Cross-Site Scripting
How to exploit cross-site scripting (XSS).
Standard XSS
Dalfox
Dalfox is a powerful open-source XSS scanner and utility focused on automation.
The following command will take a HTTP request saved to a file named HTTPREQUEST and look for XSS, including blind XSS if you use the -b flag with a blind XSS URL.
dalfox file --rawdata HTTPREQUEST -b <blind_xss_link>
The following command will take a URL and look for XSS, including blind XSS if you use the -b flag with a blind XSS URL.
dalfox url URL -b <blind_xss_link>
Blind XSS
XSSHunter
XSSHunter provides a weaponised URL to insert into XSS payloads to test for blind XSS. The easiest way to use XSSHunter, is by using TruffleSecuritys own platform.
For those that are more security and privacy conscious. You may wish to setup a private instance:
Last updated