XSS漏洞扫描器(2种方法) - 文章 - 开发者社区

1.使用ppmap检测和利用XSS漏洞


          
sudo apt-get install chromium
          

          
sudo sh -c 'echo "deb http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list'
          
wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | sudo apt-key add -
          
sudo apt-get update
          
sudo apt-get install google-chrome-stable
          

          
go get -u github.com/chromedp/chromedp
          

          
https://github.com/kleiton0x00/ppmap
          
https://github.com/kleiton0x00/ppmap/releases
          
git clone https://github.com/kleiton0x00/ppmap.git
          

          
cd ppmap
          
go build ppmap.go

(1).单个扫描


          
echo 'https://target.com' | ./ppmap
          
echo 'http://target.com/something/?page=home' | ./ppmap

(2). 批量扫描


        
            

          cat url.txt | ./ppmap

picture.image

2.使用XSStrike进行XSS的漏洞扫描


          
https://github.com/s0md3v/XSStrike
          
git clone https://github.com/s0md3v/XSStrike.git
          

          
cd XSStrike
          
pip install -r requirements.txt

picture.image


          
python --version
          
cd XSStrike
          
python xsstrike.py -u https://target.com
          
python xsstrike.py -u http://target.com/something/?page=home

picture.image

DOM XSS

picture.image

Reflected XSS

picture.image

Crawling

picture.image

Fuzzing

picture.image

Bruteforcing payloads from a file

picture.image

Interactive HTTP Headers Prompt

picture.image

Hidden Parameter Discovery

picture.image

历史文章推荐：

查看更多精彩内容，还请关注 橘猫学安全 ：

每日坚持学习与分享，麻烦各位师傅文章底部给点个“ 再看 ”，感激不尽 picture.image