OWASP Xenotix XSS Exploit Framework

=Main=



{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
 * valign="top" style="border-right: 1px dotted gray;padding-right:20px;" |

OWASP Xenotix XSS Exploit Framework 5
OWASP Xenotix XSS Exploit Framework is an advanced Cross Site Scripting (XSS) vulnerability detection and exploitation framework. It provides Zero False Positive scan results with its unique Triple Browser Engine (Trident, WebKit, and Gecko) embedded scanner. It is claimed to have the world’s 2nd largest XSS Payloads of about 1600+ distinctive XSS Payloads for effective XSS vulnerability detection and WAF Bypass. Xenotix Scripting Engine allows you to create custom test cases and addons over the Xenotix API. It is incorporated with a feature rich Information Gathering module for target Reconnaissance. The Exploit Framework includes offensive XSS exploitation modules for Penetration Testing and Proof of Concept creation.

OWASP Xenotix XSS Exploit Framework

LICENSING
OWASP Xenotix XSS Exploit Framework is free to use. It is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.


 * valign="top" style="padding-left:25px;width:175px;border-right: 1px dotted gray;padding-right:25px;" |

PRESENTATIONS
DEFCON DCG Banglore 2013
 * Presentation: OWASP Xenotix XSS Exploit Framework v4

BlackHat Europe Arsenal 2013
 * Presentation: OWASP Xenotix XSS Exploit Framework v3

Nulcon Goa 2013 ClubHack 2012
 * Presentation: OWASP Xenotix XSS Exploit Framework v3
 * Presentation: OWASP Xenotix XSS Exploit Framework v2

PROJECT LEADER
Ajin Abraham | @ajinabraham

AWARDS



 * valign="top" style="padding-left:25px;width:175px;" |

NEWS AND EVENTS

 * [14 Feb 2014] Xenotix XSS Exploit Framework V5 is Released
 * [16 Dec 2013] Top 5th Security tool of 2013, voted by ToolsWatch Readers
 * [10 Nov 2013] OWASP Xenotix in ISSA Journal
 * [01 Nov 2013] Toolsmith Tool of the Month

RELATED PROJECTS

 * OWASP_Xelenium_Project
 * ZAP
 * OWASP_XSSER

Ohloh

 * https://www.ohloh.net/p/OWASP-Xenotix-XSS-Exploit-Framework

CLASSIFICATIONS

 * }

= Features =

SCANNER MODULES


 * GET Request Manual Mode
 * GET Request Auto Mode
 * DOM Scanner
 * Multiple Parameter Scanner
 * POST Request Scanner
 * Request Repeater
 * URL Fuzzer
 * Hidden Parameter Detector

INFORMATION GATHERING MODULES


 * WAF Fingerprinting
 * Victim Fingerprinting
 * Browser Fingerprinting
 * Browser Features Detector
 * Get Network IP
 * Ping Scan
 * Port Scan
 * Internal Network Scan

EXPLOITATION MODULES


 * Send Message
 * Cookie Thief
 * Phisher
 * Tabnabbing
 * Keylogger
 * HTML5 DDoSer
 * Load File
 * Grab Page Screenshot
 * Gram WebCam Screenshot
 * Executable Drive By
 * JavaScript Shell
 * Reverse HTTP WebShell
 * Drive-By Reverse Shell
 * Metasploit Browser Exploit
 * Firefox Reverse Shell Addon (Persistent)
 * Firefox Session Stealer Addon (Persistent)
 * Firefox Keylogger Addon (Persistent)
 * Firefox DDoSer Addon (Persistent)
 * Firefox Linux Credential File Stealer Addon (Persistent)
 * Firefox Download and Execute Addon (Persistent)

UTILITY MODULES
 * WebKit Developer Tools
 * Payload Encoder
 * JavaScript Beautify
 * Hash Calculator
 * Hash Detector

XENOTIX SCRIPTING ENGINE
 * Xenotix API
 * IronPython Scripting Support
 * Trident and Gecko Web Engine Support

= Conference Talks =

 NULLCON GOA 2013 

 CLUBHACK 2012 

= Screenshots =

=Downloads=

IMPORTANT
Antivirus Solutions may detect it as a threat. However it is due to the features in the exploitation framework.

Latest Release
MD5: bdfce2d4af4012ecc20b86bed876a54a

Requirements

 * Microsoft .NET Framework 4.0 http://www.microsoft.com/en-in/download/details.aspx?id=17718
 * IronPython 2.7.3 http://ironpython.codeplex.com/downloads/get/423690

Older Versions

 * Version 4.5 http://opensecurity.in/downloads/Xenotix_XSS_Exploit_Framework_v4.5.rar
 * Version 4 https://www.dropbox.com/s/ookdse6pyszh736/Xenotix%20XSS%20Exploit%20Framework%20V4.rar
 * Version 3 https://www.owasp.org/index.php/File:OWASP_Xenotix_XSS_Exploit_Framework_v3_2013.zip
 * Version 2 https://www.owasp.org/index.php/File:Xenotix_XSS_Exploit_Framework_2013_v2.zip
 * Version 1 https://www.owasp.org/index.php/File:Xenotix_XSS_Exploitation_Framework.zip

Source
= Documentation =
 * GitHub https://github.com/ajinabraham/OWASP-Xenotix-XSS-Exploit-Framework/

Version 5 Videos

Version 4.5 Videos

Version 4 Videos

Version 3 Videos

= Roadmap =

V5 Changes

 * Xenotix Scripting Engine
 * Xenotix API
 * V4.5 Bug Fixes
 * GET Network IP (Information Gathering)
 * QR Code Generator for Xenotix xook
 * HTML5 WebCam Screenshot(Exploitation Module)
 * HTML5 Get Page Screenshot (Exploitation Module)
 * Find Feature in View Source.
 * Improved Payload Count to 1630
 * Name Changes

V4.5 Changes

 * JavaScript Beautifier
 * Pause and Resume support for Scan
 * Jump to Payload
 * Cookie Support for POST Request
 * Cookie Support and Custom Headers for Header Scanner
 * Added TRACE method Support
 * Improved Interface
 * Better Proxy Support
 * WAF Fingerprinting
 * Load Files
 * Hash Calculator
 * Hash Detector

= XSS Protection Cheat Sheet =



The Ultimate XSS Protection Cheat Sheet for Developers is a compilation of information available on XSS Protection from various organization, researchers, websites, and from our own experience. This document follows a simple language and justifying explanations that helps a developer to implement the correct XSS defense and to build a secure web application that prevents XSS vulnerability and Post XSS attacks. It will also discuss about the existing methods or functions provided by various programming languages to mitigate XSS vulnerability. This document will be updated regularly in order to include updated and correct in information in the domain of XSS Protection.

VIEW: THE ULTIMATE XSS PROTECTION CHEAT SHEET FOR DEVELOPERS

= Get Involved =

Involvement in the development of Xenotix is highly encouraged!

Here are some of the ways you can help:

Support Us

 * Facebook Page: Xenotix on Facebook
 * Official Page: [Xenotix @ OpenSecurity]

Feedback & Queries

 * Do you have any issues with it?
 * Do you find any design flows or errors?
 * Do you need help in using it?
 * Do you have something to tell about it?

Then please use this form: https://docs.google.com/forms/d/1RpUhQvuHGvPTl7Gi-EXzecidGvJwKpsRaY9-MeXm1ro/viewform

Development
Are you a developer? Do you have some cool ideas to contribute? Get in touch via ajin [DOT] abraham [AT] owasp.org If you actively contribute to Xenotix then you will be invited to join the project.

=Project About=