PAGES
← all tools
◆ Web Application Security

xsstrike

3.1.2 open-source

XSS detection suite that crawls targets, analyzes response context, and generates context-aware payloads to find reflected, DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime., and blind XSS vulnerabilities.

source ↗ rss ↗ What is a cyber toolchain?

Summary

xsstrike is an open-source command-line tool for finding cross-site scriptingcross-site scriptingCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. vulnerabilities, free to use, built around hand-written HTML and JavaScript parsers that analyse a page's response and generate context-specific payloads rather than firing a fixed wordlist and checking what sticks. It also crawls a target, discovers parameters, fuzzes them, detects and evades WAFs, and checks for outdated JS libraries and DOM-based XSS, which suits penetration testers and bug bounty hunters who currently stitch these steps together from separate recon and fuzzing tools. First committed in 2017 and grown by 30 contributors across 29 tracked releases, it has had no commits in the past year and its last release was over 500 days ago, so treat it as stable but no longer actively maintained.

XSS detection suite that crawls targets, analyzes response context, and generates context-aware payloads to find reflected, DOM, and blind XSS vulnerabilities.

How xsstrike helps

Which parameters on this page can actually be used to inject script, and not just reflect it?

crawls the target, discovers parameters, and parses the response with its HTML and JavaScript parsers to work out the surrounding context before crafting a payload guaranteed to fire in that context, rather than firing a fixed wordlist and checking what sticks

Does this page have a DOM-based XSS issue that never shows up in the server response?

scans the DOM directly for sources and sinks that a purely server-side response check would miss

Is a firewall in front of this target going to block or reshape my requests before they reach the code being tested?

detects which WAF is in front of the target and adjusts payloads to evade it

Are any of the JavaScript libraries this page loads carrying a known vulnerability?

checks the libraries the page pulls in against known outdated versions and reports which ones are stale

Can I get a payload past this input without tripping the obvious filters, using something other than the built-in generator?

accepts a file of bruteforce payloads and tests each one against the target in place of, or alongside, its own generated set

all 4 features, with the evidence for each →

Languages

Not documented

Features

4 capabilities · 1 backed by code, an API document or a real run

Built from xsstrike's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • xsstrike covers 1 of the 8 vulnerability assessment methods capabilities we track.

What xsstrike offers you

  • Command-line interface3
All capabilities 4 capabilities
Logging configuration verified Controls how the tool logs output, with separate options for console and file logging levels and a configurable log file path. 4 other sources · first seen Apr 2019

Also counts toward: Command-line interface

command line

example

  • Launch XSStrike python xsstrike.py
XSS Detection shipped Crawls targets, analyzes response context, and generates context-aware payloads to find reflected, DOM, and blind XSS vulnerabilities. 2 releases · 2 other sources · first seen Dec 2018

Shared capability: Web vulnerability scanning

Also counts toward: Command-line interface

release

  • Adds --headers flag to pass custom HTTP headers from the command line. 3.1.2 · Dec 2018 · source · release history
  • Enables support for sending POST requests with JSON body data. 3.1.2 · Dec 2018 · source · release history

docs

  • XSS detection suite that crawls targets, analyzes response context, and generates context-aware payloads to find reflected, DOM, and blind XSS vulnerabilities.

example

  • Pass custom headers like an Authorization token or User-Agent override directly from the CLI without editing input files. xsstrike -u https://example.com/page --headers 'Authorization: Bearer <token>; X-Custom-Header: value' 3.1.2 · Dec 2018 · source
Scan Exclusion Patterns shipped Skips specific input contexts during scanning based on user-defined patterns or regex. 1 release · 1 other source · first seen Nov 2018

Also counts toward: Command-line interface

release

  • Adds --skip switch to specify patterns or contexts to ignore during scanning. 3.0.1 · Nov 2018 · source · release history

example

  • Scan a target while skipping specific input contexts defined in a file or regex pattern. xsstrike -u http://example.com/page --skip bad_contexts.txt 3.0.1 · Nov 2018 · source
SSL Certificate Bypass shipped suggested Bypasses SSL certificate verification for internal targets or self-signed certificates. 1 release · 1 other source · first seen Nov 2018

Suggested capability: Web vulnerability scanning. This is our guess, not confirmed.

release

  • Ignores SSL certificates by default when making requests. 3.0.1 · Nov 2018 · source · release history

example

  • Bypass SSL certificate verification for self-signed certificates in internal targets. xsstrike -u https://internal-app.local --insecure 3.0.1 · Nov 2018 · source

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for xsstrike, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail xsstrike puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

2 entries

  1. December 20181
  3. November 20181

    2 entries

    1. 3.1.2 Dec 30, 2018 · release notes

      XSStrike 3.1.2 adds JSON POST support, URL rewriting, CLI headers and improved DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime. scanning

      └──▷ GET THIS VERSION 
      $ git clone --branch 3.1.2 https://github.com/s0md3v/XSStrike.git
# already have the repo? check out this version:
$ git checkout 3.1.2
      └──▷ USE IT
      Pass custom headers like an Authorization token or User-Agent override directly from the CLI without editing input files.
      shell 
      xsstrike -u https://example.com/page --headers 'Authorization: Bearer <token>; X-Custom-Header: value'
      • Adds --headers flag to pass custom HTTP headers from the command line.
      • Enables support for sending POST requests with JSON body data.

      2 details in Everything

    2. 3.0.1 Nov 12, 2018 · release notes

      XSStrike 3.0.1 adds the --skip CLI flag and configurable SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certificate handling

      └──▷ GET THIS VERSION 
      $ git clone --branch 3.0.1 https://github.com/s0md3v/XSStrike.git
# already have the repo? check out this version:
$ git checkout 3.0.1
      └──▷ USE IT
      Scan a target while skipping specific input contexts defined in a file or regex pattern.
      shell 
      xsstrike -u http://example.com/page --skip bad_contexts.txt
      Bypass SSL certificate verification for self-signed certificates in internal targets.
      shell 
      xsstrike -u https://internal-app.local --insecure
      • Adds --skip switch to specify patterns or contexts to ignore during scanning.
      • Ignores SSL certificates by default when making requests.

      2 details in Everything

    Project health

    Issue, contributor and maintainer activity in s0md3v/XSStrike, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 0 −2 vs prior 12 months
    2. Maintainers 0 +0 joined · −1 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 70 of 295 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 70
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 15,188
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback