Vulnerabilities
Confirm reflected XSS on a parameterized URL
Tiny XSS check for GET and POST parameters on one URL.
overview
What dsxs does
In a Trickest workflow, dsxs is a confirmation node for parameterized URLs: inject a marker, watch reflection, write FOLDER and FILE findings.
Use it when you suspect a reflected XSS point and want a yes-or-no on GET or POST params before opening a heavier XSS engine.
Inputs mirror dsss: -u, --data, --cookie, --referer, --user-agent, --proxy. Hits note no filtering versus some filtering so you know if evasion is still needed.
source github.com/stamparm/DSXS
use cases
Where dsxs fits
Confirm a reflected XSS point
Point dsxs at a parameterized URL to check whether a GET or POST parameter reflects an injected marker, a fast yes-or-no on a suspected flaw.
Reach parameters behind a session
Set the Cookie, Referer, and User-Agent headers so dsxs loads authenticated pages and tests the parameters that only appear once you are logged in.
Sweep a crawled URL set
Run dsxs over parameterized URLs from a crawler like gau or katana to flag the candidates worth a closer manual look.
Gauge how much filtering blocks a payload
Read the no-filtering or some-filtering note dsxs prints on each hit to judge whether a parameter reflects raw or needs an evasion payload to fire.
reference
dsxs inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | Target URL, e.g. http://www.target.com/page.htm?id=1. |
| post-data | STRING | --data | POST data to test, e.g. query=test. |
| cookie | STRING | --cookie | HTTP Cookie header value. |
| user-agent | STRING | --user-agent | HTTP User-Agent header value. |
| referer | STRING | --referer | HTTP Referer header value. |
| proxy | STRING | --proxy | HTTP proxy address, e.g. http://127.0.0.1:8080. |
Showing key inputs. dsxs exposes 6 inputs in total.
example
Run dsxs
# test a reflected GET parameter and a POST form field on one endpointpython dsxs.py -u "http://example.com/search?q=1" --data "comment=test" --cookie "PHPSESSID=1a2b3c" Damn Small XSS Scanner (DSXS) < 100 LoC (Lines of Code) #v0.3c by: Miroslav Stampar (@stamparm) * scanning GET parameter 'q' (i) GET parameter 'q' appears to be XSS vulnerable (".xss.", pure text response, no filtering)* scanning GET parameter 'category'* scanning POST parameter 'search' scan results: possible vulnerabilities foundguidance
Choosing dsxs
Use dsxs for a lightweight reflected XSS check on one parameterized URL. Sibling dsss covers SQLi the same way. For large payload libraries or multi-endpoint crawling, switch to a dedicated XSS engine.
dsss
Sibling damn-small scanner for SQL injection. Same minimal request shape, different vulnerability class.
airixss
Reflection-based XSS verification over a URL list. Better for high-volume confirmation than single-URL checks.
faq
dsxs questions
related
More Vulnerabilities tools
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
commix
Automates OS command injection detection and exploitation.
dalfox
Parameter mining and XSS testing with headless verification.
dnsreaper
Subdomain takeover scanner with cloud-zone intake.
find-gh-poc
Locate public CVE proof-of-concept repositories on GitHub.
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
Run dsxs yourself
A target URL feeds dsxs, which tests its GET and POST parameters for cross-site scripting and writes the findings as a queryable output.
Facts on this page come from the live Trickest tool library.