1

I tried to evaluate the effectivity of xsser (http://xsser.03c8.net) by letting it run against the "Web For Pentester" XSS tests (https://pentesterlab.com/exercises/web_for_pentester/course) is it implements very easy exploitable XSS vulnerabilities and thus serve as a good baseline.

However, the tool fails to find even the simplest (example 1) XSS vulnerability. If I understood correctly, the tool generates a unique hash per test case and checks if this hash is reflected in the response body.

However, looking at the verbose output and re-submitting one of the tests, the response indeed includes the hashes. So to me it seems like xsser generates a lot of false negatives.

Can somebody reproduce or tell me what I am missing?

user1192748
  • 273
  • 1
  • 8
  • Could you provide a way to reproduce the problem? If I understand correctly, the lab you're linking to is behind a paywall. – Arminius Apr 09 '18 at 18:06
  • The exercises, especially Web For Pentesters are free: https://pentesterlab.com/exercises/ – user1192748 Apr 09 '18 at 18:07

0 Answers0