tools

Overview

XSStrike is an automated XSS vulnerability scanner written in Python. Unlike payload-list tools, it generates context-specific payloads by analyzing how the application processes and reflects input — reducing false positives and increasing bypass success against filters and WAFs. It can crawl entire sites, test GET and POST parameters, detect DOM sinks in JavaScript, and test for blind XSS via a callback listener.

Target / Context

Web applications with GET/POST parameters, forms, or JavaScript-rendered input. Effective against applications that partially sanitize input but can be bypassed with context-aware payloads.

Installation

ℹ︎Installation Commands: 
git clone https://github.com/s0md3v/XSStrike.git
cd XSStrike
pip install -r requirements.txt
python xsstrike.py

Basic Usage

ℹ︎Basic Usage: 
python xsstrike.py -u "http://<target>/page?param=test"

Analyzes the param parameter for XSS injection points and generates context-aware payloads based on the reflected output.

Flags & Options

ℹ︎Flags & Options:
FlagDescriptionExample
-uTarget URL with parameter to test-u “http://<target>/search?q=test”
—crawlCrawl the site and test all discovered parameters—crawl
—blindTest for blind XSS; prints payloads to inject manually—blind
—fuzzerEnable fuzzer mode — tests WAF and filter bypass—fuzzer
—dataPOST body data—data “username=test&pass=test”
—paramsComma-separated list of parameters to test—params “q,search”
-lLog all payloads and results to a file-l output.log
—skipSkip confirmation prompts — non-interactive mode—skip
—timeoutRequest timeout in seconds—timeout 10
—proxyRoute traffic through a proxy—proxy “http://127.0.0.1:8080”
-tNumber of threads-t 10

Common Use Cases

Basic Parameter Scan

ℹ︎Commands: 
python xsstrike.py -u "http://<target>/page?param=test"

Tests a single GET parameter. XSStrike analyzes the reflected context and generates payloads tailored to break out of the surrounding HTML structure.

Full Site Crawl

ℹ︎Commands: 
python xsstrike.py -u "http://<target>/" --crawl

Crawls the site from the provided URL, discovers all links and forms, and tests each discovered parameter. Useful when the full attack surface is unknown.

POST Parameter Testing

ℹ︎Commands: 
python xsstrike.py -u "http://<target>/login" --data "username=test&password=test"

Tests POST body parameters — useful for login forms, search endpoints, or any form that submits via POST.

WAF and Filter Bypass Fuzzing

ℹ︎Commands: 
python xsstrike.py -u "http://<target>/page?param=test" --fuzzer

Attempts to identify filtering rules and generate payloads that evade them. Useful when standard payloads are blocked but the reflection point is confirmed.

Proxy Through Burp Suite

ℹ︎Commands: 
python xsstrike.py -u "http://<target>/page?param=test" --proxy "http://127.0.0.1:8080"

Routes all XSStrike requests through Burp Suite for manual inspection and replay. Useful for capturing working payloads and importing them into Repeater.

References / Images