XSStrike: detecting and confirming cross-site scripting

XSStrike · MIT

XSStrike tests for cross-site scripting. What sets it apart from a generic fuzzer is that it analyses how a parameter is reflected — HTML body, attribute, script context — and generates payloads that fit that context, rather than firing a fixed list and hoping.

Install

git clone https://github.com/s0md3v/XSStrike.git
cd XSStrike && pip install -r requirements.txt
python xsstrike.py --help

Core commands

# a single parameterised URL
python xsstrike.py -u "https://example.com/search?q=test"

# POST data
python xsstrike.py -u "https://example.com/search" --data "q=test"

# crawl then test
python xsstrike.py -u "https://example.com" --crawl

# authenticated
python xsstrike.py -u "https://example.com/search?q=test" 
  --headers "Cookie: session=abc123"

# throttle
python xsstrike.py -u "https://example.com/search?q=test" --delay 2 --timeout 10

Output

Human-readable to the console: the parameter, the reflection context, the payload that fired, and its confidence. XSStrike is an interactive analysis tool, not a JSON producer — its results are confirmed by hand.

Where it sits in Tandera

XSStrike runs in the analyze phase of recon_web_full — the active flow only; it sends real payloads, so it is excluded from NonIntrusive lite recon. It works over the parameters that arjun discovered and the endpoints katana crawled, focusing effort on inputs that are actually reflected.

Using it in a pentest

A reflected payload is not yet a finding. Confirm execution — a real alert, a real DOM change — and capture a screenshot as evidence. “Reflected without encoding” and “executes script” are different severities.

Context is the whole game. The same input can be safe in one context and exploitable in another. XSStrike’s context detection is why it finds cases a generic payload list misses; read what context it reports, because that determines the real-world impact.

Throttle and coordinate. XSS testing writes payloads into the application. On anything with stored inputs you can persist test strings into places real users see — agree the testing window with the client and use --delay.

Stored XSS needs manual follow-up. XSStrike is strongest on reflected XSS. For stored, use it to find the injection point, then confirm the execution sink by hand.