XSS-Radar

XSS Radar is a tool that detects parameters and fuzzes them for cross-site scripting vulnerabilities.

Cross-site scripting discovery
A Chrome extension for fast and easy XSS fuzzing

GitHub issues Twitter

XSS Radar is a tool that detects parameters and fuzzes them for cross-site scripting vulnerabilities.
It's also the first tool developed by the Bug Bounty Forum community!

How do I install it?

At present, we're only supporting the widely used Google Chrome. XSS Radar takes the form of a browser extension, so we hope to support Firefox in the future.

  1. First, git clone https://github.com/bugbountyforum/XSS-Radar
  2. Visit chrome://extensions/
  3. Enable Developer Mode via the checkbox
  4. Select "Load Unpacked Extension"
  5. Finally, locate and select the inner extension folder

How do I use it?

Visit a target page, open the extension and select Fuzz!

Screenshot of extension Fuzz window

Contexts and tests

We've developed contexts – and their respective tests – in a fully modular fashion. By doing so, we've made it easy to contribute new methodologies to Radar's Scanner module.

Contexts are found in contexts.js (inside extension/src/payloads/). Upon fuzzing, the Scanner searches for applicable contexts on the target and deploys the right payloads. For instance, link-based XSS bugs often rely on injection within the href attribute, so we've added a context which specifically matches against these:

{
    'type': 'a', // link/anchor type
    'matches': ['href'], // URI attribute
    'file': 'link.js' // payload file
}

Tests are found within the playground subdirectory. The XSS Playground contains a variety of cross-site scripting scenarios designed to support development and ensure Radar's effectiveness. At present, we test for classic vectors, JavaScript injection, tag breakouts, and templating vulnerabilities.

Payloads

We've integrated the following reflected payload classes. These can be found in extension/src/payloads.

  • AngularJS template injection
    • All versions with a vulnerable Expression Sandbox are supported
  • Link-based URIs
  • Script injections
  • Generic tag strings

Contributors

XSS Radar is a Bug Bounty Forum project with the following contributors. It's community-driven, and we truly appreciate your contributions!

  • Ibram Marzouk
  • Anshuman Bhartiya
  • Rafal Janicki
  • Jack Cable
  • Filipe Reis
  • gradius
  • Olivier beg
  • Yasin Soliman

FAQ

Can I use my own payloads?

Yes, you can add your own payloads in extension/src/payloads.

What types of XSS does XSS Radar detect?

XSS Radar detects reflected XSS. Self-XSS, DOM based XSS and stored XSS cannot be detected with this extension.