| name | acidrain-security-script-hub |
| description | Web-oriented XSS analysis resources, JavaScript utilities, and PHP examples for authorized security testing and hands-on learning |
| triggers | ["how do I use acidrain for xss testing","set up acidrain security scripts","show me acidrain xss examples","test cross-site scripting with acidrain","acidrain javascript injection samples","configure acidrain php security tests","run acidrain web security analysis","acidrain authorized penetration testing"] |
AcidRain Security Script Hub Skill
Skill by ara.so — Security Skills collection.
What AcidRain Does
AcidRain is a web security toolbox containing XSS injection resources, JavaScript utilities, and PHP examples for authorized security testing, education, and research. It provides browser-side and server-side material organized for experimentation in controlled environments.
Key capabilities:
- XSS analysis and cross-site scripting testing resources
- Client-side JavaScript security utilities
- Server-side PHP research examples
- Injection testing samples for input/output validation
- Web security helper scripts for targeted investigation
⚠️ CRITICAL: Use only against systems you own or have explicit written authorization to test. Unauthorized use is illegal.
Installation
Clone the repository and navigate to the working directory:
git clone https://github.com/henry-lewiskpp1107/acidrain-security-script-hub.git
cd acidrain-security-script-hub
Inspect the directory structure before running any scripts:
ls -la
tree scripts/
Expected structure:
acidrain-security-script-hub/
├── scripts/
│ ├── javascript/
│ ├── php/
│ └── xss/
├── configs/
├── examples/
├── docs/
├── LICENSE
└── README.md
JavaScript Utilities
Basic XSS Payload Testing
Create a test environment HTML file:
<!DOCTYPE html>
<html>
<head>
<title>XSS Test Environment</title>
</head>
<body>
<h1>Authorized Testing Zone</h1>
<div id="output"></div>
<script>
function getTestParameter(name) {
const urlParams = new URLSearchParams(window.location.search);
return urlParams.get(name);
}
function displayUnsafeOutput(input) {
document.getElementById('output').innerHTML = input;
}
const userInput = getTestParameter('test');
if (userInput) {
displayUnsafeOutput(userInput);
}
XSS Detection Script
class XSSDetector {
constructor() {
this.payloads = [
'<script>alert(1)</script>',
'<img src=x onerror=alert(1)>',
'<svg onload=alert(1)>',
'javascript:alert(1)',
'<iframe src="javascript:alert(1)">',
'<body onload=alert(1)>',
'<input autofocus onfocus=alert(1)>',
'"><script>alert(1)</script>'
];
}
testEndpoint(url, params) {
console.log(`Testing: ${url}`);
this.payloads.forEach((payload, index) => {
const testParams = { ...params, test: payload };
const queryString = new URLSearchParams(testParams).toString();
const testUrl = `${url}?${queryString}`;
console.log(`[${index + 1}] Payload: ${payload}`);
console.log(` URL: ${testUrl}`);
});
}
() {
element = .();
element. = input;
element.;
}
() {
dangerous = ;
!dangerous.(html);
}
}
detector = ();
detector.(, { : });
userInput = ;
safe = detector.(userInput);
.(, safe);
DOM-Based XSS Analysis
function analyzeDOMSinks() {
const dangerousSinks = {
'innerHTML': document.querySelectorAll('[id]'),
'eval': 'eval() calls',
'setTimeout': 'setTimeout with string',
'setInterval': 'setInterval with string',
'document.write': 'document.write() calls',
'location': 'location manipulation'
};
console.log('=== DOM XSS Sink Analysis ===');
document.querySelectorAll('*').forEach(el => {
const id = el.id;
if (id) {
console.log(`Found element with ID: ${id}`);
console.log(` - Can be targeted via innerHTML`);
}
});
const sources = {
'location.href': window.location.href,
'location.search': ..,
: ..,
: .
