# 2.3.5 Identifying & Exploiting XSS with XSSer

{% embed url="https://github.com/epsylon/xsser" %}

{% embed url="https://www.kali.org/tools/xsser/" %}

Cross Site "Scripter" (aka XSSer) is an automatic -framework- to detect, exploit and report XSS vulnerabilities in web-based applications.

It provides several options to try to bypass certain filters and various special techniques for code injection.

XSSer has pre-installed \[ > 1300 XSS ] attacking vectors and can bypass-exploit code on several browsers/WAFs:

## Lab

XSS Reflected - DNS Lookup -> [https://localhost/mutillidae/index.php?page=dns-lookup.php](https://localhost/mutillidae/index.php?page=dns-lookup.php)

<figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/TKHD8dDC6PRVQrJUHTUM/image.png" alt=""><figcaption></figcaption></figure>

Trying to insert and execute a standard payload: \<script>alert("XSS")\</script> I can't write all text for shorter input lenght, in addition i receive this error only writing \<script> tag:

<figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/M1oajFibAfbL4PJImxtm/image.png" alt=""><figcaption></figcaption></figure>

Then, capturing the request using Burp Suite we can prepare a payload to give to xsser

<figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/IGHfQxHX2cR3iJ9pkB6z/image.png" alt=""><figcaption></figcaption></figure>

The type of command that we need is this: xsser --url "\<http://website.com" -p "payload (request that we want to test, changing the target\_host value with XSS instead of example)"

```bash
xsser --url "https://localhost/mutillidae/index.php?page=dns-lookup.php" -p "target_host=XSS&dns-lookup-php-submit-button=Lookup+DNS"
```

<figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/3YB8aESINlPgaEYQ9k2I/image.png" alt=""><figcaption></figcaption></figure>

#### Active GUI mode

There's a XSSer GUI mode that facilitate the utilize, activable with  flag --gtk

`xsser --gtk`

<figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/V5OcFAgQNRDvKhUEh410/image.png" alt=""><figcaption></figcaption></figure>
