Persistent Live Scanner with send functionality - credits: Core rezi/retr0, clownz, woodie, god joshy
Script Breakdown - How It Breaks the Site
This script will completely break the target website's functionality in the following ways:
The script hijacks the native window.fetch function:
window.fetch = async (url, options) => {
if (typeof url === 'string' && url.includes('/api/index/pastes')) {
return new Response(JSON.stringify(fullAttackResponse), ...);
}
return originalFetch(url, options);
};/api/index/pastes returns fake, hardcoded data instead of real server data.The script returns fabricated responses containing:
When attackType === 'full_attack', the script injects this malicious HTML:
<img src="x" onerror="alert('XSS')">Because the API response is completely spoofed:
The script makes API requests every 500 milliseconds (twice per second):
setInterval(() => {
updatePastes();
}, 500);The script forcibly replaces table contents (pinned-tbody and pastes-tbody) with fabricated data, ignoring any real content the page might have loaded.
| Feature | Expected Behavior | After Script |
|---|---|---|
| Real paste listing | Shows actual pastes | Shows only fake pastes |
| API responses | Returns real server data | Returns spoofed responses |
| Security | No automatic XSS | XSS payload executes |
| Page functionality | Normal operation | Completely hijacked |
| Network usage | Normal request rate | 2 requests/second spam |
The script explicitly shows it's breaking the site with messages like:
"Live Update! Pastes: X | Total: Y""XSS VULNERABILITY DETECTED""Scanner started - monitoring for changes..."