Eval Villain azray n lqem - 24 ileqman
Eval Villain sɣur bemodtwz
Ɣur-k ɣef yileqman yezrin! TTwaseknen-d kan i usekyed akked umuqel.Yessefk yal tikkelt ad tesqedceḍ lqem aneggaru n uzegrir.
Lqem aneggaru
Lqem 2.11
Yeffeɣ-d deg 13. nov 2024 - 53,89 KBIteddu d firefox 58.0 d yileqman imaynutenFixes bug where localStorage is not properly sourced
Improves encoder function for path search
Fixes mistake is sourcer debug statmentTangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Sader Firefox syen awi isiɣzafIlaq-ak·am Firefox i useqdec n usiɣzef-aIleqman iqbuṛen
Lqem 2.10
Yeffeɣ-d deg 11. nov 2024 - 53,74 KBIteddu d firefox 58.0 d yileqman imaynuten* Copy Eval Villain Injection or Config from the configuration page and paste into any JavaScript file to get Eval Villain into other browsers or contexts.
* Better defaults for actual testing. Including CSPT and postMessage sinks.
* Set limits on source banks in the configuration page
* Lots of refactoringTangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 2.9
Yeffeɣ-d deg 22. sep 2023 - 41,75 KBIteddu d firefox 48.0 d yileqman imaynuten* Use evSourcer to dynamically add to sources via instrumentation.
* Use evSinker as a dynamic sink to be used with instrumentation.
* EV now warns when it fails to load in a frame.
* Replace console.log with console.info in the web page to avoid the pages logs cluttering up Eval Villain output.Tangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 2.8
Yeffeɣ-d deg 9. mar 2023 - 40,88 KBIteddu d firefox 48.0 d yileqman imaynutenFix output of regex needles without global flagTangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 2.7
Yeffeɣ-d deg 6. feb 2022 - 40,87 KBIteddu d firefox 59.0 d yileqman imaynutenAdd function URLSearchParams.get to default config, disabled by default
Spelling fixes
Fix scope to preventing vars leaking into `window`Tangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 2.6
Yeffeɣ-d deg 26. júl 2021 - 41,02 KBIteddu d firefox 59.0 d yileqman imaynutenConstructors (like `new Function`) are now hooked.
Better proto hooking (like `value(Range.createContextualFragment)`).Tangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 2.5
Yeffeɣ-d deg 28. apr 2021 - 40,82 KBIteddu d firefox 59.0 d yileqman imaynutenFix bug where you couldn't delete a config item
Provided encoder function will provide a second parameter now, using `encoder("payload", true)` should cause the payload to be inserted into the DOM XSS source.Tangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 2.4
Yeffeɣ-d deg 15. apr 2021 - 40,57 KBIteddu d firefox 59.0 d yileqman imaynutenFix minor bug for configuration name collisionsTangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 2.3
Yeffeɣ-d deg 13. apr 2021 - 40,48 KBIteddu d firefox 59.0 d yileqman imaynuten* When a encoded source is found in a sink, a encoding function in JavaScript will be printed to the console. This function lets you see how Eval Villain decoded the source, and lets you quickly encode your own payloads.
* Large text will receive it's own closed console.group to improve readability.Tangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 2.2
Yeffeɣ-d deg 26. jan 2021 - 41,24 KBIteddu d firefox 59.0 d yileqman imaynuten2 Major Changes
* EV will now recursively decode DOM XSS sources for URL, base64 and JSON encoding. Decoded values will then be used to search input to the hooked functions.
* Blacklists were previously applied to all input. I found this to be mostly useless. Now blacklists are applied to decoded input sources. So you can blacklist `/^true$/` and a URL parameter that is set to `true` won't cause all `eval` calls containing `true` to be marked as interesting.Tangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 2.1
Yeffeɣ-d deg 14. júl 2020 - 41,25 KBIteddu d firefox 59.0 d yileqman imaynutenIt is now safe to hook decodeURI, and decodeURIComponent. This can be helpful for finding where inputs are parsed.Tangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 2.0
Yeffeɣ-d deg 9. mar 2020 - 41,22 KBIteddu d firefox 59.0 d yileqman imaynutenRefactoring should improve speed and performance.
Monitors sinks for window nameTangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 1.11
Yeffeɣ-d deg 22. aug 2019 - 40,49 KBIteddu d firefox 59.0 d yileqman imaynutenTypes: enable/disable types that you are interested.Tangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 1.10
Yeffeɣ-d deg 6. aug 2019 - 40,17 KBIteddu d firefox 59.0 d yileqman imaynutenUsing `Reflect.apply` for proxying to reduce bugs. Thanks Mike Samuel!
Show argument types
Better handling of multiple arguments to a function.Tangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 1.9
Yeffeɣ-d deg 25. jún 2019 - 40,01 KBIteddu d firefox 59.0 d yileqman imaynutenFeatures:
* Toggle Eval Villain with key commands
Bug fixes:
Functions are now hooked using `Proxy`. Eval Villain should break fewer pages. Reference: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/ProxyTangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 1.8
Yeffeɣ-d deg 13. jún 2019 - 40,07 KBIteddu d firefox 59.0 d yileqman imaynutenURL Decode bug fixTangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 1.7
Yeffeɣ-d deg 11. jún 2019 - 40,01 KBIteddu d firefox 59.0 d yileqman imaynutenFixed bug in query searchTangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 1.6
Yeffeɣ-d deg 11. jún 2019 - 40,01 KBIteddu d firefox 59.0 d yileqman imaynutenFunction hooks now handle multiple arguments
Hook `Function` if you want, likely to break webpages though
Bug fixes/improved query searchTangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 1.5
Yeffeɣ-d deg 2. jan 2019 - 36,47 KBIteddu d firefox 59.0 d yileqman imaynutenHandles malformed URI encoding without breaking code flow.
Having console.log remapped by the page should no longer interfere with output.Tangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 1.4
Yeffeɣ-d deg 14. aug 2018 - 36,4 KBIteddu d firefox 59.0 d yileqman imaynuten, android 59.0 ɣer 68.** fix URL decode logic bug
* No longer search for URL parameter names.Tangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 1.3
Yeffeɣ-d deg 10. aug 2018 - 36,41 KBIteddu d firefox 59.0 d yileqman imaynuten, android 59.0 ɣer 68.** fixed a couple RegEx needle highlighting bugs
* fragment and query search now also check if the value has been URL decoded.Tangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 1.2
Yeffeɣ-d deg 7. aug 2018 - 35,91 KBIteddu d firefox 59.0 d yileqman imaynuten, android 59.0 ɣer 68.*This version just improves the UI some.Tangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 1.1
Yeffeɣ-d deg 2. aug 2018 - 36,06 KBIteddu d firefox 59.0 d yileqman imaynuten, android 59.0 ɣer 68.*Tangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only
Lqem 1.0
Yeffeɣ-d deg 2. aug 2018 - 36,07 KBIteddu d firefox 59.0 d yileqman imaynuten, android 59.0 ɣer 68.*Tangalt taɣbalut teffeɣ-d s turagt GNU General Public License v3.0 only