OWASP Xenotix XSS Exploit Framework 6

OWASP Xenotix XSS Exploit Framework is an advanced Cross Site Scripting (XSS) vulnerability detection and exploitation framework. Xenotix provides Zero False Positive XSS Detection by performing the Scan within the browser engines where in real world, payloads get reflected. Xenotix Scanner Module is incorporated with 3 intelligent fuzzers to reduce the scan time and produce better results. If you really don't like the tool logic, then leverage the power of Xenotix API to make the tool work like you wanted it to be. It is claimed to have the world’s 2nd largest XSS Payloads of about 4800+ distinctive XSS Payloads. It is incorporated with a feature rich Information Gathering module for target Reconnaissance. The Exploit Framework includes real world offensive XSS exploitation modules for Penetration Testing and Proof of Concept creation.

Features

SCANNER MODULES

• GET Request Manual Mode
• GET Request Auto Mode
• Multiple Parameter Scanner
• GET Request Fuzzer
• POST Request Fuzzer
• Advanced Request Fuzzer
• OAuth 1.0a Request Scanner
• DOM Scanner
• Hidden Parameter Detector

INFORMATION GATHERING MODULES

• WAF Fingerprinting
• Victim Fingerprinting
  • IP to Location
  • IP to GeoLocation
• Network
  • Network IP (WebRTC)
  • Ping Scan
  • Port Scan
  • Internal Network Scan
• Browser
  • Fingerprinting
  • Features Detector

EXPLOITATION MODULES

• Send Message
• Cookie Thief
• Keylogger
• HTML5 DDoSer
• Load File
• Grab Page Screenshot
• JavaScript Shell
• Reverse HTTP WebShell
• Metasploit Browser Exploit
• Social Engineering
  • Phisher
  • Tabnabbing
  • Live WebCam Screenshot
  • Download Spoofer
  • Geolocation HTML5 API
  • Java Applet Drive-By (Windows)
  • Java Applet Drive-By Reverse Shell (Windows)
  • HTA Network Configuration (Windows, IE)
  • HTA Drive-By (Windows, IE)
  • HTA Drive-By Reverse Shell (Windows, IE)
• Firefox Addons
  • Reverse TCP Shell Addon (Windows, Persistent)
  • Reverse TCP Shell Addon (Linux, Persistent)
  • Session Stealer Addon (Persistent)
  • Keylogger Addon (Persistent)
  • DDoSer Addon (Persistent)
  • Linux Credential File Stealer Addon (Persistent)
  • Drop and Execute Addon (Persistent)

AUXILIARY MODULES

• WebKit Developer Tools
• Encoder/Decoder
• JavaScript Encoders
  • JSFuck 6 Char Encoder
  • jjencode Encoder
  • aaencode Encoder
• JavaScript Beautifier
• Hash Calculator
• Hash Detector
• View Injected JavaScript
• View XSS Payloads

XENOTIX SCRIPTING ENGINE

• Xenotix API
• IronPython Scripting Support
• Trident and Gecko Web Engine Support 

Download OWASP Xenotix XSS Exploit Framework 6

Read More

Xenotix xBOT - A Cross Platform PoC Bot that abuse certain Google Services to implement it's C&C

Xenotix xBOT is a proof of concept cross platform (Linux, Windows, Mac) bot written in Python that abuse certain Google Services to implement Command & Control Center for the botnet. The Google Apps Data API, Google Forms and Google Spreadsheet is abused to implement C2 for a bot network. The Google Forms can act as the C2 for a bot network. All the entries to the Google Form are send to an attached Spreadsheet. Here we can implement a bot that will listen to the Google Data API URL and extract the commands and later send back the response via the same Form. The Google Data API allows us to fetch the contents of a published spreadsheet in a variety of formats. The spreadsheet feeds are fetched in RSS format and will parsed. For implementing the bot we will parse through the source, fetch the commands and do the corresponding operations. xBOT’s communication is encrypted as it uses Google’s own SSL connection and is nowhere affected by any firewalls as it works at Application layer. The botnet’s commands and responses are encrypted with SSL from Google Itself making it harder to sniff the bot’s communications in the network. It is a prototype bot with the bare minimum features of a Typical Bot. The intention of this tool is to give an idea about how Google API’s can be abused for Botnet Implementation.

xBOT COMMANDS

• xSYSINFO : Get System Information
• EXECUTE : Execute a passive system command
• xDOWNLOAD : Download a file from an URL
• xUPLOAD : Upload a file
• xNETWORK : Get network information
• xPORTSCAN : Run a Portscan
• xSCREENSHOT : Grab a Screenshot
• xKILL : Kill and Remove the xBOT.

Download Xenotix xBOT

Read More

OWASP Xenotix XSS Exploit Framework v5

OWASP Xenotix XSS Exploit Framework is an advanced Cross Site Scripting (XSS) vulnerability detection and exploitation framework. It provides Zero False Positive scan results with its unique Triple Browser Engine (Trident, WebKit, and Gecko) embedded scanner. It is claimed to have the world’s 2nd largest XSS Payloads of about 1600+ distinctive XSS Payloads for effective XSS vulnerability detection and WAF Bypass. Xenotix Scripting Engine allows you to create custom test cases and addons over the Xenotix API. It is incorporated with a feature rich Information Gathering module for target Reconnaissance. The Exploit Framework includes offensive XSS exploitation modules for Penetration Testing and Proof of Concept creation.

