Does airixss find DOM-based XSS?

No. It inspects server responses for a reflected payload, so it misses DOM XSS that only fires in client-side JavaScript. Pair it with findom-xss or dalfox for DOM coverage.

How does airixss compare to kxss?

kxss reports which special characters reflect unfiltered per parameter. airixss injects a full -payload and checks for that reflection. A common pipeline runs kxss first, then airixss on the reflecting parameters.

When should I use dalfox instead?

Use dalfox when you want deeper XSS analysis and verification on a focused target. Use airixss to shortlist reflection hits across thousands of recon URLs first.

How do I keep only potentially vulnerable URLs?

Enable --only-poc. The run then lists only URLs that look potentially vulnerable instead of a Vulnerable or Not Vulnerable line for every target.

Updated Jul 14, 2026

Scanners

Flag reflected XSS across a list of parameter URLs

Reflection triage for parameter URLs during recon.

Triage reflected XSS across a URL list Keep output to likely vulnerabilities only Bolt onto a recon pipeline

overview

What airixss does

airixss reads parameter-bearing URLs, injects your payload into each one, and checks whether that string returns in the response unfiltered. Each URL prints as Vulnerable or Not Vulnerable, so a long candidate list collapses into a short set for manual confirmation.

Set -payload to the reflection string you want matched. Raise -c for concurrent workers on large sets. Enable --only-poc to keep only likely hits. Use --headers for auth or request shaping, and --proxy when you want traffic logged or replayed.

The managed Scanners node reads a file of target URLs and writes a file and folder of results. Feed parameter URLs from a crawler or archive collector, then hand hits to a deeper XSS tool or manual review. It flags reflection; it does not prove exploitability.

source github.com/ferreiraklet/airixss

use cases

Where airixss fits

Triage reflected XSS across a URL list

Run airixss over crawler or archive output to flag the URLs where an injected payload reflects unfiltered, narrowing a huge list to a few candidates worth a closer look.

Keep output to likely vulnerabilities only

Enable --only-poc so the run reports only the potentially vulnerable URLs and drops the Not Vulnerable noise before a human or a deeper tool takes over.

Bolt onto a recon pipeline

Chain gau or waybackurls into gf xss and qsreplace, then pipe the parameter URLs into airixss so reflection triage runs as one automated stage in an attack-surface workflow.

Route checks through a proxy

Send traffic through --proxy to log every request and response, so reflected hits can be replayed and confirmed in an interception tool like Burp or ZAP.

reference

airixss inputs and flags

6 inputs

Name	Type	Flag	Description
targets	FILE	·	File of target URLs to test for reflected XSS (read from stdin on the CLI).
payload	STRING	-payload	Reflection flag string to inject and match in each response, e.g. "><svg onload=confirm(1)>.
only-poc	BOOLEAN	--only-poc	Show only potentially vulnerable URLs and drop the Not Vulnerable lines.
concurrency	STRING	-c	Set the number of concurrent workers (default 50).
headers	STRING	--headers	Custom request headers, for auth or specific request shaping.
proxy	STRING	--proxy	Send traffic through a proxy for logging, inspection, or replay.

Showing key inputs. airixss exposes 6 inputs in total.

example

Run airixss

airixss · command

# triage parameter URLs for reflected XSS with 40 concurrent workerscat urls.txt | airixss -payload '"><svg onload=confirm(1)>' -c 40

sample output

Vulnerable - https://example.com/search?q="><svg onload=confirm(1)>Not Vulnerable - https://example.com/about?ref=navNot Vulnerable - https://example.com/catalog?id=42Vulnerable - https://example.com/redirect?next="><svg onload=confirm(1)>Not Vulnerable - https://example.com/blog?page=7Not Vulnerable - https://example.com/filter?sort=ascVulnerable - https://app.example.com/preview?tpl="><svg onload=confirm(1)>

guidance

Choosing airixss

Use airixss as a first pass for reflected XSS over a large set of parameter-bearing URLs during recon. It flags reflection, not confirmed exploitability. Prefer dalfox for deeper verification; use findom-xss for DOM-based cases.

dalfox

Full XSS scanner with parameter analysis and verification. Heavier and more thorough than a reflection check.

kxss

Reports which characters reflect unfiltered per parameter. Useful precursor before airixss payload checks.

findom-xss

Focuses on DOM-based XSS. Covers cases airixss reflection checks miss.

faq

airixss questions

Reflected XSS. It injects the string from -payload and checks whether that string returns unfiltered, then labels each URL Vulnerable or Not Vulnerable. Hits are candidates; they are not confirmed executions.

Run airixss yourself

A list of parameter URLs feeds airixss, which checks each for reflected payloads and writes the likely-vulnerable hits as a queryable output.

Open airixss in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.

Flag reflected XSS across a list of parameter URLs

What airixss does

Where airixss fits

Triage reflected XSS across a URL list

Keep output to likely vulnerabilities only

Bolt onto a recon pipeline

Route checks through a proxy

airixss inputs and flags

Run airixss

Choosing airixss

dalfox

kxss

findom-xss

airixss questions

More Scanners tools

ac-scanner

bedrock-keys-security

cmseek

jaeles

joomscan

nikto

Run airixss yourself