https://github.com/phra/crosser
A Reflected / Stored / DOM XSS Scanner based on Headless Chrome Node API via Puppeteer
https://github.com/phra/crosser
Last synced: over 1 year ago
JSON representation
A Reflected / Stored / DOM XSS Scanner based on Headless Chrome Node API via Puppeteer
- Host: GitHub
- URL: https://github.com/phra/crosser
- Owner: phra
- License: gpl-3.0
- Created: 2019-05-27T10:42:05.000Z (about 7 years ago)
- Default Branch: master
- Last Pushed: 2023-01-07T05:51:39.000Z (over 3 years ago)
- Last Synced: 2024-04-23T19:24:29.683Z (over 2 years ago)
- Language: TypeScript
- Homepage: https://iwantmore.pizza
- Size: 1.56 MB
- Stars: 39
- Watchers: 4
- Forks: 6
- Open Issues: 16
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# crosser
A Reflected / Stored / DOM XSS Scanner based on Headless Chrome Node API via Puppeteer
[](https://asciinema.org/a/QqM8LcqVyNeXF2oVMlVdPkftN)
## Installation
Install it with:
`npm i -g @phra/crosser`
or
`yarn add --global @phra/crosser`
## Usage
```
$ crosser --help
A Reflected / Stored / DOM XSS Scanner based on Headless Chrome Node API via Puppeteer
VERSION
@phra/crosser/0.2.2-0 linux-x64 node-v9.11.1
USAGE
$ crosser [COMMAND]
COMMANDS
help display help for crosser
reflected checks for reflected xss
stored checks for stored xss
```
```
$ crosser reflected --help
checks for reflected xss
USAGE
$ crosser reflected
OPTIONS
-h, --help show CLI help
-u, --url=url url to connect
EXAMPLE
$ crosser reflected -u "http://localhost:4200/vuln/"
```
```
$ crosser stored --help
checks for stored xss
USAGE
$ crosser stored
OPTIONS
-a, --post=post url to connect
-b, --pre=pre url to connect
-h, --help show CLI help
-u, --url1=url1 url to connect
-x, --url2=url2 url to connect
EXAMPLE
$ crosser stored -u "http://localhost:4200/stored1/" -x "http://localhost:4200/stored2/" --pre "document.querySelector('#vuln').value = ``;
document.querySelector('#button').click();" --post "document.querySelector('#button').click();"
```