loading
Loading content
loading
Scanners
Reflection triage for parameter URLs during recon.
overview
airixss reads parameter-bearing URLs, injects your payload into each one, and checks whether that string returns in the response unfiltered. Each URL prints as Vulnerable or Not Vulnerable, so a long candidate list collapses into a short set for manual confirmation.
Set -payload to the reflection string you want matched. Raise -c for concurrent workers on large sets. Enable --only-poc to keep only likely hits. Use --headers for auth or request shaping, and --proxy when you want traffic logged or replayed.
The managed Scanners node reads a file of target URLs and writes a file and folder of results. Feed parameter URLs from a crawler or archive collector, then hand hits to a deeper XSS tool or manual review. It flags reflection; it does not prove exploitability.
use cases
Run airixss over crawler or archive output to flag the URLs where an injected payload reflects unfiltered, narrowing a huge list to a few candidates worth a closer look.
Enable --only-poc so the run reports only the potentially vulnerable URLs and drops the Not Vulnerable noise before a human or a deeper tool takes over.
Chain gau or waybackurls into gf xss and qsreplace, then pipe the parameter URLs into airixss so reflection triage runs as one automated stage in an attack-surface workflow.
Send traffic through --proxy to log every request and response, so reflected hits can be replayed and confirmed in an interception tool like Burp or ZAP.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| targets | FILE | · | File of target URLs to test for reflected XSS (read from stdin on the CLI). |
| payload | STRING | -payload | Reflection flag string to inject and match in each response, e.g. "><svg onload=confirm(1)>. |
| only-poc | BOOLEAN | --only-poc | Show only potentially vulnerable URLs and drop the Not Vulnerable lines. |
| concurrency | STRING | -c | Set the number of concurrent workers (default 50). |
| headers | STRING | --headers | Custom request headers, for auth or specific request shaping. |
| proxy | STRING | --proxy | Send traffic through a proxy for logging, inspection, or replay. |
Showing key inputs. airixss exposes 6 inputs in total.
example
# triage parameter URLs for reflected XSS with 40 concurrent workerscat urls.txt | airixss -payload '"><svg onload=confirm(1)>' -c 40Vulnerable - https://example.com/search?q="><svg onload=confirm(1)>Not Vulnerable - https://example.com/about?ref=navNot Vulnerable - https://example.com/catalog?id=42Vulnerable - https://example.com/redirect?next="><svg onload=confirm(1)>Not Vulnerable - https://example.com/blog?page=7Not Vulnerable - https://example.com/filter?sort=ascVulnerable - https://app.example.com/preview?tpl="><svg onload=confirm(1)>guidance
Use airixss as a first pass for reflected XSS over a large set of parameter-bearing URLs during recon. It flags reflection, not confirmed exploitability. Prefer dalfox for deeper verification; use findom-xss for DOM-based cases.
Full XSS scanner with parameter analysis and verification. Heavier and more thorough than a reflection check.
Reports which characters reflect unfiltered per parameter. Useful precursor before airixss payload checks.
Focuses on DOM-based XSS. Covers cases airixss reflection checks miss.
faq
related
CMS detection and version fingerprinting.
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Bundled web server checks for dangerous files and outdated software.
Bypass 403/40X restrictions through smart request manipulation.
YAML template scanner for live hosts; scope runs with tags and severity.
Modular multi-protocol credential brute forcer with response filtering.
A list of parameter URLs feeds airixss, which checks each for reflected payloads and writes the likely-vulnerable hits as a queryable output.
Facts on this page come from the live Trickest tool library.