Ppmap is a simple scanner/exploitation tool written in GO which automatically exploits known and existing gadgets (checks for specific variables in the global context) to perform XSS via Prototype Pollution. NOTE: The program only exploits known gadgets, but does not cover code analysis or any advanced Prototype Pollution exploitation, which may include custom gadgets.
Requirements
Make sure to have Chromium/Chrome installed:
sudo sh -c ‘echo “deb http://dl.google.com/linux/chrome/deb/ stable main” >> /etc/apt/sources.list.d/google.list’
wget -q -O – https://dl-ssl.google.com/linux/linux_signing_key.pub | sudo apt-key add –
sudo apt-get update
sudo apt-get install google-chrome-stable
Make sure to have chromedp installed:
go get -u github.com/chromedp/chromedp
Installation
chmod +x ppmap
git clone https://github.com/kleiton0x00/ppmap.git
cd ~/ppmap
go build ppmap.go
Using the program is very simple, you can either:
echo 'https://target.com/index.html' | ./ppmap
echo 'http://target.com/something/?page=home' | ./ppmap
For mass scanning:cat url.txt | ./ppmap
where url.txt contains all url(s) in column.
Demo
Feel free to test the tool on the following websites as a part of demonstration:
https://msrkp.github.io/pp/2.html
https://ctf.nikitastupin.com/pp/known.html
This repository contains tools created by yogSahare0 while learning Python 3 for ethical hacking and penetration testing.…
"NetSecChallenger" provides a suite of automated tools designed for security professionals and network administrators to…
The essential tool for cybersecurity enthusiasts! This guide provides a detailed walkthrough on how to…
Meet "Poodone," the ultimate Python script designed for cybersecurity enthusiasts and professionals alike. Packed with…
The Linux version is no longer supported! The last Linux version is 6.0 that you…
Jin is a hacking command-line tools designed to make your scan port, gathering urls, check…