How do I run only a SQL injection check?

Pass the module to -m, for example `-m sqli`, to scope the run to SQL injection. Use `-m xss` or `-m ssrf` the same way for a single bug class.

Can ScanT3r catch blind SSRF and blind XSS?

Yes. Set an external host with -x (Burp Collaborator or interactsh) for blind SSRF callbacks, and an XSS Hunter host with -b for blind XSS. Hits are recorded when a target reaches those hosts.

Does ScanT3r find DOM-based XSS?

Its xss, xss_param, and reflect modules test server-reflected XSS over HTTP. DOM-based XSS that only fires in a browser needs a renderer such as dalfox, so pair the two when DOM sinks matter.

What should run before ScanT3r?

A URL harvester such as gau or waybackurls. Feed their output as the URL list on stdin so ScanT3r tests a real captured surface.

Updated Jul 14, 2026

Cloud Storage

Probe harvested URLs for XSS, SSRF, and SQLi

Sweeps a URL list with module-based checks across multiple HTTP methods.

Sweep a harvested URL set for bugs Target a specific bug class Catch out-of-band findings

overview

What scant3r does

ScanT3r reads a URL list on stdin and probes parameters and headers across multiple HTTP methods. Modules cover XSS, SSRF, SQLi, RCE, SSTI, reflected parameters, and header injection.

Operators run it after gau or waybackurls harvest a surface. Scope one bug class with -m, raise concurrency with -w, and carry session cookies with -H into authenticated endpoints.

Blind SSRF and blind XSS need callbacks: set -x for an out-of-band host and -b for an XSS Hunter host. For deeper template coverage use nuclei; for focused XSS, pair with dalfox.

source github.com/knassar702/scant3r

use cases

Where scant3r fits

Sweep a harvested URL set for bugs

Feed the output of waybackurls or gau and let ScanT3r test each URL's parameters and methods for common vulnerabilities in one pass.

Target a specific bug class

Select a module such as xss, ssrf, sqli, ssti, or rce with -m to focus the run on one vulnerability type instead of the full set.

Catch out-of-band findings

Set an external host with -x and an XSS Hunter host with -b so blind SSRF and blind XSS callbacks are captured during the scan.

Carry session context

Add custom headers and cookies with -H so authenticated endpoints are tested as a logged-in user rather than as an anonymous visitor.

reference

scant3r inputs and flags

14 inputs

Name	Type	Flag	Description
url-list	FILE	·	URL list file to scan, passed on stdin (for example the output of gau).
module	STRING	-m	Run one module: lorsrf, ssrf, paths, xss, sqli, rce, finder, xss_param, ssti, injheaders, reflect.
header	STRING	-H	Add a custom header, such as a session cookie (Cookie: test=1).
methods	STRING	-y	HTTP methods allowed against the target (for example GET,POST).
workers	STRING	-w	Number of concurrent workers. Default: 50.
external-host	STRING	-x	Your out-of-band host for callbacks (Burp Collaborator, interactsh, etc.).
xss-hunter-host	STRING	-b	Your XSS Hunter host, or any blind-XSS callback host.
proxy	STRING	-p	Forward all requests through a proxy (host:port).

Showing key inputs. scant3r exposes 14 inputs in total.

Full flag reference (14 inputs)

Name	Type	Flag	Description
api	BOOLEAN	-a	Start the ScanT3r API server instead of running a direct scan.
proxy	STRING	-p	Forward all requests through a proxy (host:port).
header	STRING	-H	Add a custom header, such as a session cookie (Cookie: test=1).
module	STRING	-m	Run one module: lorsrf, ssrf, paths, xss, sqli, rce, finder, xss_param, ssti, injheaders, or reflect.
silent	BOOLEAN	-n	Silent mode: suppress the banner and progress noise.
methods	STRING	-y	HTTP methods allowed against the target (for example GET,POST).
timeout	STRING	-t	Connection timeout in seconds. Default: 10.
workers	STRING	-w	Number of concurrent workers. Default: 50.
url-list	FILE	·	URL list file to scan, passed on stdin (for example the output of gau).
external-host	STRING	-x	Your out-of-band host for callbacks (Burp Collaborator, interactsh, etc.).
debugging-mode	BOOLEAN	-d	Debugging mode: print the raw requests and responses.
xss-hunter-host	STRING	-b	Your XSS Hunter host, or any blind-XSS callback host.
random-parameters	BOOLEAN	-g	Generate common parameter names when a URL has none of its own.
random-user-agent	BOOLEAN	-R	Rotate a random User-Agent on each request.

example

Run scant3r

scant3r · command

# scan a harvested URL list for reflected and blind XSScat urls.txt | scant3r -m xss -H "Cookie: session=t0ken" -w 50 -b xss.example.com

sample output

[*] scant3r  modules: xss  workers: 50[*] 218 URLs queued from urls.txt[xss] reflected parameter 'q'       GET https://example.com/search?q=FUZZ[xss] reflected parameter 'return'  GET https://app.example.com/login?return=FUZZ[xss] reflected header 'Referer'    GET https://example.com/account[xss] blind payload fired           callback at xss.example.com  (GET /profile)[-] no reflection                   https://static.example.com/  (no parameters)[*] done  4 findings written to scant3r-out/

guidance

Choosing scant3r

Use as a first pass over a large harvested URL list for parameter-driven bugs. For broader templates use nuclei; for deeper XSS or SQLi, prefer dalfox or sqlmap. Chain after gau or waybackurls.

nuclei

Template-driven scanner with broader, community-maintained vulnerability coverage.

dalfox

Specialized XSS scanner with deeper parameter analysis than a general sweep.

gau

Harvests URLs from archives; typical upstream feed for ScanT3r's URL list.

faq

scant3r questions

Modules cover XSS, SSRF, SQLi, RCE, SSTI, reflected parameters, and header injection (lorsrf, ssrf, paths, xss, sqli, rce, finder, xss_param, ssti, injheaders, reflect). Allow methods with -y. It targets reflected XSS, not CSRF.

Run scant3r yourself

A seed feeds gau to harvest URLs, which ScanT3r then probes for parameter-driven bugs before the findings land as a queryable output.

Open scant3r in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.