mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.0 KiB
2.0 KiB
API Reference: Testing for XSS Vulnerabilities
requests Library for XSS Testing
Reflection Testing
from urllib.parse import quote
# Inject canary to find reflection points
resp = requests.get(f"{url}?q={canary}")
if canary in resp.text:
# Input is reflected - test payloads
resp = requests.get(f"{url}?q={quote(payload)}")
XSS Payload Categories
| Context | Example Payload |
|---|---|
| HTML body | <script>alert(document.domain)</script> |
| HTML attribute | " onfocus=alert(1) autofocus=" |
| JavaScript string | ';alert(1)// |
| URL/href | javascript:alert(1) |
| Event handler | <img src=x onerror=alert(1)> |
| SVG | <svg onload=alert(1)> |
| Filter bypass | <ScRiPt>alert(1)</sCrIpT> |
XSS Types
| Type | Description | Persistence |
|---|---|---|
| Reflected | Payload in URL/request, reflected in response | Non-persistent |
| Stored | Payload saved server-side, rendered to others | Persistent |
| DOM-based | Payload processed by client-side JavaScript | Client-side |
CSP Analysis
| Directive | Insecure Value | Risk |
|---|---|---|
script-src |
'unsafe-inline' |
Allows inline <script> tags |
script-src |
'unsafe-eval' |
Allows eval() and similar |
script-src |
*.googleapis.com |
May host JSONP endpoints |
base-uri |
Not set | Allows <base> tag injection |
default-src |
* |
Allows scripts from any origin |
Cookie Security Flags
| Flag | Purpose |
|---|---|
HttpOnly |
Prevents JavaScript access to cookies |
Secure |
Only send over HTTPS |
SameSite |
Cross-site request protection |
References
- OWASP XSS Guide: https://owasp.org/www-community/attacks/xss/
- XSS Filter Evasion: https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html
- CSP Evaluator: https://csp-evaluator.withgoogle.com/
- PortSwigger XSS: https://portswigger.net/web-security/cross-site-scripting