acidrain-security-script-hub

Web-oriented XSS analysis resources, JavaScript utilities, and PHP examples for authorized security testing and hands-on learning

跳到安装

仓库: Aradotso/security-skills
最近来源活动: 2026年8月4日 10:22
检测到的 SKILL.md 语言: 英语
星标: 11
分支: 1

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/Aradotso/security-skills --skill acidrain-security-script-hub

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

ai-security-trainer-2026

Browser-based cybersecurity education platform with guided lessons, quizzes, gamified progression, and adaptive learning scenarios for information security practice.

2026-08-04

avira-security-loader-2026-deployment

Automated Windows bootstrapper for deploying Avira Internet Security 2026 on 64-bit Windows 10/11 systems

2026-08-04

acidrain-security-testing-toolkit

Use AcidRain's XSS analysis resources, JavaScript utilities, and PHP injection testing samples for authorized web security research and learning

2026-08-04

查看这个仓库的全部 Skills

name	acidrain-security-script-hub
description	Web-oriented XSS analysis resources, JavaScript utilities, and PHP examples for authorized security testing and hands-on learning
triggers	["how do I use acidrain for xss testing","set up acidrain security scripts","show me acidrain xss examples","test cross-site scripting with acidrain","acidrain javascript injection samples","configure acidrain php security tests","run acidrain web security analysis","acidrain authorized penetration testing"]

AcidRain Security Script Hub Skill

Skill by ara.so — Security Skills collection.

What AcidRain Does

AcidRain is a web security toolbox containing XSS injection resources, JavaScript utilities, and PHP examples for authorized security testing, education, and research. It provides browser-side and server-side material organized for experimentation in controlled environments.

Key capabilities:

XSS analysis and cross-site scripting testing resources
Client-side JavaScript security utilities
Server-side PHP research examples
Injection testing samples for input/output validation
Web security helper scripts for targeted investigation

⚠️ CRITICAL: Use only against systems you own or have explicit written authorization to test. Unauthorized use is illegal.

Installation

Clone the repository and navigate to the working directory:

git clone https://github.com/henry-lewiskpp1107/acidrain-security-script-hub.git
cd acidrain-security-script-hub

Inspect the directory structure before running any scripts:

ls -la
tree scripts/  # if available

Expected structure:

acidrain-security-script-hub/
├── scripts/
│   ├── javascript/
│   ├── php/
│   └── xss/
├── configs/
├── examples/
├── docs/
├── LICENSE
└── README.md

JavaScript Utilities

Basic XSS Payload Testing

Create a test environment HTML file:

<!DOCTYPE html>
<html>
<head>
    <title>XSS Test Environment</title>
</head>
<body>
    <h1>Authorized Testing Zone</h1>
    <div id="output"></div>
    
    <script>
        // Safe parameter extraction for testing
        function getTestParameter(name) {
            const urlParams = new URLSearchParams(window.location.search);
            return urlParams.get(name);
        }
        
        // Demonstrate unsafe output (for testing only)
        function displayUnsafeOutput(input) {
            document.getElementById('output').innerHTML = input;
        }
        
        // Test XSS vulnerability
        const userInput = getTestParameter('test');
        if (userInput) {
            displayUnsafeOutput(userInput);
        }

XSS Detection Script

// scripts/javascript/xss-detector.js

class XSSDetector {
    constructor() {
        this.payloads = [
            '<script>alert(1)</script>',
            '<img src=x onerror=alert(1)>',
            '<svg onload=alert(1)>',
            'javascript:alert(1)',
            '<iframe src="javascript:alert(1)">',
            '<body onload=alert(1)>',
            '<input autofocus onfocus=alert(1)>',
            '"><script>alert(1)</script>'
        ];
    }
    
    testEndpoint(url, params) {
        console.log(`Testing: ${url}`);
        
        this.payloads.forEach((payload, index) => {
            const testParams = { ...params, test: payload };
            const queryString = new URLSearchParams(testParams).toString();
            const testUrl = `${url}?${queryString}`;
            
            console.log(`[${index + 1}] Payload: ${payload}`);
            console.log(`    URL: ${testUrl}`);
        });
    }
    
    () {
         element = .();
        element. = input;
         element.;
    }
    
    () {
         dangerous = ;
         !dangerous.(html);
    }
}


 detector =  ();
detector.(, { :  });


 userInput = ;
 safe = detector.(userInput);
.(, safe);

DOM-Based XSS Analysis

// scripts/javascript/dom-xss-analyzer.js

function analyzeDOMSinks() {
    const dangerousSinks = {
        'innerHTML': document.querySelectorAll('[id]'),
        'eval': 'eval() calls',
        'setTimeout': 'setTimeout with string',
        'setInterval': 'setInterval with string',
        'document.write': 'document.write() calls',
        'location': 'location manipulation'
    };
    
    console.log('=== DOM XSS Sink Analysis ===');
    
    // Check for innerHTML usage
    document.querySelectorAll('*').forEach(el => {
        const id = el.id;
        if (id) {
            console.log(`Found element with ID: ${id}`);
            console.log(`  - Can be targeted via innerHTML`);
        }
    });
    
    // Monitor location-based sources
    const sources = {
        'location.href': window.location.href,
        'location.search': ..,
        : ..,
        : .
    };
    
    .();
    .(sources).( {
         (value) {
            .();
        }
    });
}


();

PHP Security Testing

Input Validation Testing

<?php
// scripts/php/input-validator.php

class InputValidator {
    
    public static function testInputs() {
        $testCases = [
            '<script>alert(1)</script>',
            '"><img src=x onerror=alert(1)>',
            "'; DROP TABLE users; --",
            '../../../etc/passwd',
            '${7*7}',
            '{{7*7}}'
        ];
        
        echo "=== Input Validation Tests ===\n\n";
        
        foreach ($testCases as $input) {
            echo "Testing: " . $input . "\n";
            echo "Sanitized: " . self::sanitize($input) . "\n";
            echo "Escaped: " . self::escape($input) . "\n\n";
        }
    }
    
    public static function sanitize($input) {
        return htmlspecialchars($input, ENT_QUOTES, );
    }
    
      {
         ();
    }
    
      {
         (, FILTER_VALIDATE_EMAIL);
    }
    
      {
         (, FILTER_VALIDATE_URL);
    }
}


::();

XSS Vulnerable Endpoint (Testing Only)

<?php
// scripts/php/vulnerable-endpoint.php
// WARNING: This is intentionally vulnerable for testing

header('X-Frame-Options: DENY');
header('X-Content-Type-Options: nosniff');

$test_mode = getenv('ACIDRAIN_TEST_MODE');
if ($test_mode !== 'enabled') {
    die('Test mode must be explicitly enabled via ACIDRAIN_TEST_MODE=enabled');
}

// Intentionally vulnerable for testing
function displayUnsafe($input) {
    return "<div>User input: " . $input . "</div>";
}

// Safe version for comparison
function displaySafe($input) {
    return "<div>User input: " . htmlspecialchars($input, ENT_QUOTES, 'UTF-8') . "</div>";
}

if (isset($_GET['unsafe'])) {
    echo displayUnsafe($_GET['unsafe']);
}

if (isset($_GET['safe'])) {
    echo ([]);
}

Secure Form Handler

<?php
// scripts/php/secure-form-handler.php

class SecureFormHandler {
    
    private $allowedFields = ['name', 'email', 'message'];
    private $errors = [];
    
    public function processForm($data) {
        $sanitized = [];
        
        foreach ($this->allowedFields as $field) {
            if (!isset($data[$field])) {
                $this->errors[] = "Missing field: $field";
                continue;
            }
            
            $value = $data[$field];
            
            // Sanitize
            $value = trim($value);
            $value = stripslashes($value);
            $value = htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
            
            // Validate
            if ($field === 'email' && !filter_var(, FILTER_VALIDATE_EMAIL)) {
                ->errors[] = ;
                ;
            }
            
            [] = ;
        }
        
         ((->errors)) {
             [ => ,  => ];
        }
        
         [ => ,  => ->errors];
    }
    
     {
         ->errors;
    }
}


 =  ();
 = ->();

 ([]) {
    
     = [];
     ;
}  {
     ;
     ([]  ) {
         ;
    }
}

Configuration

Environment Setup

Create a .env file in the project root:

