Difference between revisions of "OWASP Xenotix XSS Exploit Framework"

From OWASP
Jump to: navigation, search
 
(47 intermediate revisions by 3 users not shown)
Line 1: Line 1:
=Xenotix XSS Exploit Framework 2013 v2=
+
=Main=
http://fbcdn-sphotos-e-a.akamaihd.net/hphotos-ak-prn1/156957_534969326531306_1496797257_n.png
+
{{:Projects/OWASP_Xenotix_XSS_Exploit_Framework}}
+
  
[[Category:OWASP Project]]
+
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>
=Features of Xenotix XSS Exploit Framework=
+
  
# Built in XSS Payloads
+
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
# XSS Key logger
+
| valign="top"  style="border-right: 1px dotted gray;padding-right:20px;" |
# XSS Executable Drive-by downloader
+
# Automatic XSS Testing
+
# XSS Encoder
+
#      XSS Reverse Shell (new)
+
  
=Support us on Facebook=
+
==OWASP Xenotix XSS Exploit Framework 5==
  
[http://https://www.facebook.com/xenotix Xenotix on Facebook]
+
[[Image:XenotixV5.png|left|550px]]
 +
'''OWASP Xenotix XSS Exploit Framework''' is an advanced Cross Site Scripting (XSS) vulnerability detection and exploitation framework. It provides Zero False Positive scan results with its unique Triple Browser Engine (Trident, WebKit, and Gecko) embedded scanner. It is claimed to have the world’s 2nd largest XSS Payloads of about 1600+ distinctive XSS Payloads for effective XSS vulnerability detection and WAF Bypass. Xenotix Scripting Engine allows you to create custom test cases and addons over the Xenotix API. It is incorporated with a feature rich Information Gathering module for target Reconnaissance. The Exploit Framework includes offensive XSS exploitation modules for Penetration Testing and Proof of Concept creation.
  
=White Paper=
 
  
[http://www.exploit-db.com/wp-content/themes/exploit/docs/21223.pdf Download From Exploit-DB]
+
<paypal>OWASP Xenotix XSS Exploit Framework</paypal>
[http://packetstormsecurity.org/files/116455/Detecting-And-Exploiting-XSS-With-Xenotix-XSS-Exploit-Framework.html Download From PacketStorm Security]
+
  
=Videos=
+
== LICENSING ==
 +
OWASP Xenotix XSS Exploit Framework is free to use. It is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.
  
[http://www.youtube.com/watch?v=UyxEV3FLiX8 Xenotix XSS Exploit Framework 2012 Version 2 Tutorial]
 
[http://www.youtube.com/watch?v=ei1ny7L8-8k Xenotix XSS Exploit Framework 2013 Version 3 Tutorial]
 
  
=Download=
+
| valign="top"  style="padding-left:25px;width:175px;border-right: 1px dotted gray;padding-right:25px;" |
  
 +
== PRESENTATIONS ==
  
# Download Version 3  [[File:Xenotix_XSS_Exploit_Framework_2013_v2.zip‎]]
+
'''DEFCON DCG Banglore 2013'''
# Download Version 2  [[File:Xenotix_XSS_Exploitation_Framework.zip]]
+
*Presentation: [http://www.slideshare.net/ajin25/pwning-with-xss-from-alert-to-reverse-shell-defcon-banglore-2013 OWASP Xenotix XSS Exploit Framework v4 ]
  
 +
'''BlackHat Europe Arsenal 2013'''
 +
*Presentation: [https://www.dropbox.com/s/o8adyvtngbszq32/blackhat.zip OWASP Xenotix XSS Exploit Framework v3 ]
  
=IMPORTANT=
+
'''Nulcon Goa 2013'''
 +
*Presentation: [http://www.slideshare.net/ajin25/owasp-xenotix-xss-exploit-framework-v3-nullcon-goa-2013 OWASP Xenotix XSS Exploit Framework v3 ]
 +
'''ClubHack 2012'''
 +
*Presentation: [http://www.slideshare.net/ajin25/xenotix-xss-exploit-framework-clubhack-2012 OWASP Xenotix XSS Exploit Framework v2]
  
The tool may be detected by some Anti-virus solutions as a threat. However it is due to the features in the exploitation framework.
+
== PROJECT LEADER ==
 +
 
