Vulnerabilities
Flag URL parameters that reflect XSS characters
kxss is a Go command-line tool that reads URLs from standard input and, for each query parameter, reports which special characters such as quotes and angle brackets are reflected unfiltered in the response.
installgo install github.com/Emoe/kxss@latest
Go · Apache-2.0 license
overview
What kxss does
kxss takes a url-list of parameterized URLs and reports which special characters reflect back unfiltered. Quotes, angle brackets, and parentheses are XSS raw material, so an echo without escaping is the first signal a parameter is worth testing.
It is triage, not an exploit engine. It appends a marker plus each test character to a parameter, requests the URL, and checks which characters survive intact. Scan a large set first; spend payload work only where reflection exists.
Feed parameterized URLs from gau, a crawler, or qsreplace, then route hits into dalfox or manual proof of concept. The node accepts a url-list and writes FILE plus FOLDER of reflecting URLs. Reflection is a precondition, not confirmed XSS.
source github.com/Emoe/kxss
use cases
Where kxss fits
Triage a URL set for XSS candidates
Scan a large list of parameterized URLs and keep only the ones that reflect special characters unfiltered, so testing focuses on real candidates.
Filter before a heavy XSS scanner
Run kxss first so a slower payload-based scanner like dalfox only sees parameters that already reflect dangerous characters.
Map reflection points across a domain
Collect every parameterized URL on a target, then use kxss to map which parameters echo unescaped characters worth a closer look.
Spot-check a parameter quickly
Pass a small URL list to confirm whether a specific parameter reflects quotes or brackets before writing a manual proof of concept.
reference
kxss inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url-list | FILE | · | List of URLs to check for reflected, unfiltered special characters. |
Showing key inputs. kxss exposes 1 inputs in total.
example
Run kxss
# check a list of parameterized URLs for reflected special characters
cat urls.txt | kxssURL: https://example.com/search?q=aaa Param: q Unfiltered: [" ' < >]
URL: https://example.com/product?id=1 Param: id Unfiltered: [< > ']
URL: https://app.example.com/page?ref=aaa Param: ref Unfiltered: [" < > ( )]
URL: https://example.com/redirect?url=aaa Param: url Unfiltered: [" ']
URL: https://example.com/filter?category=aaa Param: category Unfiltered: [< >]
URL: https://staging.example.com/view?name=aaa Param: name Unfiltered: [" ' < > ( ) ;]
URL: https://example.com/note?msg=aaa Param: msg Unfiltered: [" ' < > { }]guidance
Choosing kxss
Use kxss to triage parameterized URLs for reflected characters before full XSS testing. It flags candidates; it does not confirm exploitability. Pass output to dalfox for payload verification. Feed URLs from gau or a crawler.
dalfox
Full XSS scanner that crafts and verifies payloads. kxss triages first; dalfox confirms the reflections it flags.
findom-xss
Hunts DOM-based XSS sinks in client code. Complements kxss, which catches reflected ones.
xspear
Parameter XSS scanner with analysis output. A heavier alternative for confirming what kxss surfaces.
faq
kxss questions
related
More Vulnerabilities tools
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
commix
Automates OS command injection detection and exploitation.
dalfox
Parameter mining and XSS testing with headless verification.
dnsreaper
Subdomain takeover scanner with cloud-zone intake.
find-gh-poc
Locate public CVE proof-of-concept repositories on GitHub.
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
Run kxss yourself
A target feeds gau, which collects parameterized URLs, then kxss flags the ones that reflect special characters and writes them as a queryable output.
Facts on this page come from the live Trickest tool library.