ExploiterX - ExploiterX is a lightweight, customizable vulnerab

项目说明

ExploiterX 3.0 - Professional Web Scanner

![Tests]()
![License: MIT]()
![Python 3.8+]()

A professional, enterprise-grade web scanner for security professionals and de. Detects XSS, SQL Injection, CSRF, XXE, Path Tra, Open Redirect, Command Injection, and security misconfigurations with ad scanning capabilities.

🎯 Features

Detection

XSS (Cross-Site Scripting): 20+ payload including DOM-based, event handlers, and encoding bypasses — detects raw, HTML-encoded, and URL-encoded reflections

SQL Injection: Multiple payload types (boolean-based, UNION-based, error-based) plus time-based blind detection using response timing

XXE (XML External Entity): 10+ XXE payload including blind XXE and file read attempts

Path Tra: Directory tra detection with Unix, Windows, and encoded payloads

Open Redirect: Redirect payloads with reflection and cross-host (no false positives on benign same-host redirects)

Command Injection: Output-pattern detection plus time-based detection for blind command execution

CSRF : CSRF token detection and missing token identification

Security Headers & Cookies: Missing header analysis plus weak CSP / X-Frame-Options checks and cookie flag analysis (HttpOnly, Secure, SameSite)

Ad Capabilities

Command-Line Interface: Fully scriptable non-interacti (--url, --format, --output, --threads, and more)

Concurrent Scanning: Thread pool-based parallel scanning (up to 50 threads)

Web Crawling: Iterati crawler with depth/page limits and O(1) duplicate detection

Form Extraction: Intelligent HTML form parsing co input, textarea, and select fields

Seed URL Scanning: The entry page is always scanned, so homepage forms are ne

Authentication Support: Login handling with masked password input (secure getpass on TTYs)

Multiple Report Formats: JSON, CSV, and professional HTML reports with safe escaping

Comprehensi: File and console logging with configurable levels

Configuration Management: YAML-based configuration with CLI o

Resilient Requests: Built-in retry handling for transient timeouts and connection issues, plus optional politeness delay

Smart Parameter Injection: Payloads are injected into existing query parameters to reduce malformed test URLs

Header Fallback: Security-header checks automatically fall back from HEAD to GET when needed

Professional Features

Type Hints: Full type annotation for better IDE support

Error Handling: Robust exception handling with graceful degradation

Input : URL with RFC compliance

Thread-Safe: Proper synchronization for concurrent operations

Duplicate Finding Protection: Deduplicates repeated findings for cleaner reports

Report Security: HTML reports escape payloads (no self-XSS) and CS neutralize spreadsheet formula injection

87%+ Test Co: Comprehensive unit and integration tests (250 test cases)

📋 Requirements

Python 3.8 or higher

Linux, macOS, or Windows

Dependencies

🚀 Installation

Via pip (Recommended)

From Source

De Installation

🐳 Docker Deployment

Quick Start with Docker Compose

Standalone Docker Image

📖 For detailed Docker documentation, see DOCKER.md

💻 Usage

Basic Usage

Non-Interactive Mode (CLI)

Interactive Mode

The tool will prompt you for:
1. Target URL: The URL to scan (e.g., )
2. Ignore Links: URLs to exclude from scanning (optional)
3. Authentication: Login credentials if required (optional, password input is masked)

Example Session

🎬 Demo

Crawling the Target

<p align="center"><img src=" width="50%" height="auto"/></p>

Crawling if Target Has Login Function

<p align="center"><img src=" width="50%" height="auto"/></p>

Video Demo

<p align="center">
<a href="
<img src=" alt="Watch the video" width="600" height="auto">
</a>
</p>

📊 Report Formats

JSON Report

Example JSON structure:

CS

Clean, spreadsheet-friendly format:

HTML Report

Professional interacti with:

Executi with risk scores

Se distribution charts

Detailed listings

Color-coded se indicators

Scan metadata and timeline

⚙️ Configuration

config/config.yaml

Customize scanner behavior:

Command-Line Arguments

| Flag | Description |
| --- | --- |
| -u, --url | Target URL (enables non-interactive mode) |
| --ignore | URL patterns to ignore |
| --auth-url, --auth-username, --auth-password | Authentication for logged-in scans |
| -t, --threads | Concurrent scan threads (1-50) |
| --timeout | HTTP request timeout in seconds |
| --retries | Retries for transient failures |
| --max-depth | Maximum crawl depth |
| --max-links | Maximum links to crawl (0 = unlimited) |
| --delay | Seconds between requests (rate-limit a) |
| --time-based-threshold | Min. delay (s) for time-based blind detection (default 3.0) |
| -f, --format | Report format(s): json, csv, html, console |
| -o, --output | Output file (single format) or directory (multiple formats) |
| -c, --config | YAML config file path |
| --log-level | Logging |
| --no-banner | Skip the banner |
| -- | Show and exit |

