XSStrike – Advanced XSS Detection | Full Tutorial!

11.9K

XSStrike literally makes XSS detection very simple!

It is very handy tool one can use.

What is XSStrike?

XSStrike is a cross-site scripting tool.

It is provided with four handwritten parsers, an intelligent payload generator, a great fuzzing engine, and an amazingly fast crawler.

XSStrike unlike other tools does not inject payloads.

It instead uses handmade parsers to test for web application’s various responses.

Also, it can scan of DOM XSS.

It can also crawl, fingerprint, and fuzz WAFs.

The tool requires Python 3.4+ to work.

Furthermore, it supports Linux, Mac, and even Windows.

---

Editor’s choice:

• Macof – Ultimate Flooding Tool | Tutorial[2020]
• NWAnime – Best Alternatives of NWAnime [2020]
• CCMAKER – Download Ultimate Adobe Piracy Kit[2020]
• LOSMOVIES – The Best Movie Streaming Website Alive
• Andrax – Penetration Testing on Android | Complete Guide

---

XSStrike Highlights:

• Context analysis.
• Configurable Core.
• Highly Researched Work-flow.
• Reflected and DOM XSS Scanning.
• Multi-threaded crawling.
• WAF detection & evasion, WAF Fingerprinting.
• Handmade HTML & JavaScript parser.
• Powerful fuzzing engine.
• Intelligent payload generator.
• Complete HTTP Support.
• Powered by Photon, Zetanize, and Arjun.
• Well documented code and regular updates.

Installing XSStrike:

1. Cloning git repo.

$ git clone https://github.com/s0md3v/XSStrike.git

2. Navigating directory and install the requirements:

$ cd XSStrike
$ pip install -r requirements.txt

3. Running XSStrike:

$ python xsstrike

XSStrike Usage:

To list all available arguments, type --help:

usage: xsstrike.py [-h] [-u TARGET] [--data DATA] [-t THREADS]
                   [--fuzzer] [--update] [--timeout] [--params] [--crawl]
                   [--skip-poc] [--skip-dom] [--headers] [-d DELAY]

optional arguments:
  -h, --help            show this help message and exit
  -u, --url             target url
  --data                post data
  -t, --threads         number of threads
  -l, --level           level of crawling
  --fuzzer              fuzzer
  --update              update
  --timeout             timeout
  --params              find params
  --crawl               crawl
  --skip-poc            skip poc generation
  --skip-dom            skip dom checking
  --headers             add headers
  -d, --delay           delay between requests

How to use XSStrike Tool?

Using this tool is quite simple.

You just need to understand some of the Linux basics.

Don’t worry, we will guide you to use it step-by-step.

1. Scanning Single URL:

Option: -u or --url

To test a single webpage which uses the GET method:

$ python xsstrike.py -u "http://example.com/search.php?q=query"

Supplying POST data:

$ python xsstrike.py -u "http://example.com/search.php" --data "q=query"

2. Crawling:

Option: --crawl

To start crawling from the target webpage, run:

$ python xsstrike.py -u "http://example.com/page.php" --crawl

To find hidden parameters:

Option: --params

$ python xsstrike.py -u "http://example.com/page.php" --params

3. Skipping POC and DOM:

Option: --skip-poc

$ python xsstrike.py -u "http://example.com/search.php?q=query" --skip-poc

Option: --skip-dom

$ python xsstrike.py -u "http://example.com/search.php?q=query" --skip-dom

Conclusion:

XSStrike is really amazing tool to find for XSS vulnerability in web applications.

You can use this tool for your convenience.

If you liked our content make sure to leave a comment down below and appreciate our team. If you are finding it difficult to use this tool you can leave your questions down below. Team CSHAWK will be soon in touch with you.