Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking for JavaScript malware. I need it just for local tests on my computer for a project I am working on. Are there any Internet resources where I could find this?

share|improve this question
I'm surprised nobody suggested browsing for some pron which should be sure way to catch a few js malware examples. – Cthulhu Aug 12 '14 at 10:22
@Cthulhu Its flawed technique when you are interested in just one type of malware ;) – PTwr Aug 12 '14 at 10:56
@Cthulhu I read that religious sites are worse than porn sites a while ago. – Martin Ueding Aug 12 '14 at 12:09
up vote 12 down vote accepted

If you are looking for malware to study and understand how it works metasploit is great. The framework is open source so you can study how it works.

You can search the metasploit database.

I'm not sure what exactly you're looking for when you say "JavaScript Malware" but if you mean JavaScript that could compromise users who view a site CVE-2012-3993 looks pretty cool.

If your looking for JavaScript that if injected to a site could do nasty things OWASP is a good resource.

I also quite like Troy Hunt's Intentionally Vulnerable Site it gives you a good playground where you can break things and he has some good training on what not to do.

share|improve this answer
I want to develop a tool that allows me to detect JS malware when I visit a given website. So i am also interested in websites that perform drive by download attack – user52657 Aug 12 '14 at 8:29

Try BeEF framework, It is specifically useful for a wide range of web browsers and has tested methodologies. Once the main javascript file is loaded in the client browser(Through cross site or any other means), an attacker can perform full control of the client system depending upon the available browser specific exploits.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.