XSStrike is a python script designed to detect and exploit XSS vulnerabilites. Visit XSStrike's project site for more info.
A list of features XSStrike has to offer:
- Fuzzes a parameter and builds a suitable payload
- Bruteforces paramteres with payloads
- Has an inbuilt crawler like functionality
- Can reverse engineer the rules of a WAF/Filter
- Detects and tries to bypass WAFs
- Both GET and POST support
- Most of the payloads are hand crafted
- Negligible number of false positives
- Opens the POC in a browser window
Use the following command to download it
git clone https://github.com/UltimateHackers/XSStrike/
After downloading, navigate to XSStrike directory with the following command
cd XSStrike
Now install the required modules with the following command
pip install -r requirements.txt
Now you are good to go! Run XSStrike with the following command
python xsstrike
You can enter help in XSStrike's target prompt for basic usages.
You can view XSStrike's complete documentation here.
If you are a developer and want to use XSStrike's code in your project or want to contribute to XSStrike then you should read the developer guide.
XSStrike uses code from BruteXSS, Intellifuzzer-XSS and XsScan, WAFNinja.