xssnude(USP)

Name

xssnude : replaces special characters with entity references.

Synopsis

Usage   : xssnude [option] <file>

Option  : --number

          --name

          --space

          --del

          --limited

Version : Wed Nov 11 10:31:19 JST 2020

Description

To prevent cross-site scripting escape string in <file> mainly coming from the Web to be harmless.

Note that (WS) means a white space in the following.

Example 1

Set --number to replace ASCII characters with entity numbers.

$ cat file

<script>alert("hoge")</script>

$ xssnude --number file

&#60;script&#62;alert&#40;&#34;hoge&#34;&#41;&#60;&#47;script&#62;

Symbols will be replaced with entity numbers as below.

     →  9

\n   →  10

\r   →  13

(WS) →  32

!    →  33

"    →  34

#    →  35

$    →  36

%    →  37

&    →  38

'    →  39

(    →  40

)    →  41

*    →  42

+    →  43

,    →  44

-    →  45

.    →  46

/    →  47

:    →  58

;    →  59

<    →  60

=    →  61

>    →  62

?    →  63

@    →  64

Example 2

Set --name to replace ASCII characters with entity names.

$ cat file

<script>alert("hoge")</script>

$ xssnude --name file

&lt;script&gt;alert(&quot;hoge&quot;)&lt;/script&gt;

Symbols will be replaced too entity names as below.

<    → &lt;

>    → &gt;

&    → &amp;

"    → &quot;

(WS) → &nbsp;

Example 3

Set --space to replace ASCII symbols into white spaces.

$ cat file

<script>alert("hoge")</script>

$ xssnude --space file

 script alert  hoge    script

Example 4

Set --del to remove ASCII symbols.

$ cat file

<script>alert("hoge")</script>

$ xssnude --del file

scriptalerthogescript

Example 5

Set --limited for specific symbols below frequently used for attacking to be replaced.

< > & " (WS)

 --limited is used cooperatively with other options/.

$ cat file

<script>alert("hoge")</script>

$ xssnude --limited --number file

&#60;script&#62;alert(&#34;hoge&#34;)&#60;/script&#62;

$ cat file

<script>alert("hoge")</script>

$ xssnude --limited --name file

&lt;script&gt;alert(&quot;hoge&quot;)&lt;/script&gt;

$ cat file

<script>alert("hoge")</script>

$ xssnude --limited --space file

 script alert( hoge ) /script

$ cat file

<script>alert("hoge")</script>

$ xssnude --limited --del file

scriptalert(hoge)/script