JSSCM - JavaScript Supply Chain Monitor

JSSCM detects expired domains for Stored XSS exploitation during browsing.

Key Features • Install • Usage • Configuration • How It Works • Contributing • License

Demo

See JSSCM in action here: https://sametsahin.com/images/jsscmtest

Key Features

• Real-time Detection: Automatically identifies JavaScript resources with expired domains that could be exploited for XSS.
• Alert Notifications: Displays browser alerts when potential XSS vulnerabilities are detected to ensure visibility.
• Domain Status Check: Uses the Domainr API to verify domain registration status and determine exploitability.

Install

Manual Installation (Developer Mode)

1. Download as ZIP and unpack, or git clone
2. Enable Developer Mode in Extensions tab
3. Click Load unpacked and select the cloned repository folder
4. Done!

Here is a video showing how to install a Chrome extension: How to install unpacked extensions in chrome

Usage

After installation, the extension works automatically in the background:

1. The extension monitors JavaScript resources as you browse.
2. When an expired domain is detected, a browser alert appears with details.
3. Visit the settings page for more information

Configuration

You need to set up an API key to enable domain status checking:

1. Get a free API key (X-RapidAPI-Key) from RapidAPI Domainr.
2. Open the extension settings page
3. Enter your API key in the settings panel
4. Click "Save Settings"

How It Works

The extension:

1. Listens for DNS resolution errors on script resources
2. Records domains that fail to resolve (potential XSS opportunities)
3. Provides UI components to review and analyze these vulnerable domains
4. Offers an easy way to check if domains are available for registration and exploitation

Contributing

This was a weekend project with no plans for new features. However, I'm open to ideas and contributions. Feel free to implement something if you'd like :)

License

GPLv3

Acknowledgements

• Domainr API for domain status checking
• Chrome Extension API documentation
• Instant Domain Search for manual domain lookups

---

• Samet Sahin sametsahin.com
• LinkedIn @sametsahinnet
• Twitter @sametsahinnet