XSS漏洞扫描器(2种方法)

1.使用ppmap检测和利用XSS漏洞

sudo apt-get install chromium

sudo sh -c 'echo "deb http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list'
wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | sudo apt-key add -
sudo apt-get update
sudo apt-get install google-chrome-stable

go get -u github.com/chromedp/chromedp

https://github.com/kleiton0x00/ppmap
https://github.com/kleiton0x00/ppmap/releases
git clone https://github.com/kleiton0x00/ppmap.git

cd ppmap
go build ppmap.go

(1).单个扫描

echo 'https://target.com' | ./ppmap
echo 'http://target.com/something/?page=home' | ./ppmap

(2).批量扫描

cat url.txt | ./ppmap

2.使用XSStrike进行XSS的漏洞扫描

https://github.com/s0md3v/XSStrike
git clone https://github.com/s0md3v/XSStrike.git

cd XSStrike
pip install -r requirements.txt

python --version
cd XSStrike
python xsstrike.py -u https://target.com
python xsstrike.py -u http://target.com/something/?page=home

DOM XSS

Reflected XSS

Crawling

Fuzzing

Bruteforcing payloads from a file

Interactive HTTP Headers Prompt

Hidden Parameter Discovery