XSSearch - A comprehensive reflected XSS tool built on selenium framework in python

Last update: Oct 18, 2022

Overview

XSSearch

A Comprehensive Reflected XSS Scanner

XSSearch is a comprehensive reflected XSS tool with 3000+ Payloads for automating XSS attacks and validating XSS endpoints.

DISCLAIMER :

The XSSearch developer will not be held liable if the tool is used with harmful or criminal intent. Please use at your own risk. :)

USES :

XSSearch can be used to discover reflected Cross Site Scripting (XSS) vulnerabilities
XSSearch is capable of validating XSS payloads.
XSSearch will facilitate in the automation of brute - force attack for the verification of reflected XSS.
Works on all Linux environment
This can also be used in penetration testing to evaluate sanitization strength.

FEATURES :

Contains more than 3000 payloads for XSS validation
Works on selenium framework & ChromeDriver
It is faster than other XSS tools since the code is very light and rapid.
The code and payloads can be modified according to the situation.

SETUP & INSTALLATION

XSSearch requires Selenium, ChromeDriver and Python to work smoothly on your system.

Installing Selenium

$ sudo apt update
$ pip3 install selenium

Installing Chrome Browser for Linux (Skip this if you already have Chrome browser on your Linux)

$ wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
$ sudo apt install ./google-chrome-stable_current_amd64.deb

You may use the command to start Chrome from your terminal.

$ google-chrome --no-sandbox

Downloading ChromeDriver

Go to https://chromedriver.chromium.org/downloads and get the linux 64 zipped version of ChromeDriver 80.0.3987.106.

Unzip the zip file. There will be a file for ChromeDriver. Open terminal on the same location and use the following command.

$ sudo chmod +x chromedriver
$ sudo mv -f chromedriver /usr/bin/chromedriver

USAGE

XSSearch is a command line tool that uses a single command line instruction for simple and speedy execution.
Note : This tool will only work on url which has a input paramter in the url. Example : www[.]target[.]com/?xyz=

$ python3 xssearch.py -u url.com/?s={xss} -p payloads.txt

Arguments :
-u : It is required for URL input
-p : It is required for Payload file input
{xss} : It is a placeholder that the user should append after an equal to sign (=) in the url argument.

Live Usage

$ python3 xssearch.py -u https://ac121f0e1eb31ae5c0c9473f00f400f7.web-security-academy.net/?search={xss} -p payloads.txt

Above is the screenshot of the tool with live example.
Valid XSS exploits are marked with red alerts.
Invalid XSS exploits are marked with blue alerts.

Errors & Warnings
The following are some errors that might arise as a result of an incomplete command, not specifying arguments or not specifying placeholders.

Use the below command to get help

$ python3 xssearch.py -h

LICENSE

MIT-License

More suggestions and contributions are highly appreciated to make this tool better :)

STAY SAFE, ACT SMART

Hit Me Up

Python Webscraping using Selenium

Web Scraping with Python and Selenium The code shows how to do web scraping using Python and Selenium. We use as data the https://sbot.org.br/localize

1 Dec 1, 2021

This file will contain a series of Python functions that use the Selenium library to search for elements in a web page while logging everything into a file

element_search with Selenium (Now With docstrings 😎 ) Just to mention, I'm a beginner to all this, so it it's very possible to make some mistakes The

2 Aug 12, 2021

A simple Python script I wrote that scrapes NASA's James Webb Space Telescope tracker website using Selenium and returns its current status and location.

9 Feb 10, 2022

Comments

error: unrecognized arguments:

i have this issue : D:\BugHunter\XSSearch-main> python.exe xssearch.py -u https://xss-game.appspot.com/level1/frame?query={xss} -p payloads.txt DevTools listening on ws://127.0.0.1:50738/devtools/browser/55094a07-eb16-49ee-bcfd-f6b52fe21536 [0907/142057.264:ERROR:command_buffer_proxy_impl.cc(125)] ContextResult::kTransientFailure: Failed to send GpuControl.CreateCommandBuffer. usage: xssearch.py [-h] -u url.com/?s={xss} -p payloads.txt xssearch.py: error: unrecognized arguments: -encodedCommand eABzAHMA -inputFormat xml -outputFormat text

OS = Windows 10

opened by OVERPEY 0

Releases(v1.0)

v1.0(Feb 4, 2022)

This is the version 1.0 of XSSearch
Source code(tar.gz)
Source code(zip)

XSSearch - A comprehensive reflected XSS tool built on selenium framework in python

Related tags

Overview

XSSearch

A Comprehensive Reflected XSS Scanner

XSSearch is a comprehensive reflected XSS tool with 3000+ Payloads for automating XSS attacks and validating XSS endpoints.

DISCLAIMER :

USES :

FEATURES :

SETUP & INSTALLATION

USAGE

LICENSE

More suggestions and contributions are highly appreciated to make this tool better :)

STAY SAFE, ACT SMART

Hit Me Up

You might also like...

Python Webscraping using Selenium

This file will contain a series of Python functions that use the Selenium library to search for elements in a web page while logging everything into a file

Compiles python selenium script to be a Window's executable

Automated tests for OKAY websites in Python (Selenium) - user friendly version

Whatsapp messages bulk sender using Python Selenium.

reCaptchaBypasser For Bypass Any reCaptcha For Selenium Python

Percy visual testing for Python Selenium

A Python Selenium library inspired by the Testing Library

A simple Python script I wrote that scrapes NASA's James Webb Space Telescope tracker website using Selenium and returns its current status and location.

Comments

error: unrecognized arguments:

Releases(v1.0)

v1.0(Feb 4, 2022)

Owner

Sathyaprakash Sahoo

pytest_pyramid provides basic fixtures for testing pyramid applications with pytest test suite

Based on the selenium automatic test framework of python, the program crawls the score information of the educational administration system of a unive

Cloint India Pvt. Ltd's (ClointFusion) Pythonic RPA (Automation) Platform

Show surprise when tests are passing

WIP SAT benchmarking tooling, written with only my personal use in mind.

Webscreener is a tool for mass web domains pentesting.

This package is a python library with tools for the Molecular Simulation - Software Gromos.

UUM Merit Form Filler is a web automation which helps automate entering a matric number to the UUM system in order for participants to obtain a merit

This repository contains a set of benchmarks of different implementations of Parquet (storage format) <-> Arrow (in-memory format).

Python Testing Crawler 🐍 🩺 🕷️ A crawler for automated functional testing of a web application

Selenium Page Object Model with Python

Mockoon is the easiest and quickest way to run mock APIs locally. No remote deployment, no account required, open source.

Python version of the Playwright testing and automation library.

Code coverage measurement for Python

Generic automation framework for acceptance testing and RPA

This project is used to send a screenshot by email of your MyUMons schedule using Selenium python lib (headless mode)

Pynguin, The PYthoN General UnIt Test geNerator is a test-generation tool for Python

A python bot using the Selenium library to auto-buy specified sneakers on the nike.com website.

Public repo for automation scripts

A pytest plugin to run an ansible collection's unit tests with pytest.