 +
Ajin Abraham | [https://twitter.com/ajinabraham @ajinabraham]
 +
 
 +
 
 +
== AWARDS ==
 +
 
 +
[[Image:ToolsWatch.png‎ |180px | thumb | left |link=http://www.toolswatch.org/2013/12/2013-top-security-tools-as-voted-by-toolswatch-org-readers/ | Top 5th Security Tool of 2013]]
 +
[[Image:CSPF.jpg |180px | thumb | left | Recommended by CSPF]]
 +
 
 +
 
 +
 
 +
| valign="top"  style="padding-left:25px;width:175px;" |
 +
 
 +
== QUICK DOWNLOAD ==
 +
 
 +
[[Image:Download.png |200px| link=http://opensecurity.in/downloads/OWASP_Xenotix_XSS_Exploit_Framework_V5.rar]]
 +
 
 +
== NEWS AND EVENTS ==
 +
* [14 Feb 2014] Xenotix XSS Exploit Framework V5 is Released
 +
* [16 Dec 2013] [http://www.toolswatch.org/2013/12/2013-top-security-tools-as-voted-by-toolswatch-org-readers/ Top 5th Security tool of 2013, voted by ToolsWatch Readers]
 +
* [10 Nov 2013] [http://holisticinfosec.org/toolsmith/pdf/november2013.pdf OWASP Xenotix in ISSA Journal]
 +
* [01 Nov 2013] [http://holisticinfosec.blogspot.in/2013/11/toolsmith-owasp-xenotix-xss-exploit.html Toolsmith Tool of the Month]
 +
 
 +
== RELATED PROJECTS ==
 +
 
 +
* [[OWASP_Xelenium_Project]]
 +
* [[ZAP]]
 +
* [[OWASP_XSSER]]
 +
* [[OWASP_AntiSamy_Project]]
 +
 
 +
== CLASSIFICATIONS ==
 +
 
 +
  {| width="200" cellpadding="2"
 +
  |-
 +
  | align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
 +
  | align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]] 
 +
  |-
 +
  | align="center" valign="top" width="50%"| [[File:Owasp-breakers-small.png|link=]]
 +
  |-
 +
  | colspan="2" align="center"  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
 +
  |-
 +
  | colspan="2" align="center"  | [[File:Project_Type_Files_CODE.jpg|link=]]
 +
  |}
 +
 
 +
|}
 +
 
 +
= Features =
 +
 
 +
<div style="font-size:120%;border:none;margin: 0;color:#000">
 +
 
 +
'''SCANNER MODULES'''
 +
 
 +
*GET Request Manual Mode
 +
*GET Request Auto Mode
 +
*DOM Scanner
 +
*Multiple Parameter Scanner
 +
*POST Request Scanner
 +
*Request Repeater
 +
*URL Fuzzer
 +
*Hidden Parameter Detector
 +
 
 +
'''INFORMATION GATHERING MODULES'''
 +
 
 +
*WAF Fingerprinting
 +
*Victim Fingerprinting
 +
*Browser Fingerprinting
 +
*Browser Features Detector
 +
*Get Network IP
 +
*Ping Scan
 +
*Port Scan
 +
*Internal Network Scan
 +
 
 +
'''EXPLOITATION MODULES'''
 +
 
 +
*Send Message
 +
*Cookie Thief
 +
*Phisher
 +
*Tabnabbing
 +
*Keylogger
 +
*HTML5 DDoSer
 +
*Load File
 +
*Grab Page Screenshot
 +
*Gram WebCam Screenshot
 +
*Executable Drive By
 +
*JavaScript Shell
 +
*Reverse HTTP WebShell
 +
*Drive-By Reverse Shell
 +
*Metasploit Browser Exploit
 +
*Firefox Reverse Shell Addon (Persistent)
 +
*Firefox Session Stealer Addon (Persistent)
 +
*Firefox Keylogger Addon (Persistent)
 +
*Firefox DDoSer Addon (Persistent)
 +
*Firefox Linux Credential File Stealer Addon (Persistent)
 +
*Firefox Download and Execute Addon (Persistent)
 +
 
 +
'''UTILITY MODULES'''
 +
*WebKit Developer Tools
 +
*Payload Encoder
 +
*JavaScript Beautify
 +
*Hash Calculator
 +
*Hash Detector
 +
 
 +
'''XENOTIX SCRIPTING ENGINE'''
 +
* Xenotix API
 +
* IronPython Scripting Support
 +
* Trident and Gecko Web Engine Support
 +
 
