XSStrike icon indicating copy to clipboard operation
XSStrike copied to clipboard

Reflection without HTML tags goes undetected

Open qing-root opened this issue 5 years ago • 4 comments

Is your feature request related to a problem? Please describe. A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

Describe the solution you'd like A clear and concise description of what you want to happen.

Additional context Add any other context or screenshots about the feature request here.

qing-root avatar May 15 '19 10:05 qing-root

hello,I have a problem when i use this tool:

`root@kali:~/XSStrike# python3 xsstrike.py -u http://192.168.5.1/a.php?a=a

XSStrike v3.1.4

[~] Checking for DOM vulnerabilities [+] WAF Status: Offline [!] Testing parameter: a [!] Reflections found: 1 [~] Analysing reflections [~] Generating payloads [-] No vectors were crafted.`

please help me

qing-root avatar May 15 '19 10:05 qing-root

This is not an error. It means XSStrike was unable to find a vulnerability.

s0md3v avatar May 15 '19 11:05 s0md3v

Here is the code for my test file:

`<?php $a = $_GET['a']; echo $a;

?>`

I don't think this should fail to detect XSS vulnerabilities..

qing-root avatar May 15 '19 11:05 qing-root

Thank you,I solved the problem when i use the HTML tags. The tools is good for finding XSS vulnerability,Hard to you.

qing-root avatar May 15 '19 11:05 qing-root