XSS-Radar

Cross-site scripting discovery
A Chrome extension for fast and easy XSS fuzzing

XSS Radar is a tool that detects parameters and fuzzes them for cross-site scripting vulnerabilities.
It's also the first tool developed by the Bug Bounty Forum community!

How do I install it?

At present, we're only supporting the widely used Google Chrome. XSS Radar takes the form of a browser extension, so we hope to support Firefox in the future.

First, git clone https://github.com/bugbountyforum/XSS-Radar
Visit chrome://extensions/
Enable Developer Mode via the checkbox
Select "Load Unpacked Extension"
Finally, locate and select the inner extension folder

How do I use it?

Visit a target page, open the extension and select Fuzz!

Contexts and tests

We've developed contexts – and their respective tests – in a fully modular fashion. By doing so, we've made it easy to contribute new methodologies to Radar's Scanner module.

Contexts are found in contexts.js (inside extension/src/payloads/). Upon fuzzing, the Scanner searches for applicable contexts on the target and deploys the right payloads. For instance, link-based XSS bugs often rely on injection within the href attribute, so we've added a context which specifically matches against these:

{
    'type': 'a', // link/anchor type
    'matches': ['href'], // URI attribute
    'file': 'link.js' // payload file
}

Tests are found within the playground subdirectory. The XSS Playground contains a variety of cross-site scripting scenarios designed to support development and ensure Radar's effectiveness. At present, we test for classic vectors, JavaScript injection, tag breakouts, and templating vulnerabilities.