# .env
ACIDRAIN_TEST_MODE=enabled
ACIDRAIN_TARGET_URL=http://localhost:8000
ACIDRAIN_LOG_LEVEL=debug
ACIDRAIN_REPORT_DIR=./reports

Load environment variables in PHP:

<?php
// Load configuration
$dotenv = parse_ini_file('.env');
foreach ($dotenv as $key => $value) {
    putenv("$key=$value");
}

$testMode = getenv('ACIDRAIN_TEST_MODE');
$targetUrl = getenv('ACIDRAIN_TARGET_URL');
?>

Test Server Setup

Start a PHP development server for testing:

# Navigate to scripts directory
cd scripts/php

# Start server
php -S localhost:8000

# Test endpoint
curl "http://localhost:8000/vulnerable-endpoint.php?safe=<script>test</script>"

Common Testing Patterns

XSS Reflection Testing

// Test for reflected XSS
function testReflectedXSS(baseUrl, params) {
    const payloads = [
        '<script>alert(document.domain)</script>',
        '<img src=x onerror=alert(1)>',
        '"><svg/onload=alert(1)>',
        'javascript:alert(1)'
    ];
    
    payloads.forEach(payload => {
        const testParams = { ...params, input: payload };
        const url = `${baseUrl}?${new URLSearchParams(testParams)}`;
        
        console.log(`Testing URL: ${url}`);
        
        // In practice, use fetch or automated browser
        fetch(url)
            .then(response => response.text())
            .then(html => {
                if (html.includes(payload)) {
                    console.warn('⚠️ Potential XSS: Payload reflected');
                } else {
                    console.log('✓ Payload sanitized or filtered');
                }
            });
    });
}

// Usage
testReflectedXSS('http://localhost:8000/test.php', { :  });

Stored XSS Testing

<?php
// Test stored XSS vulnerability
function testStoredXSS($pdo, $payload) {
    // Insert test payload
    $stmt = $pdo->prepare("INSERT INTO comments (content) VALUES (?)");
    $stmt->execute([$payload]);
    
    // Retrieve and display (vulnerable)
    $stmt = $pdo->query("SELECT content FROM comments ORDER BY id DESC LIMIT 1");
    $comment = $stmt->fetch(PDO::FETCH_ASSOC);
    
    echo "Vulnerable output: " . $comment['content'] . "\n";
    echo "Safe output: " . htmlspecialchars($comment['content'], ENT_QUOTES, 'UTF-8') . "\n";
}

// Database setup for testing
$pdo = new PDO(
    'sqlite::memory:',
    null,
    null,
    [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]
);

$pdo->exec("CREATE TABLE comments (id INTEGER PRIMARY KEY, content TEXT)");


(, );

Content Security Policy Testing

// Check CSP headers
async function checkCSP(url) {
    try {
        const response = await fetch(url);
        const csp = response.headers.get('Content-Security-Policy');
        
        if (csp) {
            console.log('CSP Header found:', csp);
            
            // Parse directives
            const directives = csp.split(';').map(d => d.trim());
            directives.forEach(directive => {
                console.log(`  - ${directive}`);
            });
            
            // Check for unsafe directives
            if (csp.includes("'unsafe-inline'")) {
                console.warn('⚠️ CSP allows unsafe-inline');
            }
            if (csp.includes("'unsafe-eval'")) {
                console.warn('⚠️ CSP allows unsafe-eval');
            }
        } else {
            .();
        }
    }  (error) {
        .(, error);
    }
}

();

Reporting and Logging

Generate Test Report

<?php
// scripts/php/report-generator.php

class TestReportGenerator {
    private $results = [];
    private $reportDir;
    
    public function __construct() {
        $this->reportDir = getenv('ACIDRAIN_REPORT_DIR') ?: './reports';
        if (!is_dir($this->reportDir)) {
            mkdir($this->reportDir, 0755, true);
        }
    }
    
    public function addResult($testName, $status, $details) {
        $this->results[] = [
            'timestamp' => date('Y-m-d H:i:s'),
            'test' => $testName,
            'status' => $status,
            'details' => $details
        ];
    }
    
    public function generateReport() {
        $filename = $this->reportDir . '/report_' . () . ;
        
         = [
             => (),
             => (->results),
             => ->results
        ];
        
