- cspt.json: Useful to search for CSPT vulnerabilities in cases of path, query string, or hash reflection within fetch or resource loading.
- dom-invader.json: Inspired by the DOM Invader default configuration. Gathers information about many sinks depending on your canaries.
- leverage-innerHTML.json: Useful to search for gadgets in case of sanitized HTML input.
- leverage-xss.json: Useful to search for gadgets in cases of XSS without impact. The final goal is to poison the browser storage so that the XSS will trigger repeatedly when the victim user navigates to a specific page (e.g., draw.io diagrams backdoor).
- postmessages.json: Used to detect postMessage and onmessage misconfiguration like insecure regex, indexOf origin checks...
configs
Folders and files
| Name | Name | Last commit date | ||
|---|---|---|---|---|
parent directory.. | ||||