Shulou(Shulou.com)05/31 Report--

Today, I would like to talk to you about how to use XSStrike, many people may not know much about it. In order to make you understand better, the editor has summarized the following contents for you. I hope you can get something from this article.

Brief introduction

XSStrike is an advanced testing tool for testing Cross Site Scripting. It integrates payload generator, crawler and blur engine functions. Instead of injecting the payload and checking its work like other tools, XSStrike analyzes the response through multiple parsers, and then ensures the payload through context analysis integrated with the fuzzy engine. In addition, XSStrike also has the functions of crawling, fuzzy testing, parameter discovery and WAF detection. It also scans for DOM XSS vulnerabilities.

Characteristics

Reflection and DOM XSS scanning

Multi-thread fetching

Background analysis

Configurable core

WAF detection and avoidance

Browser engine integration becomes zero false alarm rate

Intelligent load generator

Handmade HTML and JavaScript parsers

Powerful fuzzy engine

Support for Blind XSS

Perfect work flow

Full HTTP support

Bruteforce payload from files

Payload coding

Python writing

Installation

Since XSStrike can only run on python 3.6 or later, the author uses parrot to install and run this tool (the python 3 version of my old version of Kali is 3.5).

1. Install pip for python3, using the following command:

Sudo apt-get install python3-pip

2. Download XSStrike with the following command:

Git clone https://github.com/s0md3v/XSStrike.git

3. Install the dependent module with the following command:

Pip3 install-r requirements.txt

4. Run the tool with the following command:

Python3 xsstrike.py-u "http://target" usage-h,-- help / / display help-u,-- url / / specify target URL-- data / / POST to submit content-v,-- verbose / / detailed output-f,-- file / / load custom paload dictionary-t -- threads / / defines the number of threads-l,-- level / / crawl depth-t -- encode / / defines payload encoding-- json / / treats POST data as JSON-- path / / Test URL path components-- seeds / / Test and crawl URL from files-- fuzzer / / Test filters and Web application firewalls. -- update / / update-- timeout / / set timeout-- params / / specify parameters-- crawl / / crawl-- proxy / / use proxy-- blind / / Blind Test-- skip / / skip confirmation prompt-- Skip-dom / / Skip DOM scan-headers / / provide HTTP header-d -- delay / / set delay instance

In order to test the practicability of the tool, the author wrote a simple PHP file with XSS vulnerabilities. The author named it xss.php file.

The xss.php code is shown below:

Save and upload to the author's own server.

The following figure shows a payload from the tool Fuzzing:

We use the payload from the tool Fuzzing to test it. The test results are shown in the following figure:

After reading the above, do you have any further understanding of how to use XSStrike? If you want to know more knowledge or related content, please follow the industry information channel, thank you for your support.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.