brs-xss - MIT license BRS-XSS is a modular Python CLI scanne

项目说明

BRS-XSS

Ad XSS Scanner

Deterministic, auditable XSS detection for modern web applications

!Python
!
!License

BRS-KB API • GitHub • Discussions

> v4.0.0 Release: Major update with Web UI, PTT Strategy Management, A/B Testing, and BRS-KB integration. Report issues on GitHub.

---

O

BRS-XSS is a professional-grade XSS scanner powered by BRS-KB — a comprehensi base with thousands of context-aware payloads, 169 injection contexts, and 1,999 WAF bypass techniques.

Key Features

| Feature | Description |
|---------|-------------|
| Context-Aware Scanning | HTML, Ja, CSS, URI, SVG, XML context detection |
| WAF E | Cloudflare, Akamai, AWS WAF, Imper, Sucuri |
| DOM Analysis | Browser-based DOM XSS detection |
| Smart Classification | XSS type detection with confidence scoring |
| PTT Strategy Engine | Pentesting Task Tree for adapti |
| A/B Testing | Compare strategy effecti |
| Multi-Format Reports | PDF, HTML, JSON, SARIF, JUnit |
| | Real-time notifications with PDF reports |

---

Web UI

BRS-XSS includes a modern, dark-themed web interface for easy scanning and result analysis.

Login

!Login

Secure authentication with session management.

Dashboard

!Dashboard

Real-time o featuring:

New Scan

!New Scan - Configuration

!New Scan - Ad Options

Flexible scan configuration:

Scan History

!Scan History

Complete scan archive with:

Scan Details

!Scan Details - O

!Scan Details -

Comprehensi including:

Rescan

!Rescan

Quick rescan with pre-filled configuration from previous scan.

Strategy (PTT)

!Strategy - Decision Tree

!Strategy - My Strategies

!Strategy - A/B Testing

Pentesting Task Tree management:

Settings

!Settings - Performance & Proxy

!Settings -

Full configuration:

User Management

!User Management

Multi-user support with role-based access.

---

Quick Start

Installation

System Dependencies

macOS:

Ubuntu/Debian:

Start Web UI

Access at

CLI Usage

---

Classification Engine

Accurate classification with dynamic analysis:

| Feature | Description |
|---------|-------------|
| XSS Type Classifier | Reflected, DOM-based, Stored, Mutation |
| Context Parser | Hierarchical: html > img > onerror |
| Payload Classifier | Consistent PAYLOAD CLASS for every finding |
| Confidence Calculator | Factor-based scoring with DOM/trigger boosts |

Example Output:

---

Configuration

En

| | Description |
|----------|-------------|
| BRSXSS_KB_API_KEY | BRS-KB API key |
| BRSXSS_KB_API_URL | O KB endpoint |
| BRSXSS_KB_MODE | remote, local, or auto |
| BRS_XSS_SAFE_MODE | Toggle safe mode |
| BRS_XSS_MAX_PAYLOADS | Max payloads per parameter |

Local Mode (Offline)

---

Real-time notifications with PDF reports:

1. Create bot via
2. Get channel ID via
3. Configure in Settings →

Or :

---

Links

---

Legal

This tool is for authorized security testing only.

By using BRS-XSS you agree:

---

License

MIT License • Copyright (c) 2023-2026 EasyProTech LLC

项目信息

开发语言：Python

Star 数：33

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕MIT license BRS-XSS is a modular Python CLI scanner for XSS vulnerabilities. Features context-aware payloads, WAF evasion, DOM analysis via Playwright, ML-based risk scoring, and export in HTML/JSON/SARIF. Designed for integration with Brabus Recon Suite (BRS).展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。