Python tool that probes websites for open redirection via headers, JavaScript, and meta-tag refresh, pulls candidate URLs from the Wayback Machine, and checks CRLF injection and DOM XSS.
-
Updated
Sep 28, 2026 - Python
#
dom-xss
Here are 30 public repositories matching this topic...
OWASP Xenotix XSS Exploit Framework is an advanced Cross Site Scripting (XSS) vulnerability detection and exploitation framework.
-
Updated
Jun 7, 2020 - Python
XSSB is a proactive DOM sanitizer, defending against client-side injection attacks!
-
Updated
Aug 26, 2018 - JavaScript
MIT license BRS-XSS is a modular Python CLI scanner for XSS vulnerabilities. Features context-aware payloads, WAF evasion, DOM analysis via Playwright, ML-based risk scoring, and export in HTML/JSON/SARIF. Designed for integration with Brabus Recon Suite (BRS).
security xss owasp cybersecurity penetration-testing bug-bounty web-security appsec dom-xss ethical-hacking security-automation security-tools vulnerability-scanner waf-bypass playwright brabus easyprotech
-
Updated
Jan 12, 2026 - Python
Focused XSS fuzz scanner with smart payloads, reflection analysis, CSP checks, WAF hints, DOM sink detection, and optional browser validation.
python csp xss python3 fuzzing web-security xss-scanner xss-exploitation xss-detection dom-xss xss-attacks security-testing waf-detection
-
Updated
Sep 13, 2026 - Python
Find sources and sinks in js code that could lead to DOM XSS 🔎💧🚰
security scanner xss bug-bounty pentest dom-xss web-application-security pentest-tool web-application-security-scanner
-
Updated
Feb 27, 2024 - Shell
DOM-based XSS flaw where location.search is injected into the page via innerHTML, letting us execute arbitrary JavaScript.
-
Updated
Dec 12, 2025
DOM-based XSS where location.search is written into the page via innerHTML, letting us inject HTML and trigger alert(1) using an SVG onload payload.
-
Updated
Dec 4, 2025
DOM XSS in jQuery anchor href attribute sink using location.search source
-
Updated
Dec 12, 2025
Discovering the JavaScript parameters for dom-xss
-
Updated
Jan 27, 2024 - Python
Advanced Cross-Site Scripting (XSS) vulnerability testing framework with WAF bypass, DOM XSS detection, and comprehensive reporting capabilities.
xss owasp cybersecurity penetration-testing bug-bounty web-security xss-detection dom-xss python-security security-scanner ethical-hacking security-automation security-tools web-application-security vulnerability-scanner cross-site-scripting hacking-tools waf-bypass stored-xss reflected-xss
-
Updated
Mar 15, 2025 - Python
The EyalSec browser for security testing. Browse the web app you are testing and it reports DOM-XSS flows that really happened in the page: the source (URL, postMessage, storage, cookies), the sink, and the attacker-controlled characters. Linux x86_64.
javascript security browser xss owasp penetration-testing bug-bounty web-security pentesting taint-analysis appsec dom-xss postmessage security-testing client-side-security cross-site-scripting taint-tracking
-
Updated
Oct 22, 2026
Intentionally vulnerable static website for testing DOM-based XSS detection tools, such as Dalfox. Educational and testing use only.
-
Updated
Aug 6, 2026 - HTML
URDev’s Ultimate Injection Template is my personal payload collection: a comprehensive reference collection of web injection vectors, focused primarily on client-side execution surfaces in modern and legacy web applications.
reference injection xss html-injection bug-bounty educational web-security pentesting client-side dom-xss offensive-security security-research browser-security web-payloads waf-bypass manual-testing dom-analysis payload-collection parser-confusion browser-abuse
-
Updated
Apr 4, 2026
A deliberately vulnerable retail dashboard, live at a real HTTPS origin, built as the demonstration target for es-chromium: 21 DOM-XSS flows across 8 sources and 18 sinks, each reachable from one URL. Every flaw sits inside a feature that has a reason to exist.
javascript docker security xss owasp penetration-testing web-security devcontainer appsec dom-xss security-training postmessage cross-site-scripting vulnerable-app codespaces deliberately-vulnerable
-
Updated
Oct 22, 2026 - JavaScript
A chrome extension to detect DOM changes and reflections to find XSS
-
Updated
Sep 22, 2025 - JavaScript
Ultimate DOM Clobbering Cheat Sheet - 100+ exploitation vectors for XSS, CSP bypass, and client-side attacks. Covers browser compatibility, framework evasion, and real-world exploit chains for security researchers and bug bounty hunters
ssr hacking xss owasp cheatsheet penetration-testing web-security ctf bugbounty dom-xss offensive-security ethical-hacking htb hackthebox browser-exploitation dom-clobbering csp-bypass dom-hacking hydration-react dom-clobbering-cheatsheet
-
Updated
Dec 2, 2025
BRS-KB is XSS Knowledge Base API
security xss owasp cybersecurity penetration-testing bug-bounty web-security knowledge-base dom-xss red-team cwe cvss contexts playwright waf-bypasses
-
Updated
Jan 10, 2026 - Python
An extension to find possible parameters in a web page DOM
-
Updated
Oct 15, 2026 - JavaScript
Add this topic to your repo
To associate your repository with the dom-xss topic, visit your repo's landing page and select "manage topics."