Extends
Methods
append(sufix) → {Wrapper_JS}
Add a sufix to a payload
Parameters
| Name | Type | Description |
|---|---|---|
sufix |
String | Sufix to add to the current payload |
Returns
- Type
- Wrapper_JS
appendScript(selectoropt) → {Wrapper_JS}
Transform any js code into an document.appendChild(script) payload.
Example
const p = Payload.new().eval(() => alert(1))
const w = Wrapper.new().appendScript()
const c = w.wrap(p)
eval(c)Parameters
| Name | Type | Attributes | Default | Description |
|---|---|---|---|---|
selector |
string |
<optional> |
"body" | Css selector for the parent element |
Returns
- Type
- Wrapper_JS
dataUrl() → {Wrapper_JSDataUrl}
Transform any js code into a data: pseudo url.
Example
const p = Payload.new().eval(() => alert(1))
const w = Wrapper.new().dataUrl()
const s = document.createElement('script')
s.src = w.wrap(p)
document.body.appendChild(s)Returns
- Type
- Wrapper_JSDataUrl
dataUrl64() → {Wrapper_JSDataUrl}
Transform any js code into a data: base64 encoded pseudo url.
Example
const p = Payload.new().eval(() => alert(1))
const w = Wrapper.new().dataUrl64()
const s = document.createElement('script')
s.src = w.wrap(p)
document.body.appendChild(s)Returns
- Type
- Wrapper_JSDataUrl
enclose(prefix, sufix) → {Wrapper_JS}
Add a prefix and a sufix to a payload
Parameters
| Name | Type | Description |
|---|---|---|
prefix |
String | Prefix to add to the current payload |
sufix |
String | Sufix to add to the current payload |
Returns
- Type
- Wrapper_JS
evalB64() → {Wrapper_JS}
Transform any js code into an eval(atob()) payload.
Example
const p = Payload.new().eval(() => alert(1))
const w = Wrapper.new().evalB64()
const c = w.wrap(p)
eval(c)Returns
- Type
- Wrapper_JS
evalStringForCharCode() → {Wrapper_JS}
Transform any js code into an eval(String.fromCharCode(42, 42, ...)) payload.
Example
const p = Payload.new().evalStringForCharCode(() => alert(1))
const w = Wrapper.new().evalB64()
const c = w.wrap(p)
eval(c)Returns
- Type
- Wrapper_JS
imgError() → {Wrapper_HTML}
Transform any js code into a <img onerror> payload.
Example
const p = Payload.new().eval(() => alert(1))
const w = Wrapper.new().imgError()
document.body.innerHTML = w.wrap(p)Returns
- Type
- Wrapper_HTML
inputFocus() → {Wrapper_HTML}
Transform any js code into a <input onfocus> payload.
Example
const p = Payload.new().eval(() => alert(1))
const w = Wrapper.new().inputFocus()
document.body.innerHTML = w.wrap(p)Returns
- Type
- Wrapper_HTML
minify()
Minify the js code with uglify-js
Example
const p = Payload.new().eval(() => alert(1))
const w = Wrapper.new().minify()
eval(w.wrap(p))prepend(prefix) → {Wrapper_JS}
Add a prefix to a payload
Parameters
| Name | Type | Description |
|---|---|---|
prefix |
String | Prefix to add to the current payload |
Returns
- Type
- Wrapper_JS
script() → {Wrapper_HTML}
Transform any js code into a <script> element.
Example
const p = Payload.new().eval(() => alert(1))
const w = Wrapper.new().script()
const i = document.createElement('iframe')
s.srcdoc = w.wrap(p)
document.body.appendChild(i)Returns
- Type
- Wrapper_HTML
svgLoad() → {Wrapper_HTML}
Transform any js code into a <svg onload> payload.
Example
const p = Payload.new().eval(() => alert(1))
const w = Wrapper.new().svgLoad()
document.body.innerHTML = w.wrap(p)Returns
- Type
- Wrapper_HTML
templateString() → {Wrapper_JS}
Transform any js code into a template string payload without parenthesis.
Example
const p = Payload.new().eval(() => alert(1))
const w = Wrapper.new().templateString()
const c = w.wrap(p)
eval(c)Returns
- Type
- Wrapper_JS
url() → {Wrapper_JSUrl}
Transform any js code into a javascript: pseudo url.
Example
const p = Payload.new().eval(() => alert(1))
const w = Wrapper.new().url()
document.location = w.wrap(p)Returns
- Type
- Wrapper_JSUrl