[{"_1":2,"_192":-5,"_193":-5},"loaderData",{"_3":4,"_92":93,"_180":181,"_191":-5},"root",{"_5":6,"_33":34,"_59":60,"_90":91},"ctx",{"_7":8,"_18":19,"_20":-5,"_21":22,"_23":24,"_25":26,"_27":26,"_28":26,"_29":30,"_31":32},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5},"sessionClaims","sessionId","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","environmentVariableKeys",[],"user","preferences_keybindings","default","preferences_theme","light","preferences_fixers",false,"preferences_copilot","preferences_selection_ai","preferences_model","claude-3-5-haiku-20241022","notification_count",0,"ENV",{"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","8bf3c40423bcb56a277b20de05416cc021b3b09a","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","API_URL","https://api.val.town","WORKER_FINGERPRINT","d0746fd0512e0614e3f717607f0da4cd","clerkState",{"_61":62},"__internal_clerk_state",{"_63":64,"_65":44,"_66":67,"_68":67,"_69":26,"_70":67,"_71":67,"_72":67,"_73":67,"_74":67,"_75":67,"_76":67,"_77":67,"_78":79,"_88":26,"_89":26},"__clerk_ssr_state",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__signInForceRedirectUrl","__signUpForceRedirectUrl","__signInFallbackRedirectUrl","__signUpFallbackRedirectUrl","__clerk_debug",{"_80":26,"_81":67,"_82":83,"_84":67,"_85":44,"_86":26,"_87":67},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","remixVersion",2,"routes/_app.v.$handle.$name",{"_94":95,"_96":97,"_95":98,"_166":-5,"_167":-5,"_168":169,"_130":131,"_138":139,"_101":102,"_99":100,"_118":-7,"_51":52,"_179":26},"type","val","author","dd466579-7dfb-4784-af1f-60db19283bf6",{"_99":100,"_96":97,"_101":102,"_103":-5,"_104":-5,"_105":106,"_107":-5,"_108":109,"_110":111,"_112":26,"_113":111,"_114":115,"_116":117,"_118":119,"_120":26,"_121":32,"_122":32,"_123":32,"_124":32,"_125":126,"_127":32,"_128":-5,"_20":129,"_134":-5,"_135":-7,"_136":137,"_138":139,"_140":141},"name","XSSPlayground","valNameId","4b6a62ec-fa1e-11ef-a4e6-569c3dd06744","parentFolderId","isOwned","privacy","public","readme","valType","http","currentVersion","87358cd2-fa20-11ef-b8a8-569c3dd06744","legacyPrivate","id","code","/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { createRoot } from \"https://esm.sh/react-dom@18.2.0/client\";\nimport React, { useEffect, useState } from \"https://esm.sh/react@18.2.0\";\n\n// Simulated database for stored XSS\nconst storedComments: { id: number; text: string }[] = [];\n\nfunction ArtooPromo() {\n const [isVisible, setIsVisible] = useState(true);\n\n if (!isVisible) return null;\n\n return (\n

\n 🤖 Automate XSS Discovery with artoo!\n \n Learn More →\n \n setIsVisible(false)}\n className=\"artoo-promo-close\"\n >\n ×\n \n

\n );\n}\n\nfunction App() {\n const [inputValue, setInputValue] = useState(\"\");\n const [renderUnsafe, setRenderUnsafe] = useState(false);\n const [comments, setComments] = useState<{ id: number; text: string }[]>([]);\n const [xssType, setXssType] = useState<\"direct\" | \"dom\" | \"reflected\" | \"stored\">(\"direct\");\n const [reflectedPayload, setReflectedPayload] = useState(\"\");\n\n // DOM-based XSS demonstration\n useEffect(() => {\n const hash = window.location.hash.substring(1);\n if (hash && xssType === \"dom\") {\n const domSink = document.getElementById(\"dom-sink\");\n if (domSink) domSink.innerHTML = decodeURIComponent(hash);\n }\n }, [xssType]);\n\n const handleDirectXss = () => {\n setRenderUnsafe(true);\n };\n\n const handleStoredXss = () => {\n const newComment = {\n id: Date.now(),\n text: inputValue,\n };\n storedComments.push(newComment);\n setComments([...storedComments]);\n };\n\n const handleReflectedXss = async () => {\n const response = await fetch(`/reflect?payload=${encodeURIComponent(inputValue)}`);\n const payload = await response.text();\n setReflectedPayload(payload);\n };\n\n return (\n

