xray unstable / something wrong | Why the xray can't detect an easy xss

[themeswordpress]

Dears,

Why the xray can't detect an easy xss

.\xray_windows_amd64.exe ws -u "https://www[.]taawon[.]org/donateformsubmit?currency=9337" --plugins xss --html-output sdsd.html

POC https://www[.]taawon[.]org/donateformsubmit?currency=9337">

[khanjanny]

same

[zeoxisca]

Hi there, After testing this target, We find this vuln SHOULD be detected by xray.

The payload works like: https://www.taawon.org/donateformsubmit?currency=TESTPAYLOAD

<input type="hidden"  name="PurchaseCurrency" value="TESTPAYLOAD"><br>

It's a simple one. And we believe this payload is rendered to template by server side. However, xray will send lots payload to detect this website. The server of this website will strike under high frequency requests:

currency=abcdefg
...
<input type="hidden"  name="PurchaseCurrency" value="abcdefg"><br>  // at the beginning
...

currency=PAYLOAD
...
<input type="hidden"  name="PurchaseCurrency" value=""><br>  // After a period of high frequency requests
...

So unfortunately, the payload could xssed DROPPED by server. This vulnerability can be detected after adjusting the frequency of requesting the target on the code side（time.Sleep(time.Second), lol).