Xss Open Source Projects

ALL IN ONE Hacking Tool For Hackers

SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

Most advanced XSS scanner.

Source code for Hacker101.com - a free online web and mobile security class.

🐶 A curated list of Web Security materials and resources.

A list of resources for those interested in getting started in bug bounties

一款长亭自研的完善的安全评估工具，支持常见 web 安全问题扫描和自定义 poc | 使用之前务必先阅读文档

jsoup: the Java HTML parser, built for HTML editing, cleaning, scraping, and XSS safety.

A list of web application security

Top disclosed reports from HackerOne

A curated list of bugbounty writeups (Bug type wise) , inspired from https://github.com/ngalongc/bug-bounty-reference

[灯灯]微服务中后台快速开发平台，支持jdk21、jdk17、jdk8，专注于多租户、开放平台解决方案，亦可作为普通项目（非SaaS架构）的基础开发框架使用，目前已实现插拔式数据库隔离、SCHEMA隔离、字段隔离 等租户隔离方案。

Sanitize untrusted HTML (to prevent XSS) with a configuration specified by a Whitelist

🎯 Cross Site Scripting ( XSS ) Vulnerability Payload List

Awesome XSS stuff

🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.

SwiftSoup: Pure Swift HTML Parser, with best of DOM, CSS, and jquery (Supports Linux, iOS, Mac, tvOS, watchOS)

一个好玩的Web安全-漏洞测试平台

Web-Security-Learning

Inspired by https://github.com/djadmin/awesome-bug-bounty, a list of bug bounty write-up that is categorized by the bug nature

Web Application Security Scanner Framework

Git All the Payloads! A collection of web attack payloads.

bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS

A collection of snippets of codes and commands to make your life easier!

Gets the job done when JSON.stringify can't

使用docker快速搭建各大漏洞靶场，目前可以一键搭建17个靶场。

A collection of tiny XSS Payloads that can be used in different contexts. https://tinyxss.terjanq.me

ezXSS is an easy way for penetration testers and bug bounty hunters to test (blind) Cross Site Scripting.

:cat2:Medusa是一个红队武器库平台，目前包括XSS平台、协同平台、CVE监控、免杀生成、DNSLOG、钓鱼邮件、文件获取等功能，持续开发中

XSS'OR - Hack with JavaScript.

Collection of quality safety articles. Awesome articles.

A container repository for my public web hacks!

WEB安全手册(红队安全技能栈)，漏洞理解，漏洞利用，代码审计和渗透测试总结。【持续更新】

Web vulnerability scanner written in Python3

A Python based web application scanner to gather OSINT and fuzz for OWASP vulnerabilities on a target website.

CMS漏洞测试用例集合

安全场景、基于AI的安全算法和安全数据分析业界实践

XSS spider - 66/66 wavsep XSS detected

Cleans HTML to avoid XSS attacks

A big list of Android Hackerone disclosed reports and other resources.

Biny is a tiny, high-performance PHP framework for web applications

🐛 A list of writeups from the Google VRP Bug Bounty program

Prototype Pollution and useful Script Gadgets

Advanced dork Search & Mass Exploit Scanner

Popular Pentesting scanner in Python3.6 for SQLi/XSS/LFI/RFI and other Vulns

The XSS Hunter service - a portable version of XSSHunter.com

Check your WAF before an attacker does

Cross Site "Scripter" (aka XSSer) is an automatic -framework- to detect, exploit and report XSS vulnerabilities in web-based applications.

Burp Suite Certified Practitioner Exam Study

An XSS exploitation command-line interface and payload generator.

日常积累的一些红队工具及自己写的脚本，更偏向于一些diy的好用的工具，并不是一些比较常用的msf/awvs/xray这种

XSS payloads designed to turn alert(1) into P1

🔱 Powerfull XSS Scanning and Parameter analysis tool&gem

☕ Latte: the safest & truly intuitive templates for PHP. Engine for those who want the most secure PHP sites.

A sorted and updated list of security wargame sites.

pentest framework

Burp plugin able to find reflected XSS on page in real-time while browsing on site

Browser's XSS Filter Bypass Cheat Sheet