On running sudo docker compose up xsshunterexpress I hit the following issue:

[...]
xsshunter-express-xsshunterexpress-1  | changing `configDir` from '/app/greenlock.d' to './greenlock.d'
xsshunter-express-xsshunterexpress-1  | Listening on 0.0.0.0:80 for ACME challenges, and redirecting to HTTPS
xsshunter-express-xsshunterexpress-1  | Listening on 0.0.0.0:443 for secure traffic
xsshunter-express-xsshunterexpress-1  | Ready to Serve:
xsshunter-express-xsshunterexpress-1  |          <domain_name>
xsshunter-express-xsshunterexpress-1  | ACME Directory URL: https://acme-v02.api.letsencrypt.org/directory
xsshunter-express-xsshunterexpress-1  | 
xsshunter-express-xsshunterexpress-1  | By using this software you (<private_email>) are agreeing to the following:
xsshunter-express-xsshunterexpress-1  | ACME Subscriber Agreement: https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf
xsshunter-express-xsshunterexpress-1  | Greenlock/ACME.js Terms of Use: https://rootprojects.org/legal/#terms
xsshunter-express-xsshunterexpress-1  | 
xsshunter-express-xsshunterexpress-1  | set greenlockOptions.notify to override the default logger
xsshunter-express-xsshunterexpress-1  | Error cert_issue:
xsshunter-express-xsshunterexpress-1  | connect ETIMEDOUT <public_ip>:80
xsshunter-express-xsshunterexpress-1  | code: ETIMEDOUT
xsshunter-express-xsshunterexpress-1  | Error: connect ETIMEDOUT <public_ip>:80
xsshunter-express-xsshunterexpress-1  |     at TCPConnectWrap.afterConnect [as oncomplete] (net.js:1144:16)
xsshunter-express-xsshunterexpress-1  | Error cert_issue:
xsshunter-express-xsshunterexpress-1  | connect ETIMEDOUT <public_ip>:80
xsshunter-express-xsshunterexpress-1  | code: ETIMEDOUT
xsshunter-express-xsshunterexpress-1  | Error: connect ETIMEDOUT <public_ip>:80
xsshunter-express-xsshunterexpress-1  |     at TCPConnectWrap.afterConnect [as oncomplete] (net.js:1144:16)
xsshunter-express-xsshunterexpress-1  | Error cert_issue:
xsshunter-express-xsshunterexpress-1  | connect ETIMEDOUT <public_ip>:80
xsshunter-express-xsshunterexpress-1  | code: ETIMEDOUT
xsshunter-express-xsshunterexpress-1  | Error: connect ETIMEDOUT <public_ip>:80
xsshunter-express-xsshunterexpress-1  |     at TCPConnectWrap.afterConnect [as oncomplete] (net.js:1144:16)

It appears the server is created and is listening on ports 80 and 443, but the certificate issuing process fails. Is there a way to manually generate the lets encrypt certificate in order to bypass this issue.

Hello,

The javascript returns:

(index):103 Uncaught TypeError: Cannot read properties of null (reading 'outerText')
at get_dom_text ((index):103:17)
at (index):243:29

When triggering the payload thru the xss redirect of xsshunter.

Any help on this?

It is working when directly using the payload on the self hosted.

For some reasons the download file is truncated but we can see the full page when using View Raw HTML in new Tab.

I'll see if I can create a pull request when I have the time.

Attaching to xsshunter-express_xsshunterexpress_1
xsshunterexpress_1 | /usr/bin/env: 'bash\r': No such file or directory
xsshunter-express_xsshunterexpress_1 exited with code 127

Is it possible to change the configuration to use another mail sender say SendGrid instead of MailGun? Thanks.

I obviously have a lot of xss data, but the title of XSSPAYLOAD FIRES page always displays XSS Payload Fire Reports (0 Total)

I'm facing the following issue when trying to up the docker

Even though there are 216 collected pages the pagination shows only 1 page.

I'll see if I can create a pull request when I have the time.

