Skip to content

Instantly share code, notes, and snippets.

@koto
Created December 1, 2012 22:05
Show Gist options
  • Save koto/4185477 to your computer and use it in GitHub Desktop.
Save koto/4185477 to your computer and use it in GitHub Desktop.
reflected xss detection using xssauditor on phantomjs
var page = require('webpage').create(),
system = require('system'),
address;
page.onInitialized = function () {
page.evaluate(function () {
// additional detection code here perhaps
// f.e. detecting STORED/DOM XSS
});
};
page.settings.XSSAuditingEnabled = true;
// Route "console.log()" calls from within the Page context to the main Phantom context (i.e. current "this")
page.onConsoleMessage = function(msg) {
if (msg.indexOf("Refused to execute a JavaScript script") == 0) {
console.log("XSS!");
}
};
if (system.args.length === 1) {
console.log('Usage: xssdetect.js <some URL>');
phantom.exit(1);
} else {
address = system.args[1];
console.log('Checking ' + address + '...');
page.open(address, function (status) {
if (status !== 'success') {
console.log('FAIL to load the address');
} else {
window.setTimeout(function () {
phantom.exit();
}, 1500);
}
});
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment