xssencode

package
v0.5.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 3, 2026 License: MIT Imports: 4 Imported by: 0

Documentation

Overview

Package xssencode provides reusable payload-encoding primitives and WAF-aware mutation for the XSS modules. Everything here is a pure function: callers opt in by asking for variants, so a module that never calls into this package behaves exactly as before.

  • Encoding helpers (URLEncode, Base64): wrap a value so it gets past a WAF and is reconstituted by the application's own decoding. Used by the pre-encoded XSS Light variant to detect parameters the app decodes.
  • WAF mutation (MutateForWAF, in wafmutate.go): rewrite an HTML/JS payload into an execution-preserving evasion form keyed off the detected WAF.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Base64 

func Base64(s string) string

Base64 returns the standard base64 encoding of s.

func URLEncode 

func URLEncode(s string) string

URLEncode percent-encodes every byte that url.QueryEscape would, applied to the whole string (so structural characters like < > " ' are encoded).

Types

type Variant 

type Variant struct {
	Name  string
	Value string
}

Variant is a named encoding/mutation of a payload. The name is carried for finding evidence ("base64", "slash-sep", ...).

func MutateForWAF 

func MutateForWAF(wafType, payload string) []Variant

MutateForWAF returns execution-preserving evasion variants of payload tuned to the detected WAF. It excludes any variant identical to the input (the plain payload is assumed to have already been tried). An unknown/empty wafType returns nil, so callers spend no extra requests when no WAF was observed.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.