Advanced XSS Discovery Framework — From Recon to Exploitation
b0dj0xstrike is an all-in-one XSS vulnerability discovery tool that automates the entire attack chain: subdomain enumeration → port scanning → live host detection → link harvesting → JavaScript analysis → parameter discovery → XSS detection → payload generation → WAF bypass → DOM analysis → reporting.
- Subdomain Enumeration — crt.sh, DNS brute, certificate transparency, TLS SAN extraction
- Port Scanning — Common + full range, service detection, banner grabbing
- Live Host Detection — HTTP probing, fingerprinting, WAF detection, tech stack identification
- Link Harvesting — Crawling, sitemap, robots.txt, API endpoint extraction
- JavaScript Analysis — Secret extraction, endpoint discovery, vulnerability detection, sourcemap finding
- Parameter Discovery — Form analysis, JS extraction, brute force, reflection detection
- XSS Scanning — Reflected, DOM-based, and Stored XSS detection
- Payload Generation — 200+ payloads, context-aware, 15 encoding techniques
- WAF Bypass — 20 bypass techniques, WAF detection, adaptive payload generation
- DOM Analysis — Source/sink tracing, data flow analysis, sanitizer detection
- Reporting — JSON, HTML, Markdown reports with severity breakdown
# Clone
git clone https://github.com/yourusername/b0dj0xstrike.git
cd b0dj0xstrike
# Install dependencies
pip install -r requirements.txt
# Run full scan
python3 b0dj0xstrike.py -d example.com
# Scan single URL
python3 b0dj0xstrike.py -u "http://example.com/search?q=test"
# Aggressive scan with WAF bypass
python3 b0dj0xstrike.py -d example.com --mode aggressive --waf-bypass
# Skip recon, XSS only
python3 b0dj0xstrike.py -u "http://example.com/page" --xss-only
# Custom payload
python3 b0dj0xstrike.py -u "http://example.com?q=test" --payload '<script>alert(1)</script>'
# HTML report
python3 b0dj0xstrike.py -d example.com --report htmlpython3 b0dj0xstrike.py [options]
Target:
-d, --domain DOMAIN Target domain (e.g., example.com)
-u, --url URL Target URL (e.g., http://example.com/search?q=test)
-l, --list FILE File containing list of URLs to scan
Scan Options:
--skip-recon Skip reconnaissance phase
--skip-subdomain Skip subdomain enumeration
--skip-portscan Skip port scanning
--skip-js Skip JavaScript analysis
--mode {normal,aggressive,stealth,passive}
--threads N Number of threads (default: 30)
--timeout SECONDS Request timeout (default: 5)
--delay SECONDS Delay between requests (default: 0)
--depth N Crawl depth (default: 2)
Port Scanning:
--ports RANGE common, full, or start-end (e.g., 1-1000)
--no-banner Skip banner grabbing
XSS Options:
--xss-only Run only XSS scanning
--payload PAYLOAD Custom payload to test
--context CTX Force context: html_body, attribute, javascript, url, css
--waf-bypass Enable WAF bypass techniques
--waf-type TYPE Specify WAF type for targeted bypass
--verify Verify found vulnerabilities
Wordlists:
-w, --wordlist FILE Custom subdomain wordlist
-p, --param-wordlist FILE Custom parameter wordlist
Reporting:
--report {json,html,markdown,all}
-o, --output DIR Output directory (default: reports)
--quiet Suppress banner
Utilities:
--list-payloads List all available XSS payloads
--encode-payload PAYLOAD Encode payload with all techniques
--detect-waf Detect WAF on target
--test-subdomains Quick subdomain test only
┌─────────────────────────────────────────────────────┐
│ b0dj0xstrike Pipeline │
├─────────────────────────────────────────────────────┤
│ │
│ PHASE 1: RECONNAISSANCE │
│ ├── Subdomain Enumeration (crt.sh, DNS, TLS) │
│ ├── Port Scanning (common + service detection) │
│ └── Live Host Detection + Fingerprinting │
│ │
│ PHASE 2: ENDPOINT DISCOVERY │
