🎯 XSSROOTX - Advanced XSS Testing Framework

Advanced Web Crawler & XSS Vulnerability Detection Framework

Features • Installation • Usage • Examples • Legal Notice

⚠️ LEGAL NOTICE

FOR AUTHORIZED TESTING ONLY

This tool is designed EXCLUSIVELY for:

✅ Authorized penetration testing
✅ Security research and education
✅ Testing systems you own or have explicit written permission to test

Unauthorized use is ILLEGAL and may violate computer crime laws. Always obtain proper written authorization before conducting any security testing!

✨ Features

Core Capabilities

🕷️ Intelligent Web Crawler - Automatic discovery of URLs and parameters
🎯 Multi-Type XSS Detection - Reflected, Stored, and DOM-based XSS
🛡️ WAF Detection & Bypass - Automatic WAF identification and evasion techniques
🔍 Blind XSS Detection - Out-of-band XSS payload tracking
📝 Form Auto-Testing - Automatic form discovery and testing
🍪 Cookie Testing - XSS vulnerability testing in cookies
📊 Professional Reporting - HTML and JSON reports with detailed analysis

Advanced Features

⚡ 1000+ XSS Payloads - Extensive payload library with encoding variations
🧬 Smart Payload Encoding - URL, Base64, HTML entity encoding
🎨 SVG-Based Payloads - Advanced SVG XSS vectors
🔄 Multi-Threading - Fast concurrent testing
📈 Confidence Scoring - Intelligent vulnerability rating system
🎯 Parameter Analysis - Deep parameter injection testing
🌐 Custom Headers Testing - User-Agent, Referer, and custom header injection

Detection Engines

🔴 Reflected XSS Tester - GET/POST parameter reflection analysis
💾 Stored XSS Tester - Persistent payload detection with verification
🖥️ DOM XSS Tester - Client-side vulnerability analysis
🛡️ WAF Detector - Identifies 15+ major WAF solutions

🏗️ Architecture

XSSROOTX/
├── main.py                    # Main application entry point
├── requirements.txt           # Python dependencies
├── payloads.txt              # XSS payload database (1000+ payloads)
├── modules/
│   ├── core.py               # Core utilities and configuration
│   ├── crawler.py            # Web crawling engine
│   ├── tester.py             # Main testing controller
│   ├── reflected.py          # Reflected XSS detection
│   ├── stored.py             # Stored XSS detection
│   ├── dom.py                # DOM-based XSS detection
│   ├── waf_detector.py       # WAF detection and bypass
│   ├── payload.py            # Payload management
│   ├── reporter.py           # Report generation
│   ├── form_handler.py       # Form processing
│   └── colors.py             # Terminal color output
├── results/                  # Output directory
│   ├── *.html               # HTML reports
│   └── *.json               # JSON reports
└── logs/                    # Execution logs

📦 Installation

Prerequisites

Python 3.6 or higher
pip (Python package manager)
Git

Method 1: Clone from GitHub (Recommended)

# Clone the repository
git clone https://github.com/Rootx202/XSSRootX.git

# Navigate to the directory
cd XSSRootX

# Install required dependencies
pip install -r requirements.txt

# Or using pip3
pip3 install -r requirements.txt

Method 2: Installation with Virtual Environment (Best Practice)

Using a virtual environment keeps dependencies isolated and prevents conflicts:

# Clone the repository
git clone https://github.com/Rootx202/XSSRootX.git

# Navigate to the directory
cd XSSRootX

# Create a virtual environment
python3 -m venv venv

# Activate the virtual environment
source venv/bin/activate

# Your prompt should now show (venv) at the beginning
# Install dependencies inside the virtual environment
pip install -r requirements.txt

# Run the tool
python3 main.py --help

# When finished, deactivate the virtual environment
deactivate

Note for Windows Users:

# Activate virtual environment on Windows
venv\Scripts\activate

Method 3: Manual Installation

# Install dependencies manually
pip install requests beautifulsoup4 lxml colorama urllib3

# Or using pip3
pip3 install requests beautifulsoup4 lxml colorama urllib3

Verify Installation

# Check Python version
python3 --version

# Test the tool
python3 main.py --help

🚀 Usage

Basic Syntax

python3 main.py -u <target_url> [options]

Essential Options

Option	Description	Default
`-u, --url`	Target URL to test (required)	-
`-p, --payloads`	Custom payload file path	`payloads.txt`
`-m, --model`	XSS type to test: `reflected`, `stored`, `dom`, `all`	`all`
`-o, --output`	Output directory for results	`results`
`-t, --threads`	Number of concurrent threads	`5`
`--max-depth`	Maximum crawling depth	`3`
`--max-urls`	Maximum URLs to crawl	`100`
`--delay`	Delay between requests (seconds)	`0.5`
`--timeout`	Request timeout (seconds)	`5`
`-v, --verbose`	Enable verbose/debug output	`False`

Advanced Options

Option	Description
`--test-headers`	Test HTTP headers (User-Agent, Referer, etc.)
`--test-cookies`	Test cookie parameters for XSS
`--test-forms`	Enable POST form auto-testing
`--waf-bypass`	Enable WAF bypass mode
`--blind-xss`	Enable Blind XSS detection
`--blind-xss-url`	Callback URL for Blind XSS (e.g., yoursubdomain.xss.ht)
`--all-tests`	Enable all advanced testing features
`--tag`	Custom tag for XSS payloads
`--user-agent`	Custom User-Agent string

🎯 Testing Modes

1. Reflected XSS Testing

Tests for immediate reflection of malicious payloads in the response.

