anonmoty/xxstrikeXSStrike based XSS scanner with custom features. Detects XSS vulnerabilities in web applications.
Developed by: Maxod anonmoty 🔰
Official Repository: https://github.com/anonmoty/XXStrike
Overview • Key Features • Modules • Installation • Usage • Comparison • Disclaimer
XXStrike is an advanced, multi-threaded Cross-Site Scripting (XSS) detection and vulnerability assessment framework engineered for penetration testers, bug bounty hunters, application security engineers, and DevSecOps professionals.
Designed as a modern, lightweight, and high-speed alternative to legacy XSS scanners, XXStrike combines intelligent parameter discovery, DOM source-to-sink tracking, context-aware payload fuzzing, and WAF/filter bypass heuristics into a single cohesive terminal interface.
Optimized natively for both Android (Termux) and standard Linux distributions.
innerHTML, document.write, eval(), postMessage).| # | Module Name | Method & Capabilities |
|---|---|---|
01 | Parameter Discovery | Uncovers query parameters, hidden form fields, and reflected arguments. |
02 | Reflected XSS Scanner | Contextual injection verification with boundary-breaking tests. |
03 | DOM-Based XSS Detector | JavaScript source-to-sink flow tracing and dangerous pattern extraction. |
04 | XSS Header Audit | Evaluates Content-Security-Policy (CSP), X-XSS-Protection, and X-Content-Type-Options. |
05 | WAF / Filter Detection | Tests 12 bypass transformations (Unicode, Hex, Double-encoding, mixed cases). |
06 | JavaScript Sink Analysis | Scans external scripts and inline blocks for insecure APIs. |
07 | Cookie Security Audit | Checks session token flags (HttpOnly, Secure, SameSite) for XSS-assisted exfiltration. |
08 | Stored XSS Vector Analyzer | Detects persistent storage entry points (forms, textareas, comment fields). |
09 | Advanced XSS Fuzzer | 45+ categorized vectors testing encoding, protocol handlers (javascript:, data:), and nested tags. |
10 | HTML & Injection Point Analyzer | Parses meta tags, sandboxed iframes, event attributes, and sanitizers (DOMPurify, Bleach). |
| Capability | Legacy XSStrike | Generic Scanners | ⚡ XXStrike v2.0 |
|---|---|---|---|
| Termux / Mobile Linux Support | ⚠️ Unstable | ❌ No | ✅ Native (100% Optimized) |
| Integrated DOM Sink Tracker | Partial | ❌ No | ✅ Full Source-to-Sink |
| Cookie Flag & CSP Security Scoring | ❌ No | Partial | ✅ Comprehensive (A+ to F) |
| Interactive CLI + Full Auto Scan | ❌ CLI Only | ❌ CLI Only | ✅ Dual (Menu + Batch 99) |
| HTML / JSON Auto-Reporter | ❌ No | Partial | ✅ Built-in Exporter |
| Active Development | Stale | Varies | ✅ Active (2025 Release) |
# Update repository lists
pkg update && pkg upgrade -y
# Install dependencies
pkg install python git -y
# Clone repository
git clone https://github.com/anonmoty/XXStrike.git
# Navigate to project directory
cd XXStrike
# Install required Python packages
pip install -r requirements.txt
# Launch XXStrike
python XSStrike.py