        (, (, JSON_PRETTY_PRINT));
        
         ;
         ;
    }
}


 =  ();
->(, , );
->(, , );
->();

Troubleshooting

Scripts Not Executing

Issue: PHP scripts return 403 or permission errors

Solution:

# Fix file permissions
chmod +x scripts/php/*.php
chmod 755 scripts/

# Check PHP is installed
php --version

# Verify script syntax
php -l scripts/php/your-script.php

CORS Issues with JavaScript

Issue: Browser blocks fetch requests during testing

Solution:

// Add CORS headers in PHP test endpoints
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type');

// Or use a proxy for testing
const proxyUrl = 'http://localhost:8080/';
fetch(proxyUrl + targetUrl);

Test Mode Not Enabled

Issue: Scripts refuse to run vulnerable code

Solution:

# Enable test mode
export ACIDRAIN_TEST_MODE=enabled

# Or in .env
echo "ACIDRAIN_TEST_MODE=enabled" >> .env

# Verify
php -r "echo getenv('ACIDRAIN_TEST_MODE');"

False Positives in Detection

Issue: XSS detector reports issues on properly sanitized code

Solution:

// Improve detection logic
function validateSanitization(input, output) {
    const encoded = input
        .replace(/</g, '&lt;')
        .replace(/>/g, '&gt;')
        .replace(/"/g, '&quot;')
        .replace(/'/g, '&#x27;');
    
    return output === encoded;
}

Database Connection Errors

Issue: Stored XSS tests fail due to database connection

Solution:

<?php
// Use SQLite for isolated testing
$pdo = new PDO('sqlite::memory:');

// Or configure MySQL/PostgreSQL
$host = getenv('DB_HOST') ?: 'localhost';
$db = getenv('DB_NAME') ?: 'acidrain_test';
$user = getenv('DB_USER') ?: 'root';
$pass = getenv('DB_PASS') ?: '';

try {
    $pdo = new PDO("mysql:host=$host;dbname=$db", $user, $pass);
} catch (PDOException $e) {
    die("Database error: " . $e->getMessage());
}
?>

Safety Reminders

Authorization Required: Only test systems you own or have written permission to test
Isolated Environment: Use local VMs, containers, or dedicated test infrastructure
No Production Data: Never test against production systems or real user data
Document Findings: Keep detailed records of authorized testing activities
Responsible Disclosure: Report discovered vulnerabilities through proper channels

Best Practices

Always sanitize user input with htmlspecialchars() or equivalent
Implement Content Security Policy headers
Use prepared statements for database queries
Validate and whitelist input rather than blacklisting patterns
Log all testing activities for audit purposes
Test in isolated environments separate from development/production
Keep AcidRain updated by pulling latest changes regularly

acidrain-security-script-hub

来源信息

安装方式

检查来源文件

同仓库更多 Skills

同仓库更多 Skills

AcidRain Security Script Hub Skill

What AcidRain Does

Installation

JavaScript Utilities

Basic XSS Payload Testing

XSS Detection Script

DOM-Based XSS Analysis

PHP Security Testing

Input Validation Testing

XSS Vulnerable Endpoint (Testing Only)

Secure Form Handler

Configuration

Environment Setup

Test Server Setup

Common Testing Patterns

XSS Reflection Testing

Stored XSS Testing

Content Security Policy Testing

Reporting and Logging

Generate Test Report

Troubleshooting

Scripts Not Executing

CORS Issues with JavaScript

Test Mode Not Enabled

False Positives in Detection

Database Connection Errors

Safety Reminders

Best Practices

AcidRain Security Script Hub Skill

What AcidRain Does

Installation

JavaScript Utilities

Basic XSS Payload Testing

XSS Detection Script

DOM-Based XSS Analysis

PHP Security Testing

Input Validation Testing

XSS Vulnerable Endpoint (Testing Only)

Secure Form Handler

Configuration

Environment Setup

Test Server Setup

Common Testing Patterns

XSS Reflection Testing

Stored XSS Testing

Content Security Policy Testing

Reporting and Logging

Generate Test Report

Troubleshooting

Scripts Not Executing

CORS Issues with JavaScript

Test Mode Not Enabled

False Positives in Detection

Database Connection Errors

Safety Reminders

Best Practices