s0md3v / XSStrike

Most advanced XSS scanner.
GNU General Public License v3.0
13.38k stars 1.91k forks source link

Blind XSS Parameter Issue #359

Open tekcap opened 2 years ago

tekcap commented 2 years ago

If the blind xss payload in config.py starts with ", then it causes issues with the payload when the script is run.

If we use the following as our payload:

">

And we run the script with debug on, this is what the value in the parameter looks like:

"\">"

There is now a backslash added to the front, which changes the payload.

Cdaprod commented 1 year ago

I'm also trying to figure out what the format/syntax should be when adding a custom blind payload.