loading
Loading content
loading
Vulnerabilities
Triage reflected special characters on parameterized URLs.
overview
kxss takes a url-list of parameterized URLs and reports which special characters reflect back unfiltered. Quotes, angle brackets, and parentheses are XSS raw material, so an echo without escaping is the first signal a parameter is worth testing.
It is triage, not an exploit engine. It appends a marker plus each test character to a parameter, requests the URL, and checks which characters survive intact. Scan a large set first; spend payload work only where reflection exists.
Feed parameterized URLs from gau, a crawler, or qsreplace, then route hits into dalfox or manual proof of concept. The node accepts a url-list and writes FILE plus FOLDER of reflecting URLs. Reflection is a precondition, not confirmed XSS.
source github.com/Emoe/kxss
use cases
Scan a large list of parameterized URLs and keep only the ones that reflect special characters unfiltered, so testing focuses on real candidates.
Run kxss first so a slower payload-based scanner like dalfox only sees parameters that already reflect dangerous characters.
Collect every parameterized URL on a target, then use kxss to map which parameters echo unescaped characters worth a closer look.
Pass a small URL list to confirm whether a specific parameter reflects quotes or brackets before writing a manual proof of concept.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url-list | FILE | · | List of URLs to check for reflected, unfiltered special characters. |
Showing key inputs. kxss exposes 1 inputs in total.
example
# check a list of parameterized URLs for reflected special characterscat urls.txt | kxssURL: https://example.com/search?q=aaa Unfiltered: [" ' < >]URL: https://example.com/product?id=1 Unfiltered: [< > ']URL: https://app.example.com/page?ref=aaa Unfiltered: [" < > ( )]URL: https://example.com/redirect?url=aaa Unfiltered: [" ']URL: https://example.com/filter?category=aaa Unfiltered: [< >]URL: https://staging.example.com/view?name=aaa Unfiltered: [" ' < > ( ) ;]URL: https://example.com/note?msg=aaa Unfiltered: [" ' < > { }]guidance
Use kxss to triage parameterized URLs for reflected characters before full XSS testing. It flags candidates; it does not confirm exploitability. Pass output to dalfox for payload verification. Feed URLs from gau or a crawler.
Full XSS scanner that crafts and verifies payloads. kxss triages first; dalfox confirms the reflections it flags.
Hunts DOM-based XSS sinks in client code. Complements kxss, which catches reflected ones.
Parameter XSS scanner with analysis output. A heavier alternative for confirming what kxss surfaces.
faq
related
Automates OS command injection detection and exploitation.
Subdomain takeover scanner with cloud-zone intake.
Locate public CVE proof-of-concept repositories on GitHub.
Decode, forge, crack, and tamper JWTs for auth checks.
Detect and exploit SQL injection on authorized web targets.
Subdomain takeover checks driven by can-i-take-over-xyz response fingerprints.
A target feeds gau, which collects parameterized URLs, then kxss flags the ones that reflect special characters and writes them as a queryable output.
Facts on this page come from the live Trickest tool library.