xss.py

import requests

def load_payloads(filename="wordlist/xsspld.txt"):
    try:
        with open(filename, "r") as file:
            return [line.strip() for line in file.readlines()]
    except FileNotFoundError:
        print(f"{filename} not found.")
        return []
    
def test_xss(url, param_name=None, method="GET"):
    xss_payloads = load_payloads()
    if method == "GET":
        type_url = f"{url}?{param_name}="
    elif method == "POST":
        type_url = url
    print(f"\nTesting XSS vulnerabilities using method: {method}\nURL: {type_url}\n")
    for payload in xss_payloads:
        if param_name:
            data = {param_name: payload}
        else:
            data = None

        try:
            if method == "GET":
                response = requests.get(f"{url}?{param_name}={payload}")
            elif method == "POST":
                response = requests.post(url, data=data)
            else:
                print("[!] Invalid method specified.")
                return

            print(f"Payload: {payload}")
            print(f"Status Code: {response.status_code}")

            if response.status_code == 200:
                if payload in response.text:
                    print("[!] Possible XSS vulnerability detected: Payload reflected in the response.\n")
                else:
                    print("[+] No XSS vulnerability detected: Payload sanitized or not reflected.\n")
            else:
                print("[+] No obvious vulnerability detected with this payload.\n")

        except requests.exceptions.RequestException as e:
            print(f"[!] An error occurred: {e}")

def run_xss_injection():
    choice = input("Is this a URL-based XSS test (GET) or other (POST)? Enter 'GET' or 'POST': ").strip().upper()

    if choice in ['GET', 'POST']:
        url = input("Enter the URL to test for XSS (e.g., http://google.com/search): ")
        param_name = input("Enter the parameter name to test for XSS injection (leave blank if none): ").strip()
        param_name = param_name if param_name else None
        test_xss(url, param_name, method=choice)
    else:
        print("Invalid choice. Please run the script again and choose either 'GET' or 'POST'.")
        
if __name__ == "__main__":
    run_xss_injection()