Some parsing stuff in the xss_spider.py init so we don't hit logouts, not sure if this is desirable but it made sense at the time
The actual passing of the cookies in start_requests
Usage of --cookies in README.md
I've made a bit of a mess of the xss_spider.start_requests to account for cookies, this logic can probably be cleaned up.
I used the COOKIES_DEBUG=true to debug and validate. I also routed requests through Burp to be extra sure and it looks like it is working. It could definitely take a second set of eyes before accepting though.
Added:
I've made a bit of a mess of the xss_spider.start_requests to account for cookies, this logic can probably be cleaned up.
I used the COOKIES_DEBUG=true to debug and validate. I also routed requests through Burp to be extra sure and it looks like it is working. It could definitely take a second set of eyes before accepting though.
Cheers!