Why Choose This Project?

Cross-Site Scripting (XSS) remains one of the most common and dangerous vulnerabilities in web applications, enabling attackers to inject malicious scripts into websites viewed by other users. This project allows users to test web inputs, URLs, forms, and parameters for XSS vulnerabilities and even provides mitigation techniques, making it ideal for educational demonstrations, pentesting tools, or freelance bug bounty work.

What You Get in This Project

• Full working source code (frontend + backend)

• Form and URL scanner for stored and reflected XSS

• Interactive input testing interface with payload injection

• Auto-testing common input fields like search boxes, comments, etc.

• Report panel showing XSS vulnerability status and response output

• Suggestions for defense: input sanitization, output encoding, CSP headers

• Admin dashboard for viewing scan history and payload logs

• Complete documentation with setup & usage instructions

Technology Stack

How It Works

1. Target Input
   The user enters a URL or uploads form details to scan.

2. Injection Phase
   The system injects pre-defined XSS payloads into input fields (GET/POST parameters, headers, cookies).

3. Response Analysis
   It analyzes the response for signs of payload reflection without sanitization, such as <script> execution or DOM manipulation.

4. Vulnerability Report
   Generates a report with:

   • Vulnerable fields and payloads

   • Type of XSS detected (Reflected, Stored, DOM-based)

   • Suggested patch and secure code samples

5. Hardening Advice
   Provides patching strategies like:

   • Escaping/encoding user input

   • Setting Content-Security-Policy headers

   • Using libraries like DOMPurify (frontend) or OWASP Java Encoder

6. Admin Dashboard
   Track all scans, their result statuses, payload logs, and timestamps.

Key Features

• Tests for Reflected, Stored, and DOM-based XSS

• Injects and logs various payloads from OWASP XSS Cheat Sheet

• Highlights input fields vulnerable to script injection

• Suggests code fixes in multiple languages (PHP, Node.js, Java)

• Supports scanning multiple pages/forms in bulk

• Logs suspicious responses and alert conditions

• Real-time payload execution simulation via iframe or JS eval

• Built-in protections for running in testing mode only