I'm getting Secure Connection Failed how can I fix this ? I have added the right information for all the required fields. i need to setup this on localhost

$ docker-compose up -d postgresdb
ERROR: Version in "./docker-compose.yml" is unsupported. You might be seeing this error because you're using the wrong Compose f           ile version. Either specify a supported version (e.g "2.2" or "3.3") and place your service definitions under the `services` key           , or omit the `version` key and place your service definitions at the root of the file to use version 1.
For more on the Compose file format versions, see https://docs.docker.com/compose/compose-file/

OK, changed version to version: "3.3" ... that works I guess.

$ docker-compose up xsshunterexpress
Building xsshunterexpress
Traceback (most recent call last):
  File "/usr/bin/docker-compose", line 11, in <module>
    load_entry_point('docker-compose==1.25.0', 'console_scripts', 'docker-compose')()
  File "/usr/lib/python3/dist-packages/compose/cli/main.py", line 72, in main
    command()
  File "/usr/lib/python3/dist-packages/compose/cli/main.py", line 128, in perform_command
    handler(command, command_options)
  File "/usr/lib/python3/dist-packages/compose/cli/main.py", line 1107, in up
    to_attach = up(False)
  File "/usr/lib/python3/dist-packages/compose/cli/main.py", line 1088, in up
    return self.project.up(
  File "/usr/lib/python3/dist-packages/compose/project.py", line 542, in up
    svc.ensure_image_exists(do_build=do_build, silent=silent, cli=cli)
  File "/usr/lib/python3/dist-packages/compose/service.py", line 366, in ensure_image_exists
    self.build(cli=cli)
  File "/usr/lib/python3/dist-packages/compose/service.py", line 1084, in build
    build_output = builder.build(
  File "/usr/lib/python3/dist-packages/docker/api/build.py", line 159, in build
    context = utils.tar(
  File "/usr/lib/python3/dist-packages/docker/utils/build.py", line 30, in tar
    files=sorted(exclude_paths(root, exclude, dockerfile=dockerfile[0])),
  File "/usr/lib/python3/dist-packages/docker/utils/build.py", line 49, in exclude_paths
    return set(pm.walk(root))
  File "/usr/lib/python3/dist-packages/docker/utils/build.py", line 214, in rec_walk
    for sub in rec_walk(cur):
  File "/usr/lib/python3/dist-packages/docker/utils/build.py", line 184, in rec_walk
    for f in os.listdir(current_dir):
PermissionError: [Errno 13] Permission denied: '/home/ropcc/xsshunter-express/postgres-db-data'

So, this was supposed to "just work" -- right? :')

Appreciate your help and supporting this project!

Does anyone know how to fix this?

im getting this error, while doing docker-compose up -d postgresdb

ERROR: Version in "./docker-compose.yml" is unsupported. You might be seeing this error because you're using the wrong Compose file version. Either specify a supported version (e.g "2.2" or "3.3") and place your service definitions under the services key, or omit the version key and place your service definitions at the root of the file to use version 1.
For more on the Compose file format versions, see https://docs.docker.com/compose/compose-file/

Uncaught TypeError: Cannot read properties of null (reading 'outerText')
    at get_dom_text ((index):103)
    at (index):243

Tested on chrome. Below is html content:

<html>
<script src=https://xx.xx></script>
<body>
test
</body>
</html>

xyz.xss.ht payload works fine on above html page.

Im running the docker and it is serving on the domain succesfully.
But not able to know what is the password used to login.

Not Displaying on terminal or on docker logs

I run this command "docker-compose up xsshunterexpress" and following error results :

xsshunterexpress_1 | Starting server...
xsshunterexpress_1 | (node:28) [SEQUELIZE0002] DeprecationWarning: The logging-option should be either a function or false. Default: console.log
xsshunterexpress_1 | (node:28) UnhandledPromiseRejectionWarning: SequelizeHostNotFoundError: getaddrinfo ENOTFOUND postgresdb
xsshunterexpress_1 | at Client._connectionCallback (/app/node_modules/sequelize/lib/dialects/postgres/connection-manager.js:175:24)
xsshunterexpress_1 | at Client._handleErrorWhileConnecting (/app/node_modules/pg/lib/client.js:305:19)
xsshunterexpress_1 | at Client._handleErrorEvent (/app/node_modules/pg/lib/client.js:315:19)
xsshunterexpress_1 | at Connection.emit (events.js:314:20)
xsshunterexpress_1 | at Socket.reportStreamError (/app/node_modules/pg/lib/connection.js:53:12)
xsshunterexpress_1 | at Socket.emit (events.js:314:20)
xsshunterexpress_1 | at emitErrorNT (internal/streams/destroy.js:92:8)
xsshunterexpress_1 | at emitErrorAndCloseNT (internal/streams/destroy.js:60:3)
xsshunterexpress_1 | at processTicksAndRejections (internal/process/task_queues.js:84:21)
xsshunterexpress_1 | (node:28) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag --unhandled-rejections=strict (see https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode). (rejection id: 1)
xsshunterexpress_1 | (node:28) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.
xsshunter-express_xsshunterexpress_1 exited with code 0

