XSSer - Cross Site "Scripter"

automatic framework to detect, exploit and report XSS vulnerabilities in web-based applications

v1.9 — "Bl4ck Swarm!" 1515 XSS vectors DOM DCP Blind-XSS HTTP Response Splitting XST Induced injection WAF bypassers Encoding bypassers Dorking Crawler GET / POST Heuristic PDF · XML · JSON Tor / Reverse proxy

#News

#Introduction

Cross Site "Scripter" (aka XSSer) is an automatic -framework- to detect, exploit and report XSS vulnerabilities in web-based applications. It provides several options to try to bypass certain filters and various special techniques for code injection.

Key features

Widely regarded as one of the most complete and influential XSS frameworks ever released — used, shipped, taught and cited across the security world since 2010.

  • [ > 1500 ] pre-installed XSS attacking vectors (automatic fuzzing).
  • Targeting: URL, file, stdin/pipe, raw HTTP request (-r), 'dorking' (multiple engines) and crawler.
  • Injection: GET/POST, Cookie/User-Agent/Referer, DOM and HTTP Response Splitting.
  • Evasion: per-WAF bypassers + character-encoding bypassers; proxy/Tor; client-certificate auth.
  • Validation: each finding is verified for real executability — a context-aware engine tells apart executable contexts (HTML, JS, event handlers, javascript:/data: URIs) from harmless reflections, with an optional headless-browser reverse connection to confirm findings and cut false positives.
  • Reporting: PDF (professional), XML and JSON (for CI / pipelines).

XSSer can bypass-exploit code on several WAFs:

[Cloudflare] Cloudflare WAF
[Akamai] Akamai (Kona / App & API Protector)
[AWS] AWS WAF
[Azure] Azure Front Door WAF
[Imperva] Imperva (Incapsula / Cloud WAF)
[F5] F5 BIG-IP ASM / Advanced WAF
[Barracuda] Barracuda WAF
[ModSec] Mod-Security + OWASP CRS v3
[Wordfence] Wordfence (WordPress)
[Sucuri] Sucuri (CloudProxy)
[FortiWeb] Fortinet FortiWeb
[WebKnight] AQTRONIX WebKnight

#Download

Latest stable: XSSer v1.9 "Bl4ck Swarm!"

XSSer v1.9 (.tar.gz) .zip Torrent (.tar.gz) Torrent (.zip) Debian/Ubuntu (.deb) 
$ wget https://xsser.03c8.net/xsser/xsser-1.9.tar.gz
$ tar xf xsser-1.9.tar.gz
$ cd xsser-1.9
$ sudo python3 setup.py install
$ xsser -h
$ xsser --gtk   # for the GUI

#Captures

Click any capture to open it full-size.

Shell
XSSer shell
Dorking (multiple engines)
XSSer dorking
WAF Bypassers & Encoders
XSSer options
GTK GUI
XSSer GUI
GUI: Anti-antiXSS / IDS (WAFs)
XSSer GUI WAFs
GUI: Encoders & Bypassers
XSSer GUI bypassers
GeoMap (dorking swarm)
XSSer GeoMap
PDF Report
XSSer PDF report

#Documentation

Talks & papers

References & recognition

Running strong since 2010, XSSer is one of the most widely-used and recognised open-source XSS frameworks in the world — shipped by default in the leading security distributions, featured in books and the security press, cited across academic research and taught in hundreds of tutorials.

Security distributions

Books & press

Academic research

Community & awards

Installation

XSSer runs on many platforms. It requires Python (>= 3.9).

Only two libraries are mandatory (the core HTTP engine and the HTML parser):

The rest are optional and only needed for a specific feature:

Install with pip

Core libs only:

$ pip3 install .

With a single feature (e.g. PDF reporting):

$ pip3 install .[pdf]

Everything (all optional features):

$ pip3 install .[full]

Debian-based systems (Kali, Ubuntu, ParrotSec)

Install the package directly:

$ sudo apt install ./xsser_1.9_all.deb

Or install the libraries by hand. The distro package name differs from the pip name:

pip nameDebian/Ubuntu/Kali packageNeeded for
pycurlpython3-pycurlmandatory — core HTTP engine
beautifulsoup4python3-bs4mandatory — core HTML parser
fpdf2python3-fpdf2--pdf report exporter
ddgspip only (no distro package yet)-d / -l dorking
seleniumpython3-selenium--Dom / --reverse-check
PyGObjectpython3-gi--gtk GUI
pycairopython3-cairo (+ python3-gi-cairo)--gtk GUI
pygeoippython3-geoip--gtk GeoMap
Pillowpython3-pil--gtk GUI

Mandatory:

$ sudo apt-get install python3-pycurl python3-bs4

Optional (per feature you want to enable):

$ sudo apt-get install python3-fpdf2 python3-selenium python3-gi python3-gi-cairo python3-cairo python3-pil python3-geoip

#Source Code

XSSer can be cloned from different code repositories.

Official

https://code.03c8.net/epsylon/xsser

$ git clone https://code.03c8.net/epsylon/xsser

Mirror (GitHub)

https://github.com/epsylon/xsser

$ git clone https://github.com/epsylon/xsser

Mirror (SourceForge)

https://sourceforge.net/p/xsser/code/

$ git clone https://git.code.sf.net/p/xsser/code xsser

#Packages

XSSer v1.9: "Bl4ck Swarm!" latest

$ wget https://xsser.03c8.net/xsser/xsser_1.9_all.deb
$ sudo apt install ./xsser_1.9_all.deb
$ xsser --gtk   # for the GUI

XSSer v1.8.3: "The HiV€!"

XSSer v1.7.2b: "ZiKA-47 Swarm!"

XSSer v1.6: "Grey Swarm!"

#License

XSSer is released under the General Public License v3 and is copyrighted by psy.

#Support

This framework is actively looking for new sponsors and funding. If you or your organization has an interest in keeping XSSer alive, please contact directly.

Shop: thehackerstyle.com/store