Live data from Hacker News

XSStrike: XSS detection suite

github.com

21–30 of 36 posts

Re: XSStrike: XSS detection suite

#21
(Hoping that the author(s) is (are) here) Thank you for working on and sharing a great tool. I spotted two typos on the main site:

“...payload generator generates patloads which are...” patloads -> payloads.

“...flaunting it's genius backend.” it’s -> its.

Re: XSStrike: XSS detection suite

#22
post #21

(Hoping that the author(s) is (are) here) Thank you for working on and sharing a great tool. I spotted two typos on the main site: “...payload generator generates patloads which are...” patloads -> payloads. “...flaunting it's genius backend.” it’s -> its.

Submit a PR, the author will definately see it.

Re: XSStrike: XSS detection suite

#23

Just a word of caution: Running tools like this from your home IP address is a good way of getting banned from the Internet* by Akamai. * (yes, yes, you're not banned from the Internet, but you'll be surprised by all the sites you visit that sit behind Akamai) Some ISPs are relatively easy to get a new IP address on, others are rather difficult, so don't be dumb, use protection: a VPN.

Do I risk getting banned if I only use this against my own websites?

Re: XSStrike: XSS detection suite

#24
Must be advanced because:

> Throw away your paid tools because this is some God level shit. Now with 4 hand written parsers, an intelligent payload generator, powerful fuzzing engine, DOM scanner, hidden parameter discovery and an incredibly fast crawler. F*cking retweet it!

- https://twitter.com/s0md3v/status/1061255510677057537

> Exactly, that's why you have no idea how it works and all. Well, it took me a month and being a developer of 30+ open source software, this is the first time I am saying this is some God level shit and I mean it.

- https://twitter.com/s0md3v/status/1061662698335723520

Re: XSStrike: XSS detection suite

#27

Must be advanced because: > Throw away your paid tools because this is some God level shit. Now with 4 hand written parsers, an intelligent payload generator, powerful fuzzing engine, DOM scanner, hidden parameter discovery and an incredibly fast crawler. F*cking retweet it! - https://twitter.com/s0md3v/status/1061255510677057537 > Exactly, that's why you have no idea how it works and all. Well, it took me a month an…

Related: https://somdev.me/how-i-became-a-hacker-and-more/

Re: XSStrike: XSS detection suite

#28
post #23

Just a word of caution: Running tools like this from your home IP address is a good way of getting banned from the Internet* by Akamai. * (yes, yes, you're not banned from the Internet, but you'll be surprised by all the sites you visit that sit behind Akamai) Some ISPs are relatively easy to get a new IP address on, others are rather difficult, so don't be dumb, use protection: a VPN.

Do I risk getting banned if I only use this against my own websites?

By who?

If you're running out against an Akamai or Cloudfoare reverse proxy in front of your website, then sure. If not, no; they don't have wiretaps.

Re: XSStrike: XSS detection suite

#30
post #14

Just a word of caution: Running tools like this from your home IP address is a good way of getting banned from the Internet* by Akamai. * (yes, yes, you're not banned from the Internet, but you'll be surprised by all the sites you visit that sit behind Akamai) Some ISPs are relatively easy to get a new IP address on, others are rather difficult, so don't be dumb, use protection: a VPN.

Just don't run it against anything for which you do not have permission to run such tools. Running a tool like this against your favorite websites, is a simple way of getting banned from your favorite websites.

Even sites that have bug bounties don't turn off their WAF for you. So you can have permission to run some tools against them, but still anger Akamai.
Post reply on HN