Gxss v2.2

A Light Weight Tool for checking reflecting Parameters in a URL. Inspired by kxss by @tomnomnom.

Installation

go get -u github.com/KathanP19/Gxss

Usage

                  
 _____ __ __ _____ _____ 
|   __|  |  |   __|   __|
|  |  |-   -|__   |__   |
|_____|__|__|_____|_____|
                         
        2.0 - @KathanP19

  Usage of ./Gxss:
  -c int
        Set the Concurrency (default 50)
  -o string
        Save Result to OuputFile
  -p string
        Payload you want to Send to Check Refelection (default "Gxss")
  -v    Verbose mode

• Checking Single Url

  echo "https://target.com/some.php?first=hello&last=world | Gxss -c 100

• Checking List of Urls

  cat urls.txt | Gxss -c 100 -p XssReflected

• Save Urls Which have Reflecting Params in a file for further analysis

  cat urls.txt | Gxss -c 100 -o Result.txt

• For verbose mode

  cat urls.txt | Gxss -c 100 -o Result.txt -v

How It Works

1. It takes Urls from STDIN
2. It check for the reflected value on params one by one. (There are some tool like qsreplace which replace all params value but gxss checks payload one by one which makes it different from all those tools.)

For Example- 
Url is https://example.com/?p=first&q=second

First it will check if p param reflects
https://example.com/?p=Gxss&q=second

Then it will check if q param reflects
https://example.com/?p=first&q=Gxss

3. If reflection for any param is found it tells which param reflected in response.

Use Case or How to add to your workflow

echo "testphp.vulnweb.com" | waybackurls | httpx -silent | Gxss -c 100 -p Xss | sort -u | dalfox pipe

• Dalfox is Xss Scanner by @hahwul

TODO

• [ ] Add an option for user to add there own headers
• [ ] Add an option for User-Agent

Thanks To

• Zoid for helping me out with code.

To Support Me

• You Can Buy Me A Coffee