#406·XSStrike

Allow Injecting Payloads in URLs Path using requests or other light weight tool instead of selenium

Author: basedygtCreated Jun 21, 2024Updated Sep 5, 2024

Is your feature request related to a problem? Please describe. Injecting payloads in URLs paths is very slow as it uses selenium by default

Describe the solution you'd like Adding an additional argument which allows user to inject the payload with requests or other light weight tool should solve this issue

Additional context

For scanning a URL which reflects the value from it's path say https://example.com/file/payload results in file payload not found can be exploited with https://example.com/file/<script>alert(1)</script>

Using xsstrike we can automate it with below command:

python3 xsstrike.py -u "https://example.com/file/payload" --path

However it uses selenium to test payloads which is slow as compared to requests