loading
Loading content
loading
Vulnerabilities
Parameter XSS analysis with optional blind callbacks.
overview
xspear tests web parameters for cross-site scripting. Point --url at a target, name fields with --param, and it analyzes reflection before firing payloads to confirm where injection executes.
Blind XSS is supported through -b so injections that fire later in an admin panel or log still report back. Drive POST with --data, add --cookie or --headers for session context, load --custom-payload JSON, and choose cli, json, or html via --output.
Compared with dalfox, xspear stays on focused Ruby parameter analysis and confirmation. Compared with nuclei, it stays on XSS instead of multi-class templates. Run it after discovery yields live parameterized URLs; use --no-xss when you only want reflection context first. Trickest runs it as a managed Vulnerabilities node.
source github.com/hahwul/XSpear
use cases
Point xspear at a URL and its parameters so it analyzes reflection and confirms which inputs let injected script execute.
Supply a blind XSS vector with -b so injections that only fire later, in an admin view or log, still report back through your callback host.
Load a custom payload JSON file with --custom-payload to test the specific vectors a target's filtering requires, beyond the built-in set.
Choose --output so confirmed findings flow into an automated pipeline as JSON or land as a readable HTML report.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| target-url | STRING | --url | Target URL to scan for XSS. |
| param | STRING | --param | Parameters to test. |
| post-data | STRING | --data | POST method body data. |
| cookie | STRING | --cookie | Cookie to add to requests. |
| blind-vector | STRING | -b | Blind XSS vector for XSS Hunter, ezXSS, HBXSS, etc. |
| custom-payload-json-file | FILE | --custom-payload | Load a custom payload JSON file. |
| output-format | STRING | --output | Output format: cli, json, html. |
| threads | STRING | --threads | Number of threads (default 10). |
Showing key inputs. xspear exposes 15 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| param | STRING | --param | Test paramters |
| cookie | STRING | --cookie | Add Cookie |
| no-xss | BOOLEAN | --no-xss | Don't test XSS, only parameters analysis |
| headers | STRING | --headers | Add HTTP Headers |
| raw-ssl | BOOLEAN | --raw-ssl | http/https switch for burp raw file |
| threads | STRING | --threads | Threads , default: 10 |
| post-data | STRING | --data | POST Method Body data |
| target-url | STRING | --url | Target Url |
| config-file | FILE | --config | Use config file |
| blind-vector | STRING | -b | Add vector of Blind XSS. With XSS Hunter, ezXSS, HBXSS... e.g: https://hahwul.xss.ht |
| burp-raw-file | FILE | --raw | Load raw file(e.g raw_sample.txt) |
| output-format | STRING | --output | Output format (cli , json, html) |
| verbose-level | STRING | --verbose | Show log depth. 0: quite mode(only result) 1: show scanning status(default) 2: show scanning logs 3: show detail log(req/res) |
| test-all-params | BOOLEAN | --test-all-params | Test to all params(include not reflected) |
| custom-payload-json-file | FILE | --custom-payload | Load custom payload json file |
example
# xspear: reflected XSS test on query params, JSON outputxspear --url 'https://app.example.com/search?q=test&lang=en' --param q,lang --threads 10 --output json[*] Target: https://app.example.com/search?q=test&lang=en[+] Reflected: q on https://app.example.com/search[+] Reflected: lang on https://app.example.com/search[!] XSS confirmed: q -> https://app.example.com/search?q=<payload>[!] XSS confirmed: lang -> https://app.example.com/search?lang=<payload>[*] Blind vector armed for callback on admin.example.com[*] 2 confirmed XSS / 2 reflected params[*] Results written for app.example.comguidance
Use xspear when you want focused XSS testing on known parameters, including blind XSS via -b. For hidden parameter discovery first, run x8; for broad multi-class scanning, run nuclei alongside it.
Go XSS scanner with deeper parameter mining and headless checks. Similar focus; choose by payload handling and report format.
Template scanner across many vulnerability classes. Broader coverage, not XSS-specialized like xspear.
faq
related
Automates OS command injection detection and exploitation.
Subdomain takeover scanner with cloud-zone intake.
Locate public CVE proof-of-concept repositories on GitHub.
Decode, forge, crack, and tamper JWTs for auth checks.
Triage reflected special characters on parameterized URLs.
Detect and exploit SQL injection on authorized web targets.
A URL feeds XSpear, which analyzes its parameters and fires payloads to confirm cross-site scripting, writing the verified findings as a queryable output.
Facts on this page come from the live Trickest tool library.