Abusing Trusted Types to discover XSS sinks.
Untrusted Types for DevTools Extension
A sink is a code pattern that could run arbitrary JavaScript code if the input is malicious, for example: innerHTML, eval, document.write.
This extension adds a panel to DevTools where you can see/filter the sink logs and customize settings.
Keywords (by default: \"d0mxss\") that are found to be passed in a sink will be highlighted in the extension and in console.
You can then find the stack trace of a specific log:
1. Click to copy the ID,
2. Open Console>Filter and paste the ID,
3. Now you can inspect the stack trace. Click on the function name to open it in the Sources tab.
Source Manifest.json
How to download and manually install Untrusted Types for DevTools extension for Chrome
Looking for a way to install Untrusted Types for DevTools extensions for Chrome, you can search for them in the Chrome Web Store, clicking the "Add to Chrome" button, and following the straightforward process.
However, you may need to install Untrusted Types for DevTools extensions manually, this article outlines two simple methods to effortlessly install Untrusted Types for DevTools extensions, whether they come as unpacked folders in compressed formats like .zip or as .crx files.
Method 1: Download Untrusted Types for DevTools extension and manually install through Drag &Drop
If you ever need to manually install a Untrusted Types for DevTools extension for Chrome, don't worry, it's a simple process. Just follow these easy steps, and you will have your extension ready to use in no time.
Step 1: Download the Untrusted Types for DevTools Extension by clicking the "Download CRX" button on the website.
Look for the Untrusted Types for DevTools extension you wish to install. Go to the website and download the Untrusted Types for DevTools extension package, which is usually a .CRX file and comes in a zipped file. Here ".crx" file is the format for Untrusted Types for DevTools extension that contains all the data.
Step 2: Extract &Arrange Files
Once the file is downloaded, extract that file into its own folder. Similarly, give that extension files a permanent home. In other words, keep it in a folder that you don't accidentally delete it because these files will be needed to make that extension work.
Step 3: Go to the Chrome Extensions Page
Open Google Chrome and in the address bar, type chrome://extensions; it will open the Google Chrome extensions page. Make sure that "My extensions" is selected in the sidebar.
Step 4: Drag and Drop the Extension
Now, go to the folder where you extracted the Untrusted Types for DevTools extension and drag &drop the extension file from there anywhere onto the extension page within Google Chrome.
Step 5: Complete the Installation
Once you drag and drop the extension file, follow the steps that Google Chrome takes you through. Similarly, if the extension file is of .crx file format, you will be required to review the permissions and then add the extension.
Now, you can manage that added extension as you would like to with any other Chrome extension that you added through Chrome Webstore. Its icon will also appear in the Google Chrome Menu on the right side of the address bar once you activate it.
Method 2: Download Untrusted Types for DevTools extension for Chrome and install in Developer Mode
This is another method to install Untrusted Types for DevTools extension manually, but the twist is that here, you install by enabling the developer mode option provided in Google Chrome. This mode is commonly used for testing extensions or running unpublished tools.
Step 1: Download the Untrusted Types for DevTools extension file
Select and download the Untrusted Types for DevTools extension by clicking the 'Download CRX' button on the website.
Step 2: Extract the downloaded contents
Convert the file to a ZIP file if it is in CRX format then extract the Untrusted Types for DevTools extension zip file or folder that you downloaded. Make sure you extract it using the same folder name and keep it safely in another folder, so you don't delete it by mistake. The extracted folder will be needed to keep your Untrusted Types for DevTools extension running.
Step 3: Open Chrome Extension Setting Page
In the address bar of Google Chrome, type chrome://extensions and open the Chrome Extension Page.
Step 4: Enable Developer Mode
After opening the Chrome Extension page, look at the top right side, and you will find the toggle option of "Developer mode."Simply enable that developer mode option.
Step 5: Load the Unpacked Extension
Once you enable the developer mode option, you will see the menu of Load Unpacked, Pack Extensions and Update. From that, select the option "Load unpacked."
Step 6: Select the Extension Folder
Once the pop-up opens upon clicking Load unpacked, select the Untrusted Types for DevTools extension directory and click on the "Select Folder "button.
Step 7: Confirm and Install
After you select an extension folder of a Google Chrome extension you're installing manually, confirm its installation for the final time and let the installation complete.
Conclusion
Here we've made a step-by-step guide on How to manually install Untrusted Types for DevTools extension in 2 ways. We hope this guide proves helpful.
Similar Extensions
Hack-Tools 1,000+ 27 ★ 1.61MiB
Shodan 1,000+ 136 ★ 27.6KiB
YesWeHack VDP Finder 1,000+ 2 ★ 88.31KiB
HackBar 1,000+ 52 ★ 1.56MiB
CounterXSS 1,000+ 3 ★ 98.96KiB
retire.js 1,000+ 9 ★ 132KiB
Tracy 1,000+ 2 ★ 899KiB
Vulners Web Scanner 1,000+ 20 ★ 534KiB
XSS 1,000+ 6 ★ 232KiB
OWASP Penetration Testing Kit 1,000+ 43 ★ 7.14MiB
Plugin Vulnerabilities 1,000+ 1 ★ 9.98KiB
Bishop Vulnerability Scanner 1,000+ 12 ★ 198KiB
DotGit 1,000+ 12 ★ 147KiB
Breakbot 1,000+ 5 ★ 141KiB
Trufflehog 1,000+ 8 ★ 34.61KiB
DOMLogger++ 1,000+ 4 ★ 652KiB
Display Access Keys 1,000+ 3 ★ 6.56KiB
FindSomething 1,000+ 34 ★ 512KiB
ZoomEye Tools 1,000+ 6 ★ 583KiB
Cyber Web Tools 1,000+ 6 ★ 340KiB
Input hidden Monitor 1,000+ 0 ★ 36.05KiB
h4ck3r 1,000+ 1 ★ 178KiB
d3coder 1,000+ 37 ★ 108KiB
Evil Console 1,000+ 0 ★ 1.76MiB
User reviews
Rizan Fauzi (ID: 000000df4e2dd2b6) Voted 5 ★ - Updated 08/31/2021