Most advanced XSS scanner 8k stars

FEATURES :

Reflected and DOM XSS scanning

Multi-threaded crawling

Context analysis

Configurable core

WAF detection & evasion

Outdated JS lib scanning

Intelligent payload generator

Handmade HTML & JavaScript parser

Powerful fuzzing engine

Blind XSS support

Highly researched work-flow

Complete HTTP support

Bruteforce payloads from a file

Powered by Photon, Zetanize and Arjun

Payload Encoding

🦑Os :

> debians (kali-parrot-ubuntu...)

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1️⃣git clone https://github.com/s0md3v/XSStrike

2️⃣cd XSStrike

2️⃣python xsstrike.py [-h] [-u TARGET] [--data DATA] [-t THREADS] [--seeds SEEDS] [--json] [--path]

                   [--fuzzer] [--update] [--timeout] [--params] [--crawl] [--blind]

                   [--skip-dom] [--headers] [--proxy] [-d DELAY] [-e ENCODING]

MORE USAGES :

4️⃣Scan a single URL

Option: -u or --url

5️⃣Test a single webpage which uses GET method.

python xsstrike.py -u "http://example.com/search.php?q=query"

6️⃣Supplying POST data

python xsstrike.py -u "http://example.com/search.php" --data "q=query"

7️⃣Testing URL path components

Option: --path

8️⃣Want to inject payloads in the URL path like http://example.com/search/<payload>, you can do that with --path switch.

python xsstrike.py -u "http://example.com/search/form/query" --path

9️⃣Treat POST data as JSON

Option: --json

This switch can be used to test JSON data via POST method.

python xsstrike.py -u "http://example.com/search.php" --data '{"q":"query"} --json'

🔟Crawling

Option: --crawl

For more type -h

✅

Enjoy! Follow us for more...