};
.();
.(sources).( {
(value) {
.();
}
});
}
();
PHP Security Testing
Input Validation Testing
<?php
class InputValidator {
public static function testInputs() {
$testCases = [
'<script>alert(1)</script>',
'"><img src=x onerror=alert(1)>',
"'; DROP TABLE users; --",
'../../../etc/passwd',
'${7*7}',
'{{7*7}}'
];
echo "=== Input Validation Tests ===\n\n";
foreach ($testCases as $input) {
echo "Testing: " . $input . "\n";
echo "Sanitized: " . self::sanitize($input) . "\n";
echo "Escaped: " . self::escape($input) . "\n\n";
}
}
public static function sanitize($input) {
return htmlspecialchars($input, ENT_QUOTES, );
}
{
();
}
{
(, FILTER_VALIDATE_EMAIL);
}
{
(, FILTER_VALIDATE_URL);
}
}
::();
XSS Vulnerable Endpoint (Testing Only)
<?php
header('X-Frame-Options: DENY');
header('X-Content-Type-Options: nosniff');
$test_mode = getenv('ACIDRAIN_TEST_MODE');
if ($test_mode !== 'enabled') {
die('Test mode must be explicitly enabled via ACIDRAIN_TEST_MODE=enabled');
}
function displayUnsafe($input) {
return "<div>User input: " . $input . "</div>";
}
function displaySafe($input) {
return "<div>User input: " . htmlspecialchars($input, ENT_QUOTES, 'UTF-8') . "</div>";
}
if (isset($_GET['unsafe'])) {
echo displayUnsafe($_GET['unsafe']);
}
if (isset($_GET['safe'])) {
echo ([]);
}
Secure Form Handler
<?php
class SecureFormHandler {
private $allowedFields = ['name', 'email', 'message'];
private $errors = [];
public function processForm($data) {
$sanitized = [];
foreach ($this->allowedFields as $field) {
if (!isset($data[$field])) {
$this->errors[] = "Missing field: $field";
continue;
}
$value = $data[$field];
$value = trim($value);
$value = stripslashes($value);
$value = htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
if ($field === 'email' && !filter_var(, FILTER_VALIDATE_EMAIL)) {
->errors[] = ;
;
}
[] = ;
}
((->errors)) {
[ => , => ];
}
[ => , => ->errors];
}
{
->errors;
}
}
= ();
= ->();
([]) {
= [];
;
} {
;
([] ) {
;
}
}
Configuration
Environment Setup
Create a .env file in the project root:
ACIDRAIN_TEST_MODE=enabled
ACIDRAIN_TARGET_URL=http://localhost:8000
ACIDRAIN_LOG_LEVEL=debug
ACIDRAIN_REPORT_DIR=./reports
Load environment variables in PHP:
<?php
$dotenv = parse_ini_file('.env');
foreach ($dotenv as $key => $value) {
putenv("$key=$value");
}
$testMode = getenv('ACIDRAIN_TEST_MODE');
$targetUrl = getenv('ACIDRAIN_TARGET_URL');
?>
Test Server Setup
Start a PHP development server for testing:
cd scripts/php
php -S localhost:8000
curl "http://localhost:8000/vulnerable-endpoint.php?safe=<script>test</script>"
Common Testing Patterns
XSS Reflection Testing
function testReflectedXSS(baseUrl, params) {
const payloads = [
'<script>alert(document.domain)</script>',
'<img src=x onerror=alert(1)>',
'"><svg/onload=alert(1)>',
'javascript:alert(1)'
];
payloads.forEach(payload => {
const testParams = { ...params, input: payload };
const url = `${baseUrl}?${new URLSearchParams(testParams)}`;
console.log(`Testing URL: ${url}`);
fetch(url)
.then(response => response.text())
.then(html => {
if (html.includes(payload)) {
console.warn('⚠️ Potential XSS: Payload reflected');
} else {
console.log('✓ Payload sanitized or filtered');
}
});
});
}
testReflectedXSS('http://localhost:8000/test.php', { : });
Stored XSS Testing
<?php
function testStoredXSS($pdo, $payload) {
$stmt = $pdo->prepare("INSERT INTO comments (content) VALUES (?)");
$stmt->execute([$payload]);
$stmt = $pdo->query("SELECT content FROM comments ORDER BY id DESC LIMIT 1");
$comment = $stmt->fetch(PDO::FETCH_ASSOC);
echo "Vulnerable output: " . $comment['content'] . "\n";
echo "Safe output: " . htmlspecialchars($comment['content'], ENT_QUOTES, 'UTF-8') . "\n";