Following are the V5 Additions

• Xenotix Scripting Engine
• Xenotix API
• V4.5 Bug Fixes
• GET Network IP (Information Gathering)
• QR Code Generator for Xenotix xook
• HTML5 WebCam Screenshot(Exploitation Module)
• HTML5 Get Page Screenshot (Exploitation Module)
• Find Feature in View Source.
• Improved Payload Count to 1630
• Name Changes

Xenotix Scripting Engine and API

This release features the Xenotix Scripting Engine that works on the top of Xenotix API. The Scripting Engine helps you to create tools and test cases on the go based on your requirements. There are situations when you have to go the manual way and since the ruleset set of an automated tool is not applicable in certain situations. Xenotix Scripting Engine powered by Xenotix API come into your rescue. Now you can make sure your tool works based on your requirements. Apply your Python scripting skills on the latest Scripting Engine.

Xenotix API features

• 1630 XSS Detection Payloads.
• An inbuilt GET Request XSS Fuzzer for Intelligent and Fast XSS Vulnerability Detection.
• Analyze Response in Trident and Gecko Web Engines to make sure that there are no false positives.
• Interact with Web Engines from the scope of a Python Script.
• Make GET and POST Requests with one liner codes.

Reguirements

• Microsoft .NET Framework 4.0 http://www.microsoft.com/en-in/download/details.aspx?id=17718
• IronPython 2.7.3 http://ironpython.codeplex.com/downloads/get/423690

Download OWASP Xenotix XSS Exploit Framework v5

Read More

OWASP Xenotix XSS Exploit Framework v4.5

Version 4.5 Additions

• JavaScript Beautifier
• Pause and Resume support for Scan
• Jump to Payload
• Cookie Support for POST Request
• Cookie Support and Custom Headers for Header Scanner
• Added TRACE method Support
• Improved Interface
• Better Proxy Support
• WAF Fingerprinting
• Load Files
• Hash Calculator
• Hash Detector

Download OWASP Xenotix XSS Exploit Framework v4.5

Read More

[OWASP Xenotix XSS Exploit Framework v4 2013] Herramienta para detectar errores de Cross Site Scripting (XSS)

OWASP Xenotix XSS Exploit Framework es un herramienta para detectar errores de Cross Site Scripting (XSS). Xenotic ofrece un scanner triple para los motores de renderizado Trident de IE, WebKit de Chrome, Safari y Opera y Gecko de Mozilla Firefox y tiene más de 1.500 payloads distintivos para detectar eficientemente vulnerabilidades XSS y sobrepasar los WAF más utilizados.

Además, incorpora un módulo de recopilación de información para realizar reconocimiento del objetivo e incluye módulos de explotación ofensivos para realizar pruebas de penetración y pruebas de concepto sobre el mismo.

Módulos de escaneo

• Manual Mode Scanner
• Auto Mode Scanner
• DOM Scanner
• Multiple Parameter Scanner
• POST Request Scanner
• Header Scanner
• Fuzzer
• Hidden Parameter Detector 

Information Gathering

• Victim Fingerprinting
• Browser Fingerprinting
• Browser Features Detector
• Ping Scan
• Port Scan
• Internal Network Scan

Explotación

• Send Message
• Cookie Thief
• Phisher
• Tabnabbing
• Keylogger
• HTML5 DDoSer
• Executable Drive By
• JavaScript Shell
• Reverse HTTP WebShell
• Drive-By Reverse Shell
• Metasploit Browser Exploit
• Firefox Reverse Shell Addon (Persistent)
• Firefox Session Stealer Addon (Persistent)
• Firefox Keylogger Addon (Persistent)
• Firefox DDoSer Addon (Persistent)
• Firefox Linux Credential File Stealer Addon (Persistent)
• Firefox Download and Execute Addon (Persistent)

Utilidades

• WebKit Developer Tools
• Payload Encoder 

Desde aquí se puede descargar el paper de su autor, ver los videos introductorios y la herramienta.

Fuente: http://blog.segu-info.com.ar/

Descargar OWASP Xenotix XSS Exploit Framework

Read More

[Xenotix] XSS Exploit Framework 2013 v2 Released

Xenotix XSS Exploit Framework is a penetration testing tool to detect and exploit XSS vulnerabilities in Web Applications. This tool can inject codes into a webpage which are vulnerable to XSS. It is basically a payload list based XSS Scanner and XSS Exploitation kit. It provides a penetration tester the ability to test all the XSS payloads available in the payload list against a web application to test for XSS vulnerabilities. The tool supports both manual mode and automated time sharing based test modes. The exploitation framework in the tool includes a XSS encoder, a victim side XSS keystroke logger, an Executable Drive-by downloader and a XSS Reverse Shell. These exploitation tools will help the penetration tester to create proof of concept attacks on vulnerable web applications during the creation of a penetration test report.

Features: 

• Built in XSS Payloads
• XSS Key logger
• XSS Executable Drive-by downloader
• Automatic XSS Testing
• XSS Encoder
• XSS Reverse Shell (new)

Download Xenotix XSS Exploit Framework 2013 v2

Read More