https://github.com/fyxme/blistener

Blind-XSS listener with payloads to the target user's browser data including cookies, local/session storage, html code, screenshot of current page (HTTP listener optionally)
https://github.com/fyxme/blistener

blind-xss golang http http-listener javascript listener payloads xss

Last synced: 8 days ago
JSON representation

Blind-XSS listener with payloads to the target user's browser data including cookies, local/session storage, html code, screenshot of current page (HTTP listener optionally)

• Host: GitHub
• URL: https://github.com/fyxme/blistener
• Owner: fyxme
• Created: 2021-08-08T10:56:44.000Z (over 3 years ago)
• Default Branch: master
• Last Pushed: 2024-10-10T20:13:30.000Z (6 months ago)
• Last Synced: 2025-04-14T23:06:01.613Z (8 days ago)
• Topics: blind-xss, golang, http, http-listener, javascript, listener, payloads, xss
• Language: Go
• Homepage:
• Size: 4.24 MB
• Stars: 8
• Watchers: 1
• Forks: 1
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• WebHackersWeapons - blistener - XSS listener with payloads||[`xss`](/categorize/tags/xss.md) [`blind-xss`](/categorize/tags/blind-xss.md)|[](/categorize/langs/Go.md)| (Weapons / Tools)

README

        
# Blistener (Blind-XSS listener)

Code was written quickly during a CTF and should probably be refactored. Not going to change it for now since it's working. I'll refactor when I add new features to it.

It has 2 exploits, one which will take all data available on the page including the html code and the other which will also take a screenshot of the page as well as all the data on the page.

## Compiling

```

go build blistener.go

```

## Usage

1. Create an output directory where the listener will store html code and png images from the xss pages it identifies

2. Start the listener:

```

./blistener

```

3. Use one of the payloads to trigger an XSS 

## Exploit strings

```

# The normal payloads will grab all content from the page including the html source

# The extended payloads do the same as the normal payloads except that they also take a screenshot of the page 

# You call also use a normal request to make sure the XSS can be trigger such as:



# Simple cookie grabber



```

_Note: The listener is on port 8899 by default, change to another port if you need._

## Example trigger

![example trigger](.github/img/example.png)

## Todo

- Add cli flags

- Refactor code