}
$pdo = new PDO(
'sqlite::memory:',
null,
null,
[PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]
);
$pdo->exec("CREATE TABLE comments (id INTEGER PRIMARY KEY, content TEXT)");
(, );
Content Security Policy Testing
async function checkCSP(url) {
try {
const response = await fetch(url);
const csp = response.headers.get('Content-Security-Policy');
if (csp) {
console.log('CSP Header found:', csp);
const directives = csp.split(';').map(d => d.trim());
directives.forEach(directive => {
console.log(` - ${directive}`);
});
if (csp.includes("'unsafe-inline'")) {
console.warn('⚠️ CSP allows unsafe-inline');
}
if (csp.includes("'unsafe-eval'")) {
console.warn('⚠️ CSP allows unsafe-eval');
}
} else {
.();
}
} (error) {
.(, error);
}
}
();
Reporting and Logging
Generate Test Report
<?php
class TestReportGenerator {
private $results = [];
private $reportDir;
public function __construct() {
$this->reportDir = getenv('ACIDRAIN_REPORT_DIR') ?: './reports';
if (!is_dir($this->reportDir)) {
mkdir($this->reportDir, 0755, true);
}
}
public function addResult($testName, $status, $details) {
$this->results[] = [
'timestamp' => date('Y-m-d H:i:s'),
'test' => $testName,
'status' => $status,
'details' => $details
];
}
public function generateReport() {
$filename = $this->reportDir . '/report_' . () . ;
= [
=> (),
=> (->results),
=> ->results
];
(, (, JSON_PRETTY_PRINT));
;
;
}
}
= ();
->(, , );
->(, , );
->();
Troubleshooting
Scripts Not Executing
Issue: PHP scripts return 403 or permission errors
Solution:
chmod +x scripts/php/*.php
chmod 755 scripts/
php --version
php -l scripts/php/your-script.php
CORS Issues with JavaScript
Issue: Browser blocks fetch requests during testing
Solution:
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type');
const proxyUrl = 'http://localhost:8080/';
fetch(proxyUrl + targetUrl);
Test Mode Not Enabled
Issue: Scripts refuse to run vulnerable code
Solution:
export ACIDRAIN_TEST_MODE=enabled
echo "ACIDRAIN_TEST_MODE=enabled" >> .env
php -r "echo getenv('ACIDRAIN_TEST_MODE');"
False Positives in Detection
Issue: XSS detector reports issues on properly sanitized code
Solution:
function validateSanitization(input, output) {
const encoded = input
.replace(/</g, '<')
.replace(/>/g, '>')
.replace(/"/g, '"')
.replace(/'/g, ''');
return output === encoded;
}
Database Connection Errors
Issue: Stored XSS tests fail due to database connection
Solution:
<?php
$pdo = new PDO('sqlite::memory:');
$host = getenv('DB_HOST') ?: 'localhost';
$db = getenv('DB_NAME') ?: 'acidrain_test';
$user = getenv('DB_USER') ?: 'root';
$pass = getenv('DB_PASS') ?: '';
try {
$pdo = new PDO("mysql:host=$host;dbname=$db", $user, $pass);
} catch (PDOException $e) {
die("Database error: " . $e->getMessage());
}
?>
Safety Reminders
- Authorization Required: Only test systems you own or have written permission to test
- Isolated Environment: Use local VMs, containers, or dedicated test infrastructure
- No Production Data: Never test against production systems or real user data
- Document Findings: Keep detailed records of authorized testing activities
- Responsible Disclosure: Report discovered vulnerabilities through proper channels
Best Practices
- Always sanitize user input with
htmlspecialchars() or equivalent
- Implement Content Security Policy headers
- Use prepared statements for database queries
- Validate and whitelist input rather than blacklisting patterns
- Log all testing activities for audit purposes
- Test in isolated environments separate from development/production
- Keep AcidRain updated by pulling latest changes regularly
