Awesome Open Source
Awesome Open Source

Gxss v3.0

A Light Weight Tool for checking reflecting Parameters in a URL. Inspired by kxss by @tomnomnom.

Installation

go get -u github.com/KathanP19/Gxss

Usage

                  
 _____ __ __ _____ _____ 
|   __|  |  |   __|   __|
|  |  |-   -|__   |__   |
|_____|__|__|_____|_____|
                         
        3.0 - @KathanP19

Usage of Gxss:
  -c int
        Set the Concurrency (default 50)
  -h value
        Set Custom Header.
  -o string
        Save Result to OutputFile
  -p string
        Payload you want to Send to Check Reflection (default "Gxss")
  -u string
        Set Custom User agent. Default is Mozilla (default "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36")
  -v    Verbose mode

  • Checking Single Url

    echo "https://target.com/some.php?first=hello&last=world | Gxss -c 100

  • Checking List of Urls

    cat urls.txt | Gxss -c 100 -p XssReflected

  • Save Urls Which have Reflecting Params in a file for further analysis

    cat urls.txt | Gxss -c 100 -o Result.txt

  • For verbose mode -v

    cat urls.txt | Gxss -c 100 -o Result.txt -v

  • Send Custom Header -h

    cat urls.txt | Gxss -c 100 -p Xss -h "Cookie: Value"

  • Send Custom User-Agent -u

    cat urls.txt | Gxss -c 100 -p Xss -h "Cookie: Value" -u "Google Bot"

How It Works

  1. It takes Urls from STDIN
  2. It check for the reflected value on params one by one. (There are some tool like qsreplace which replace all params value but gxss checks payload one by one which makes it different from all those tools.)
For Example- 
Url is https://example.com/?p=first&q=second

First it will check if p param reflects
https://example.com/?p=Gxss&q=second

Then it will check if q param reflects
https://example.com/?p=first&q=Gxss
  1. If reflection for any param is found it tells which param reflected in response.

asciicast

Use Case or How to add to your workflow

echo "testphp.vulnweb.com" | waybackurls | httpx -silent | Gxss -c 100 -p Xss | sort -u | dalfox pipe

TODO

  • [ ] Add Post Method Support.
  • [ ] Add Proxy Support.
  • [x] Add an option for user to add there own headers
  • [x] Add an option for User-Agent

Thanks To

  • Zoid for helping me out with code.
  • Parth Parmar for adding Custom Header and User-Agent Support.

To Support Me

  • You Can Buy Me A Coffee

    Buy Me A Coffee


Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
Go (196,482
Golang (32,788
Bugbounty (765
Xss (356
Related Projects