# XSStrike: detecting and confirming cross-site scripting

> How to install and run XSStrike, why context-aware payloads beat generic ones, and how to keep XSS testing inside scope.

`XSStrike` tests for cross-site scripting. What sets it apart from a generic fuzzer is that it analyses how a parameter is reflected — HTML body, attribute, script context — and generates payloads that fit that context, rather than firing a fixed list and hoping.

## Install

```bash
git clone https://github.com/s0md3v/XSStrike.git
cd XSStrike && pip install -r requirements.txt
python xsstrike.py --help
```

## Core commands

```bash
# a single parameterised URL
python xsstrike.py -u "https://example.com/search?q=test"

# POST data
python xsstrike.py -u "https://example.com/search" --data "q=test"

# crawl then test
python xsstrike.py -u "https://example.com" --crawl

# authenticated
python xsstrike.py -u "https://example.com/search?q=test" \
  --headers "Cookie: session=abc123"

# throttle
python xsstrike.py -u "https://example.com/search?q=test" --delay 2 --timeout 10
```

## Output

Human-readable to the console: the parameter, the reflection context, the payload that fired, and its confidence. XSStrike is an interactive analysis tool, not a JSON producer — its results are confirmed by hand.

## Where it sits in Tandera

XSStrike runs in the **analyze** phase of `recon_web_full` — the active flow only; it sends real payloads, so it is excluded from `NonIntrusive` lite recon. It works over the parameters that `arjun` discovered and the endpoints `katana` crawled, focusing effort on inputs that are actually reflected.

## Using it in a pentest

**A reflected payload is not yet a finding.** Confirm execution — a real alert, a real DOM change — and capture a screenshot as evidence. "Reflected without encoding" and "executes script" are different severities.

**Context is the whole game.** The same input can be safe in one context and exploitable in another. XSStrike's context detection is why it finds cases a generic payload list misses; read what context it reports, because that determines the real-world impact.

**Throttle and coordinate.** XSS testing writes payloads into the application. On anything with stored inputs you can persist test strings into places real users see — agree the testing window with the client and use `--delay`.

**Stored XSS needs manual follow-up.** XSStrike is strongest on reflected XSS. For stored, use it to find the injection point, then confirm the execution sink by hand.

---

Canonical: https://tandera.io/tools/xsstrike
This page as markdown: https://tandera.io/tools/xsstrike.md
Index for agents: https://tandera.io/llms.txt

Every page here is also available as markdown: append `.md` to the path (e.g. `/recon.md`, `/index.md` for this homepage, `/blog/<slug>.md`), or request the canonical path with `Accept: text/markdown`.