|
17 | 17 | </p> |
18 | 18 |
|
19 | 19 | *** |
20 | | -#### DISCLAIMER : |
| 20 | +>#### DISCLAIMER : |
21 | 21 |
|
22 | 22 | The XSSearch developer will not be held liable if the tool is used with harmful or criminal intent. Please use at your own risk. :) |
23 | 23 |
|
24 | | -*** |
| 24 | +**** |
| 25 | +>#### USES OF WEB SCRAPER : |
| 26 | +- XSSearch can be used to discover reflected Cross Site Scripting (XSS) vulnerabilities |
| 27 | +- XSSearch is capable of validating XSS payloads. |
| 28 | +- XSSearch will facilitate in the automation of brute - force attack for the verification of reflected XSS. |
| 29 | +- Works on all Linux environment |
| 30 | +- This can also be used in penetration testing to evaluate sanitization strength. |
| 31 | +*** |
| 32 | +>#### FEATURES : |
| 33 | +- Contains more than 3000 payloads for XSS validation |
| 34 | +- Works on selenium framework & ChromeDriver |
| 35 | +- It is faster than other XSS tools since the code is very light and rapid. |
| 36 | +- The code and payloads can be modified according to the situation. |
| 37 | +*** |
| 38 | +>#### SETUP & INSTALLATION |
| 39 | +XSSearch requires Selenium, ChromeDriver and Python to work smoothly on your system. |
| 40 | + |
| 41 | +**Installing Selenium** |
| 42 | +``` |
| 43 | +$ sudo apt update |
| 44 | +$ pip3 install selenium |
| 45 | +``` |
| 46 | +**Installing Chrome Browser for Linux (Skip this if you already have Chrome browser on your Linux)** |
| 47 | +```` |
| 48 | +$ wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb |
| 49 | +$ sudo apt install ./google-chrome-stable_current_amd64.deb |
| 50 | +```` |
| 51 | +**You may use the command to start Chrome from your terminal.** |
| 52 | +``` |
| 53 | +$ google-chrome --no-sandbox |
| 54 | +``` |
| 55 | +**Downloading ChromeDriver** |
| 56 | + |
| 57 | +Go to https://chromedriver.chromium.org/downloads and get the linux 64 zipped version of ChromeDriver 80.0.3987.106. |
| 58 | + |
| 59 | +Unzip the zip file. There will be a file for ChromeDriver. Open terminal on the same location and use the following command. |
| 60 | +```` |
| 61 | +$ sudo chmod +x chromedriver |
| 62 | +$ sudo mv -f chromedriver /usr/bin/chromedriver |
| 63 | +```` |
| 64 | +*** |
| 65 | +>#### USAGE |
| 66 | +XSSearch is a command line tool that uses a single command line instruction for simple and speedy execution.<br/> |
| 67 | +**Note** : This tool will only work on url which has a input paramter in the url. Example : www[.]target[.]com/?xyz= |
| 68 | +``` |
| 69 | +$ python3 xssearch.py -u url.com/?s={xss} -p payloads.txt |
| 70 | +``` |
| 71 | +**Arguments :**<br/> |
| 72 | +**-u** : It is required for URL input<br/> |
| 73 | +**-p** : It is required for Payload file input<br/> |
| 74 | +**{xss}** : It is a placeholder that the user should append after an equal to sign (=) in the url argument. |
| 75 | + |
| 76 | +**Live Usage** |
| 77 | +```` |
| 78 | +$ python3 xssearch.py -u https://ac121f0e1eb31ae5c0c9473f00f400f7.web-security-academy.net/?search={xss} -p payloads.txt |
| 79 | +```` |
| 80 | +<p align="center"> |
| 81 | +<img src=https://github.com/Encryptor-Sec/XSSearch/blob/main/Images/xssearch.PNG> |
| 82 | +</p> |
| 83 | + |
| 84 | +Above is the screenshot of the tool with live example.<br/> |
| 85 | +_Valid XSS exploits are marked with red alerts.<br/> |
| 86 | +Invalid XSS exploits are marked with blue alerts._ |
| 87 | + |
| 88 | +**Errors & Warnings**<br/> |
| 89 | +The following are some errors that might arise as a result of an incomplete command, not specifying arguments or not specifying placeholders.<br/> |
| 90 | + |
| 91 | +Use the below command to get help |
| 92 | +```` |
| 93 | +$ python3 xssearch.py -h |
| 94 | +```` |
| 95 | +<p align="center"> |
| 96 | +<img src=https://github.com/Encryptor-Sec/XSSearch/blob/main/Images/xssearch_warnings.PNG> |
| 97 | +</p> |
| 98 | + |
| 99 | +*** |
| 100 | +#### LICENSE |
| 101 | +[MIT-License](LICENSE) |
| 102 | +*** |
| 103 | +#### More suggestions and contributions are highly appreciated to make this tool better :) |
| 104 | +### _STAY SAFE, ACT SMART_ |
| 105 | +### Hit Me Up |
| 106 | +[](https://twitter.com/_encryptor_) |
| 107 | +[](https://www.instagram.com/xhackerboyy) |
| 108 | +[](https://www.linkedin.com/in/sathyaprakashsahoo) |
| 109 | +[](https://www.cyberbuddy.co.in) |
| 110 | + |
0 commit comments