security enabled community high v1.0.0

xsstrike

Advanced XSS detection suite with context-aware payload generation, WAF detection/evasion, and DOM XSS scanning.

📋 Live Preview

python3 xsstrike.py -u {target}

🌍 target → url

python3 xsstrike.py -u {target}

Sandbox: execFile · Timeout: 600s

Capabilities

web.injection.xss

web.discovery.xss

security.evasion.waf

web.scan.dom

Parameters

Name	Type	Required	Default	Description	Aliases
`url`	string	Yes	-	Target URL (-u)	`-u`
`data`	string	No	-	POST data string (--data)	`--data`
`json`	boolean	No	-	Treat POST data as JSON (--json)	`--json`
`path`	boolean	No	-	Inject payloads into path (--path)	`--path`
`crawl`	boolean	No	-	Crawl the target URL (--crawl)	`--crawl`
`depth`	integer	No	2	Crawl depth level (-l)	`-l`
`threads`	integer	No	1	Number of threads (-t)	`-t`
`timeout`	integer	No	30	Request timeout in seconds (--timeout)	`--timeout`
`delay`	integer	No	0	Delay between requests in seconds (-d)	`-d`
`headers`	string	No	-	Custom HTTP headers (--headers)	`--headers`
`proxy`	string	No	-	Proxy URL (--proxy)	`--proxy`
`skip-dom`	boolean	No	-	Skip DOM XSS scanner (--skip-dom)	`--skip-dom`
`fuzzer`	boolean	No	-	Enable payload fuzzer (--fuzzer)	`--fuzzer`
`blind`	boolean	No	-	Enable blind XSS detection (--blind)	`--blind`
`silent`	boolean	No	-	Suppress output banner (-s)	`-s`
`console_log_level`	boolean	No	-	Console log level	`--console-log-level`
`e`	boolean	No	-	Encode payloads	`-e`, `--encode`
`file_log_level`	boolean	No	-	File log level	`--file-log-level`
`h`	boolean	No	-	Show this help	`-h`, `--help`
`log_file`	boolean	No	-	Log file path	`--log-file`
`s`	boolean	No	-	Suppress banner	`-s`, `--silent`
`seed`	boolean	No	-	Seed for payload generation	`--seed`

Artifacts

Type	Description	MIME	Schema	Trust
`web.xss.report`	XSS vulnerability report	text/plain	-	verified

Contract

Inputs

web.target.url

Target URL to test for XSS

Outputs

web.injection.xss.results

XSS vulnerability findings

Side effects: network_traffic

Workflow Edges

Produces

web.injection.xss.results

Consumes

web.target.url

Resource Profile

Resource	Value
CPU	medium
Memory	128 MB
Network	medium
Disk I/O	low

Examples

Basic XSS scan

python3 xsstrike.py -u "http://target.com/page.php?q=test"

Scan with POST data

python3 xsstrike.py -u "http://target.com/search" --data "q=test"

Crawl and scan for XSS

python3 xsstrike.py -u "http://target.com" --crawl -l 3

Use proxy and custom headers

python3 xsstrike.py -u "http://target.com/page.php?q=test" --proxy "http://127.0.0.1:8080" --headers "X-Custom: test"

Blind XSS with fuzzer

python3 xsstrike.py -u "http://target.com/page.php?q=test" --blind --fuzzer

Documentation

XSStrike — Advanced XSS Detection

XSStrike is an advanced XSS detection tool with context-aware payload generation, WAF detection and evasion, and DOM XSS scanning capabilities.

Basic Usage

# Simple GET parameter test
python3 xsstrike.py -u "http://target.com/page.php?q=test"

# POST request test
python3 xsstrike.py -u "http://target.com/search" --data "q=test"

# JSON data test
python3 xsstrike.py -u "http://target.com/api" --data '{"q":"test"}' --json

Advanced Scanning

# Crawl and scan
python3 xsstrike.py -u "http://target.com" --crawl -l 3

# Blind XSS detection
python3 xsstrike.py -u "http://target.com/feedback" --blind

# Fuzzer mode
python3 xsstrike.py -u "http://target.com/page.php?q=test" --fuzzer

# WAF evasion
python3 xsstrike.py -u "http://target.com/page.php?q=test" --skip-dom

Dependencies

python3

Related Tools

dalfoxcommixbeef

References

XSStrike GitHub