Eval Villain

Eval Villain is a powerful Chrome extension designed to hook native JavaScript sink functions before page load, enabling users to monitor how web pages utilize these functions. It automatically hooks common DOM XSS sinks but can be customized to target any JavaScript function. With options to filter results based on URL patterns, session data, user-defined strings or regex, and blacklists, users gain precise control over output.

Beyond detecting DOM-based cross-site scripting, Eval Villain aids in analyzing webpage behavior by hooking functions like eval(), decodeURI(), and addEventListener(), unveiling potential obfuscation, hidden URL parameters, or post message handlers. Its recursive decoding capabilities help identify encoded HTML embedded in unusual locations such as the window name. This highly configurable tool is ideal for security researchers and developers aiming to understand JavaScript execution flows and identify vulnerabilities or malware. Supported by Doyensec Research, Eval Villain offers deep insight into web security through advanced JavaScript instrumentation.