loading
Loading content
loading
Vulnerabilities
Flag potential DOM-based XSS across a URL list.
overview
findom-xss reads a urls-file (one URL per line) and looks for client-side source and sink patterns that suggest DOM-based XSS. It returns candidate endpoints rather than a confirmed exploit.
Reach for it when a crawl or passive URL dump is ready and you need the JavaScript path that server-response XSS scanners miss: values flowing from location or document.referrer into sinks like innerHTML or eval.
False confidence is the main failure mode. A hit is a shortlist item, not proof of exploitability. Confirm with dalfox or a manual review before reporting.
use cases
Point findom-xss at a file of crawled or archived URLs and let it flag pages whose client-side code mishandles input, turning a broad surface into a short candidate list.
DOM XSS never appears in the server response, so a reflected-XSS scanner walks past it. Run findom-xss alongside those tools to cover the JavaScript sink-and-source path they cannot see.
Take endpoints from katana or a passive collector, write them to a file, and pass that straight into findom-xss so it scans only live, in-scope URLs.
Use findom-xss as the cheap first pass, then send its shortlist to a heavier scanner or a manual reviewer to confirm exploitability and craft a working payload.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| urls-file | FILE | · | File with line by line urls to scan. |
Showing key inputs. FinDOM-XSS exposes 1 inputs in total.
example
# scan a line-by-line URL list for potential DOM-based XSSfindom-xss.sh urls.txthttps://example.com/search?q=https://example.com/app#/profilehttps://app.example.com/dashboard?ref=https://example.com/product?id=1&callback=https://staging.example.com/widget?name=https://example.com/docs?page=https://cdn.example.com/static/app.js (sink: innerHTML)https://example.com/legacy?redir=guidance
Use FinDOM-XSS when you have a URL list and want a dedicated pass for DOM-based XSS, the client-side variant server-response scanners miss. For reflected and parameter-based XSS with payload confirmation, use dalfox. For a quick reflected-character check, use kxss.
Parameter-analysis XSS scanner with a DOM parser. Broader coverage and payload confirmation; heavier than a DOM-only pass.
Finds unfiltered special characters reflected from URLs. A lightweight pre-filter for reflected XSS, not DOM-focused.
Damn Small XSS Scanner for GET and POST parameters. Simpler scope than a dedicated DOM finder.
faq
related
Automates OS command injection detection and exploitation.
Subdomain takeover scanner with cloud-zone intake.
Locate public CVE proof-of-concept repositories on GitHub.
Decode, forge, crack, and tamper JWTs for auth checks.
Triage reflected special characters on parameterized URLs.
Detect and exploit SQL injection on authorized web targets.
A target feeds katana, which crawls it into a list of URLs. That list goes to FinDOM-XSS, which scans each one for potential DOM-based XSS and writes the candidate findings out for review.
Facts on this page come from the live Trickest tool library.