│ ├── Link Harvesting (crawl, sitemap, robots.txt) │
│ ├── JavaScript Analysis (secrets, endpoints) │
│ └── API Endpoint Extraction │
│ │
│ PHASE 3: PARAMETER DISCOVERY │
│ ├── Form Parameter Extraction │
│ ├── JS Parameter Mining │
│ ├── Header Parameter Detection │
│ └── Parameter Brute Force + Reflection Test │
│ │
│ PHASE 4: XSS SCANNING │
│ ├── WAF Detection + Bypass Generation │
│ ├── Reflected XSS Detection │
│ ├── DOM-based XSS Analysis │
│ ├── Stored XSS Testing │
│ └── Payload Generation (200+ payloads) │
│ │
│ PHASE 5: REPORTING │
│ ├── Terminal Summary │
│ ├── JSON Report │
│ ├── HTML Report (dark theme) │
│ └── Markdown Report │
│ │
└─────────────────────────────────────────────────────┘
| Category | Count | Description |
|---|---|---|
| Base | 40+ | Standard XSS payloads |
| Tag Bypass | 20+ | Case manipulation, null bytes |
| HTML Body | 20+ | Context-aware body payloads |
| Attribute | 30+ | Attribute breakout payloads |
| JavaScript | 15+ | Script context payloads |
| URL | 15+ | Protocol handler payloads |
| CSS | 10+ | Style injection payloads |
| Template | 13+ | SSTI/template injection |
| Polyglot | 9+ | Multi-context payloads |
| CSP Bypass | 9+ | Content Security Policy bypass |
Total: 200+ unique payloads
| Technique | Description |
|---|---|
| Case Manipulation | Mixed case variations |
| Null Bytes | Null byte injection |
| URL Encoding | Single, double, triple encoding |
| HTML Entities | Named and numeric entities |
| Chunked Transfer | HTTP chunked encoding |
| HPP | HTTP Parameter Pollution |
| Comment Injection | HTML/JS comment breaking |
| Protocol Abuse | Non-standard protocols |
| Mutation | Null byte in tag names |
| Fragmentation | Splitting payloads |
| Unicode | Unicode/homoglyph bypass |
| Mixed Encoding | Combining multiple techniques |
| Backtick | Backtick insertion |
| Newline | Whitespace manipulation |
# Basic domain scan
python3 b0dj0xstrike.py -d example.com
# Scan with custom wordlist
python3 b0dj0xstrike.py -d example.com -w wordlists/subdomains.txt
# Aggressive mode with WAF bypass
python3 b0dj0xstrike.py -d example.com --mode aggressive --waf-bypass
# Stealth mode (slow, less noise)
python3 b0dj0xstrike.py -d example.com --mode stealth --delay 2
# XSS only on a specific URL
python3 b0dj0xstrike.py -u "http://example.com/search?q=test" --xss-only
# Detect WAF
python3 b0dj0xstrike.py --detect-waf -d example.com
# List all payloads
python3 b0dj0xstrike.py --list-payloads
# Encode a payload
python3 b0dj0xstrike.py --encode-payload '<script>alert(1)</script>'
# Full port scan
python3 b0dj0xstrike.py -d example.com --ports full
# Scan multiple URLs
echo "http://example.com/page1?q=test" > urls.txt
echo "http://example.com/page2?id=1" >> urls.txt
python3 b0dj0xstrike.py -l urls.txtb0dj0xstrike/
├── b0dj0xstrike.py # Main entry point
├── requirements.txt # Python dependencies
├── core/
│ ├── __init__.py
│ ├── logger.py # Animated terminal output
│ ├── subdomain.py # Subdomain enumeration
│ ├── portscan.py # Port scanning
│ ├── livecheck.py # Live host detection
│ ├── linkfinder.py # Link harvesting
│ ├── jsfinder.py # JavaScript analysis
│ ├── paramfinder.py # Parameter discovery
│ ├── xssscanner.py # XSS detection engine
│ ├── payloadgen.py # Payload generation
│ ├── wafbypass.py # WAF bypass techniques
│ ├── domanalyzer.py # DOM XSS analysis
│ └── reporter.py # Report generation
├── wordlists/ # Custom wordlists (optional)
└── reports/ # Generated reports
b0dj0xstrike is designed for authorized security testing and bug bounty programs only. Always obtain proper authorization before testing against any target. The author is not responsible for any misuse or damage caused by this tool.
MIT License