XSSF v2.1 - Cross-Site Scripting Framework
The Cross-Site Scripting Framework (XSSF) is a security tool designed to turn the XSS vulnerability exploitation task into a much easier work. The XSSF project aims to demonstrate the real dangers of XSS vulnerabilities, vulgarizing their exploitation. This project is created solely for education, penetration testing and lawful research purposes.
XSSF allows creating a communication channel with the targeted browser (from a XSS vulnerability) in order to perform further attacks. Users are free to select existing modules (a module = an attack) in order to target specific browsers.
XSSF provides a powerfull documented API, which facilitates development of modules and attacks. In addition, its integration into the Metasploit Framework allows users to launch MSF browser based exploit easilly from an XSS vulnerability.
In addition, an interesting though exploiting an XSS inside a victim's browser could be to browse website on attacker's browser, using the connected victim's session. In most of cases, simply stealing the victim cookie will be sufficient to realize this action. But in minority of cases (intranets, network tools portals, etc.), cookie won't be useful for an external attacker. That's why XSSF Tunnel was created to help the attacker to help the attacker browsing on affected domain using the victim's session.
Изменения:
- Ruby versions prior to 1.9.* should be working fine with XSSF
- Webrick FileHandler implementation for faster XSSF files resources handler
- Fixed URL with quote character handling bug in tunnel mode since revision 12
- Added check in tunnel mode in order to prevent attacker from loading XSSF script
- Better management with older Ruby versions
- Server port separation between victims (attacks) and attacker resources (GUI + Proxy). Attacker sevices port = Victims services port + 1
- New commands to see logs within console directly
- Removed useless comands firing some bugs sometimes (xssf_test, xssf_logs, xssf_stats, xssf_help). Replaced with xssf_urls
- Better public mode management for GUI and XSSF Tunnel remote access
- Cleaned and modified help files
