X-XSS
XSStrike
Context-aware XSS detection and exploitation suite with its own fuzzing engine and payload generator.
OVERVIEW
XSStrike (github.com/s0md3v/XSStrike) is a Python3 XSS detection and exploitation suite built around a fuzzing engine and its own HTML/JS parser, rather than a static list of canned payloads. It crawls a target, parses the DOM context around each reflection point, and generates payloads tailored to that specific context — inside a script tag, an attribute, an event handler — instead of firing the same generic <script>alert(1)</script> everywhere.
Beyond detection it can also fingerprint WAFs and attempt to craft bypasses, test for DOM-based XSS, and generate proof-of-concept payloads ready to hand to a client, which makes it useful both as a first-pass scanner across many parameters and as a way to build a working payload once a reflection point has already been spotted manually.
USE CASES
Practical use cases
- 01
Fuzzing every parameter of a URL or form to find reflected/DOM XSS across a large surface quickly.
- 02
Generating a context-aware payload once a reflection point has already been found manually.
- 03
Fingerprinting the WAF in front of a target and testing candidate bypass payloads.
- 04
Producing a working proof-of-concept payload to include in the report.
QUICK START
Once a parameter reflects input and a lightweight scanner isn't enough — to fuzz it properly and generate context-aware payloads for confirmed XSS.
- Confirm the target and the parameters being fuzzed are inside the agreed scope, and that automated crawling/fuzzing traffic is authorized.
- Clone the repo and install the Python3 dependencies with pip.
- Run XSStrike against a single URL to fuzz its parameters, or point it at a crawl to cover a whole path.
- Review each reported finding and confirm the generated payload actually fires in a real browser before reporting it.
python3 xsstrike.py -u "https://target.example.com/search?q=test" --crawlBEFORE YOU RUN IT
What to check before running it
Fuzzing and crawling generate a real volume of requests against the target app — confirm the rules of engagement allow automated traffic at that rate before pointing it at production.
A flagged payload is a candidate, not a confirmed vulnerability: manually reproduce it in a real browser session, since some contexts (WAFs, output encoding) produce false positives.
The WAF-bypass and DOM XSS modules actively execute JavaScript in the target's context — stay inside the agreed scope and note in the report exactly which payload and endpoint were used.