Search the Community

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches lasting from database fingerprinting, over data fetching from the database to accessing the underlying file system and executing commands on the operating system via out-of-band connections. Changelog v1.7.2 Implements tamper script if2case (#5301) [hide][Hidden Content]]

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches lasting from database fingerprinting, over data fetching from the database to accessing the underlying file system and executing commands on the operating system via out-of-band connections. [hide][Hidden Content]]

An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws Features Supports the following types of injection payloads: Boolean based. Error Based Time-Based Stacked Queries Support SQL injection for following DBMS. MySQL Microsoft SQL Server Postgre Oracle Supports following injection types. GET/POST-Based injections Headers Based injections Cookies Based injections Multipart Form data injections JSON based injections support proxy option –proxy. supports parsing requests from txt files: switch for that -r file.txt supports limiting data extraction for dbs/tables/columns/dump: switch –start 1 –stop 2 Changelog v1.1.2 updated code quality for gracefully exiting the threads on user interrupt. updated code to resume the data fetching in threads. updated code for read timeout issue to auto adjust time-sec and timeout [hide][Hidden Content]]

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches lasting from database fingerprinting, over data fetching from the database to accessing the underlying file system and executing commands on the operating system via out-of-band connections. [hide][Hidden Content]]

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches lasting from database fingerprinting, over data fetching from the database to accessing the underlying file system and executing commands on the operating system via out-of-band connections. [hide][Hidden Content]]

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches lasting from database fingerprinting, over data fetching from the database to accessing the underlying file system and executing commands on the operating system via out-of-band connections. [hide][Hidden Content]]

AutoPWN Suite is a project for scanning vulnerabilities and exploiting systems automatically. Features Fully automatic! (Use -y flag to enable) Detect network IP range without any user input. Vulnerability detection based on version. Get information about the vulnerability right from your terminal. Automatically download exploit related with vulnerability. Noise mode for creating a noise on the network. Evasion mode for being sneaky. Automatically decide which scan types to use based on privilege. Easy to read output. Function to output results to a file. Argument for passing custom nmap flags. Specify your arguments using a config file. [hide][Hidden Content]]

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches lasting from database fingerprinting, over data fetching from the database to accessing the underlying file system and executing commands on the operating system via out-of-band connections. [hide][Hidden Content]]

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches lasting from database fingerprinting, over data fetching from the database to accessing the underlying file system and executing commands on the operating system via out-of-band connections. Changelog v1.6.5 One patch related to #5087 [hide][Hidden Content]]

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches lasting from database fingerprinting, over data fetching from the database to accessing the underlying file system and executing commands on the operating system via out-of-band connections. [hide][Hidden Content]]

massExploitConsole a collection of tools with a cli ui disclaimer Please use this tool only on authorized systems, I’m not responsible for any damage caused by users who ignore my warning I do not own the code of adapted exploits or tools exploits are adapted from other sources, please refer to their author info Please note, due to my limited programming experience (it’s my first Python project), you can expect some silly bugs Feature an easy-to-use cli ui execute any adpated exploits with process-level concurrency some built-in exploits (automated) hide your ip addr using proxychains4 and ss-proxy (built-in) zoomeye host scan (10 threads) google page crawler with gecko and Firefox (not fully working) a simple Baidu crawler (multi-threaded) censys host scan Changelog v2.3.4 Bug Fixes get_version crashes when not in a git directory (3963dfd) MECROOT not found (e13011e) [hide][Hidden Content]]

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches lasting from database fingerprinting, over data fetching from the database to accessing the underlying file system and executing commands on the operating system via out-of-band connections. [hide][Hidden Content]]

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches lasting from database fingerprinting, over data fetching from the database to accessing the underlying file system and executing commands on the operating system via out-of-band connections. Changelog v1.6.2 Update for #4928 [hide][Hidden Content]]

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches lasting from database fingerprinting, over data fetching from the database to accessing the underlying file system and executing commands on the operating system via out-of-band connections. [Hidden Content]

