Abusing Trusted Types to discover XSS sinks.

Latest Version

Version
1.1.1
Update
October 12, 2021
Size
39.16KiB
Developer
Category
Users
1,000+
Rating
5 ★
Manifest Version
2
Web Store Status
Languages Support
English
See more
Permissions
Storage
WebRequest
WebRequestBlocking
Http://*/*
Https://*/*
See more

Untrusted Types for DevTools Extension

Discover and test inputs passed into sinks that could lead to DOM XSS vulnerabilities.

A sink is a code pattern that could run arbitrary JavaScript code if the input is malicious, for example: innerHTML, eval, document.write.

This extension adds a panel to DevTools where you can see/filter the sink logs and customize settings.

Keywords (by default: \"d0mxss\") that are found to be passed in a sink will be highlighted in the extension and in console.

You can then find the stack trace of a specific log:
1. Click to copy the ID,
2. Open Console>Filter and paste the ID,
3. Now you can inspect the stack trace. Click on the function name to open it in the Sources tab.
Read more

Source Manifest.json

{"update_url": "https://clients2.google.com/service/update2/crx", "name": "Untrusted Types for DevTools", "description": "Abusing Trusted Types to discover XSS sinks.", "version": "1.1.1", "manifest_version": 2, "icons": { "128": "icons/icon128.png" }, "permissions": [ "storage", "webRequest", "webRequestBlocking", "http://*/*", "https://*/*" ], "web_accessible_resources": [ "settings.json" ], "content_scripts": [ { "matches": [ "http://*/*", "https://*/*" ], "all_frames": true, "match_about_blank": true, "run_at": "document_start", "js": [ "build/content.js" ] } ], "devtools_page": "devtools.html", "background": { "scripts": [ "build/background.js" ], "persistent": true }}
Read more

Similar Extensions

icon

Hack-Tools Extension · Developer Tools 1,000+ 27 ★ 1.61MiB

icon

Shodan Extension · Productivity 1,000+ 136 ★ 27.6KiB

icon

YesWeHack VDP Finder Extension · Productivity 1,000+ 2 ★ 88.31KiB

icon

HackBar Extension · Developer Tools 1,000+ 52 ★ 1.56MiB

icon

CounterXSS Extension · Accessibility 1,000+ 3 ★ 98.96KiB

icon

retire.js Extension · Developer Tools 1,000+ 9 ★ 132KiB

icon

Tracy Extension · Developer Tools 1,000+ 2 ★ 899KiB

icon

Vulners Web Scanner Extension · Productivity 1,000+ 20 ★ 534KiB

icon

XSS Extension · Developer Tools 1,000+ 6 ★ 232KiB

icon

OWASP Penetration Testing Kit Extension · Developer Tools 1,000+ 43 ★ 7.14MiB

icon

Plugin Vulnerabilities Extension · Developer Tools 1,000+ 1 ★ 9.98KiB

icon

Bishop Vulnerability Scanner Extension · Developer Tools 1,000+ 12 ★ 198KiB

icon

DotGit Extension · Developer Tools 1,000+ 12 ★ 147KiB

icon

Breakbot Extension · Developer Tools 1,000+ 5 ★ 141KiB

icon

Trufflehog Extension · Developer Tools 1,000+ 8 ★ 34.61KiB

icon

DOMLogger++ Extension · Developer Tools 1,000+ 4 ★ 652KiB

icon

Display Access Keys Extension · Accessibility 1,000+ 3 ★ 6.56KiB

icon

FindSomething Extension · Developer Tools 1,000+ 34 ★ 512KiB

icon

ZoomEye Tools Extension · Developer Tools 1,000+ 6 ★ 583KiB

icon

Cyber Web Tools Extension · Developer Tools 1,000+ 6 ★ 340KiB

icon

Input hidden Monitor Extension · Developer Tools 1,000+ 0 ★ 36.05KiB

icon

h4ck3r Extension · Developer Tools 1,000+ 1 ★ 178KiB

icon

d3coder Extension · Developer Tools 1,000+ 37 ★ 108KiB

icon

Evil Console Extension · Developer Tools 1,000+ 0 ★ 1.76MiB

User reviews

icon

Rizan Fauzi (ID: 000000df4e2dd2b6) Voted 5 ★ - Updated 08/31/2021 fantastic tool! helps me display the xss dom sink in devtools console! Thanks