xsser - Cross Site "Scripter" (aka XSSer) is an automatic

项目说明

!XSSer

----------

+ Web:

----------

Cross Site "Scripter" (aka XSSer) is an automatic -framework- to detect, exploit and report XSS in web-based applications.

It provides several options to try to bypass certain filters and special techniques for code injection.

Key features:

- [ > 1500 ] pre-installed XSS attacking (automatic fuzzing).
- : each finding is for real executability. A context-aware engine tells apart executable contexts (HTML, JS, event handlers, ja:/data: URIs) from harmless reflections, with an optional headless-browser reverse connection (--re) to confirm findings and cut false positives.
- Targeting: URL, file, stdin/pipe, raw HTTP request (-r), 'dorking' (multiple engines) and crawler.
- Injection: GET/POST, Cookie/User-Agent/Referer, DOM and HTTP Response Splitting.
- E: per-WAF bypassers + character-encoding bypassers; proxy/Tor; client-certificate auth.
- Reporting: PDF (professional), XML and JSON (for CI / pipelines).

It can also bypass-exploit code on several WAFs:

[Cloudflare]: Cloudflare WAF
[Akamai]: Akamai (Kona / App & API Protector)
[AWS]: AWS WAF
[Azure]: Azure Front Door WAF
[Imperva]: Imper / Cloud WAF)
[F5]: F5 BIG-IP ASM / Ad WAF
[Barracuda]: Barracuda WAF
[ModSec]: Mod-Security + OWASP CRS v3
[Wordfence]: Wordfence (WordPress)
[Sucuri]: Sucuri (CloudProxy)
[FortiWeb]: Fortinet FortiWeb
[WebKnight]: AQTRONIX WebKnight

!XSSer

----------

#### Installing:

XSSer runs on many platforms. It requires Python (>=3.9).

Only two libraries are mandatory (the core HTTP engine and the HTML parser):

- pycurl - Python bindings to libcurl
- beautifulsoup4 - error-tolerant HTML parser

The rest are optional and only needed for a specific feature. If missing, XSSer
can auto-install them on demand (pip) the first time the feature is used, except
on 'externally-managed' (PEP 668) Python en, where it prints the manual
install command instead (set XSSER_AUTOINSTALL=1 to o):

- fpdf2 - '--pdf' report exporter [extra: pdf]
- ddgs - 'dorking' engine ('-d' / '-l') [extra: dork]
- selenium - DOM / re browser ('--Dom') [extra: dom]
- PyGObject + pycairo + pygeoip + Pillow - GTK GUI + GeoMap ('--gtk') [extra: gtk]

Install (from the source tree), core only or with the extras you want:

pip3 install . # mandatory libs only
pip3 install .[pdf] # + PDF reporting
pip3 install .[full] # e (all optional features)

On Debian-based systems (ex: Kali, Ubuntu, ParrotSec) the same libs are also
packaged. The distro package name differs from the pip name; the mapping is:

pip name Debian/Ubuntu/Kali package
------------ --------------------------
beautifulsoup4 python3-bs4
pycurl python3-pycurl
fpdf2 python3-fpdf2
selenium python3-selenium
PyGObject python3-gi
pycairo python3-cairo (+ python3-gi-cairo for GTK integration)
Pillow python3-pil
pygeoip python3-geoip
(ddgs has no distro package yet: install it with pip)

# mandatory:
sudo apt-get install python3-pycurl python3-bs4
# optional (per feature you want to enable):
sudo apt-get install python3-fpdf2 python3-selenium python3-gi python3-gi-cairo python3-cairo python3-pil python3-geoip

Note: some optional features also need system-level (non-pip) components:

- '--Dom' / '--re' : firefox + geckodriver (the Firefox WebDriver).
- '--gtk' : GTK 3 plus its GObject-Introspection typelib
files (the .typelib for Gtk-3.0). That typelib
ships under different system package names per
distro, e.g. 'gir1.2-gtk-3.0' on Debian/Ubuntu/
Kali, and 'gtk3' on Fedora/Arch.

#### Source libs:

* Python:
* PyCurl:
* BeautifulSoup4:
* fpdf2:
* ddgs:
* Selenium:
* PyGObject:
* pycairo:
* PyGeoIP:
* Pillow:

----------

#### License:

XSSer is released under the GPLv3. You can find the full license text
in the COPYING file.

----------

#### Screenshots:

!XSSer

!XSSer")

!XSSer

!XSSer

!XSSer

!XSSer

!XSSer

项目信息

开发语言：Python

Star 数：1470

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Cross Site "Scripter" (aka XSSer) is an automatic -framework- to detect, exploit and report XSS vulnerabilities in web-based applications.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。