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches lasting from database fingerprinting, over data fetching from the database to accessing the underlying file system and executing commands on the operating system via out-of-band connections. The sqlmap project is sponsored by Netsparker Web Application Security Scanner. Features implemented in sqlmap include: Full support for MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase, SAP MaxDB and HSQLDB database management systems. Full support for five SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION query and stacked queries. Support to directly connect to the database without passing via a SQL injection, by providing DBMS credentials, IP address, port and database name. It is possible to provide a single target URL, get the list of targets from Burp proxy or WebScarab proxy requests log files, get the whole HTTP request from a text file or get the list of targets by providing sqlmap with a Google dork which queries Google search engine and parses its results page. You can also define a regular-expression based scope that is used to identify which of the parsed addresses to test. Tests provided GET parameters, POST parameters, HTTP Cookie header values, HTTP User-Agent header value and HTTP Referer header value to identify and exploit SQL injection vulnerabilities. It is also possible to specify a comma-separated list of specific parameter(s) to test. Option to specify the maximum number of concurrent HTTP(S) requests (multi-threading) to speed up the blind SQL injection techniques. Vice versa, it is also possible to specify the number of seconds to hold between each HTTP(S) request. Others optimization switches to speed up the exploitation are implemented too. HTTP Cookie header string support, useful when the web application requires authentication based upon cookies and you have such data or in case you just want to test for and exploit SQL injection on such header values. You can also specify to always URL-encode the Cookie. Automatically handles HTTP Set-Cookie header from the application, re-establishing of the session if it expires. Test and exploit on these values is supported too. Vice versa, you can also force to ignore any Set-Cookie header. HTTP protocol Basic, Digest, NTLM and Certificate authentications support. HTTP(S) proxy support to pass by the requests to the target application that works also with HTTPS requests and with authenticated proxy servers. Options to fake the HTTP Referer header value and the HTTP User-Agent header value specified by user or randomly selected from a textual file. Support to increase the verbosity level of output messages: there exist seven levels of verbosity. Support to parse HTML forms from the target URL and forge HTTP(S) requests against those pages to test the form parameters against vulnerabilities. Granularity and flexibility in terms of both user’s switches and features. Estimated time of arrival support for each query, updated in real time, to provide the user with an overview on how long it will take to retrieve the queries’ output. Automatically saves the session (queries and their output, even if partially retrieved) on a textual file in real time while fetching the data and resumes the injection by parsing the session file. Support to read options from a configuration INI file rather than specify each time all of the switches on the command line. Support also to generate a configuration file based on the command line switches provided. Support to replicate the back-end database tables structure and entries on a local SQLite 3 database. Option to update sqlmap to the latest development version from the subversion repository. Support to parse HTTP(S) responses and display any DBMS error message to the user. Integration with other IT security open source projects, Metasploit and w3af. More… Changelog v1.5.12 Fixes #4895 [hide][Hidden Content]]

iblessing iblessing is iOS security exploiting toolkit, it mainly includes application information collection, static analysis, and dynamic analysis. iblessing is based on a unicorn engine and capstone engine. Features 🔥 Cross-platform: Tested on macOS and Ubuntu. iOS App static info extract, including meta data, deeplinks, urls, etc. Mach-O parser and dyld symbol bind simulator Objective-C class realizing and parsing Scanners making dynamic analysis for arm64 assembly code and find key information or attack surface Scanners using unicorn to partially simulate Mach-O arm64 code execution and find some features Generators that can provide secondary processing on scanner’s report to start a query server, or generate script for IDA Super objc_msgSend xrefs scanner 😄 objc methods and subs (such as blocks) emulation to generate xrefs like flare-emu objc function wrapper detects and ida usercall generate objc_msgSend sub-functions analysis objc block to objc_msgSend xrefs in args and a capture list report format including json, etc. Swift class and method parsing following branches and calls SimProcedures for extern symbols Tests Android Scanners Support Diagnostic logs More flexible scanner infrastructure for new scanner plugins Changelog v1.0.4 beta fix: bof [hide][Hidden Content]]

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches lasting from database fingerprinting, over data fetching from the database to accessing the underlying file system and executing commands on the operating system via out-of-band connections. Changelog v1.5.11 Implements option –retry-on (#4876) [hide][Hidden Content]]