What could be the reason for this?

Docker desktop: Version 2.0.0.3 (31259)
docker-compose.yaml is set to 3.3 (3.9 not compatible with this docker version)
node version: v12.18.2

The default configuration use 80 and 443 for both the container and the host machine.

Is it possible to run on a non-default port e.g. 1234 for HTTPS? We don't want Internet crawlers and malicious web attackers to easily access the site on default ports (80/443).

Thanks,
@luchua-bc

im getting the below error while doing docker-compose up -d postgresdb

ERROR: Version in "./docker-compose.yml" is unsupported. You might be seeing this error because you're using the wrong Compose file version. Either specify a supported version (e.g "2.2" or "3.3") and place your service definitions under the services key, or omit the version key and place your service definitions at the root of the file to use version 1.
For more on the Compose file format versions, see https://docs.docker.com/compose/compose-file/

It would be useful to be able to disable the automatic SSL/TLS so that you can handle the certificates seperately.

For example, I already have an nginx reverse proxy setup with my cloudflare origin certificates. I don't need the automatic certificates and stuff, so if I could run it over http and handle the rest myself that would be useful.

[root@iZt4ndkfpmx5eozp4q0aowZ xsshunter-express]# docker-compose up xsshunterexpress
Building xsshunterexpress
Sending build context to Docker daemon 66.14MB

Step 1/25 : FROM node:12
---> 6c8de432fc7f
Step 2/25 : RUN mkdir /app/
---> Using cache
---> 4abafa969f34
Step 3/25 : WORKDIR /app/
---> Using cache
---> 4794f390a553
Step 4/25 : COPY front-end/ /app/front-end/
---> Using cache
---> 73c41d33c9ff
Step 5/25 : WORKDIR /app/front-end/
---> Using cache
---> 02f480253d47
Step 6/25 : RUN npm install
---> Running in 71e72397d17f
npm ERR! code EAI_AGAIN
npm ERR! errno EAI_AGAIN
npm ERR! request to https://registry.npmjs.org/vue-loader failed, reason: getaddrinfo EAI_AGAIN registry.npmjs.org

npm ERR! A complete log of this run can be found in:
npm ERR! /root/.npm/_logs/2022-12-11T14_33_26_267Z-debug.log
The command '/bin/sh -c npm install' returned a non-zero code: 1

Please clarify in the documentation, which ports/protocols are used.

xsshunterexpress_1 | (node:29) UnhandledPromiseRejectionWarning: Error: Connection timeout
xsshunterexpress_1 | at SMTPConnection._formatError (/app/node_modules/nodemailer/lib/smtp-connection/index.js:774:19)
xsshunterexpress_1 | at SMTPConnection._onError (/app/node_modules/nodemailer/lib/smtp-connection/index.js:760:20)
xsshunterexpress_1 | at Timeout. (/app/node_modules/nodemailer/lib/smtp-connection/index.js:229:22)
xsshunterexpress_1 | at listOnTimeout (internal/timers.js:554:17)
xsshunterexpress_1 | at processTimers (internal/timers.js:497:7)
xsshunterexpress_1 | (node:29) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag --unhandled-rejections=strict (see https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode). (rejection id: 5)

Hi,

I have edited the settings as below

  - SMTP_EMAIL_NOTIFICATIONS_ENABLED=true
  - SMTP_HOST=smtp.gmail.com
  - SMTP_PORT=465
  - SMTP_USE_TLS=true
  - [email protected]
  - SMTP_PASSWORD=YourEmailPassword
  - [email protected]
  - [email protected]

