Nexus: OWASP Xenotix

OWASP Xenotix XSS Exploit Framework 6

Read

OWASP Xenotix XSS Exploit Framework is an advanced Cross Site Scripting (XSS) vulnerability detection and exploitation framework. Xenotix provides Zero False Positive XSS Detection by performing the Scan within the browser engines where in real world, payloads get reflected. Xenotix Scanner Module is incorporated with 3 intelligent fuzzers to reduce the scan time and produce better results. If you really don't like the tool logic, then leverage the power of Xenotix API to make the tool work like you wanted it to be. It is claimed to have the world’s 2nd largest XSS Payloads of about 4800+ distinctive XSS Payloads. It is incorporated with a feature rich Information Gathering module for target Reconnaissance. The Exploit Framework includes real world offensive XSS exploitation modules for Penetration Testing and Proof of Concept creation.

Features

SCANNER MODULES

GET Request Manual Mode
GET Request Auto Mode
Multiple Parameter Scanner
GET Request Fuzzer
POST Request Fuzzer
Advanced Request Fuzzer
OAuth 1.0a Request Scanner
DOM Scanner
Hidden Parameter Detector

INFORMATION GATHERING MODULES

WAF Fingerprinting
Victim Fingerprinting
- IP to Location
- IP to GeoLocation
Network
- Network IP (WebRTC)
- Ping Scan
- Port Scan
- Internal Network Scan
Browser
- Fingerprinting
- Features Detector

EXPLOITATION MODULES

Send Message
Cookie Thief
Keylogger
HTML5 DDoSer
Load File
Grab Page Screenshot
JavaScript Shell
Reverse HTTP WebShell
Metasploit Browser Exploit
Social Engineering
- Phisher
- Tabnabbing
- Live WebCam Screenshot
- Download Spoofer
- Geolocation HTML5 API
- Java Applet Drive-By (Windows)
- Java Applet Drive-By Reverse Shell (Windows)
- HTA Network Configuration (Windows, IE)
- HTA Drive-By (Windows, IE)
- HTA Drive-By Reverse Shell (Windows, IE)
Firefox Addons
- Reverse TCP Shell Addon (Windows, Persistent)
- Reverse TCP Shell Addon (Linux, Persistent)
- Session Stealer Addon (Persistent)
- Keylogger Addon (Persistent)
- DDoSer Addon (Persistent)
- Linux Credential File Stealer Addon (Persistent)
- Drop and Execute Addon (Persistent)

AUXILIARY MODULES

WebKit Developer Tools
Encoder/Decoder
JavaScript Encoders
- JSFuck 6 Char Encoder
- jjencode Encoder
- aaencode Encoder
JavaScript Beautifier
Hash Calculator
Hash Detector
View Injected JavaScript
View XSS Payloads

XENOTIX SCRIPTING ENGINE

Xenotix API
IronPython Scripting Support
Trident and Gecko Web Engine Support

Download OWASP Xenotix XSS Exploit Framework 6

Read More Add comment

OWASP Xenotix XSS Exploit Framework v5

By 0x000216

Read

0 Comments

OWASP Xenotix XSS Exploit Framework is an advanced Cross Site Scripting (XSS) vulnerability detection and exploitation framework. It provides Zero False Positive scan results with its unique Triple Browser Engine (Trident, WebKit, and Gecko) embedded scanner. It is claimed to have the world’s 2nd largest XSS Payloads of about 1600+ distinctive XSS Payloads for effective XSS vulnerability detection and WAF Bypass. Xenotix Scripting Engine allows you to create custom test cases and addons over the Xenotix API. It is incorporated with a feature rich Information Gathering module for target Reconnaissance. The Exploit Framework includes offensive XSS exploitation modules for Penetration Testing and Proof of Concept creation.

Following are the V5 Additions

Xenotix Scripting Engine
Xenotix API
V4.5 Bug Fixes
GET Network IP (Information Gathering)
QR Code Generator for Xenotix xook
HTML5 WebCam Screenshot(Exploitation Module)
HTML5 Get Page Screenshot (Exploitation Module)
Find Feature in View Source.
Improved Payload Count to 1630
Name Changes

Xenotix Scripting Engine and API

This release features the Xenotix Scripting Engine that works on the top of Xenotix API. The Scripting Engine helps you to create tools and test cases on the go based on your requirements. There are situations when you have to go the manual way and since the ruleset set of an automated tool is not applicable in certain situations. Xenotix Scripting Engine powered by Xenotix API come into your rescue. Now you can make sure your tool works based on your requirements. Apply your Python scripting skills on the latest Scripting Engine.

Xenotix API features

1630 XSS Detection Payloads.
An inbuilt GET Request XSS Fuzzer for Intelligent and Fast XSS Vulnerability Detection.
Analyze Response in Trident and Gecko Web Engines to make sure that there are no false positives.
Interact with Web Engines from the scope of a Python Script.
Make GET and POST Requests with one liner codes.

Reguirements