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections. Changelog v1.5.10 Struggling with Github Actions [hide][Hidden Content]]

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections. The sqlmap project is sponsored by Netsparker Web Application Security Scanner. Features implemented in sqlmap include: Full support for MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase, SAP MaxDB and HSQLDB database management systems. Full support for five SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION query and stacked queries. Support to directly connect to the database without passing via a SQL injection, by providing DBMS credentials, IP address, port and database name. It is possible to provide a single target URL, get the list of targets from Burp proxy or WebScarab proxy requests log files, get the whole HTTP request from a text file or get the list of targets by providing sqlmap with a Google dork which queries Google search engine and parses its results page. You can also define a regular-expression based scope that is used to identify which of the parsed addresses to test. Tests provided GET parameters, POST parameters, HTTP Cookie header values, HTTP User-Agent header value and HTTP Referer header value to identify and exploit SQL injection vulnerabilities. It is also possible to specify a comma-separated list of specific parameter(s) to test. Option to specify the maximum number of concurrent HTTP(S) requests (multi-threading) to speed up the blind SQL injection techniques. Vice versa, it is also possible to specify the number of seconds to hold between each HTTP(S) request. Others optimization switches to speed up the exploitation are implemented too. HTTP Cookie header string support, useful when the web application requires authentication based upon cookies and you have such data or in case you just want to test for and exploit SQL injection on such header values. You can also specify to always URL-encode the Cookie. Automatically handles HTTP Set-Cookie header from the application, re-establishing of the session if it expires. Test and exploit on these values is supported too. Vice versa, you can also force to ignore any Set-Cookie header. HTTP protocol Basic, Digest, NTLM and Certificate authentications support. HTTP(S) proxy support to pass by the requests to the target application that works also with HTTPS requests and with authenticated proxy servers. Options to fake the HTTP Referer header value and the HTTP User-Agent header value specified by user or randomly selected from a textual file. Support to increase the verbosity level of output messages: there exist seven levels of verbosity. Support to parse HTML forms from the target URL and forge HTTP(S) requests against those pages to test the form parameters against vulnerabilities. Granularity and flexibility in terms of both user’s switches and features. Estimated time of arrival support for each query, updated in real time, to provide the user with an overview on how long it will take to retrieve the queries’ output. Automatically saves the session (queries and their output, even if partially retrieved) on a textual file in real time while fetching the data and resumes the injection by parsing the session file. Support to read options from a configuration INI file rather than specify each time all of the switches on the command line. Support also to generate a configuration file based on the command line switches provided. Support to replicate the back-end database tables structure and entries on a local SQLite 3 database. Option to update sqlmap to the latest development version from the subversion repository. Support to parse HTTP(S) responses and display any DBMS error message to the user. Integration with other IT security open source projects, Metasploit and w3af. More… Changelog v1.5.9 Minor refactoring [hide][Hidden Content]]

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches including database fingerprinting, over data fetching from the database, accessing the underlying file system, and executing commands on the operating system via out-of-band connections. 1.5.8 Trivial update [hide][Hidden Content]]

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections. Changelog v1.5.7 Fixes #4728 [hide][Hidden Content]]

