xssearch

Advanced XSS detection tool written in Rust, combining context-aware payload intelligence with the injection breadth.

This tool was inspired XSStrike and XSSER. The payload was collected from different sources:

• https://github.com/ardakocadoru/xss-cheatsheet
• https://github.com/Proviesec/xss-payload-list
• https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html
• https://github.com/swisskyrepo/PayloadsAllTheThings

Thanks guys, you are awesome ❤️

Warning: Only use against systems you own or have explicit written authorization to test.

Features

• Context-aware scanning - probes each parameter first, detects where the value reflects (HTML body, attribute, JavaScript, comment, <title>, <textarea>, etc.) and selects the most appropriate payloads for that context rather than blindly firing everything
• 100+ built-in payloads - HTML tags, attribute breakouts, JS injection, polyglots, DOM sinks, WAF bypass variants
• WAF detection & bypass - fingerprints Cloudflare, ModSecurity, Sucuri, Imperva, Akamai, AWS WAF, F5 BIG-IP, Barracuda, Wordfence; applies per-WAF bypass transforms (case mutation, comment insertion, zero-width characters and encoding)
• Crawler - spiders links and forms to discover injectable parameters automatically
• Header & cookie injection - tests Referer, User-Agent, X-Forwarded-For, X-Real-IP, and other headers, plus cookie values
• Blind XSS - injects out-of-band callback payloads (compatible with Burp Collaborator, interactsh) into every sink for deferred execution scenarios (admin panels, log viewers and alike)
• DOM XSS analysis - static inspection of innerHTML, eval, document.write, location.href, jQuery .html(), and other dangerous sinks with source detection
• Payload encoding - URL, double-URL, HTML entity, Unicode and base64/eval encoding with composable flags
• JSON output - structured findings for integration with other tooling
• Markdown report - human-readable report with a severity summary table, per-finding detail sections, and a quick-reference table; ready to paste into a wiki or attach to a ticket
• Pure Rust/rustls - no OpenSSL dependency; single static-ish binary

Installation

From source (Nix)

git clone https://github.com/fabian-affolter/xssearch
cd xssearch
nix-shell --run "cargo build --release"
# binary: target/release/xssearch

Release build with LTO and stripped symbols:

nix-shell --argstr release true --run "$BUILD"

From source (standard)

Requires Rust 1.75+.

cargo build --release

Nixpkgs

For Nix or NixOS users is a package available. Keep in mind that the latest releases might only be present in the unstable channel.

nix-env -iA nixos.xssearch

Usage

xssearch [OPTIONS] <--url <URL> | --file <URLS_FILE>>

Options

Flag	Description
-u, --url <URL>	Target URL. Use FUZZ to mark a custom injection point
-f, --file <FILE>	File with one URL per line
-d, --data <DATA>	POST body. Use FUZZ to mark injection point
-H, --header <H>	Extra request header, repeatable
--cookie <COOKIE>	Cookie string
--proxy <URL>	HTTP/HTTPS proxy
--timeout <N>	Request timeout in seconds (default: 10)
--user-agent <UA>	Custom User-Agent
--follow-redirects	Follow HTTP redirects
--threads <N>	Concurrent requests (default: 2)
--delay <MS>	Delay between requests in milliseconds
--crawl	Spider the target for links and forms
--crawl-depth <N>	Crawl depth (default: 3)
--headers-inject	Test common HTTP headers as injection points
--cookie-inject	Test cookie values as injection points
--blind <URL>	Blind XSS callback URL
--dom	Static DOM XSS sink analysis
--fuzz	Fire all payloads regardless of reflection context
--payload-set <SET>	all | html | js | attr | poly | dom | mxss | waf (default: all)
--payloads-file <FILE>	Custom payload file, one per line
--encode <LIST>	Comma-separated encodings: url,html,unicode,double,base64
--prefix <STR>	Prepend string to every payload
--suffix <STR>	Append string to every payload
--waf-detect	Fingerprint WAF before scanning
--waf-bypass	Apply WAF bypass transforms to payloads
--output-json <FILE>	Write findings to JSON file
--output-md <FILE>	Write findings to Markdown file
-v, --verbose	Verbose output (show context, all probes)
-V, --version	Print version and exit

Examples

Basic GET parameter scan

xssearch -u "https://example.com/search?q=test"

POST form

xssearch -u "https://example.com/login" -d "user=admin&pass=FUZZ"

Crawl from root, detect WAF, test headers

xssearch -u "https://example.com/" --crawl --waf-detect --headers-inject -v

WAF bypass with URL + HTML encoding

xssearch -u "https://example.com/?q=FUZZ" --waf-detect --waf-bypass --encode url,html

Blind XSS with interactsh callback

xssearch -u "https://example.com/contact" -d "msg=FUZZ" \
  --blind "https://abc123.oast.fun/xssearch"

DOM XSS static analysis only

xssearch -u "https://example.com/app" --dom --no-banner

Save results as JSON

xssearch -u "https://example.com/?q=test" --output-json results.json

Save results as Markdown

xssearch -u "https://example.com/?q=test" --output-md report.md

Save both formats at once

xssearch -f targets.txt --crawl --waf-detect --output-json results.json --output-md report.md

Proxy through Burp Suite

xssearch -u "https://example.com/?q=test" --proxy http://127.0.0.1:8080 -v

Testing

Local minimal target

The fastest way to verify the tool is to spin up an intentionally vulnerable Python server locally:

python3 - <<'EOF'
import http.server, urllib.parse

class H(http.server.BaseHTTPRequestHandler):
    def log_message(self, *a): pass
    def do_GET(self):
        p = urllib.parse.urlparse(self.path)
        q = urllib.parse.parse_qs(p.query)
        val = q.get('q', [''])[0]
        body = f'<html><body><p>Search: {val}</p></body></html>'.encode()
        self.send_response(200)
        self.send_header('Content-Type', 'text/html')
        self.end_headers()
        self.wfile.write(body)

http.server.HTTPServer(('127.0.0.1', 9999), H).serve_forever()
EOF

Then scan it:

xssearch -u "http://127.0.0.1:9999/?q=test" -v

Expected output: [Vuln] XSS in 'q' with an HTML-context payload.

Local Docker targets

These images are purpose-built for security tool testing and contain no real user data.

DVWA (Damn Vulnerable Web Application)

docker run -d -p 8080:80 vulnerables/web-dvwa
# Set security level to Low in the UI first
xssearch -u "http://localhost:8080/vulnerabilities/xss_r/?name=test" \
  --cookie "PHPSESSID=<your-session>; security=low"

OWASP WebGoat

docker run -d -p 8081:8080 webgoat/goat-and-wolf
xssearch -u "http://localhost:8081/WebGoat/" --crawl --crawl-depth 2 -v

OWASP Juice Shop

docker run -d -p 3000:3000 bkimminich/juice-shop
xssearch -u "http://localhost:3000/" --crawl --dom -v

bWAPP

docker run -d -p 8082:80 raesene/bwapp
# Activate bWAPP at http://localhost:8082/install.php first
xssearch -u "http://localhost:8082/xss_get.php?firstname=test&lastname=test" \
  --cookie "PHPSESSID=<your-session>; security_level=0"

Public intentionally vulnerable targets

These sites are provided specifically for security tool testing. No authentication or setup is needed.