Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Please add ability to detect XSS #414

Open
reevesy1 opened this issue Sep 9, 2024 · 2 comments
Open

Please add ability to detect XSS #414

reevesy1 opened this issue Sep 9, 2024 · 2 comments

Comments

@reevesy1
Copy link

reevesy1 commented Sep 9, 2024

I'm assuming this tool isn't maintained anymore or decided to target some other vuln other than XSS, which would make the its name kind of unfortunate.
That or somethings gone wrong with mine as it couldn't find water if it fell out of a boat.
I even gave it the link to vulnerable DVWA page that i even left a working payload in it and it still can't find an XSS.
Surely i'm doing something wrong here.
python3 xsstrike.py -u http://10.6.6.100/vulnerabilities/xss_r/?name=

                                                                                                                        
[~] Checking for DOM vulnerabilities 
[+] WAF Status: Offline 
[!] Testing parameter: name 
[-] No reflection found 

        XSStrike v3.1.5                                                                                                 
                                                                                                                        
[~] Checking for DOM vulnerabilities 
[-] No parameters to test. 
[~] Checking for DOM vulnerabilities 
[~] Checking for DOM vulnerabilities 
[+] WAF Status: Offline 
[+] WAF Status: Offline 
[!] Testing parameter: name 
[!] Testing parameter: name 
[-] No reflection found 
[-] No reflection found

image
2024-09-09_11-42

@TitoSantana609
Copy link

It helps if you add the URL in a string like this:

python3 xsstrike.py -u "http://10.6.6.100/vulnerabilities/xss_r/?name=test"

Ive had way more success with this when enclosing the URL in quotes than if I didn't do it.

@sitsrimts
Copy link

even if it does find something, it just parses out some nonsense payloads with maximum confidence, like:
[+] Payload: <hTmL/+/ONPointEreNTEr%0a=%0aconfirm()%0dx//
[!] Efficiency: 92
[!] Confidence: 10
and they never work.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants