Damn Small XSS Scanner (DSXS) is a fully functional Cross-site scripting vulnerability scanner (supporting GET and POST parameters) written in under 100 lines of code.
As of optional settings it supports HTTP proxy together with HTTP header values User-Agent, Referer and Cookie.
$ python3 dsxs.py -h
Damn Small XSS Scanner (DSXS) < 100 LoC (Lines of Code) #v0.4a
by: Miroslav Stampar (@stamparm)
Usage: dsxs.py [options]
Options:
--version show program's version number and exit
-h, --help show this help message and exit
-u URL, --url=URL Target URL (e.g. "http://www.target.com/page.htm?id=1")
--data=DATA POST data (e.g. "query=test")
--cookie=COOKIE HTTP Cookie header value
--user-agent=UA HTTP User-Agent header value
--referer=REFERER HTTP Referer header value
--proxy=PROXY HTTP proxy address (e.g. "http://127.0.0.1:8080")
$ python3 dsxs.py -u "http://testphp.vulnweb.com/search.php?test=query" --data="s
earchFor=foobar"
Damn Small XSS Scanner (DSXS) < 100 LoC (Lines of Code) #v0.4a
by: Miroslav Stampar (@stamparm)
* scanning GET parameter 'test'
* scanning POST parameter 'searchFor'
(i) POST parameter 'searchFor' appears to be XSS vulnerable (">.xss.<", outside
of tags, no filtering)
scan results: possible vulnerabilities found
$ python3 dsxs.py -u "http://public-firing-range.appspot.com/address/location.has
h/replace"
Damn Small XSS Scanner (DSXS) < 100 LoC (Lines of Code) #v0.4a
by: Miroslav Stampar (@stamparm)
(i) page itself appears to be XSS vulnerable (DOM)
(o) ...<script>
var payload = window.location.hash.substr(1);location.replace(payload);
</script>...
(x) no usable GET/POST parameters found
scan results: possible vulnerabilities found
The tests/ directory holds a regression suite that runs the real CLI against
deterministic localhost fixtures - no third party target is ever contacted:
$ python3 -m unittest discover -s tests
Set DSXS_ORACLE_JOBS to cap how many browsers the oracle runs at once (it
defaults to the CPU count, up to four); each one is a full browser process, so
memory is usually the binding constraint.
Besides one fixture per supported context (and per non-vulnerable counterpart), the suite contains a ground truth oracle: if a Chromium/Chrome binary is available, every fixture is additionally attacked with real breakout payloads inside a headless browser, and DSXS' verdict is required to match whatever the browser actually executed. The DOM XSS sinks are validated the same way, with the payload delivered through the fragment or the query string exactly as a browser hands it to the page (i.e. percent encoded and undecoded).
Python version 3.x is required for running this program.
Running the test suite additionally needs openssl (for the throwaway TLS certificate) and,
for the browser oracle, an installed Chromium/Chrome (skipped automatically when missing).