xss_vibes is a Python-based automated tool designed to efficiently detect and exploit XSS vulnerabilities with advanced payload management and WAF bypass capabilities.
A modern tool written in Python that automates your xss findings.
This tool is primarily used by web security professionals and penetration testers to automate the discovery and exploitation of cross-site scripting (XSS) vulnerabilities across multiple URLs or single targets. It is ideal for security assessments where speed, accuracy, and bypassing web application firewalls are critical. Users can also customize payloads and headers to test authenticated or restricted endpoints.
Ensure Katana is installed to leverage the built-in crawler functionality for link discovery. Use thread counts responsibly (max 10) to avoid overwhelming target servers or triggering defensive mechanisms. Custom headers allow testing behind authentication or restricted access, but ensure you have permission to test such endpoints. The tool’s WAF detection and bypass features can help in realistic penetration testing scenarios but should be used ethically.
Clone the repository: git clone https://github.com/faiyazahmad07/xss_vibes
Install the requirements: pip3 install -r requirements
Install Katana on your machine to enable full tool functionality
Run the tool using: python3 main.pypython3 main.py -f <filename> -o <output>
Scan multiple URLs listed in a file and save vulnerable endpoints to an output file
python3 main.py -u http://example.com/hpp/?pp=12 -o out.txt
Scan a single URL for XSS vulnerabilities and save results
python3 main.py -f urls.txt -H "Cookies:test=123;id=asdasd, User-Agent: Mozilla/Firefox" -t 7 -o result.txt
Scan URLs with multiple custom headers and 7 concurrent threads
python3 main.py -f urls.txt -H "Cookies:test=123;id=asdasd" -t 7 -o result.txt
Scan URLs with a single custom header and 7 concurrent threads
python3 main.py -u http://example.com/hpp/?pp=12 -o out.txt --waf
Detect WAF on the target and use specialized payloads to bypass it
python3 main.py -u http://example.com/hpp/?pp=12 -o out.txt -w cloudflare
Manually specify the WAF type to use tailored bypass payloads
cat katana.txt | python3 main.py --pipe -t 7
Pipe URLs from a file into the tool for scanning with 7 threads