I'm getting an error like below

xsshunterexpress_1 | (node:29) UnhandledPromiseRejectionWarning: Error: Invalid login: 535-5.7.8 Username and Password not accepted. Learn more at
xsshunterexpress_1 | 535 5.7.8 https://support.google.com/mail/?p=BadCredentials x14-20020a170902a38e00b001b8b2b95068sm9112067pla.204 - gsmtp
xsshunterexpress_1 | at SMTPConnection._formatError (/app/node_modules/nodemailer/lib/smtp-connection/index.js:774:19)
xsshunterexpress_1 | at SMTPConnection._actionAUTHComplete (/app/node_modules/nodemailer/lib/smtp-connection/index.js:1513:34)
xsshunterexpress_1 | at SMTPConnection. (/app/node_modules/nodemailer/lib/smtp-connection/index.js:540:26)
xsshunterexpress_1 | at SMTPConnection._processResponse (/app/node_modules/nodemailer/lib/smtp-connection/index.js:932:20)
xsshunterexpress_1 | at SMTPConnection._onData (/app/node_modules/nodemailer/lib/smtp-connection/index.js:739:14)
xsshunterexpress_1 | at TLSSocket.SMTPConnection._onSocketData (/app/node_modules/nodemailer/lib/smtp-connection/index.js:189:44)
xsshunterexpress_1 | at TLSSocket.emit (events.js:314:20)
xsshunterexpress_1 | at addChunk (_stream_readable.js:297:12)
xsshunterexpress_1 | at readableAddChunk (_stream_readable.js:272:9)
xsshunterexpress_1 | at TLSSocket.Readable.push (_stream_readable.js:213:10)
xsshunterexpress_1 | (node:29) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag --unhandled-rejections=strict (see https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode). (rejection id: 2)

I have checked in the forums it is mentioned that Gmail SMTP port: 465 (SSL) or 587 (TLS), so I changed to 587, I got the below message.

xsshunterexpress_1 | (node:30) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag --unhandled-rejections=strict (see https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode). (rejection id: 1)
xsshunterexpress_1 | (node:30) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.

See error message below.
uname -a yields Linux xsshunter 5.10.0-11-amd64 #1 SMP Debian 5.10.92-1 (2022-01-18) x86_64 GNU/Linux

xsshunterexpress_1  | renewAt: 1
xsshunterexpress_1  | defaults:
xsshunterexpress_1  |   store:{"module":"greenlock-store-fs"}
xsshunterexpress_1  |   challenges:{"http-01":{"module":"acme-http-01-standalone"}}
xsshunterexpress_1  | Starting server...
xsshunterexpress_1  | (node:29) [SEQUELIZE0002] DeprecationWarning: The logging-option should be either a function or false. Default: console.log
xsshunterexpress_1  | (node:29) UnhandledPromiseRejectionWarning: SequelizeConnectionError: could not open file "global/pg_filenode.map": Permission denied
xsshunterexpress_1  |     at Client._connectionCallback (/app/node_modules/sequelize/lib/dialects/postgres/connection-manager.js:184:24)
xsshunterexpress_1  |     at Client._handleErrorWhileConnecting (/app/node_modules/pg/lib/client.js:305:19)
xsshunterexpress_1  |     at Client._handleErrorMessage (/app/node_modules/pg/lib/client.js:325:19)
xsshunterexpress_1  |     at Connection.emit (events.js:314:20)
xsshunterexpress_1  |     at /app/node_modules/pg/lib/connection.js:115:12
xsshunterexpress_1  |     at Parser.parse (/app/node_modules/pg-protocol/dist/parser.js:40:17)
xsshunterexpress_1  |     at Socket.<anonymous> (/app/node_modules/pg-protocol/dist/index.js:10:42)
xsshunterexpress_1  |     at Socket.emit (events.js:314:20)
xsshunterexpress_1  |     at addChunk (_stream_readable.js:297:12)
xsshunterexpress_1  |     at readableAddChunk (_stream_readable.js:272:9)
xsshunterexpress_1  | (node:29) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag `--unhandled-rejections=strict` (see https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode). (rejection id: 1)
xsshunterexpress_1  | (node:29) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.
xsshunter-express_xsshunterexpress_1 exited with code 0