🧪 Testing

Run All Tests

Run with Co

Run Specific Tests

Test Co

Current co: 87%

Scanner: 84%

Models: 98%

Reporters: 95%

Configuration: 82%

🏗️ Architecture

🔒 Security Features

Input : All user inputs are

Type Safety: Full type hints throughout codebase

Error Handling: Comprehensi handling

Thread Safety: Proper locking for concurrent operations

Timeout Protection: Configurable request timeouts

Secure Defaults: Safe default configurations

🚦 Payloads

XSS Detection

Script injection: <script>alert('XSS')</script>

Event handlers: <img onerror="alert('XSS')">

DOM manipulation: "><script>alert('XSS')</script>

Protocol handlers: <a href="ja:alert('XSS')">

And 16+ more

SQL Injection Detection

Boolean-based: ' OR '1'='1

Time-based: ' OR SLEEP(5)--

UNION-based: ' UNION SELECT NULL--

Error-based: ' AND extractvalue(...)

Stacked queries: '; DROP TABLE users--

CSRF Detection

Missing CSRF tokens

Token bypass

Method

Cookie attribute analysis

📈 Performance

Sequential Scanning: ~50-100 endpoints/minute

Concurrent (5 threads): ~150-300 endpoints/minute

Concurrent (10 threads): ~250-500 endpoints/minute

Memory Usage: Typical ~50-100MB

Performance depends on:

Target ser time

Network latency

Payload complexity

Number of forms per page

🐛 Known Limitations

Crawler Limitations

1. Production Websites: Production websites often block automated crawlers and render links , which this scanner cannot execute. The crawler may find 0 endpoints on real-world sites.
2. Ja Rendering: Cannot execute Ja - only parses static HTML. Modern websites that render content dynamically won't ha full endpoint list discovered.
3. Security Controls: Sites with WAF (Web Application Firewall), bot detection, or rate limiting may block or slow down scanning.

Payload Testing Limitations

4. Complex Forms: Multi-step forms with state management may require manual testing
5. API Rate Limiting: Respects server rate limits with timeouts (may miss on slow-responding sites)
6. CORS Restrictions: Cannot test cross-origin endpoints
7. Ad Obfuscation: May miss heavily obfuscated payloads

Recommended Use Cases

✅ Local applications (DVWA, WebGoat, OWASP Juice Shop)

✅ Authorized penetration testing on staging/de

✅ Security training and learning

❌ NOT recommended for production website testing without proper WAF/rate limit handling

🔧 Testing with DVWA (Recommended)

What is DVWA?

DVWA (Damn Web Application) is a deliberately PHP/MySQL application designed for security professionals to test and impro detection skills.

Quick Start with Docker

1. Start D:

2. Open in browser (Windows/macOS):

On Linux (if localhost doesn't work):

3. Login with default credentials:
- Username: admin
- Password: password

4. Run ExploiterX (in another terminal):

5. Enter DVWA URL when prompted:

D Details

Security Le (in DVWA):

Low: Minimal security (great for learning)

Medium: Some security controls

High: Enhanced security (closer to production)

Pages to Test:

/D/xss_r/ - Reflected XSS

/D/sqli/ - SQL Injection

/D/csrf/ - CSRF

/D/upload/ - File upload issues

Alternati Applications

#### OWASP Juice Shop (Modern, Feature-Rich)

#### WebGoat (OWASP Learning Platform)

#### Local Testing Alternatives

Expected Scanner Output with DVWA

When running against DVWA, you should see:

🤝 Contributing

Contributions are welcome! Please see CONTRIBUTING.md for guidelines.

Areas for Contribution

Additional types (XXE, Path Tra, etc.)

Performance optimization

Payload impro

Documentation

Bug fixes

Test co expansion

📝 Roadmap

[x] Add XXE injection detection

[x] Add Path Tra detection

[x] Add Open Redirect detection

[x] Add Command Injection detection

[x] Time-based blind SQLi detection

[x] Cookie flag / weak header analysis

[ ] Headless browser integration (Playwright/Selenium)

[ ] API endpoint detection

[ ] GraphQL query scanning

[ ] Burp Suite integration

[ ] OWASP Top 10 mapping

[ ] REST API for automation

[ ] Docker containerization

📄 License

This project is licensed under the MIT License. See the LICENSE file for details.

