#!/usr/bin/env python3
"""
XSS Fuzzer - XSS Payload 模糊测试工具
支持:
- 反射型 XSS 检测
- 存储型 XSS 检测
- DOM 型 XSS 检测
- CSP 绕过测试
- 自定义 Payload
Usage:
python3 xss-fuzzer.py -u "http://target.com/search?q=test"
python3 xss-fuzzer.py -u "http://target.com/comment" -d "comment=test" -m POST
python3 xss-fuzzer.py -u "http://target.com" --dom-scan
授权边界:
- 仅用于自有资产、测试环境或已明确授权的目标
- 对公网资产执行验证时，应使用最小化回显验证和可审计测试记录
- 不面向无授权第三方网站或公共站点
"""
import argparse
import requests
import re
import urllib.parse
from typing import List, Dict, Tuple, Optional
import time
import sys
from pathlib import Path
SCRIPTS_DIR = Path(__file__).resolve().parents[2] / "scripts"
if str(SCRIPTS_DIR) not in sys.path:
sys.path.insert(0, str(SCRIPTS_DIR))
from tool_contract import ( # noqa: E402
add_common_args,
emit_report,
ensure_authorized,
make_report,
parse_cookie_string,
parse_headers,
write_evidence,
)
class Colors:
RED = "\033[91m"
GREEN = "\033[92m"
YELLOW = "\033[93m"
BLUE = "\033[94m"
CYAN = "\033[96m"
END = "\033[0m"
BOLD = "\033[1m"
class XSSFuzzer:
def __init__(self, timeout: int = 10):
self.timeout = timeout
self.session = requests.Session()
self.session.headers.update(
{
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
}
)
self.payloads = {
"basic": [
"",
"",
"",
"
",
"",
"