XSSurge

Advanced XSS Detection Suite

Project • Installation • Documentation • FAQ • Gallery

XSSurge is a Cross Site Scripting detection suite equipped with four hand written parsers, an intelligent payload generator, a powerful fuzzing engine, and an incredibly fast crawler.

Instead of injecting payloads and checking whether they work like many other tools do, XSSurge analyzes the response with multiple parsers and then crafts payloads that are guaranteed to work by context analysis integrated with a fuzzing engine. Here are some examples of the payloads generated by XSSurge:

}]};(confirm)()//\
<A%0aONMouseOvER%0d=%0d[8].find(confirm)>z
</tiTlE/><a%0donpOintErentER%0d=%0d(prompt)``>z
</SCRiPT/><DETAILs/+/onpoINTERenTEr%0a=%0aa=prompt,a()//

Apart from that, XSSurge has crawling, fuzzing, parameter discovery, WAF detection capabilities as well. It also scans for DOM XSS vulnerabilities.

Main Features

• Reflected and DOM XSS scanning
• Multi-threaded crawling
• Context analysis
• Configurable core
• WAF detection & evasion
• Outdated JS lib scanning
• Intelligent payload generator
• Handmade HTML & JavaScript parser
• Powerful fuzzing engine
• Blind XSS support
• Highly researched work-flow
• Complete HTTP support
• Bruteforce payloads from a file
• Powered by Photon, Zetanize and Arjun
• Payload Encoding

Installation

Enter the following commands one by one in terminal:

git clone https://github.com/ssn-code/XSSurge.git
cd XSSurge
pip install -r requirements.txt --break-system-packages

Now, XSSurge can be used at any time as follows:

python xssurge.py

Documentation

• See the sections in this README for installation, usage, and contribution guidance.

FAQ

• This repository currently does not maintain a separate wiki, so please open an issue for questions or suggestions.

Gallery

DOM XSS

Reflected XSS

Crawling

Fuzzing

Bruteforcing payloads from a file

Interactive HTTP Headers Prompt

Hidden Parameter Discovery

⚠️ Acknowledgement

XSSurge is based on the excellent open-source project XSStrike created by s0md3v. This project continues its development with new features, enhancements, bug fixes, and architectural improvements.

Original Repository: https://github.com/s0md3v/XSStrike

Contribution, Credits & License

Ways to contribute

• Suggest a feature
• Report a bug
• Fix something and open a pull request
• Help me document the code
• Spread the word

Licensed under the GNU GPLv3, see LICENSE for more information.

The WAF signatures in /db/wafSignatures.json are taken & modified from sqlmap. I extracted them from sqlmap's waf detection modules, which can be found here and converted them to JSON. /plugins/retireJS.py is a modified version of retirejslib.