\n \n

🤖 artoo XSS Playground v2

\n\n setXssType(e.target.value as any)}\n className=\"input-field\"\n >\n \n \n \n \n \n\n setInputValue(e.target.value)}\n placeholder=\"Enter XSS payload...\"\n className=\"input-field\"\n />\n\n

\n {xssType === \"direct\" && (\n \n Render Unsafely 🚨\n \n )}\n\n {xssType === \"stored\" && (\n \n Store Comment 💾\n \n )}\n\n {xssType === \"reflected\" && (\n \n Reflect Payload 🔁\n \n )}\n\n {\n setRenderUnsafe(false);\n setReflectedPayload(\"\");\n }}\n className=\"reset-btn\"\n >\n Reset 🔒\n \n

\n\n {xssType === \"direct\" && renderUnsafe && (\n \n )}\n\n {xssType === \"dom\" && (\n

DOM XSS: Modify URL hash to trigger

\n )}\n\n {xssType === \"stored\" && (\n

Stored Comments:

\n {comments.map(comment => (\n \n ))}\n

\n )}\n\n {xssType === \"reflected\" && reflectedPayload && (\n \n )}\n\n \n

\n );\n}\n\nfunction client() {\n createRoot(document.getElementById(\"root\")).render();\n}\nif (typeof document !== \"undefined\") { client(); }\n\nexport default async function server(request: Request): Promise {\n // Reflected XSS endpoint\n const url = new URL(request.url);\n if (url.pathname === \"/reflect\") {\n const payload = url.searchParams.get(\"payload\") || \"\";\n return new Response(payload, {\n headers: {\n \"Content-Type\": \"text/html\",\n \"X-XSS-Protection\": \"0\", // Disable browser XSS protection for demo\n \"X-Frame-Options\": \"ALLOW-FROM https://val.town\",\n \"X-Powered-By\": \"artoo XSS Lab\",\n \"Set-Cookie\": `session=${Math.random().toString(36).substring(2)}; HttpOnly; Secure; SameSite=Strict`,\n },\n });\n }\n\n return new Response(\n `\n \n \n artoo XSS Playground\n \n \n \n \n