python3 main.py -u https://example.com -m reflected

2. Stored XSS Testing

Detects persistent XSS vulnerabilities that are stored server-side.

python3 main.py -u https://example.com -m stored

3. DOM-Based XSS Testing

Analyzes client-side JavaScript for DOM manipulation vulnerabilities.

python3 main.py -u https://example.com -m dom

4. Comprehensive Testing (All Types)

Tests all XSS types simultaneously.

python3 main.py -u https://example.com -m all

💡 Examples

Example 1: Basic Scan

Simple scan of a target website:

python3 main.py -u https://testphp.vulnweb.com

Example 2: Custom Payload File

Use your own payload list:

python3 main.py -u https://example.com -p /path/to/custom_payloads.txt

Example 3: Deep Crawling with Custom Tag

Crawl deeper with a custom XSS tag:

python3 main.py -u https://example.com --max-depth 5 --max-urls 200 --tag "MyXSSTest"

Example 4: Aggressive Testing

Fast, multi-threaded testing:

python3 main.py -u https://example.com -t 10 --delay 0.2

Example 5: Complete Security Audit

Full testing with all features enabled:

python3 main.py -u https://example.com --all-tests --max-depth 4 -t 8 -v

Example 6: WAF Bypass Mode

Test with WAF evasion techniques:

python3 main.py -u https://protected-site.com --waf-bypass -v

Example 7: Blind XSS Detection

Test for out-of-band XSS:

python3 main.py -u https://example.com --blind-xss --blind-xss-url yourdomain.xss.ht

Example 8: Custom Headers & Cookies Testing

Test injection in headers and cookies:

python3 main.py -u https://example.com --test-headers --test-cookies --test-forms

Example 9: Targeted Testing with Custom Output

Test specific XSS type with custom output directory:

python3 main.py -u https://example.com -m reflected -o /path/to/results --verbose

Example 10: Rate-Limited Testing

Slow, stealthy testing to avoid detection:

python3 main.py -u https://example.com -t 1 --delay 2 --timeout 10

🔬 Advanced Features

WAF Detection

XSSROOTX automatically detects major Web Application Firewalls:

Cloudflare
AWS WAF
Akamai
Imperva (Incapsula)
ModSecurity
Sucuri
F5 BIG-IP
Barracuda
Citrix NetScaler
And more...

Payload Encoding Techniques

Automatic payload encoding variations:

Raw
URL Encoding
Double URL Encoding
HTML Entity Encoding
Base64 Encoding
Unicode Encoding
Mixed Encoding

Intelligent Testing

Smart Payload Sorting: Most effective payloads tested first
Early Stopping: Stops testing redundant parameters after finding vulnerabilities
Reflection Analysis: Analyzes how input is reflected in the response
Context-Aware Testing: Adapts payloads based on injection context

📊 Output Reports

HTML Report

Professional, interactive HTML report with:

Executive summary
Vulnerability details with severity ratings
Proof-of-concept payloads
Remediation recommendations
Color-coded severity levels

Location: results/xss_report_YYYYMMDD_HHMMSS.html

JSON Report

Machine-readable JSON format for integration:

Full vulnerability data
Test statistics
Payload information
Crawl results

Location: results/xss_report_YYYYMMDD_HHMMSS.json

Crawl Results

Text file with all discovered URLs and parameters:

Location: results/crawl_results.txt

Log Files

Detailed execution logs for debugging:

Location: logs/xss_test_YYYYMMDD_HHMMSS.log

🛠️ Troubleshooting

Common Issues

Issue: ModuleNotFoundError: No module named 'requests'

# Solution: Install dependencies
pip3 install -r requirements.txt

Issue: Permission denied when running

# Solution: Make executable
chmod +x main.py

Issue: No payloads found

# Solution: Ensure payloads.txt is in the same directory
ls -la payloads.txt

Issue: Connection timeout errors

# Solution: Increase timeout
python3 main.py -u https://example.com --timeout 15

🎓 Tips & Best Practices

Always Get Permission: Never test systems without explicit authorization
Start Small: Use --max-urls 50 for initial reconnaissance
Use Verbose Mode: Enable -v for troubleshooting and learning
Respect Rate Limits: Increase --delay to avoid overwhelming the target
Review Reports: Always manually verify automated findings
Keep Updated: Regularly update payload database
Legal Compliance: Document authorization before testing

📱 Social Media

Stay connected and get updates:

🎵 TikTok: @rootx.202
💬 Telegram: @rootx.202
💻 GitHub: Rootx202/XSSRootX

📝 License

This project is licensed under the MIT License - see the LICENSE file for details.

⚖️ Disclaimer

This tool is provided for educational and authorized testing purposes only. The developers assume no liability and are not responsible for any misuse or damage caused by this program.

By using XSSROOTX, you agree to:

Use it only on systems you own or have explicit permission to test
Comply with all applicable local, state, and federal laws
Take full responsibility for your actions

Unauthorized access to computer systems is illegal!

🙏 Acknowledgments

Security researchers and ethical hackers worldwide
The open-source community
Bug bounty hunters who help make the web safer

📚 Additional Resources

Made with ❤️ by RootX

⭐ Star this repository if you find it helpful!

Name		Name	Last commit message	Last commit date
logs		logs
modules		modules
results		results
wordlist		wordlist
README.md		README.md
payloads.txt		payloads.txt
requirements.txt		requirements.txt
xss_framework.py		xss_framework.py

Latest commit

History

Folders and files

Repository files navigation