XSStrike: XSS detection suite

https://github.com/s0md3v/XSStrike

by godfrzero • 8 years ago

211 29 8 years ago

github.com

lysp• 8 years ago

Spelling error on the very first image example: "Cofidence"

latchkey• 8 years ago

I submitted a PR to fix the mistake before I read the comment here.

algorithm_dk• 8 years ago

Having used XSSStrike, I must say it probably is the best public tool for hunting XSS.

chii2• 8 years ago

Is there a private tool that only those in the know can use?

acct1771• 8 years ago

The implication is yes.

thawab• 8 years ago

He might meant public as free/open source. Commercial XSS tools that comes to my mind is https://www.blueclosure.com/ .

astura• 8 years ago

There are commerical/non-free tools.

strictnein3• 8 years ago

Just a word of caution: Running tools like this from your home IP address is a good way of getting banned from the Internet* by Akamai.

* (yes, yes, you're not banned from the Internet, but you'll be surprised by all the sites you visit that sit behind Akamai)

Some ISPs are relatively easy to get a new IP address on, others are rather difficult, so don't be dumb, use protection: a VPN.

chii2• 8 years ago

Don't run this kind of stuff on somebody's website without prior consent.

strictnein3• 8 years ago

Never said to do so. Even with prior consent you'll still get Akamai mad at you.

My point here is was just that this is a somewhat dangerous tool to start just aiming at random websites. Probably a fair amount of people here that don't understand the full ramifications of their actions.

kokx• 8 years ago

Just don't run it against anything for which you do not have permission to run such tools.

Running a tool like this against your favorite websites, is a simple way of getting banned from your favorite websites.

strictnein3• 8 years ago

Even sites that have bug bounties don't turn off their WAF for you. So you can have permission to run some tools against them, but still anger Akamai.

__Joker• 8 years ago

Couple of years back the amount of captcha I have to solve to visit a site was amazing while using the workplace network. Although the CDN I faced most problems with was CloudFlare.

dzek69• 8 years ago

Blocking VPN ip isn't a great contribution to community. Others including you will get that ip later.

Ruin your internet for yourself, if you have to run such tools on public websites. You shouldn't anyway.

kawera• 8 years ago

Do I risk getting banned if I only use this against my own websites?

Filligree• 8 years ago

By who?

If you're running out against an Akamai or Cloudfoare reverse proxy in front of your website, then sure. If not, no; they don't have wiretaps.

provolone• 8 years ago

No support for base64 encoded parameters?

yawz• 8 years ago

(Hoping that the author(s) is (are) here) Thank you for working on and sharing a great tool. I spotted two typos on the main site:

“...payload generator generates patloads which are...” patloads -> payloads.

“...flaunting it's genius backend.” it’s -> its.

dean177• 8 years ago

Submit a PR, the author will definately see it.

LiveOverflow• 8 years ago

Must be advanced because:

Throw away your paid tools because this is some God level shit. Now with 4 hand written parsers, an intelligent payload generator, powerful fuzzing engine, DOM scanner, hidden parameter discovery and an incredibly fast crawler. F*cking retweet it!

- https://twitter.com/s0md3v/status/1061255510677057537

Exactly, that's why you have no idea how it works and all. Well, it took me a month and being a developer of 30+ open source software, this is the first time I am saying this is some God level shit and I mean it.

- https://twitter.com/s0md3v/status/1061662698335723520

sjroot• 8 years ago

UncleMeat• 8 years ago

Why the heck would "four hand written parsers" be a selling point?

tptacek• 8 years ago

https://www.theonion.com/fuck-everything-were-doing-five-bla...

eugenekolo2• 8 years ago

Sarcastic?

Not sure testimonials from the dev themselves mean anything.

simplegeek• 8 years ago

Does this work on web-pages behind a login?

amatera• 8 years ago

You can supply your own http headers. So i guess you can send cookies and that things with it.

rynop• 8 years ago

If you’re going to use this against a site that runs in AWS, make sure to request permission first @ https://aws.amazon.com/security/penetration-testing

Thx for the oss contribution-Looking forward to trying this out

dyu• 8 years ago

Interestingly, as of last year Azure no longer requires advance notice: https://www.microsoft.com/en-us/msrc/pentest-rules-of-engage...

balibebas• 8 years ago

Great! Thanks for sharing this. Mirrored. https://git.habd.as/comfusion/XSStrike

XSStrike: XSS detection suite

Related Stories