extended-xss-search: scans for different types of xss on a list of urls

Extended XSS Searcher and Finder

This is the extended version based on the initial idea already published as “xssfinder”. This private version allows an attacker to perform not only GET but also POST requests. Additionally, it’s possible to proxy every request through Burp or another tunnel.

Download

git clone https://github.com/Damian89/extended-xss-search.git

Use

First steps

Rename the example.app-settings.conf to app-settings.conf and adjust the settings. It should work out of the box but depending on the target I would recommend resizing the chunk sizes.

Configuration

It’s possible to set a lot of options and settings, so here are some explanations.

Files

The main config file is the “app-settings.conf”, everything has to be done in that file! Besides that, there are some other files that allow setting more complex data like headers, urls, and cookies.

config/cookie-jar.txt

Use this file to add a cookie string. I usually copy the one which you can see in every burp request. Please just copy the value of the “Cookie:”-header. The sample input is in the default file.

config/http-headers.txt

This file defines the http headers which are added to the request and manipulated (payload is added to each one). The most important ones are already in the file. But feel free to add more.

config/parameters.txt

The tool has the option to brute force get and post parameters. In that case, those parameters (+ those in the query string) will be used. Each parameter gets the payload as value. Most important are already in that file.

config/urls-to-test.txt

That’s the file you need! Please add here your links to scan. The following formats are allowed:

• https://domain.com
• https://domain.com/path
• https://domain.com/path?param=value&param1=value1
• domain.com

When the last case is detected an “http://” is prepended. This tool is intended to work with a good list of urls. A good way to get one is to just export it using burp. Then you have a valid list of urls. All you need to do ist to just add your cookies.

logs/

This is the log folder where everything gets logged to!

Settings

The app-settings.conf defined the program workflow. Its the most important file, you can activate/deactivate different modules there.

Basic settings

HTTPTimeout

Some requests can take longer. Here you can define the max. execution time of one request. I recommend the values between 2 and 6 seconds.

MaxThreads

The more threads, the faster the script is – but since we are dealing with a lot of connections I usually keep this below 10 on my personal computer and around 30 on my VPS.

Attack types

OnlyBaseRequest

Setting this to true will result in only “base requests” – this means the url lists are just spidered and interesting parameters extracted. You could use that to fill your burp sitemap quickly.

UsePost

Use can skip POST requests setting this to “false”

UseGet

This is similar – skip GET requests if set to “false”

Attack type settings

GetChunkSize

How many GET parameters to test with one request?

PostChunkSize

How many POST parameters to test with one request?

Tunneling

Its also possible to use a tunnel, e.g. “127.0.0.1:8080” (Burp Proxy), to monitor all traffic within Burp.

Active

Setting this to “true” will force the script to use a tunneled connection.

Tunnel

Set here your proxy server “ip:port”.

The result is the following one when you open Burp you can watch your http history:

Execute

python3 extended-xss-search.py

Source: https://github.com/Damian89/