Package: selenium-oxide
Selenium-OxideA Selenium boilerplate for automating web exploits. Use responsibly and ethically.Selenium Oxide is a web exploitation automation framework designed
around the needs of penetration testers and attack/defense CTF players
alike! Whether you need to quickly make an automated
exploit for web apps, a stealthy automation tool for attack/defense,
or a springboard for other exploit development, this is the tool for you!The module offers a slimmer API than standard Selenium, and has
multiple handy features, such as:Stealth functionalityBuilder pattern exploit writingAutomatic browser binary configurationCookie dumping and manipulationProxy supportChrome supportArbitrary selector supportAlert waitingUser generationAPI interfaceJavaScript executionWhy the Name?When making this module I initially struggled with
what to call it. I happened to look at another module,
named Selenium Wire, and decided yeah, you know what,
using Selenium in the name is fair game. Selenium Oxide
sounded cool, and when I looked up information on the
chemical it read that it was at least somewhat dangerous.A dangerous version of Selenium. Checks out for an offsec
platform.Getting StartedLike regular Selenium, you're going to need a browser binary
and geckodriver.Selenium Oxide supports both Firefox and Chrome.FirefoxFirst, you'll want to grab a binary of Firefox. I recommend the following flow
for installing on UNIX systems. Once you've downloaded a version of firefox you
like (for that, the official download page is usually sufficient):tar-xjfyour_firefox_archive.tar.bz2sudomvfirefox/optThis way, your Firefox binary will be in/opt/firefox/firefox, which is the
default location the module looks at. Perfect.If you already have a Firefox binary on hand (maybe you already used Selenium),
then you can just specify the location in the exploit builder constructor.Then, you'll need Geckodriver. You can grab that fromhere.tar-xzfyour_geckodriver_archive.tar.gzsudomvgeckodriver/usr/binSo long as Geckodriver is in your path, you should be golden.ChromeInstalling Chrome for Seleniumis usually even easier than installing Firefox. Install Chrome normally
through your preferred package manager, then grab a copy of Chromedriver. Extract it and move
it into /opt like so:sudomvchromedriver/optAlso for reference, you can find your Chrome binary with thewhichcommand:whichgoogle-chromeFinal StepsNext, just install from Pip!python3-mpipinstallselenium-oxideIf that doesn't work, you may have an outdated version of Selenium (this library needs 4.1.0 or greater).
If so:pipinstall--upgradeseleniumThat should install everythng you need.Using Selenium OxideSelenium Oxide is a builder-pattern exploit automation
framework, designed to provide a more immediately usable
method of exploit automation before resorting
to using the network tab. The ability to use proxies
makes the tool extremely useful as a ground layer for
API-focused exploit development as well.The BasicsFirst, import the module:fromselenium_oxide.exploit_builderimportExploitBuilderThe ExploitBuilder constructor takes a number of arguments, two being mandatory:exploit=ExploitBuilder(#protocol"https",#hostname"juice-shop.herokuapp.com",#options (explained in docs)**options)protocolandhostnamecorrespond to the protocol (HTTP, HTTPS)
and hostname (domain, IP/port, etc) used by the web app.Stealth mode is interesting, allowing the user to avoid alerting blue teams
with multiple rapid requests. As of 1.0.0, it uses the length of user
inputs to determine how long its sleep time is before writing text in
input boxes. There is some randomness thrown in as well, to really throw
off blue teams. However, this may be painfully slow while you're waiting
on the input to appear, so do keep an eye on your terminal for crashes.
Adjustable stealth timings may appear in a future release.Proxy support is a 1.0.0 addition, allowing the user to use proxies (such
as ZAP or Burp Suite) to track their HTTP requests and responses. This is
handy for mapping out APIs and finding potential additional vulnerabilities.To start building exploits, you can chain functions together!(exploit.get("/").login("/#/login","admin' OR 1=1;--","password",'//*[@id="email"]','//*[@id="password"]','//*[@id="loginButton"]').type_entry('//*[@id="mat-input-0"]',"<img src=\"http://url.to.file.which/not.exist\"onerror=alert(document.cookie);>").send_enter('//*[@id="mat-input-0"]'))However, some functions, likeget_cookiesorget_cookie_by_namecannot be chained into
other functions, and further exploitation must begin on a new line.Further ReadingThe API documentation onReadtheDocswill have more information on how to use the framework to its full potential.