{"id":25074786,"url":"https://github.com/rix4uni/xsschecker","last_synced_at":"2025-04-15T00:12:47.934Z","repository":{"id":53880321,"uuid":"516688853","full_name":"rix4uni/xsschecker","owner":"rix4uni","description":"xsschecker tool checking reflected endpoints finding possible xss vulnerable endpoints.","archived":false,"fork":false,"pushed_at":"2024-11-05T08:44:24.000Z","size":65,"stargazers_count":21,"open_issues_count":1,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-15T00:12:32.118Z","etag":null,"topics":["bugbounty","masshuntxss","recon","reconnaissance","vulnerability","xss","xss-automation","xsschecker"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rix4uni.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-07-22T09:24:49.000Z","updated_at":"2024-12-19T05:24:25.000Z","dependencies_parsed_at":"2024-08-09T06:51:19.473Z","dependency_job_id":null,"html_url":"https://github.com/rix4uni/xsschecker","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rix4uni%2Fxsschecker","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rix4uni%2Fxsschecker/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rix4uni%2Fxsschecker/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rix4uni%2Fxsschecker/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rix4uni","download_url":"https://codeload.github.com/rix4uni/xsschecker/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248981270,"owners_count":21193147,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bugbounty","masshuntxss","recon","reconnaissance","vulnerability","xss","xss-automation","xsschecker"],"created_at":"2025-02-07T00:18:36.822Z","updated_at":"2025-04-15T00:12:47.908Z","avatar_url":"https://github.com/rix4uni.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"```\n _  _  ____  ____   ___  _  _  ____  ___  __ _  ____  ____ \n( \\/ )/ ___)/ ___) / __)/ )( \\(  __)/ __)(  / )(  __)(  _ \\\n )  ( \\___ \\\\___ \\( (__ ) __ ( ) _)( (__  )  (  ) _)  )   /\n(_/\\_)(____/(____/ \\___)\\_)(_/(____)\\___)(__\\_)(____)(__\\_)\n```\n\n\u003ch3 align=\"center\"\u003exsschecker tool checking reflected endpoints finding possible xss vulnerable endpoints.\u003c/h3\u003e\n\n## Install\n```\ngo install github.com/rix4uni/xsschecker@latest\n```\nor\n\n```\ngit clone https://github.com/rix4uni/xsschecker.git \u0026\u0026 cd xsschecker \u0026\u0026 go build xsschecker.go \u0026\u0026 mv xsschecker ~/go/bin/xsschecker \u0026\u0026 cd .. \u0026\u0026 rm -rf xsschecker\n```\n## Usage\n```\nxsschecker -h\nUsage: xsschecker [OPTIONS]\n\nOptions:\n  -H string\n        Custom User-Agent header for HTTP requests. (default \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\")\n  -ao string\n        File to append the output instead of overwriting.\n  -i string\n        Input file containing list of URLs.\n  -match string\n        The string(s) to match against the domain response. Separate multiple strings with commas. (required) (default \"alert(1), confirm(1), prompt(1)\")\n  -maxssc int\n        Maximum number of status code responses required before skipping all URLs from that domain, This flag only can be use with -ssc flag. (default 20)\n  -nc\n        Do not use colored output.\n  -o string\n        File to save the output.\n  -proxy string\n        Proxy server for HTTP requests. (e.g., http://127.0.0.1:8080)\n  -retries int\n        Number of retry attempts for failed HTTP requests. (default 1)\n  -scdn string\n        Comma-separated server names to skip all URLs for (e.g., \"cloudflare,AkamaiGHost,CloudFront,Imperva\").\n  -ssc string\n        Comma-separated status codes to skip all URLs from a domain if encountered (e.g., 403,400).\n  -t int\n        Number of concurrent threads. (default 20)\n  -timeout int\n        Timeout for HTTP requests in seconds. (default 15)\n  -u string\n        Single URL to test.\n  -v    Enable verbose output for debugging purposes.\n  -version\n        Print the version of the tool and exit.\n  -vuln\n        If set, only vulnerable URLs will be printed.\n```\n\n## Reflected XSS Mass Automation\n```\ncat subs.txt | waybackurls \u003e\u003e waybackurls-urls.txt\ncat subs.txt | gau \u003e\u003e gau-urls.txt\ncat live-subs.txt | hakrawler -scope \u003e\u003e hakrawler-urls.txt\ncat waybackurls-urls.txt gau-urls.txt hakrawler-urls.txt | anew -q urls.txt\n\ncat urls.txt | uro | gf allparam | grep \"=\" | gf blacklist | qsreplace '\"\u003e\u003cscript\u003econfirm(1)\u003c/script\u003e' | xsschecker -match '\"\u003e\u003cscript\u003econfirm(1)\u003c/script\u003e'\n```\n\n## Reflected XSS Oneliner Command1\n```\necho \"testphp.vulnweb.com\" | waybackurls | gf xss | uro | qsreplace '\"\u003e\u003cscript\u003econfirm(1)\u003c/script\u003e' | xsschecker -match '\"\u003e\u003cscript\u003econfirm(1)\u003c/script\u003e' -vuln\n```\n\n## Reflected XSS Oneliner Command2\n```\necho \"testphp.vulnweb.com\" | waybackurls | uro | gf allparam | grep \"=\" | gf blacklist | qsreplace '\"\u003e\u003cscript\u003econfirm(1)\u003c/script\u003e' | xsschecker -match '\"\u003e\u003cscript\u003econfirm(1)\u003c/script\u003e' -vuln\n\nor\n\necho \"testphp.vulnweb.com\" | waybackurls | uro | gf allparam | grep \"=\" | gf blacklist | qsreplace '\"\u003e\u003cscript\u003econfirm(1)\u003c/script\u003e' | xsschecker -match '\"\u003e\u003cscript\u003econfirm(1)\u003c/script\u003e, \"\u003cimage/src/onerror=confirm(1)\u003e' -vuln\n```\n\n## Reflected XSS Oneliner Command1 and Reflected XSS Oneliner Command2 Results Comparison\n![image](https://github.com/rix4uni/xsschecker/assets/72344025/8034668c-42c3-47b1-9fee-5a58c2c96d63)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frix4uni%2Fxsschecker","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frix4uni%2Fxsschecker","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frix4uni%2Fxsschecker/lists"}