un9nplayer / AutoRecon-XSS

AutoRecon-XSS is a script designed for automated reconnaissance of XSS vulnerabilities. It crawls the target URL or alive domains, extracts potential vulnerable URLs, and checks them for XSS vulnerabilities.

AutoRecon-XSS

Description

AutoRecon-XSS is a script designed for automated reconnaissance of XSS vulnerabilities. It crawls the target URL or alive domains, extracts potentially vulnerable URLs, and checks them for XSS vulnerabilities.

Table of Contents

• Installation
• External-tools
• Usage
• What New
• Contact
• Disclaimer

Installation

git clone https://github.com/un9nplayer/AutoRecon-XSS.git
cd AutoRecon-XSS
chmod +x AutoRecon-XSS.sh

External-tools

• Subfinder
• httpx
• qsreplace
• waybackurls
• dalfox
• notify

Installation:

subfinder: go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
httpx : go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
qsreplace: go install github.com/tomnomnom/qsreplace@latest
waybackurls: go install github.com/tomnomnom/waybackurls@latest
dalfox: go install github.com/hahwul/dalfox/v2@latest
notify: go install -v github.com/projectdiscovery/notify/cmd/notify@latest

Usage

bash AutoRecon-XSS.sh <Target-URL> <Url-Recon-Year> <"XSS-Payload-you-wanna-Test">

Example:

bash AutoRecon-XSS.sh http://testphp.vulnweb.com 2000 "<script>alert(1)</script>"

What-New

• Implemented DalFox to perform a scan on a URL and that will give you 99% positive results.
• Run DalFox scan on vulnerable URLs: Runs DalFox scan on vulnerable URLs if a specific file exists.
• Print vulnerability check completion message: Displays a completion message for the vulnerability check.
• Check and display the results: Check and displays the results of the vulnerability check.
• Start where you left off.
• Notify: The tool tries to use the default provider config ($HOME/.config/notify/provider-config.yaml), it can also be specified via CLI by using the provider-config flag.

This will display all new support tools.

New Update	Description
Notify	Directly send the data to Discord webhook.
Dalfox	Scan vulnerable urls to check the confirmed XSS.

Contact

You can reach out to the author via the following channels:

• Twitter
• Instagram

Disclaimer

Please use AutoRecon-XSS responsibly and only for ethical purposes. Always adhere to legal and ethical standards when conducting security assessments or vulnerability scanning. The author and contributors of AutoRecon-XSS are not responsible for any misuse or illegal activities conducted with this tool.

AutoRecon-XSS is made with 🖤 by the un9nplayer.