A tool designed to assist with finding all sinks and sources of a web application and display these results in a digestible manner.
Tracy Extension
* DOM clobbering
* DOM injection
* Frontend template injection
* Backend template injection
* Open redirects
These attack vectors are significantly different than traditional stored and reflected XSS cases and they require new tools for finding them effectively.
Many similar tools only look for server response reflection, however this is not very helpful if all output encoding is performed by the frontend. In order to really gain knowledge about all the true sinks of the application, we need a tool that grants us \"X-ray vision into the DOM\".
This extensions was written with the goal of eliminating XSS by assisting a penetration tester in identifying every source of input into an application and following that input to all of its sinks. These cases are documented and stored as references that can be used to identify the locations of potentially risky input.
Source Manifest.json
"update_url": "https://clients2.google.com/service/update2/crx",
"permissions":["
"storage",
"webRequest"],
"background":{"scripts":["background.bundle.js"]},
"content_scripts":[{"matches":["
"all_frames":true,
"css":["page.css"],
"js":["content.bundle.js"],
"run_at":"document_start"}],
"browser_action":{"default_title":"Tracy",
"default_icon":{"16":"tracy_16x16.png",
"48":"tracy_48x48.png",
"96":"tracy_96x96.png",
"128":"tracy_128x128.png"}},
"web_accessible_resources":["page.bundle.js",
"databaseWorker.bundle.js",
"searchWorker.bundle.js"],
"manifest_version":2,
"name":"Tracy",
"description":"A tool designed to assist with finding all sinks and sources of a web application and display these results in a digestible manner.",
"version":"0.9.2"}
Similar Extensions
Bishop Vulnerability Scanner 582 12 ★ 198KiB
ZoomEye Tools 582 6 ★ 583KiB
Display Access Keys 582 3 ★ 6.56KiB
Untrusted Types for DevTools 582 3 ★ 39.16KiB
HackBar 582 52 ★ 1.56MiB
CounterXSS 582 3 ★ 98.96KiB
Breakbot 582 5 ★ 141KiB
Vulners Web Scanner 582 20 ★ 534KiB
Input hidden Monitor 582 0 ★ 36.05KiB
Plugin Vulnerabilities 582 1 ★ 9.98KiB
Investigate with Lacework 582 0 ★ 17.45KiB
should-i-trust 582 0 ★ 367KiB
Cyber Web Tools 582 6 ★ 340KiB
d3coder 582 37 ★ 108KiB
OWASP Penetration Testing Kit 582 43 ★ 7.14MiB
Shodan 582 136 ★ 27.6KiB
YesWeHack VDP Finder 582 2 ★ 88.31KiB
Hack-Tools 582 27 ★ 1.61MiB
Scripter debugger extension 582 2 ★ 1.04MiB
Pulsedive Threat Intelligence 582 30 ★ 18.48MiB
retire.js 582 9 ★ 132KiB
Hackers toolkit 582 25 ★ 211KiB
IP, DNS & Security Tools | HackerTarget.com 582 31 ★ 94.76KiB
XSS 582 6 ★ 232KiB
User reviews
Mistah Mark (ID: 0000006b5d53133f) Voted 3 ★ - Updated 05/16/2021
Emmanuel Odota (ID: 000000f76d538689) Voted 5 ★ - Updated 07/28/2019