⚠️ Disclaimer

This tool is for authorized security testing only. Unauthorized access to computer systems is illegal. Always obtain proper authorization before scanning any web application.

The authors assume no liability for misuse or damage caused by this tool.

🙏 Acknowledgments

Original ExploiterX concept

Open-source security community

BeautifulSoup and requests maintainers

📞 Support

Getting Help

Issues: Report bugs on GitHub Issues

Discussions: Ask questions in GitHub Discussions

Documentation: See Wiki

Configuration Troubleshooting

Issue: Scan hangs on a URL

Issue: Too many false positives

Issue: Out of memory on large sites

📊 Statistics

Lines of Code: ~4,000

Test Cases: 250

Supported Payloads: 23+ XSS, 21+ SQLi, 10+ XXE, 20+ Path Tra, 12+ Open Redirect, 19+ Command Injection

Python : 3.8, 3.9, 3.10, 3.11, 3.12, 3.13

Operating Systems: Windows, macOS, Linux

🔄 History

v3.0.0 (2026-08-16)

NEW: Command-line interface with non-interacti (--url, --format, --output, --threads, etc.)

NEW: Open Redirect detection engine

NEW: Command Injection detection engine (output-pattern + time-based)

NEW: Time-based blind SQL injection detection

NEW: Cookie flag analysis (HttpOnly, Secure, SameSite) and weak CSP / X-Frame-Options checks

NEW: Encoded XSS reflection detection (HTML-escaped payloads now caught)

NEW: Seed URL is always scanned so entry-page forms are ne

NEW: --time-based-threshold CLI flag and time_based_threshold config key for tuning blind-detection timing

CLEANUP: Removed the unused concurrent_scanner.py module (parallelism now lives in run_scanner(threads=…))

IMPROVED: Crawler rewritten as iterative BFS (no recursion limits, O(1) dedup, --max-links cap)

IMPROVED: Form submission handles textarea and select fields

IMPROVED: Config file now supports max_depth, max_links, delay, output_format, user_agent, SSL/redirect toggles, and auth block

FIXED: HTML reports escaped payloads/URLs (pre report self-XSS)

FIXED: CS neutralize spreadsheet formula injection

FIXED: Password input masked on TTYs

FIXED: XXE/Path Tra false positives when the page reflects the payload

FIXED: Banner rendering on Windows consoles with non-UTF-8 codepages

ADDED: 57 new test cases (250 total, 87% co)

v2.1.0 (2026-05-05)

HARDENED: URL payload injection now targets existing parameters instead of appending malformed test params

HARDENED: Added bounded request retries for transient network failures

HARDENED: Security-header analysis now falls back from HEAD to GET on unsupported targets

FIXED: Parallel form scanning now correctly passes custom payloads into XSS form tests

FIXED: Concurrent batch stats now reset per run for accurate reporting

ADDED: Regression tests for retry behavior, header fallback, concurrency stats, and payload wiring

v2.0.1 (2024-01-16)

FIXED: Windows CI/CD lxml build failure (updated to lxml>=5.1.0)

IMPROVED: Crawler error handling with helpful feedback for production sites

ADDED: D guide and documentation

ADDED: Known limitations section with recommended use cases

ADDED: Support for Python 3.12, 3.13

IMPROVED: Crawler warnings when no endpoints found

v2.0.0 (2024-01-15)

NEW: Multiple detection (XSS, SQLi, CSRF, Headers)

NEW: Concurrent scanning with thread pool

NEW: Multiple report formats (JSON, CSV, HTML)

NEW: Comprehensi system

NEW: Type hints throughout codebase

IMPROVED: Error handling and logging

IMPROVED: Performance with concurrent operations

ADDED: 150+ test cases (80%+ co)

ADDED: Professional HTML reports

v1.0.0 (2023)

Initial release

Basic XSS detection

Web crawling

Form extraction

---

Made with ❤️ for the security community

项目信息

开发语言：Python

Star 数：16

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕ExploiterX is a lightweight, customizable vulnerability scanner designed to detect security weaknesses in web applications. This tool crawls target websites, identifies potential links and forms, and checks for Cross-Site Scripting (XSS) vulnerabilities, helping security researchers and developers find exploitable points in their web applications.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。