Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Vulnerabilities

Confirm reflected and blind XSS on named parameters

Parameter XSS analysis with optional blind callbacks.

Ruby · MIT license · upstream archived

Agent
Test parameters for reflected XSSCatch blind XSS with a callbackDrive custom payloads

overview

What xspear does

xspear tests web parameters for cross-site scripting. Point --url at a target, name fields with --param, and it analyzes reflection before firing payloads to confirm where injection executes.

Blind XSS is supported through -b so injections that fire later in an admin panel or log still report back. Drive POST with --data, add --cookie or --headers for session context, load --custom-payload JSON, and choose cli, json, or html via --output.

Compared with dalfox, xspear stays on focused Ruby parameter analysis and confirmation. Compared with nuclei, it stays on XSS instead of multi-class templates. Run it after discovery yields live parameterized URLs; use --no-xss when you only want reflection context first. Trickest runs it as a managed Vulnerabilities node.

source github.com/hahwul/XSpear

use cases

Where xspear fits

Test parameters for reflected XSS

Point xspear at a URL and its parameters so it analyzes reflection and confirms which inputs let injected script execute.

Catch blind XSS with a callback

Supply a blind XSS vector with -b so injections that only fire later, in an admin view or log, still report back through your callback host.

Drive custom payloads

Load a custom payload JSON file with --custom-payload to test the specific vectors a target's filtering requires, beyond the built-in set.

Emit JSON or HTML for reporting

Choose --output so confirmed findings flow into an automated pipeline as JSON or land as a readable HTML report.

reference

xspear inputs and flags

15 inputs
NameTypeFlagDescription
target-urlSTRING--urlTarget URL to scan for XSS.
paramSTRING--paramParameters to test.
post-dataSTRING--dataPOST method body data.
cookieSTRING--cookieCookie to add to requests.
blind-vectorSTRING-bBlind XSS vector for XSS Hunter, ezXSS, HBXSS, etc.
custom-payload-json-fileFILE--custom-payloadLoad a custom payload JSON file.
output-formatSTRING--outputOutput format: cli, json, html.
threadsSTRING--threadsNumber of threads (default 10).

Showing key inputs. xspear exposes 15 inputs in total.

Full flag reference (15 inputs)
NameTypeFlagDescription
paramSTRING--paramTest paramters
cookieSTRING--cookieAdd Cookie
no-xssBOOLEAN--no-xssDon't test XSS, only parameters analysis
headersSTRING--headersAdd HTTP Headers
raw-sslBOOLEAN--raw-sslhttp/https switch for burp raw file
threadsSTRING--threadsThreads , default: 10
post-dataSTRING--dataPOST Method Body data
target-urlSTRING--urlTarget Url
config-fileFILE--configUse config file
blind-vectorSTRING-bAdd vector of Blind XSS. With XSS Hunter, ezXSS, HBXSS... e.g: https://hahwul.xss.ht
burp-raw-fileFILE--rawLoad raw file(e.g raw_sample.txt)
output-formatSTRING--outputOutput format (cli , json, html)
verbose-levelSTRING--verboseShow log depth. 0: quite mode(only result) 1: show scanning status(default) 2: show scanning logs 3: show detail log(req/res)
test-all-paramsBOOLEAN--test-all-paramsTest to all params(include not reflected)
custom-payload-json-fileFILE--custom-payloadLoad custom payload json file

example

Run xspear

xspear · command
# xspear: reflected XSS test on query params, JSON output
xspear --url 'https://app.example.com/search?q=test&lang=en' --param q,lang --threads 10 --output json
sample output
[*] Target: https://app.example.com/search?q=test&lang=en
[+] Reflected: q on https://app.example.com/search
[+] Reflected: lang on https://app.example.com/search
[!] XSS confirmed: q -> https://app.example.com/search?q=<payload>
[!] XSS confirmed: lang -> https://app.example.com/search?lang=<payload>
[*] Blind vector armed for callback on admin.example.com
[*] 2 confirmed XSS / 2 reflected params
[*] Results written for app.example.com

guidance

Choosing xspear

Use xspear when you want focused XSS testing on known parameters, including blind XSS via -b. For hidden parameter discovery first, run x8; for broad multi-class scanning, run nuclei alongside it.

dalfox

Go XSS scanner with deeper parameter mining and headless checks. Similar focus; choose by payload handling and report format.

nuclei

Template scanner across many vulnerability classes. Broader coverage, not XSS-specialized like xspear.

faq

xspear questions

Yes. Supply a blind XSS vector with -b and it injects a callback payload so injections that fire later in an unseen context still report back.

Yes. Load a custom payload JSON file with --custom-payload to test vectors tuned to the target filtering.

CLI, JSON, or HTML via --output, so results fit an automated pipeline or a readable report.

Yes. Pass --no-xss to run parameter analysis only when you want reflection context before a full payload pass.

Set --url and supply the body with --data, naming fields via --param. Add --cookie or --headers when the endpoint needs a session.

related

More Vulnerabilities tools

  1. agentsleak

    Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.

  2. commix

    Automates OS command injection detection and exploitation.

  3. dalfox

    Parameter mining and XSS testing with headless verification.

  4. dnsreaper

    Subdomain takeover scanner with cloud-zone intake.

  5. find-gh-poc

    Locate public CVE proof-of-concept repositories on GitHub.

  6. golemhalt

    Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.

Run xspear yourself

A URL feeds XSpear, which analyzes its parameters and fires payloads to confirm cross-site scripting, writing the verified findings as a queryable output.

Run xspear in TrickestBrowse the library

Facts on this page come from the live Trickest tool library.