Skip to content

FAQ

Jump to bottom
Somdev Sangwan edited this page Nov 13, 2018 · 18 revisions

Frequently Asked Questions

It says fuzzywuzzy is not installed but it is.

Well it's because XSStrike runs on python3 and you have to install the module with pip3 as follows:

pip3 install fuzzywuzzy

What's up with Blind XSS?

Register on xsshunter.com, copy your payload in /core/config.py within blindPayload variable. That's it.
Then you can use the --blind option while crawling to make XSStrike inject your blind XSS payload in each parameter of each form.

Why XSStrike boasts that it is the most advanced XSS detection suite?

Because it is.

I like the project, what enhancements and features I can expect in future?

To see what is being worked on, check the development board of XSStrike. XSStrike will get the following updates in near future:

  • Dynamic JS parsing for better DOM XSS scanning
  • A dedicated filter bypassing engine
  • Enhanced WAF evasion capabilities by WAF rules reversing
  • Proxy support

How does XSStrike decide if the injection was successful without a browser engine?

Because it knows what it is doing. It crafts payloads itself based on the context of the reflection, then it injects a payload only if the characters included in the payload are not being escaped. After injecting the payload, it compares the reflected string with the injected string using levenshtein algorithm.

Does that mean it doesn't have false negatives or false positives?

When XSStrike outputs a payload, it also prints it's two properties:

  • Efficiency: The similarity between reflected and injected string 0%-100%
  • Confidence: Confidence of developer on the payload, 0-10

If a payload has confidence 10 and it's efficiency is 100%. It will work for sure. Payloads with efficiency less than 95 isn't not even printed on screen, so confidence is the measure you should have faith in.
Lower confidence = lesser chances of working.

Tool xyz works against the target, while XSStrike doesn't!

Please use that other tool.

Can I copy it's code?

Yes, as long as you state changes and release your software under the same license. For more information, please read the license. If you don't follow the conditions, you might get into trouble.

What if I want to embed it into a proprietary software?

You can mail me s0md3v@gmail.com to buy a license.

Clone this wiki locally