search

d4rckh / vaf

Vaf is a cross-platform very advanced and fast web fuzzer written in nim
GNU General Public License v3.0
312 stars 41 forks source link

[feature] attribute based XSS #4

Open jayateertha043 opened 3 years ago

jayateertha043 commented 3 years ago

Actually the tool can only detect tag based xss payloads, for detecting attribute based xss, we need to analyse context where they payload is reflected.

May be you can add context analysis if required, to reduce false positives(only for attribute based xss).

This applies only for attribute based xss vulnerability .

d4rckh commented 3 years ago

the tool is just a fuzzer, not an xss scanner, maybe a plugin mechanism so you can make your own add-ons and features?