[XSSless] An automated XSS payload generator written in python

An automated XSS payload generator written in python.

Usage

1. Record request(s) with Burp proxy
2. Select request(s) you want to generate, then right click and select "Save items"
3. Use xssless to generate your payload: ./xssless.py burp_export_file
4. Pwn!

A more detailed tutorial can be found here

Features

• Automated XSS payload generation from imported Burp proxy requests
• Payloads are 100% asynchronous and won't freeze the user's browser
• CSRF tokens can be easily extracted and set via the -p option
• POST multipart is supported, along with XSS file uploading via the -f option
• Payloads are dynamic and portable (due to relative URLs)
• Crazy JavaScript worms with no hassle!

Download XSSless

Read more

[XSS Cheat Sheet] Bypassing Modern Web Application Firewall XSS Filters

While we doing web application penetration testing for our clients, we may some time have to face the Web application Firewall that blocks every malicious request/payload.

There are some Cheat sheets available on internet that helped to bypass WAF in the past. However, those cheats won't work with the modern WAFs and latest browsers.  

So, here is need for creating new Cheat sheet.

One of the top security researcher Rafay Baloch has done an excellent job by organizing his own techniques to bypass modern WAFs and published a white paper on that.

The paper titled "Modern Web Application Firewalls Fingerprinting and Bypassing XSS Filters" covers only the techniques needed for bypassing XSS filters.

Rafay promised to write other vulnerabilities' bypassing techniques in his next paper.

Download XSS Cheat Sheet

Read more