XSStrike alternatives

Looking for an alternative tool to replace XSStrike? During the review of XSStrike we looked at other open source tools. Based on their category, tags, and text, these are the ones that have the best match.

Top 3

  1. Damn Small XSS Scanner (cross-site scripting scanner)
  2. XSSER (Cross-site scripting scanner)
  3. XSS Hunter (Cross-site scripting scanner)

These tools are ranked as the best alternatives to XSStrike.

Alternatives (by score)

64

Damn Small XSS Scanner (DSXS)

Introduction

None

Project details

Damn Small XSS Scanner is written in Python.

Strengths and weaknesses

  • + The source code of this software is available
  • - No releases on GitHub available

Typical usage

  • Penetration testing
  • Web application analysis

Damn Small XSS Scanner review

60

XSSER

Introduction

XXSER helps to get from XSS to Remote Code Execution (RCE). It provides custom tools and payloads integrated with Metasploit's Meterpreter. The goal is to automate as much as possible.

Project details

XSSER is written in Python.

Strengths and weaknesses

  • + The source code of this software is available
  • - Minimal or no documentation available

Typical usage

  • Penetration testing
  • Security assessment
  • Web application analysis

XSSER review

78

XSS Hunter

Introduction

By using a specific link, XSS Hunter can see when some attack successfully is triggered. It will then store information like the vulnerable page's URI, referer, HTML DOM, the screenshot of page, and cookies. Regarding the victim, it stores the IP address and the user agent.

Project details

60

Pybelt

Introduction

The pybelt toolkit may be useful during a pentest to simplify the process of scanning. It includes options like port scanning, dork checking, cracking and verification of hashes, and scanning for SQL injections.

Project details

Pybelt is written in Python.

Strengths and weaknesses

  • + The source code of this software is available

    Pybelt review

    64

    WAFPASS

    Introduction

    WAFPASS is a security tool to perform a security scan of a web application firewall (WAF). It tries to bypass the security defenses, to evaluate its effectiveness.

    Project details

    WAFPASS is written in Python.

    Strengths and weaknesses

    • + The source code of this software is available

      Typical usage

      • WAF bypassing
      • Application testing
      • Software testing

      WAFPASS review

      60

      WhatWaf

      Introduction

      WhatWaf can be helpful during security assessments to learn if a web application is protected by a WAF. If so, the bypass and avoidance techniques may help to further test or exploit the related web application.

      Project details

      WhatWaf is written in Python.

      Strengths and weaknesses

      • + The source code of this software is available
      • - No releases on GitHub available

      Typical usage

      • WAF bypassing
      • Application discovery
      • Application fingerprinting
      • Software identification
      • Web application analysis

      WhatWaf review

      60

      wafw00f

      Introduction

      wafw00f is a security tool to perform fingerprinting on web applications and detect any web application firewall in use.

      Project details

      wafw00f is written in Python.

      Strengths and weaknesses

      • + The source code of this software is available

        Typical usage

        • Application fingerprinting
        • Information gathering
        • Penetration testing
        • Reconnaissance
        • Security assessment

        wafw00f review

        60

        0d1n

        Introduction

        0d1n is useful to perform brute-force login attempts for authentication forms. It can discover useful directory names by using a predefined list of paths. With options to use a random proxy per request and load CSRF tokens, it is a tool that can be used in different type of assignments.

        Project details

        0d1n is written in C.

        Strengths and weaknesses

        • + The source code of this software is available

          Typical usage

          • Information gathering
          • Penetration testing
          • Security assessment
          • Vulnerability scanning

          0d1n review

          64

          Tulpar

          Introduction

          Tulpar is a vulnerability scanner that can be used to test new or existing web applications. In the former case, it could be helpful to test a new project before it is deployed into production. This could be done by the developer or a security professional. If some web application is already in production, then it might be a good tool to perform regular testing on known vulnerabilities. In this case, it is typically a pentester or security specialist that does the testing.

          Project details

          Tulpar is written in Python.

          Strengths and weaknesses

          • + The source code of this software is available
          • - Minimal or no documentation available

          Typical usage

          • Application security
          • Application testing
          • Web application analysis

          Tulpar review

          52

          WPSeku

          Introduction

          With WPSeku a WordPress installation can be tested for the presence of security issues. Some examples are cross-site scripting (XSS), sql injection, and local file inclusion. The tool also tests for the presence of default configuration files. These files may reveal version numbers, used themes and plugins.

          Project details

          WPSeku is written in Python.

          Strengths and weaknesses

          • + The source code of this software is available
          • - Unknown project license

          Typical usage

          • Penetration testing
          • Security assessment
          • Vulnerability scanning

          WPSeku review

          Some relevant tool missing as an alternative to XSStrike? Please contact us with your suggestion.