#216·XSStrike

Attack points that can not be detected.

Author: oldesecCreated Mar 25, 2019Updated Sep 3, 2024
Labelsspecial case

Hello.

I am using the "XSStrike" tool on the "xss" test site.

The "XSStrike" tool failed at the following attack points.

Hmm,, what's the reason?

Thanks.

root@oldesec:~/XSStrike# python3 xsstrike.py -u "https://public-firing-range.appspot.com/reflected/url/css_import?q=a" 

	XSStrike v3.1.2

[~] Checking for DOM vulnerabilities 
[+] WAF Status: Offline 
[!] Testing parameter: q 
[!] Reflections found: 1 
[~] Analysing reflections 
[~] Generating payloads 
[-] No vectors were crafted. 


root@oldesec:~/XSStrike# python3 xsstrike.py -u "https://public-firing-range.appspot.com/reflected/url/script_src?q=a"  --skip-dom

	XSStrike v3.1.2

[+] WAF Status: Offline 
[!] Testing parameter: q 
[!] Reflections found: 1 
[~] Analysing reflections 
[~] Generating payloads 
[-] No vectors were crafted.