aeondave/xsstrike

XSStrike

Context-aware XSS scanner — intelligent payload generation, DOM analysis, WAF evasion.

Quick Start

git clone https://github.com/s0md3v/XSStrike
cd XSStrike && pip3 install -r requirements.txt

# Single URL / GET param
python3 xsstrike.py -u "http://target.com/search?q=test"

# POST data
python3 xsstrike.py -u "http://target.com/feedback" --data "comment=test&name=x"

# Crawl full site
python3 xsstrike.py -u "http://target.com" --crawl -l 3 -t 10

# Blind XSS (inject on crawl, callback on trigger)
python3 xsstrike.py -u "http://target.com" --crawl --blind

# WAF bypass fuzzing
python3 xsstrike.py -u "http://target.com?q=test" --fuzzer

Core Flags

| Flag | Purpose | |------|---------| | -u <url> | Target URL with injectable parameter | | --data <data> | POST body (default: GET) | | --crawl | Crawl site and test all discovered parameters | | -l <depth> | Crawl depth (default: 2) | | --seeds <file> | Crawl seed URLs from file | | --blind | Blind XSS — inject payloads during crawl (no reflection check) | | --fuzzer | Fuzz WAF filters (slow, with delays) | | --dom | DOM XSS analysis only | | --skip-dom | Skip DOM analysis (faster) | | -t <threads> | Thread count | | -d <ms> | Delay between requests (ms) | | --timeout <s> | Request timeout (seconds) | | --encode | Encode payloads for WAF evasion | | --json | Treat POST data as JSON | | --path | Test path injection | | --headers <h> | Custom headers (separate multiple with \n) | | --proxy <proxy> | HTTP/HTTPS proxy (e.g., http://127.0.0.1:8080) | | --file-log-level | File logging verbosity | | --log-file <path> | Save output to log file |

XSStrike vs Dalfox

| | XSStrike | Dalfox | |-|----------|--------| | Speed | Moderate | Fast | | WAF evasion | Deep encoding engine | Basic detection | | Context analysis | 4 hand-written parsers | Heuristic | | DOM XSS | Yes (dedicated analysis) | Limited | | Use when | WAF-protected, complex filters | Large-scope quick scans |

Common Workflows

# Authenticated single-param scan
python3 xsstrike.py -u "http://target.com/search?q=test" \
    --headers "Cookie: PHPSESSID=abc123"

# POST JSON API
python3 xsstrike.py -u "http://api.target.com/render" \
    --json --data '{"name":"test","msg":"hello"}'

# Full site crawl with auth
python3 xsstrike.py -u "http://target.com" --crawl -l 3 -t 10 \
    --headers "Cookie: session=abc123\nX-Custom: value"

# Blind XSS across full site
python3 xsstrike.py -u "http://target.com" --crawl --blind \
    --headers "Cookie: session=abc123"

# WAF bypass mode (slow)
python3 xsstrike.py -u "http://target.com?id=1" --fuzzer -d 2

# Through Burp proxy
python3 xsstrike.py -u "http://target.com/search?q=test" \
    --proxy http://127.0.0.1:8080

# Log results
python3 xsstrike.py -u "http://target.com" --crawl \
    --log-file results.txt --file-log-level INFO

Payload Context Detection

XSStrike uses 4 hand-written parsers to detect injection context:

| Context | Detected By | Payload Type | |---------|------------|--------------| | HTML tag body | HTML parser | Event handler injection | | HTML attribute | Attribute parser | Attribute breakout | | JavaScript string | JS parser | Quote escape + exec | | URL context | URL parser | URL encoding aware |

Resources

| File | When to load | |------|--------------| | references/xss-context-bypass.md | Context-specific payloads, WAF evasion patterns, blind XSS setup, DOM sink list |