Abusing Trusted Types to discover XSS sinks.
Untrusted Types for DevTools Extension
A sink is a code pattern that could run arbitrary JavaScript code if the input is malicious, for example: innerHTML, eval, document.write.
This extension adds a panel to DevTools where you can see/filter the sink logs and customize settings.
Keywords (by default: \"d0mxss\") that are found to be passed in a sink will be highlighted in the extension and in console.
You can then find the stack trace of a specific log:
1. Click to copy the ID,
2. Open Console>Filter and paste the ID,
3. Now you can inspect the stack trace. Click on the function name to open it in the Sources tab.
Source Manifest.json
Similar Extensions
Hack-Tools 1,000+ 27 ★ 1.61MiB
Shodan 1,000+ 136 ★ 27.6KiB
YesWeHack VDP Finder 1,000+ 2 ★ 88.31KiB
HackBar 1,000+ 52 ★ 1.56MiB
CounterXSS 1,000+ 3 ★ 98.96KiB
retire.js 1,000+ 9 ★ 132KiB
Tracy 1,000+ 2 ★ 899KiB
Vulners Web Scanner 1,000+ 20 ★ 534KiB
XSS 1,000+ 6 ★ 232KiB
OWASP Penetration Testing Kit 1,000+ 43 ★ 7.14MiB
Plugin Vulnerabilities 1,000+ 1 ★ 9.98KiB
Bishop Vulnerability Scanner 1,000+ 12 ★ 198KiB
DotGit 1,000+ 12 ★ 147KiB
Breakbot 1,000+ 5 ★ 141KiB
Trufflehog 1,000+ 8 ★ 34.61KiB
DOMLogger++ 1,000+ 4 ★ 652KiB
Display Access Keys 1,000+ 3 ★ 6.56KiB
FindSomething 1,000+ 34 ★ 512KiB
ZoomEye Tools 1,000+ 6 ★ 583KiB
Cyber Web Tools 1,000+ 6 ★ 340KiB
Input hidden Monitor 1,000+ 0 ★ 36.05KiB
h4ck3r 1,000+ 1 ★ 178KiB
d3coder 1,000+ 37 ★ 108KiB
Evil Console 1,000+ 0 ★ 1.76MiB
User reviews
Rizan Fauzi (ID: 000000df4e2dd2b6) Voted 5 ★ - Updated 08/31/2021