skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-xs-search-attacks

Executes XS-Search and XS-Leak attacks to extract cross-origin information through browser side channels.

954|172|Updated Mar 13, 2026
Search Tags:#owasp#penetration testing#web security#cross-origin#xs-leaks#side channel#xs-search
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-xs-search-attacks
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-xs-search-attacks
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/web-application-security/performing-xs-search-attacks
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-xs-search-attacks

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Cross-origin pages often leak one bit of state (match vs no-match, logged-in vs anonymous) through side channels that scanners never chain together. This Skill provides a systematic methodology for combining inclusion methods, leak techniques, and detectable differences into working binary oracles that exfiltrate secrets character by character during authorized assessments.

Core Features & Use Cases

  • Full XS-Leak matrix coverage: Maps inclusion methods (iframes, pop-ups, HTML elements, fetch) to leak techniques (event handlers, timing, connection-pool and event-loop limits, CORB, postMessage, Performance API) so no variant is missed.
  • Oracle construction and confirmation: Provides ready-to-adapt JavaScript skeletons for timing oracles, hash-navigation onload leaks, and scriptless nested-object status leaks, plus statistical guidance to avoid false positives.
  • Defense-resistant techniques: Covers connection-pool saturation and event-loop timing that work even under Site Isolation, framing protection, and reduced timer precision.
  • Use Case: During an authorized engagement, a victim's private search endpoint returns different responses when a query matches. You frame the endpoint, use the hash-navigation onload oracle to test candidate prefixes, and recover a private token one character at a time, then document the finding with reproduction steps and remediation advice.

Quick Start

Ask the agent to assess a state-dependent cross-origin endpoint for XS-Search leaks and build a char-by-char exfiltration oracle using the appropriate inclusion method and leak technique.

Frequently Asked Questions about performing-xs-search-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform an XS-Search attack against a search endpoint?▼

Frame or fetch the victim's state-dependent search endpoint from an attacker-controlled page, then use a leak technique such as hash-navigation onload counting or timing to distinguish match from no-match. Iterate the charset to extend a known prefix one character at a time until the secret is recovered.

What are the main XS-Leak techniques for cross-origin information disclosure?▼

The core techniques are event-handler leaks (script onload/onerror as a status oracle), hash-navigation onload re-fire for content oracles, timing via performance.now or unload events, global-limit leaks using the browser connection pool or WebSocket limits, event-loop timing, CORB body stripping, and postMessage oracles.

Can XS-Leaks work when Site Isolation and framing protections are enabled?▼

Yes. Connection-pool saturation turns a queued request's delay into a timing oracle, and event-loop blocking measures cross-origin task duration on the single-threaded loop. Both techniques infer victim page load time without any direct cross-origin read, bypassing Site Isolation.

How do I confirm an XS-Search oracle is reliable and not a false positive?▼

Send a query known to match and one known not to match, and verify the chosen signal differs consistently across repeated trials. For timing leaks, collect many samples per state and compare distributions rather than single measurements, then validate by recovering a full multi-character secret.

What defenses prevent XS-Search and XS-Leak attacks?▼

Set SameSite=Lax or Strict on session cookies, deploy Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy, add framing protection via X-Frame-Options or CSP frame-ancestors, adopt Fetch Metadata headers, and normalize response size, timing, and status for state-dependent endpoints.

What tools help enumerate which XS-Leaks a browser is vulnerable to?▼

XSinator automatically tests a browser and application against many known XS-Leaks. The xsleaks.dev knowledge base catalogs inclusion methods, leak techniques, and defenses, while cure53's HTTPLeaks enumerates HTML elements that force cross-origin requests.

Related Skills

Explore More Software Engineering Skills→
woohyun212woohyun212
21

web-vuln-idor

Test IDOR vulnerabilities across two user accounts using curl-based checks.

Community
Advanced
Ap6packAp6pack
4

report-template

Converts security findings into formatted bug bounty submissions and client engagement reports.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

csrf

Exploits CSRF vulnerabilities in state-changing web endpoints and generates HTML PoC pages.

Official
Advanced
uphiagouphiago
1.2k

hunt-dom

Detect DOM clobbering, postMessage, service worker, and CSS exfiltration vulnerabilities in web applications.

Community
Advanced