Extensions inspire

XssSniper

4.22222

Details

Author:
0kee Team

Category:
Developer Tools

Version:
1.1.37

Users:
2,000+

Rating:
4.22222

Size:
203KiB

Price:
Free

Updated:
September 27, 2015

Webstore Link:
https://chrome.google.com/webstore/detail/xsssniper/pnhekakhikkhloodcedfcmfpjddcagpi

Download

version 1.1.37  - Download ZIP file

Description

XssSniper是一款为安全人员设计的发现XSS漏洞的工具。可以帮助安全人员发现隐藏于网页中的DomXSS、反射式XSS、JONP XSS以及SOME漏洞。
本扩展主要采用了两种方法去检测DOMXSS。
第一种方法:FUZZ
这种检测方法误报率非常低,只要是检测出来的一定都是都是存在漏洞的。但是代价是漏报率也比较高。 具体来说是在当前页面中创建一个隐形的iframe,在这个iframe中采用不同字符组合截断的payload去fuzz当前页面中的每个url参数,以及location.hash参数。如果payload执行,说明漏洞一定存在。
第二种方法:监控js错误变化
如果xss存在方式比较隐蔽,或者需要非常复杂的字符组合来截断的话,payload是无法正常执行的,然而尽管如此,payload可能会引发一些js语法异常,扩展只需要检测这些异常就可以。然后提示用户错误位置,错误内容,错误的行数,让用户手工去 因此以这种方式检测XSS,漏报少,但是代价是误报较高。
两种检测方式相互结合,取长补短。
更多图文介绍,请见:http://0kee.360.cn/domXss/

Top Extensions

 
(10943)
 
(50577)
 
(98995)
 
(25231)
 
(8324)
 
(1434)
 
(11367)

What has inspired us?

Extore is a team of professionals who are passionate about creating extensions for web browsers. This devotion also gives us opportunity to appreciate work of other people. We get inspired by useful, open source extensions made by developers all over the world. Our strong belief is that one should share helpful add-ons with others. That’s why we’d like to present you our ever-growing list of favourite extensions that have inspired us. Moreover, as you probably have already learned, sometimes struggling for the best brings an end to the good. Talking about add-ons it often turns out that an upgrade is worse then previous version. Also it can become really tricky to get back to the beloved version of your favourite extension. That’s why we’re going to make not only the latest, but all versions of our favourite (and we hope yours too) add-ons available for download. No more compromises, just stick to the version you really like!