Is dsxs a DOM XSS scanner?

Only lightly. Its main job is reflected XSS in request parameters, but recent versions add a quick page-level check that reports XSS vulnerable (DOM) on a suspicious sink. For thorough DOM analysis you need a browser-driven scanner; dsxs is built for fast reflection checks.

How do I scan a POST form with dsxs?

Pass the body with --data, e.g. dsxs -u http://example.com/search --data "q=test". dsxs tests each POST parameter the same way it tests GET parameters. On Trickest, set the node's post-data input instead of the flag.

Can dsxs reach authenticated pages?

Yes. Set --cookie for the session, plus --referer or --user-agent when a page or filter checks them. dsxs sends those headers on every request, so it can test parameters that only appear once you are logged in.

What does 'no filtering' versus 'some filtering' mean in the output?

It describes how the parameter reflected the marker. 'no filtering' means the payload came back untouched, so a working XSS is likely trivial; 'some filtering' means characters were stripped or encoded, so you may need an evasion payload to fire it.

When should I use a heavier XSS scanner instead?

dsxs checks one URL's known parameters fast with a fixed payload set. When you need large payload libraries, filter-evasion, or crawling across many endpoints, switch to a dedicated engine like dalfox, and use the sibling dsss for SQL injection.

Updated Jul 14, 2026

Vulnerabilities

Scan a URL's GET and POST parameters for reflected XSS

Damn Small XSS Scanner: a cross-site scripting vulnerability scanner in under 100 lines of code.

Confirm a reflected XSS point Reach parameters behind a session Sweep a crawled URL set

overview

What dsxs does

dsxs is a minimal cross-site scripting scanner that tests a single target URL's GET and POST parameters for reflection flaws. In under 100 lines of Python, it injects a marked payload, watches how each parameter echoes back into the response, and flags the parameters that reflect it unescaped.

It carries the request controls a real target needs. Route traffic through an HTTP proxy, set Cookie, Referer, and User-Agent headers to reach pages behind a session or a header check, and pass --data to test form fields over POST. Each hit also reports whether the marker came back with no filtering or some filtering, so you know how much work a firing payload still needs.

On Trickest, dsxs is a Vulnerabilities node that takes a target URL and writes a folder and a file of results. Reach for it as a quick confirmation step on one endpoint, or fan it out across a list of parameterized URLs a crawler collected earlier in the workflow.

source github.com/stamparm/DSXS

use cases

Where dsxs fits

Confirm a reflected XSS point

Point dsxs at a parameterized URL to check whether a GET or POST parameter reflects an injected marker, a fast yes-or-no on a suspected flaw.

Reach parameters behind a session

Set the Cookie, Referer, and User-Agent headers so dsxs loads authenticated pages and tests the parameters that only appear once you are logged in.

Sweep a crawled URL set

Run dsxs over parameterized URLs from a crawler like gau or katana to flag the candidates worth a closer manual look.

Gauge how much filtering blocks a payload

Read the no-filtering or some-filtering note dsxs prints on each hit to judge whether a parameter reflects raw or needs an evasion payload to fire.

reference

dsxs inputs and flags

6 inputs

Name	Type	Flag	Description
url	STRING	-u	Target URL, e.g. http://www.target.com/page.htm?id=1.
post-data	STRING	--data	POST data to test, e.g. query=test.
cookie	STRING	--cookie	HTTP Cookie header value.
user-agent	STRING	--user-agent	HTTP User-Agent header value.
referer	STRING	--referer	HTTP Referer header value.
proxy	STRING	--proxy	HTTP proxy address, e.g. http://127.0.0.1:8080.

Showing key inputs. dsxs exposes 6 inputs in total.

example

Run dsxs

dsxs · command

# test a reflected GET parameter and a POST form field on one endpointpython dsxs.py -u "http://example.com/search?q=1" --data "comment=test" --cookie "PHPSESSID=1a2b3c"

sample output

 Damn Small XSS Scanner (DSXS) < 100 LoC (Lines of Code) #v0.3c by: Miroslav Stampar (@stamparm) * scanning GET parameter 'q' (i) GET parameter 'q' appears to be XSS vulnerable (".xss.", pure text response, no filtering)* scanning GET parameter 'category'* scanning POST parameter 'search' scan results: possible vulnerabilities found

guidance

Choosing dsxs

Use dsxs for a fast, lightweight XSS check on a specific URL with known parameters. For the SQL injection equivalent, run its sibling dsss. For broad payload coverage and filter-evasion across many endpoints, reach for a dedicated XSS engine instead.

dsss

The sibling damn-small scanner for SQL injection. Same minimal design, different vulnerability class.

airixss

Reflection-based XSS verification from a URL list. A sibling for high-volume confirmation rather than single-URL checks.

faq

dsxs questions

Reflected cross-site scripting. dsxs injects a marker into each GET parameter, and into POST parameters you pass with --data, then checks whether that marker reflects back into the response unescaped. It also runs a basic check that flags the page itself as XSS vulnerable (DOM) when it spots a risky sink.

Run dsxs yourself

A target URL feeds dsxs, which tests its GET and POST parameters for cross-site scripting and writes the findings as a queryable output.

Run dsxs in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

url

STRING

-u

Target URL, e.g. http://www.target.com/page.htm?id=1.

post-data

STRING

--data

POST data to test, e.g. query=test.

STRING

--cookie

HTTP Cookie header value.

user-agent

STRING

--user-agent

HTTP User-Agent header value.

referer

STRING

--referer

HTTP Referer header value.

proxy

STRING

--proxy

HTTP proxy address, e.g. http://127.0.0.1:8080.

Damn Small XSS Scanner (DSXS) < 100 LoC (Lines of Code) #v0.3c by: Miroslav Stampar (@stamparm) * scanning GET parameter 'q' (i) GET parameter 'q' appears to be XSS vulnerable (".xss.", pure text response, no filtering)* scanning GET parameter 'category'* scanning POST parameter 'search' scan results: possible vulnerabilities found

Scan a URL's GET and POST parameters for reflected XSS

What dsxs does

Where dsxs fits

Confirm a reflected XSS point

Reach parameters behind a session

Sweep a crawled URL set

Gauge how much filtering blocks a payload

dsxs inputs and flags

Run dsxs

Choosing dsxs

dsss

airixss

dsxs questions

More Vulnerabilities tools

bypass-403

commix

cookiemonster

corstest

crlfmap

cve-2018-15473

Run dsxs yourself

Scan a URL's GET and POST parameters for reflected XSS

What dsxs does

Where dsxs fits

Confirm a reflected XSS point

Reach parameters behind a session

Sweep a crawled URL set

Gauge how much filtering blocks a payload

dsxs inputs and flags

Run dsxs

Choosing dsxs

dsss

airixss

dsxs questions

More Vulnerabilities tools

bypass-403

commix

cookiemonster

corstest

crlfmap

cve-2018-15473

Run dsxs yourself