Name: XSSRush (XSSR)
Author: N45HT

Key Capabilities

Built for Modern Penetration Testing

XSSR eliminates blind payload spray by validating reflections inside real headless browser contexts before firing targeted exploits.

Pluggable Headless Browser

Operates real browser instances using Playwright with support for Firefox, Chromium, and WebKit. Catches JavaScript-rendered sinks and Single Page Applications (SPAs) that traditional HTTP scrapers miss.

Canary Reflection & Context Mapping

Probes inputs using unique alphanumeric canary tokens to discover DOM reflection points and classifies exact injection contexts (HTML body, attributes, scripts, URL schemes, DOM JS).

Real Dialog Interception

Hooks browser-level dialogs (alert(), confirm(), prompt()) directly inside the browser event loop. Guaranteed verification of code execution with zero false positives.

Automated Form POST Testing

Detects hidden and visible form inputs, populates valid dummy values, and dispatches real requestSubmit() calls with browser execution. Automatically generates ready-to-use base64 HTML PoCs.

Parameter Mining & Wordlists

Extracts query strings, hidden HTML inputs, and global window scope properties from the DOM, augmented with built-in or custom wordlists (general params, redirect targets, custom lists).

Structured Output & JSON Reports

Presents high-fidelity formatted terminal tables with colorized severity ratings, payload details, confidence scores, and clean JSON file exports for CI/CD integration and reporting.

Audit Pipeline

7 Comprehensive Scan Phases

From discovery to payload trigger, XSSR executes a systematic sequence tailored to exploit all modern XSS attack surfaces.

STEP 0

Parameter Mining

Scrapes query strings, parses DOM input elements, inspects global window variables, and probes hidden parameters using embedded wordlists.

Module: modules/parameter_mining.py

STEP 1

Reflection Analysis

Sends randomized canary tokens (n45ht...) to discover where inputs reflect and classifies context boundaries (HTML body, attributes, script blocks).

Module: modules/reflection.py

STEP 2

Reflected XSS (GET & DOM)

Fires context-tuned injection payloads into query and DOM parameters, listening for real browser execution via dialog interception.

Module: modules/get_dom.py

STEP 3

POST-Based XSS

Locates form elements on the target page, fills required controls, dispatches form submissions, and generates base64 HTML reproduction PoCs.

Module: modules/forms.py

STEP 4

Path-Based XSS

Manipulates URL path segments and directory rewrites to uncover misconfigured routing and template injection vulnerabilities.

Module: modules/links.py

STEP 5

Fragment-Based XSS

Injects payloads into URL hash fragments (#payload) targeting client-side Single Page Application (SPA) DOM sinks and hash routing.

Module: modules/dom.py

STEP 6

Header-Based XSS

Injects payloads into sensitive HTTP request headers including User-Agent, Referer, Origin, Cookie, and X-Forwarded-* to catch server-side reflections in logs, admin consoles, and status pages.

Module: modules/headers.py

Quick Start

Get Up and Running in Minutes

XSSR is written in pure Python 3.10+ with no external daemons or complicated databases.

# 1. Clone repository from GitHub
git clone https://github.com/N45HT/XSSRush.git
cd XSSRush

# 2. Install Python dependencies
pip install -r requirements.txt

# 3. Install Playwright browser engine (Firefox is default)
playwright install firefox

# Scan query parameters on target URL (defaults to get,post vectors)
python xssr.py -u "https://example.com/search?q=test"

# Run with visible GUI browser window and verbose debugging output
python xssr.py -u "https://example.com/search?q=test" --headless false -v

# Test all attack modules (get, post, path, fragment, header) & save JSON report
python xssr.py -u "https://example.com" --scan all -o scan_report.json

# Use Chromium engine with customized request delay range (ms)
python xssr.py -u "https://example.com" -b chromium --scan all --delay-min 2000 --delay-max 4000

# Audit POST form submissions with custom postfields data
python xssr.py -u "https://example.com/contact" --scan post -d "username=admin&search=keyword"

# Exclude specific parameters from being tested
python xssr.py -u "https://example.com/profile" --scan post -e "csrf_token,session_id"

# Probe hidden parameters using custom wordlist file
python xssr.py -u "https://example.com" -w wordlists/common.txt --scan get,post

# Inspect built-in XSS payloads, known parameters, and target HTTP headers
python xssr.py --show-payloads
python xssr.py --show-params
python xssr.py --show-headers

Option / Flag	Default / Choices	Description
Target Options
`-u, --url URL`	Required	Target URL to scan (e.g. `https://example.com/search?q=test`).
Browser & Engine Options
`-b, --browser`	`firefox`	Browser engine to use. Choices: `firefox`, `chromium`, `webkit`.
`--headless`	`true`	Run browser in headless mode. Choices: `true`, `false`.
`--timeout TIMEOUT`	`15000`	Page navigation timeout in milliseconds (default: `15000`).
`--delay-min DELAY_MIN`	`3000`	Minimum request delay in milliseconds (default: `3000`).
`--delay-max DELAY_MAX`	`5000`	Maximum request delay in milliseconds (default: `5000`).
Scan Scope Options
`--scan MODULES`	`get,post`	Modules to test: `get`, `post`, `path`, `fragment`, `header`, or `all`.
`-w, --wordlist FILE`	None	Custom parameter wordlist file to probe (e.g. `wordlists/common.txt`).
`-d, --data POSTFIELDS`	None	Custom POST data fields (e.g. `username=admin&search=keyword`).
`-e, --exclude PARAMS`	None	Parameters to skip during testing (comma-separated, e.g. `name,location`).
`--include-header HEADERS`	None	Custom HTTP headers to add to header scan (comma-separated, e.g. `X-User-Agent,X-Referer`).
`--exclude-header HEADERS`	None	HTTP headers to skip during header scan (comma-separated, e.g. `User-Agent,Referer`).
Information Options
`--show-payloads`	Flag	Show all built-in XSS payloads and exit immediately.
`--show-params`	Flag	Show all built-in known parameters and exit immediately.
`--show-headers`	Flag	Show all built-in target HTTP headers and exit immediately.
Output & Reporting Options
`-o, --output FILE`	None	Save report JSON (saved to `output/` folder unless absolute path is given).
`-v, --verbose`	`False`	Enable verbose debugging output in console.
`-h, --help`	Flag	Show CLI help message and exit.
`--version`	Flag	Show program's version number and exit.

XSSR // XSSRush
Automated Multi-Vector XSS Scanner

100% Open Source

Playwright Powered

7 Attack Vectors

Zero Backend Server