xnl-h4ck3r / xnlreveal

A Chrome/Firefox browser extension to show alerts for reflected query params, show Wayback archive links for the current path, show hidden elements and enable disabled elements.

If my tools help you find any great bounties, consider BUYING ME A COFFEE ☕ (I could use the caffeine!)...

 

 

xnlreveal's Issues

whitelist urls

@xnl-h4ck3r It would be more useful if it would have a feature to add urls into whitelist category so they can be skipped.

Feature request: Get name and id attributes from input fields and make a request with them as query parameters

Input fields are one of the most common places where reflected xss vulnerabilities happen. It would great if there was a way to find if a query parameter is being reflected in an input field even if that parameter didn't exist in the initial url. The way I imagine this would work is:

1-User browses to the website as normal.
2-XnlReveal parses the dom and finds all input fields and their id and name attributes.
3-XnlReveal sends a seperate request with those ids and input names as key for query parameters and a token as value.
4-XnlReveal reports back to the user if it finds any reflections.