The most common vulnerabilities on websites is Cross-site Scripting (XSS). Not only a small website but a website like Facebook and NASA also have this vulnerability issue. But, if you know how to find Cross-site Scripting (XSS) vulnerability on your website, then your website is invulnerable from attacker hands.
Traxss
Automated Vulnerability Scanner for XSS | Written in Python3 | Utilizes Selenium Headless
Background
Traxss is a Hacktoberfest Project! If you are looking for a place to make contribute, please feel free.
Traxss is an automated framework to scan URLs and webpages for XSS Vulnerabilities. It includes over 575 Payloads to test with and multiple options for robustness of tests. View the gif above to see a preview of the fastest type of scan.
Demo
Getting Started
Prerequisites
Traxss depends on Chromedriver. On MacOS this can be installed with the homebrew command:
Alternatively, find a version for other operating systems here: https://sites.google.com/a/chromium.org/chromedriver/downloads
Installation
Run the command:
Running Traxss
Traxx can be started with the command:
This will launch an interactive CLI to guide you through the process.
Types of Scans
Full Scan w/ HTML
Uses a query scan with 575+ payloads and attempts to find XSS vulnerabilities by passing parameters through the URL. It will also render the HTML and attempt to find manual XSS Vulnerablities (this feature is still in beta).
Full Scan w/o HTML
This scan will run the query scan only.
Fast Scan w/ HTML
This scan is the same as the full w/ HTML but it will only use 7 attack vectors rather than the 575+ vectors.
Fast Scan w/o HTML
This scan is the same as the fast w/o HTML but it will only use 7 attack vectors rather than the 575+ vectors.
Contributing
Thank you for your interest! All types of contributions are welcome.
- Fork and clone this repository
- Create your branch from the master branch
- Please open your PR with the master branch as the base
