Do you need help in using it?
Do you have something to tell about it?

Then please use this form: https://docs.google.com/forms/d/1RpUhQvuHGvPTl7Gi-EXzecidGvJwKpsRaY9-MeXm1ro/viewform

Development

Are you a developer? Do you have some cool ideas to contribute? Get in touch via ajin [DOT] abraham [AT] owasp.org If you actively contribute to Xenotix then you will be invited to join the project.

OWASP Xenotix XSS Exploit Framework