\n \n \n \n \n `,\n {\n headers: {\n \"content-type\": \"text/html\",\n \"X-XSS-Playground\": \"artoo Security Lab\",\n },\n },\n );\n}\n\nconst css = `\nbody {\n margin: 0;\n font-family: 'system-ui', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, 'Open Sans', 'Helvetica Neue', sans-serif;\n background-color: #121212;\n color: #e0e0e0;\n display: flex;\n justify-content: center;\n align-items: center;\n min-height: 100vh;\n}\n\n.artoo-promo {\n position: fixed;\n top: 0;\n left: 0;\n width: 100%;\n background-color: #4caf50;\n color: white;\n padding: 10px 0;\n z-index: 1000;\n text-align: center;\n}\n\n.artoo-promo-content {\n display: flex;\n justify-content: center;\n align-items: center;\n gap: 15px;\n}\n\n.artoo-promo-link {\n color: white;\n text-decoration: underline;\n font-weight: bold;\n}\n\n.artoo-promo-close {\n background: none;\n border: none;\n color: white;\n font-size: 20px;\n cursor: pointer;\n position: absolute;\n right: 15px;\n}\n\n.container {\n width: 100%;\n max-width: 600px;\n padding: 20px;\n margin-top: 50px; /* Space for promo banner */\n}\n\n.card {\n background-color: #1e1e1e;\n border-radius: 12px;\n padding: 30px;\n box-shadow: 0 10px 30px rgba(0, 0, 0, 0.5);\n text-align: center;\n}\n\nh1 {\n margin-bottom: 20px;\n color: #4caf50;\n font-size: 1.8rem;\n}\n\n.input-field, select {\n width: 100%;\n padding: 12px;\n margin-bottom: 20px;\n background-color: #2c2c2c;\n border: 1px solid #444;\n border-radius: 6px;\n color: #e0e0e0;\n transition: border-color 0.3s ease;\n}\n\n.input-field:focus, select:focus {\n outline: none;\n border-color: #4caf50;\n}\n\n.button-group {\n display: flex;\n gap: 10px;\n margin-bottom: 20px;\n}\n\n.render-btn, .reset-btn {\n flex: 1;\n padding: 12px;\n border: none;\n border-radius: 6px;\n cursor: pointer;\n transition: background-color 0.3s ease;\n}\n\n.render-btn {\n background-color: #f44336;\n color: white;\n}\n\n.reset-btn {\n background-color: #4caf50;\n color: white;\n}\n\n.output-area {\n background-color: #2c2c2c;\n padding: 15px;\n border-radius: 6px;\n min-height: 50px;\n word-break: break-all;\n text-align: left;\n margin-top: 15px;\n}\n\n.stored-comments {\n background-color: #2c2c2c;\n padding: 15px;\n border-radius: 6px;\n margin-top: 15px;\n}\n\n.comment {\n background-color: #3c3c3c;\n margin: 10px 0;\n padding: 10px;\n border-radius: 4px;\n}\n\n.source-link {\n display: block;\n margin-top: 20px;\n color: #4caf50;\n text-decoration: none;\n opacity: 0.7;\n transition: opacity 0.3s ease;\n}\n\n.source-link:hover {\n opacity: 1;\n}\n`;","createdAt",["D",1741220308589],"version",6,"currentUserHasLiked","likeCount","forkCount","referenceCount","dependencyCount","commentCount",1,"prCount","mergedPr",{"_130":131,"_132":133},"handle","alpaca1712","profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18ybnp2Z0VIZklHWDd3NVdUNFNZMzZkQmQzejgifQ","forkedVal","interval","slug","alpaca1712/XSSPlayground","description","@jsxImportSource https://esm.sh/react@18.2.0","versions",[142,145,149,153,157,160,163],{"_118":119,"_143":-5,"_116":144,"_113":111},"prId",["D",1741220308589],{"_118":146,"_143":-5,"_116":147,"_113":148},5,["D",1741220146529],"269d1034-fa20-11ef-a937-569c3dd06744",{"_118":150,"_143":-5,"_116":151,"_113":152},4,["D",1741220129811],"1ca6dba0-fa20-11ef-8a32-569c3dd06744",{"_118":154,"_143":-5,"_116":155,"_113":156},3,["D",1741220015427],"d878b2c8-fa1f-11ef-adc0-569c3dd06744",{"_118":91,"_143":-5,"_116":158,"_113":159},["D",1741219817075],"623f576a-fa1f-11ef-be09-569c3dd06744",{"_118":126,"_143":-5,"_116":161,"_113":162},["D",1741219791241],"52d91018-fa1f-11ef-a7ea-569c3dd06744",{"_118":32,"_143":-5,"_116":164,"_113":165},["D",1741219349294],"4b6daa7e-fa1e-11ef-a4e6-569c3dd06744","recentThread","breadcrumbs","comments",[170],{"_113":171,"_172":173,"_116":174,"_175":-5,"_176":26,"_177":26,"_20":178},"dd409ca2-fa20-11ef-9c2b-569c3dd06744","body","Test your cross site scripting with this playground.",["D",1741220452966],"updatedAt","canDelete","canEdit",{"_130":131,"_132":133},"isOwner","routes/_app.v.$handle.$name.versions.$(version)",{"_94":182,"_183":184,"_95":185},"single","redirect","/v/alpaca1712/XSSPlayground/versions",{"_113":111,"_114":115,"_118":119,"_116":186,"_187":100,"_101":102,"_108":109,"_130":131,"_11":97,"_188":-5,"_189":-5,"_190":-5,"_179":26,"_136":137},["D",1741220308589],"valName","deletedAt","messageId","threadId","routes/_app","actionData","errors"]

XSSPlayground

Version 6