Eval Villain nga bemodtwz
Hook native JavaScript functions before page load to see how a website uses them. Narrow down output based on the appearance of URL and session artifacts, user configured strings/regex, blacklists and more.
Që të përdorni këtë zgjerim, ju duhet Firefox-i
Tejtëdhëna Zgjerimi
Foto ekrani
Rreth këtij zgjerimi
Eval Villain hooks JavaScript sinks and monitors input for the presence of strings found in sources. There is no race condition as Eval Villain will hook sinks before they can be used. Sinks will be hooked in all frames and pages unless a target URL pattern is configured.
The default configuration will hook common DOM XSS sinks but Eval Villain can be configured to hook any function. Go to the configuration page and click the icon -> configure to see examples.
When a sink is called, Eval Villain goes through a list of sources and tests input to that function for any occurrence of the sources. Sources include user defined strings or regex (referred to as needles), URL parameters, URL fragments (aka hash), local storage, window name and the user cookie. There is also a blacklist feature to remove commonly occurring false positives. Each of these features can be individually enabled or disabled in the popup menu. When changes are made, the page will need to be refreshed for changes to take effect.
These features make Eval Villain well suited to find DOM XSS, but also to answer other questions about how a web page is functioning. Hooking eval() and dumping input can bypass common obfuscation techniques and even find malware. Hooking decodeURI() with the URL parameter source enabled will give a stack trace that often contains the website's URL parser. Instrumenting the parser can then expose hidden URL parameters. Hooking addEventListener() with the needle "message" will dump the source code and location of post message handlers. Eval Villain allows a lot of configuration options to allow for creative solutions.
Eval Villain will also attempt to recursively decode sources. For example, ad networks often build iframes with encoded HTML hidden in the window name. Eval Villain can detect this behavior and provide both the sink where the HTML lands and an encoder function to encode arbitrary HTML into the frame.
The default configuration will hook common DOM XSS sinks but Eval Villain can be configured to hook any function. Go to the configuration page and click the icon -> configure to see examples.
When a sink is called, Eval Villain goes through a list of sources and tests input to that function for any occurrence of the sources. Sources include user defined strings or regex (referred to as needles), URL parameters, URL fragments (aka hash), local storage, window name and the user cookie. There is also a blacklist feature to remove commonly occurring false positives. Each of these features can be individually enabled or disabled in the popup menu. When changes are made, the page will need to be refreshed for changes to take effect.
These features make Eval Villain well suited to find DOM XSS, but also to answer other questions about how a web page is functioning. Hooking eval() and dumping input can bypass common obfuscation techniques and even find malware. Hooking decodeURI() with the URL parameter source enabled will give a stack trace that often contains the website's URL parser. Instrumenting the parser can then expose hidden URL parameters. Hooking addEventListener() with the needle "message" will dump the source code and location of post message handlers. Eval Villain allows a lot of configuration options to allow for creative solutions.
Eval Villain will also attempt to recursively decode sources. For example, ad networks often build iframes with encoded HTML hidden in the window name. Eval Villain can detect this behavior and provide both the sink where the HTML lands and an encoder function to encode arbitrary HTML into the frame.
Vlerësoni rastin tuaj
LejeMësoni më tepër
Kjo shtesë ka nevojë për:
- Të hyjë në të dhënat tuaja për krejt sajtet
Më tepër të dhëna
- Lidhje shtese
- Version
- 2.9
- Madhësi
- 41,75 KB
- Përditësuar së fundi më
- 8 muaj më parë (22 Sht 2023)
- Kategori të Afërta
- Licencë
- GNU General Public License v3.0
- Rregulla Privatësie
- Lexoni rregullat e privatësisë për këtë shtesë
- Historik Versionesh
- Etiketa
Shtojeni në koleksion
Shënime hedhjeje në qarkullim për 2.9
* Use evSourcer to dynamically add to sources via instrumentation.
* Use evSinker as a dynamic sink to be used with instrumentation.
* EV now warns when it fails to load in a frame.
* Replace console.log with console.info in the web page to avoid the pages logs cluttering up Eval Villain output.
* Use evSinker as a dynamic sink to be used with instrumentation.
* EV now warns when it fails to load in a frame.
* Replace console.log with console.info in the web page to avoid the pages logs cluttering up Eval Villain output.
Më tepër zgjerime nga bemodtwz
- Ende pa vlerësime
- Ende pa vlerësime
- Ende pa vlerësime
- Ende pa vlerësime
- Ende pa vlerësime
- Ende pa vlerësime