 +
</div>
 +
 
 +
= Conference Talks =
 +
 
 +
<div style="font-size:120%;border:none;margin: 0;color:#000">
 +
 
 +
''' NULLCON GOA 2013 '''
 +
 
 +
{{#ev:youtube|J1phYXmLX8w}}
 +
 
 +
''' CLUBHACK 2012 '''
 +
 
 +
{{#ev:youtube|NYZLP0q7-y4}}
 +
 
 +
</div>
 +
 
 +
= Screenshots =
 +
 
 +
{|
 +
|-
 +
|
 +
[[Image:POST_SCANNER.png|500px|thumb|right|Xenotix POST Request Scanner]]
 +
|
 +
[[Image:XENOTIX INFO.png|500px|thumb|left|Xenotix Information Gathering Modules]]
 +
|-
 +
|
 +
[[Image:XENOTIX EXPLOITATION.png|thumb|500px|right|Xenotix Exploitation Modules]]
 +
|
 +
[[Image:Scripting.png|thumb|500px|left|Xenotix Scripting Engine]]
 +
|}
 +
 
 +
=Downloads=
 +
 
 +
<div style="font-size:120%;border:none;margin: 0;color:#000">
 +
 
 +
====IMPORTANT====
 +
Antivirus Solutions may detect it as a threat. However it is due to the features in the exploitation framework.
 +
 
 +
====Latest Release====
 +
 
 +
[[Image:Download.png | 200px | link=http://opensecurity.in/downloads/OWASP_Xenotix_XSS_Exploit_Framework_V5.rar]]
 +
 
 +
Requirements
 +
* Microsoft .NET Framework 4.0 http://www.microsoft.com/en-in/download/details.aspx?id=17718
 +
* IronPython 2.7.3 http://ironpython.codeplex.com/downloads/get/423690
 +
====Older Versions====
 +
*Version 4.5 http://opensecurity.in/downloads/Xenotix_XSS_Exploit_Framework_v4.5.rar
 +
*Version 4 https://www.dropbox.com/s/ookdse6pyszh736/Xenotix%20XSS%20Exploit%20Framework%20V4.rar
 +
*Version 3 https://www.owasp.org/index.php/File:OWASP_Xenotix_XSS_Exploit_Framework_v3_2013.zip
 +
*Version 2 https://www.owasp.org/index.php/File:Xenotix_XSS_Exploit_Framework_2013_v2.zip
 +
*Version 1 https://www.owasp.org/index.php/File:Xenotix_XSS_Exploitation_Framework.zip
 +
====Source====
 +
* GitHub https://github.com/ajinabraham/OWASP-Xenotix-XSS-Exploit-Framework/
 +
</div>
 +
= Documentation =
 +
 
 +
<div style="font-size:120%;border:none;margin: 0;color:#000">
 +
 
 +
'''Version 5 Videos'''
 +
 
 +
{{#ev:youtube|loZSdedJnqc}}
 +
 
 +
'''Version 4.5 Videos'''
 +
 
 +
{{#ev:youtube|jm1-_nTlhzY}}
 +
 
 +
 
 +
'''Version 4 Videos'''
 +
 
 +
{{#ev:youtube|dCo5BCJWOdA}}
 +
 
 +
 
 +
'''Version 3 Videos'''
 +
 
 +
{{#ev:youtube|CJEgO4_kd-8}}
 +
{{#ev:youtube|owfF9C_Xerw}}
 +
{{#ev:youtube|i8c3kf4t6A8}}
 +
{{#ev:youtube|IT-8IH3yRrA}}
 +
{{#ev:youtube|cgLGgVWvi9Y}}
 +
 
 +
 
 +
</div>
 +
 
 +
= Roadmap =
 +
 
 +
<div style="font-size:120%;border:none;margin: 0;color:#000">
 +
==V5 Changes==
 +
* Xenotix Scripting Engine
 +
* Xenotix API
 +
* V4.5 Bug Fixes
 +
* GET Network IP (Information Gathering)
 +
* QR Code Generator for Xenotix xook
 +
* HTML5 WebCam Screenshot(Exploitation Module)
 +
* HTML5 Get Page Screenshot (Exploitation Module)
 +
* Find Feature in View Source.
 +
* Improved Payload Count to 1630
 +
* Name Changes
 +
 +
==V4.5 Changes==
 +
 
