Vulnerabilities
Surface DOM XSS candidates from a URL list
Flag potential DOM-based XSS across a URL list.
overview
What FinDOM-XSS does
findom-xss reads a urls-file (one URL per line) and looks for client-side source and sink patterns that suggest DOM-based XSS. It returns candidate endpoints rather than a confirmed exploit.
Reach for it when a crawl or passive URL dump is ready and you need the JavaScript path that server-response XSS scanners miss: values flowing from location or document.referrer into sinks like innerHTML or eval.
False confidence is the main failure mode. A hit is a shortlist item, not proof of exploitability. Confirm with dalfox or a manual review before reporting.
use cases
Where FinDOM-XSS fits
Triage a large URL list for DOM XSS
Point findom-xss at a file of crawled or archived URLs and let it flag pages whose client-side code mishandles input, turning a broad surface into a short candidate list.
Catch client-side bugs a server scanner misses
DOM XSS never appears in the server response, so a reflected-XSS scanner walks past it. Run findom-xss alongside those tools to cover the JavaScript sink-and-source path they cannot see.
Chain after crawling and URL collection
Take endpoints from katana or a passive collector, write them to a file, and pass that straight into findom-xss so it scans only live, in-scope URLs.
Pre-filter before confirmatory testing
Use findom-xss as the cheap first pass, then send its shortlist to a heavier scanner or a manual reviewer to confirm exploitability and craft a working payload.
reference
FinDOM-XSS inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| urls-file | FILE | · | File with line by line urls to scan. |
Showing key inputs. FinDOM-XSS exposes 1 inputs in total.
example
Run FinDOM-XSS
# scan a line-by-line URL list for potential DOM-based XSSfindom-xss.sh urls.txthttps://example.com/search?q=https://example.com/app#/profilehttps://app.example.com/dashboard?ref=https://example.com/product?id=1&callback=https://staging.example.com/widget?name=https://example.com/docs?page=https://cdn.example.com/static/app.js (sink: innerHTML)https://example.com/legacy?redir=guidance
Choosing FinDOM-XSS
Use FinDOM-XSS when you have a URL list and want a dedicated pass for DOM-based XSS, the client-side variant server-response scanners miss. For reflected and parameter-based XSS with payload confirmation, use dalfox. For a quick reflected-character check, use kxss.
dalfox
Parameter-analysis XSS scanner with a DOM parser. Broader coverage and payload confirmation; heavier than a DOM-only pass.
kxss
Finds unfiltered special characters reflected from URLs. A lightweight pre-filter for reflected XSS, not DOM-focused.
dsxs
Damn Small XSS Scanner for GET and POST parameters. Simpler scope than a dedicated DOM finder.
faq
FinDOM-XSS questions
related
More Vulnerabilities tools
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
commix
Automates OS command injection detection and exploitation.
dalfox
Parameter mining and XSS testing with headless verification.
dnsreaper
Subdomain takeover scanner with cloud-zone intake.
find-gh-poc
Locate public CVE proof-of-concept repositories on GitHub.
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
Run FinDOM-XSS yourself
A target feeds katana, which crawls it into a list of URLs. That list goes to FinDOM-XSS, which scans each one for potential DOM-based XSS and writes the candidate findings out for review.
Facts on this page come from the live Trickest tool library.