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections. The sqlmap project is sponsored by Netsparker Web Application Security Scanner. Features implemented in sqlmap include: Full support for MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase, SAP MaxDB and HSQLDB database management systems. Full support for five SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION query and stacked queries. Support to directly connect to the database without passing via a SQL injection, by providing DBMS credentials, IP address, port and database name. It is possible to provide a single target URL, get the list of targets from Burp proxy or WebScarab proxy requests log files, get the whole HTTP request from a text file or get the list of targets by providing sqlmap with a Google dork which queries Google search engine and parses its results page. You can also define a regular-expression based scope that is used to identify which of the parsed addresses to test. Tests provided GET parameters, POST parameters, HTTP Cookie header values, HTTP User-Agent header value and HTTP Referer header value to identify and exploit SQL injection vulnerabilities. It is also possible to specify a comma-separated list of specific parameter(s) to test. Option to specify the maximum number of concurrent HTTP(S) requests (multi-threading) to speed up the blind SQL injection techniques. Vice versa, it is also possible to specify the number of seconds to hold between each HTTP(S) request. Others optimization switches to speed up the exploitation are implemented too. HTTP Cookie header string support, useful when the web application requires authentication based upon cookies and you have such data or in case you just want to test for and exploit SQL injection on such header values. You can also specify to always URL-encode the Cookie. Automatically handles HTTP Set-Cookie header from the application, re-establishing of the session if it expires. Test and exploit on these values is supported too. Vice versa, you can also force to ignore any Set-Cookie header. HTTP protocol Basic, Digest, NTLM and Certificate authentications support. HTTP(S) proxy support to pass by the requests to the target application that works also with HTTPS requests and with authenticated proxy servers. Options to fake the HTTP Referer header value and the HTTP User-Agent header value specified by user or randomly selected from a textual file. Support to increase the verbosity level of output messages: there exist seven levels of verbosity. Support to parse HTML forms from the target URL and forge HTTP(S) requests against those pages to test the form parameters against vulnerabilities. Granularity and flexibility in terms of both user’s switches and features. Estimated time of arrival support for each query, updated in real time, to provide the user with an overview on how long it will take to retrieve the queries’ output. Automatically saves the session (queries and their output, even if partially retrieved) on a textual file in real time while fetching the data and resumes the injection by parsing the session file. Support to read options from a configuration INI file rather than specify each time all of the switches on the command line. Support also to generate a configuration file based on the command line switches provided. Support to replicate the back-end database tables structure and entries on a local SQLite 3 database. Option to update sqlmap to the latest development version from the subversion repository. Support to parse HTTP(S) responses and display any DBMS error message to the user. Integration with other IT security open source projects, Metasploit and w3af. More… Changelog v1.5.4 Fixes #4625 [hide][Hidden Content]]

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections. The sqlmap project is sponsored by Netsparker Web Application Security Scanner. Features implemented in sqlmap include: Full support for MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase, SAP MaxDB and HSQLDB database management systems. Full support for five SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION query and stacked queries. Support to directly connect to the database without passing via a SQL injection, by providing DBMS credentials, IP address, port and database name. It is possible to provide a single target URL, get the list of targets from Burp proxy or WebScarab proxy requests log files, get the whole HTTP request from a text file or get the list of targets by providing sqlmap with a Google dork which queries Google search engine and parses its results page. You can also define a regular-expression based scope that is used to identify which of the parsed addresses to test. Tests provided GET parameters, POST parameters, HTTP Cookie header values, HTTP User-Agent header value and HTTP Referer header value to identify and exploit SQL injection vulnerabilities. It is also possible to specify a comma-separated list of specific parameter(s) to test. Option to specify the maximum number of concurrent HTTP(S) requests (multi-threading) to speed up the blind SQL injection techniques. Vice versa, it is also possible to specify the number of seconds to hold between each HTTP(S) request. Others optimization switches to speed up the exploitation are implemented too. HTTP Cookie header string support, useful when the web application requires authentication based upon cookies and you have such data or in case you just want to test for and exploit SQL injection on such header values. You can also specify to always URL-encode the Cookie. Automatically handles HTTP Set-Cookie header from the application, re-establishing of the session if it expires. Test and exploit on these values is supported too. Vice versa, you can also force to ignore any Set-Cookie header. HTTP protocol Basic, Digest, NTLM and Certificate authentications support. HTTP(S) proxy support to pass by the requests to the target application that works also with HTTPS requests and with authenticated proxy servers. Options to fake the HTTP Referer header value and the HTTP User-Agent header value specified by user or randomly selected from a textual file. Support to increase the verbosity level of output messages: there exist seven levels of verbosity. Support to parse HTML forms from the target URL and forge HTTP(S) requests against those pages to test the form parameters against vulnerabilities. Granularity and flexibility in terms of both user’s switches and features. Estimated time of arrival support for each query, updated in real time, to provide the user with an overview on how long it will take to retrieve the queries’ output. Automatically saves the session (queries and their output, even if partially retrieved) on a textual file in real time while fetching the data and resumes the injection by parsing the session file. Support to read options from a configuration INI file rather than specify each time all of the switches on the command line. Support also to generate a configuration file based on the command line switches provided. Support to replicate the back-end database tables structure and entries on a local SQLite 3 database. Option to update sqlmap to the latest development version from the subversion repository. Support to parse HTTP(S) responses and display any DBMS error message to the user. Integration with other IT security open source projects, Metasploit and w3af. More… Changelog v1.5.3 Speedup of caching for char encoding (non-Unicode chars in page) [hide][Hidden Content]]

Sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections. The sqlmap project is sponsored by Netsparker Web Application Security Scanner. Features implemented in sqlmap include: Full support for MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase, SAP MaxDB and HSQLDB database management systems. Full support for five SQL injection techniques: boolean-based blind, time-based blind, error-based, UNION query and stacked queries. Support to directly connect to the database without passing via a SQL injection, by providing DBMS credentials, IP address, port and database name. It is possible to provide a single target URL, get the list of targets from Burp proxy or WebScarab proxy requests log files, get the whole HTTP request from a text file or get the list of targets by providing sqlmap with a Google dork which queries Google search engine and parses its results page. You can also define a regular-expression based scope that is used to identify which of the parsed addresses to test. Tests provided GET parameters, POST parameters, HTTP Cookie header values, HTTP User-Agent header value and HTTP Referer header value to identify and exploit SQL injection vulnerabilities. It is also possible to specify a comma-separated list of specific parameter(s) to test. Option to specify the maximum number of concurrent HTTP(S) requests (multi-threading) to speed up the blind SQL injection techniques. Vice versa, it is also possible to specify the number of seconds to hold between each HTTP(S) request. Others optimization switches to speed up the exploitation are implemented too. HTTP Cookie header string support, useful when the web application requires authentication based upon cookies and you have such data or in case you just want to test for and exploit SQL injection on such header values. You can also specify to always URL-encode the Cookie. Automatically handles HTTP Set-Cookie header from the application, re-establishing of the session if it expires. Test and exploit on these values is supported too. Vice versa, you can also force to ignore any Set-Cookie header. HTTP protocol Basic, Digest, NTLM and Certificate authentications support. HTTP(S) proxy support to pass by the requests to the target application that works also with HTTPS requests and with authenticated proxy servers. Options to fake the HTTP Referer header value and the HTTP User-Agent header value specified by user or randomly selected from a textual file. Support to increase the verbosity level of output messages: there exist seven levels of verbosity. Support to parse HTML forms from the target URL and forge HTTP(S) requests against those pages to test the form parameters against vulnerabilities. Granularity and flexibility in terms of both user’s switches and features. Estimated time of arrival support for each query, updated in real time, to provide the user with an overview on how long it will take to retrieve the queries’ output. Automatically saves the session (queries and their output, even if partially retrieved) on a textual file in real time while fetching the data and resumes the injection by parsing the session file. Support to read options from a configuration INI file rather than specify each time all of the switches on the command line. Support also to generate a configuration file based on the command line switches provided. Support to replicate the back-end database tables structure and entries on a local SQLite 3 database. Option to update sqlmap to the latest development version from the subversion repository. Support to parse HTTP(S) responses and display any DBMS error message to the user. Integration with other IT security open source projects, Metasploit and w3af. More… Changelog v1.5.2 Fixing HTTP chunking for Python2.6 [hide][Hidden Content]]

JSshell – a JavaScript reverse shell. This using to exploit XSS remotely, help to find blind XSS, … This tool works for both Unix and Windows operating system and it can be running with both Python 2 and Python 3. This is a big update of JShell – a tool to get a JavaScript shell with XSS by s0med3v. JSshell also doesn’t require Netcat (different from other javascript shells). New in JSshell version 2.9 Updated in the new version of JShell 2.9: New JSshell command: cookie -> allows to view the cookies of the current user who established the shell Support javascript function: Fixed some bugs [hide][Hidden Content]]