Does airixss find DOM-based XSS?

No. airixss looks at server responses for a reflected payload, so it misses DOM XSS that only fires from client-side JavaScript. For a DOM-based XSS scanner, reach for a tool like findom-xss or dalfox alongside it.

How does airixss compare to kxss?

kxss tells you which special characters reflect unfiltered for each parameter; it points at where XSS might be possible. airixss goes one step further and injects a full payload to confirm it reflects. A common pipeline runs kxss first to find reflecting parameters, then airixss to test payloads against them.

airixss vs dalfox, which should I use?

dalfox is a full XSS scanner with parameter mining, encoding, and verification; use it when you want depth on a focused target. airixss is a lightweight reflection triage that runs fast over thousands of URLs during recon. Many workflows use airixss to shortlist, then dalfox to dig in.

How do I cut airixss output down to only the vulnerable URLs?

Add --only-poc (or -s on the CLI). Instead of printing a Vulnerable or Not Vulnerable line for every URL, the run lists only the URLs that look potentially vulnerable, which is easier to pipe into the next tool.

How do I pass a payload and headers to airixss?

Set the reflection string with -payload, for example -payload '"> '. Add request headers with --headers (the CLI also accepts the short -H form, repeated per header), and route traffic through --proxy for inspection.

What feeds airixss in a workflow?

A list of parameter-bearing URLs. Collect them with gau or waybackurls, optionally filter likely-XSS candidates with gf xss and rewrite values with qsreplace, then pipe the result into airixss for reflection triage.

Updated Jul 14, 2026

Scanners

Flag reflected XSS across a list of parameter URLs

Find reflected XSS during recon by checking payload reflection.

Triage reflected XSS across a URL list Keep output to likely vulnerabilities only Bolt onto a recon pipeline

overview

What airixss does

airixss reads parameter-bearing URLs from stdin, injects your payload into each one, and checks whether the reflection comes back in the response unfiltered. It prints every URL as Vulnerable or Not Vulnerable, so a long list of candidate URLs collapses into a short set worth manual confirmation.

It is built for the recon phase rather than deep exploitation. Concurrency is tunable with -c so it keeps pace with large URL sets, --only-poc trims output to the URLs that look vulnerable, and --proxy routes traffic through an interception tool for logging or replay. Custom --headers let it reach endpoints that need auth or specific request shaping.

On Trickest, airixss is a Scanners node that reads a file of target URLs and writes a file and a folder of results. Feed it parameter URLs from a crawler or archive collector like gau or waybackurls, then hand its hits to a dedicated XSS tool or manual review for confirmation.

source github.com/ferreiraklet/airixss

use cases

Where airixss fits

Triage reflected XSS across a URL list

Run airixss over crawler or archive output to flag the URLs where an injected payload reflects unfiltered, narrowing a huge list to a few candidates worth a closer look.

Keep output to likely vulnerabilities only

Enable --only-poc so the run reports only the potentially vulnerable URLs and drops the Not Vulnerable noise before a human or a deeper tool takes over.

Bolt onto a recon pipeline

Chain gau or waybackurls into gf xss and qsreplace, then pipe the parameter URLs into airixss so reflection triage runs as one automated stage in an attack-surface workflow.

Route checks through a proxy

Send traffic through --proxy to log every request and response, so reflected hits can be replayed and confirmed in an interception tool like Burp or ZAP.

reference

airixss inputs and flags

6 inputs

Name	Type	Flag	Description
targets	FILE	·	File of target URLs to test for reflected XSS (read from stdin on the CLI).
payload	STRING	-payload	Reflection flag string to inject and match in each response, e.g. "><svg onload=confirm(1)>.
only-poc	BOOLEAN	--only-poc	Show only potentially vulnerable URLs and drop the Not Vulnerable lines.
concurrency	STRING	-c	Set the number of concurrent workers (default 50).
headers	STRING	--headers	Custom request headers, for auth or specific request shaping.
proxy	STRING	--proxy	Send traffic through a proxy for logging, inspection, or replay.

Showing key inputs. airixss exposes 6 inputs in total.

example

Run airixss

airixss · command

# triage parameter URLs for reflected XSS with 40 concurrent workerscat urls.txt | airixss -payload '"><svg onload=confirm(1)>' -c 40

sample output

Vulnerable - https://example.com/search?q="><svg onload=confirm(1)>Not Vulnerable - https://example.com/about?ref=navNot Vulnerable - https://example.com/catalog?id=42Vulnerable - https://example.com/redirect?next="><svg onload=confirm(1)>Not Vulnerable - https://example.com/blog?page=7Not Vulnerable - https://example.com/filter?sort=ascVulnerable - https://app.example.com/preview?tpl="><svg onload=confirm(1)>

guidance

Choosing airixss

Use airixss as a fast first pass for reflected XSS over a large set of parameter-bearing URLs during recon. It flags reflection, it does not confirm exploitability, so pass its hits to a dedicated XSS tool or manual review.

dalfox

Full-featured XSS scanner with parameter analysis and verification. Heavier, more thorough than a reflection check.

kxss

Reports which characters reflect unfiltered per parameter. Pairs well as a precursor to airixss.

findom-xss

Focuses on DOM-based XSS. Use it to cover the cases airixss reflection checks miss.

faq

airixss questions

Reflected XSS. It injects the payload you pass with -payload and checks whether that string returns in the response unfiltered, then prints each URL as Vulnerable or Not Vulnerable. It does not confirm that the payload executes, so treat hits as candidates for manual review.

Run airixss yourself

A list of parameter URLs feeds airixss, which checks each for reflected payloads and writes the likely-vulnerable hits as a queryable output.

Run airixss in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

targets

FILE

File of target URLs to test for reflected XSS (read from stdin on the CLI).

payload

STRING

-payload

Reflection flag string to inject and match in each response, e.g. "><svg onload=confirm(1)>.

only-poc

BOOLEAN

--only-poc

Show only potentially vulnerable URLs and drop the Not Vulnerable lines.

concurrency

STRING

-c

Set the number of concurrent workers (default 50).

headers

STRING

--headers

Custom request headers, for auth or specific request shaping.

proxy

STRING

--proxy

Send traffic through a proxy for logging, inspection, or replay.

Vulnerable - https://example.com/search?q="><svg onload=confirm(1)>Not Vulnerable - https://example.com/about?ref=navNot Vulnerable - https://example.com/catalog?id=42Vulnerable - https://example.com/redirect?next="><svg onload=confirm(1)>Not Vulnerable - https://example.com/blog?page=7Not Vulnerable - https://example.com/filter?sort=ascVulnerable - https://app.example.com/preview?tpl="><svg onload=confirm(1)>

Flag reflected XSS across a list of parameter URLs

What airixss does

Where airixss fits

Triage reflected XSS across a URL list

Keep output to likely vulnerabilities only

Bolt onto a recon pipeline

Route checks through a proxy

airixss inputs and flags

Run airixss

Choosing airixss

dalfox

kxss

findom-xss

airixss questions

More Scanners tools

alterx

bomber

broken-link-checker

chopchop

cmseek

jaeles

Run airixss yourself

Flag reflected XSS across a list of parameter URLs

What airixss does

Where airixss fits

Triage reflected XSS across a URL list

Keep output to likely vulnerabilities only

Bolt onto a recon pipeline

Route checks through a proxy

airixss inputs and flags

Run airixss

Choosing airixss

dalfox

kxss

findom-xss

airixss questions

More Scanners tools

alterx

bomber

broken-link-checker

chopchop

cmseek

jaeles

Run airixss yourself