 +
* JavaScript Beautifier
 +
* Pause and Resume support for Scan
 +
* Jump to Payload
 +
* Cookie Support for POST Request
 +
* Cookie Support and Custom Headers for Header Scanner
 +
* Added TRACE method Support
 +
* Improved Interface
 +
* Better Proxy Support
 +
* WAF Fingerprinting
 +
* Load Files <exploitation module>
 +
* Hash Calculator
 +
* Hash Detector
 +
</div>
 +
 
 +
= Get Involved =
 +
 
 +
<div style="font-size:120%;border:none;margin: 0;color:#000">
 +
 
 +
Involvement in the development of Xenotix is highly encouraged!
 +
 
 +
Here are some of the ways you can help:
 +
 
 +
==Support Us==
 +
 
 +
*Facebook Page: [https://www.facebook.com/xenotix Xenotix on Facebook]
 +
*Official Page: [[http://www.opensecurity.in/owasp-xenotix-xss-exploit-framework-v4-2013  Xenotix @ OpenSecurity]]
 +
 
 +
==Feedback & Queries==
 +
 
 +
* Do you have any issues with it?
 +
* Do you find any design flows or errors?
 +
* Do you need help in using it?
 +
* Do you have something to tell about it?
 +
 
 +
Then please use this form: https://docs.google.com/forms/d/1RpUhQvuHGvPTl7Gi-EXzecidGvJwKpsRaY9-MeXm1ro/viewform
 +
 
 +
==Development==
 +
 
 +
Are you a developer? Do you have some cool ideas to contribute? Get in touch via '''ajin [DOT] abraham [AT] owasp.org'''
 +
If you actively contribute to Xenotix then you will be invited to join the project.
 +
 
 +
</div>
 +
 
 +
=Project About=
 +
<div style="font-size:120%;border:none;margin: 0;color:#000">
 +
 
 +
{{:Projects/OWASP Xenotix XSS Exploit Framework | Project About}}
 +
__NOTOC__ <headertabs />
 +
 
 +
[[Category:OWASP Project]]  [[Category:OWASP_Breakers]] [[Category:OWASP_Defenders]]
 +
[[Category:OWASP_Project|Xenotix XSS Exploit Framework Project]] [[Category:OWASP_Tool]] [[Category:OWASP_Release_Quality_Tool|OWASP Release Quality Tool]] [[Category:OWASP_Download]]

Latest revision as of 06:30, 10 April 2014

[edit]

OWASP Project Header.jpg

OWASP Xenotix XSS Exploit Framework 5

XenotixV5.png

OWASP Xenotix XSS Exploit Framework is an advanced Cross Site Scripting (XSS) vulnerability detection and exploitation framework. It provides Zero False Positive scan results with its unique Triple Browser Engine (Trident, WebKit, and Gecko) embedded scanner. It is claimed to have the world’s 2nd largest XSS Payloads of about 1600+ distinctive XSS Payloads for effective XSS vulnerability detection and WAF Bypass. Xenotix Scripting Engine allows you to create custom test cases and addons over the Xenotix API. It is incorporated with a feature rich Information Gathering module for target Reconnaissance. The Exploit Framework includes offensive XSS exploitation modules for Penetration Testing and Proof of Concept creation.


funds to OWASP earmarked for OWASP Xenotix XSS Exploit Framework.

LICENSING

OWASP Xenotix XSS Exploit Framework is free to use. It is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.


PRESENTATIONS

DEFCON DCG Banglore 2013

BlackHat Europe Arsenal 2013

Nulcon Goa 2013

ClubHack 2012

PROJECT LEADER

Ajin Abraham | @ajinabraham


AWARDS

Top 5th Security Tool of 2013
Recommended by CSPF


QUICK DOWNLOAD

Download.png

NEWS AND EVENTS

RELATED PROJECTS

CLASSIFICATIONS

Owasp-incubator-trans-85.png Owasp-builders-small.png
Owasp-breakers-small.png
Cc-button-y-sa-small.png
Project Type Files CODE.jpg

SCANNER MODULES

  • GET Request Manual Mode
  • GET Request Auto Mode
  • DOM Scanner
  • Multiple Parameter Scanner
  • POST Request Scanner
  • Request Repeater
  • URL Fuzzer
  • Hidden Parameter Detector

