sleepy-puppy - Sleepy Puppy XSS Payload Management Framework

项目说明

--------------------DEPRECATED-------------------
============
*July 24th, 2018*

So many amazing tools have come out since the release of Sleepy Puppy that streamline the original goals of the project. We're currently leaving Sleepy Puppy 代码 online but are not planning on adding any new features or addressing issues/pull requests. If you are interested in maintaining this project, please reach out to me ().

-Scott

What is Sleepy Puppy? ##

Sleepy Puppy is a cross-site scripting (XSS) payload management 框架 which simplifies the ability to capture, manage, and track XSS propagation over long periods of time.

Why Should I use Sleepy Puppy? ##

Often when testing for 客户端 side injections (HTML/JS/etc.) security engineers are looking for where the injection occurs within the application they are testing *only*. While this provides ample co for the application in scope, there is a possibility that the 代码 engineers are injecting may be reflected back in a completely separate application.

Sleepy Puppy helps facilitate inter-application XSS testing by pro Ja payloads that callback to the Sleepy Puppy application. This allows tracking when/where a payload fires even if the execution is triggered by a different user, occurs in a different application, or happens long after the initial test was performed.

These payloads and the "PuppyScripts" (which are often Ja) that define them are completely customizable, allowing you to capture only the information you need depending on your en.

How Does Sleepy Puppy Do It? ##

Sleepy Puppy provides you with a number of payloads, PuppyScripts, and captures/collectors. Payloads are the actual XSS strings that are used to load Sleepy Puppy PuppyScripts. The PuppyScripts provide a way to collect the information on the 客户端 and application where the payload was executed. Captures and Collectors allow you to view the data you ha from your PuppyScripts. E is configurable and you can create your own payloads and PuppyScripts as needed.

Testers can le the Sleepy Puppy Assessment model, to categorize payloads and subscribe to email notifications when delayed cross-site scripting events are triggered.

The default PuppyScript we use most often generates useful capture metadata including the url, DOM with payload highlighting, user-agent, cookies, referer header, and a screenshot of the application where the payload executed. This provides the tester ample knowledge to quickly identify what the application is so they may mitigate the quickly. As payloads propagate throughout a 网络, the tester can trace what applications the payload executes in throughout the payload’s lifecycle.

Sleepy Puppy also supports email notifications for captures received for specific assessments.

Sleepy Puppy exposes an API for users who may want to develop plugins for scanners such as Burp or Zap.

API Documentation

Getting Started #

Sleepy Puppy has a Docker composition which includes Nginx, PostGres, and Sleepy-Puppy. The Docker guide is the fastest way to try out Sleepy Puppy. The setup guide has examples on how to setup Sleepy Puppy for test as well as as more production setup using SSL and Nginx.

Release History #

V0.3 "Netflix OSS Release" - 8/31/2015
* Support for custom Ja and Ja chaining with new PuppyScripts model
* ACE Ja editor integration into PuppyScripts models
* Created new model for collecting arbitrary data from PuppyScripts (Generic Collector)
* Created new model for logging anytime a PuppyScript is requested but not necessarily executed (Access Log)
* Added "Snooze" and "Run Once" option for noisy Payloads
* Updated a large number of dependencies to latest releases
* Migrated from Bootstrap2 to Bootstrap3
* Numerous UI fixes/impro
* Impro PuppyScript for collecting captures with better module loading
* Additional error logging has been integrated
* Better exception handling throughout the application
* New API endpoints for all new models (Ja, Generic Collector, Access Log)
* New setup directi) creates example ja, payloads, and an assessment.

V0.2 "OWASP Beta Release" - 7/9/2015 ()
* Updated a number of third party dependencies
* Bug fixes for jQuery and Email Notifications
* Amazon S3 storage configuration is now a for screenshots
* Amazon SES email support is now a
* Allowed domains config directi users to whitelist which domains to log captures for
* Callback configuration settings for hostname and 协议 now supported
* PEP 8 changes (thanks )
* manage.py now supports a new command 'create_bootstrap_assessment' which adds a number of example payloads and an example assessment
* Added comprehensive Wiki documentation

V0.1 Alpha - 2/26/2014
* Initial release

Documentation #

Documentation is maintained in the Github Wiki

项目信息

开发语言：Ja

Star 数：1043

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Sleepy Puppy XSS Payload Management 框架展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。