INFORMATION GATHERING MODULES

  • WAF Fingerprinting
  • Victim Fingerprinting
  • Browser Fingerprinting
  • Browser Features Detector
  • Get Network IP
  • Ping Scan
  • Port Scan
  • Internal Network Scan

EXPLOITATION MODULES

  • Send Message
  • Cookie Thief
  • Phisher
  • Tabnabbing
  • Keylogger
  • HTML5 DDoSer
  • Load File
  • Grab Page Screenshot
  • Gram WebCam Screenshot
  • Executable Drive By
  • JavaScript Shell
  • Reverse HTTP WebShell
  • Drive-By Reverse Shell
  • Metasploit Browser Exploit
  • Firefox Reverse Shell Addon (Persistent)
  • Firefox Session Stealer Addon (Persistent)
  • Firefox Keylogger Addon (Persistent)
  • Firefox DDoSer Addon (Persistent)
  • Firefox Linux Credential File Stealer Addon (Persistent)
  • Firefox Download and Execute Addon (Persistent)

UTILITY MODULES

  • WebKit Developer Tools
  • Payload Encoder
  • JavaScript Beautify
  • Hash Calculator
  • Hash Detector

XENOTIX SCRIPTING ENGINE

  • Xenotix API
  • IronPython Scripting Support
  • Trident and Gecko Web Engine Support

NULLCON GOA 2013

CLUBHACK 2012

Xenotix POST Request Scanner
Xenotix Information Gathering Modules
Xenotix Exploitation Modules
Xenotix Scripting Engine

Version 5 Videos

Version 4.5 Videos


Version 4 Videos


Version 3 Videos


V5 Changes

  • Xenotix Scripting Engine
  • Xenotix API
  • V4.5 Bug Fixes
  • GET Network IP (Information Gathering)
  • QR Code Generator for Xenotix xook
  • HTML5 WebCam Screenshot(Exploitation Module)
  • HTML5 Get Page Screenshot (Exploitation Module)
  • Find Feature in View Source.
  • Improved Payload Count to 1630
  • Name Changes

V4.5 Changes

  • JavaScript Beautifier
  • Pause and Resume support for Scan
  • Jump to Payload
  • Cookie Support for POST Request
  • Cookie Support and Custom Headers for Header Scanner
  • Added TRACE method Support
  • Improved Interface
  • Better Proxy Support
  • WAF Fingerprinting
  • Load Files <exploitation module>
  • Hash Calculator
  • Hash Detector

Involvement in the development of Xenotix is highly encouraged!

Here are some of the ways you can help:

Support Us

Feedback & Queries

  • Do you have any issues with it?
  • Do you find any design flows or errors?
  • Do you need help in using it?
  • Do you have something to tell about it?

Then please use this form: https://docs.google.com/forms/d/1RpUhQvuHGvPTl7Gi-EXzecidGvJwKpsRaY9-MeXm1ro/viewform

Development

Are you a developer? Do you have some cool ideas to contribute? Get in touch via ajin [DOT] abraham [AT] owasp.org If you actively contribute to Xenotix then you will be invited to join the project.


PROJECT INFO
What does this OWASP project offer you?
RELEASE(S) INFO
What releases are available for this project?
what is this project?
Name: OWASP Xenotix XSS Exploit Framework v4 2013
Purpose: OWASP Xenotix XSS Exploit Framework is an advanced Cross Site Scripting (XSS) vulnerability detection and exploitation framework. It provides Zero False Positive scan results with its unique Triple Browser Engine (Trident, WebKit, and Gecko) embedded scanner. It is claimed to have the world’s 2nd largest XSS Payloads of about 1500+ distinctive XSS Payloads for effective XSS vulnerability detection and WAF Bypass. It is incorporated with a feature rich Information Gathering module for target Reconnaissance. The Exploit Framework includes highly offensive XSS exploitation modules for Penetration Testing and Proof of Concept creation.
License: Creative Commons Attribution ShareAlike 3.0 License
who is working on this project?
Project Leader(s):
  • Ajin Abraham @
how can you learn more?
Project Pamphlet: Not Yet Created
Project Presentation:
Mailing list: Mailing List Archives
Project Roadmap: View
Key Contacts
  • Contact Ajin Abraham @ to contribute to this project
  • Contact Ajin Abraham @ to review or sponsor this project
  • Contact the GPC to report a problem or concern about this project or to update information.
current release
Not Yet Published
last reviewed release
Not Yet Reviewed


other releases