xss0r Plan Comparison

What the PRO PLAN Offers Beyond the BASIC PLAN:

1. PATH Request Analysis: The PRO PLAN includes PATH request analysis, allowing users to detect and exploit vulnerabilities that require payloads in URL paths, a feature not available in the BASIC PLAN. This adds flexibility for testing more sophisticated vulnerabilities.

2. Increased Payload Library: With access to 2,000 XSS payloads compared to 1,500 in the BASIC PLAN, the PRO PLAN provides a broader and more versatile range of payloads to test against a variety of web application defenses.

3. Enhanced WAF Bypass Capabilities: The PRO PLAN includes advanced WAF bypass capabilities, making it more effective for testing applications with stringent security measures. This feature is more limited in the BASIC PLAN, giving the PRO PLAN an advantage in secure environments.

4. JSON and Multipart WebApp Support: The PRO PLAN offers support for both JSON and Multipart Web Applications, expanding its capability to handle modern web app architectures. This feature enables users to test APIs and multipart form submissions effectively, which is absent in the BASIC PLAN.

5. One Result Option and Resume Scan Functionality: The PRO PLAN includes a "One Result Option" to limit output to one match per vulnerability type, making reports clearer and more concise. The "Resume Scan" functionality allows users to pick up scanning from where they left off, an efficiency boost for longer testing sessions that’s missing in the BASIC PLAN.

6. Higher Thread Speed Limit: The PRO PLAN supports up to 10 threads, providing faster scanning and better performance on larger sites. In comparison, the BASIC PLAN is limited to 7 threads, making it less optimal for extensive testing.

7. Technical Support and Educational Resources: Both plans offer technical support, an eBook with practical examples, and instructional videos, but the PRO PLAN is designed for users who have some experience and want to deepen their expertise. It provides a more robust toolset and advanced features, making it ideal for intermediate users looking to advance their skills beyond the basics covered in the BASIC PLAN.

The PRO PLAN provides an upgraded set of features, allowing users to explore more complex vulnerabilities and improve testing efficiency, making it well-suited for those ready to take their web security skills to the next level.

What the DIAMOND PLAN Offers Beyond the PRO PLAN:

1. Expanded Payload Library with Full WAF Bypass: The DIAMOND PLAN provides access to 3,000 XSS payloads, compared to 2,000 in the PRO PLAN, with advanced WAF bypass capabilities. Additionally, it allows for unlimited custom payload list loading, enabling users to test an extensive range of vulnerabilities and tailor payloads to specific applications.

2. Enhanced BlindXSS with All Features Included: While the PRO PLAN offers BlindXSS capabilities, the DIAMOND PLAN takes it further with full-featured BlindXSS, which includes additional advanced payloads and detection mechanisms. This enhancement is ideal for detecting delayed or hidden XSS vulnerabilities that require more sophisticated detection techniques.

3. Advanced Crawling and Fuzzing Capabilities: The DIAMOND PLAN includes both Crawling and Fuzzing functionalities, enabling users to automate exploration and injection of payloads across the application, increasing the chance of identifying complex vulnerabilities. These advanced scanning capabilities go beyond the PRO PLAN, allowing users to dive deeper into application behavior and structure.

4. Automated Resuming and Limit Requests Features: The DIAMOND PLAN provides the ability to resume scans automatically and set request limits, ensuring scans are efficient without overwhelming target applications. These features enhance scan management and control, particularly useful for large-scale applications, and are not available in the PRO PLAN.

5. User-Interaction Payloads Support and CSP Bypass: The DIAMOND PLAN supports payloads that require user interaction, offering deeper real-world vulnerability testing. It also includes CSP (Content Security Policy) bypass capabilities, allowing users to test applications with strict security policies, which is not supported in the PRO PLAN.

6. Increased Thread Speed Limit: With a thread speed limit of up to 13, the DIAMOND PLAN is faster and more efficient for larger, more complex applications, compared to the PRO PLAN’s limit of 10 threads.

7. Broader License and Device Support: The DIAMOND PLAN allows usage for 1 user on up to 4 devices across 2 different IP addresses, whereas the PRO PLAN is limited to 3 devices on the same IP. This flexibility makes the DIAMOND PLAN more suitable for team settings or users who need access across multiple environments.

8. Additional Features and Advanced Support Tools: The DIAMOND PLAN includes exclusive features like Fuzzing, Crawling, Resuming Scan, and Limit Requests. These tools are designed to provide a more thorough, automated approach to XSS testing, making the DIAMOND PLAN ideal for users looking to conduct comprehensive and efficient scans on complex applications.

The DIAMOND PLAN offers a significant upgrade over the PRO PLAN, providing a powerful toolset that includes advanced detection capabilities, faster scanning, enhanced automation, and support for user-interactive and CSP bypass payloads. This plan is ideal for experienced users or teams who require a comprehensive solution for tackling sophisticated web application vulnerabilities.

What the GOLDEN PLAN Offers Beyond the DIAMOND:

Higher Thread Speed Limit: The GOLDEN PLAN supports up to 15 threads, while the DIAMOND PLAN is limited to 13 threads. This increased speed allows for faster and more efficient scanning, especially beneficial for testing larger applications requiring extensive scans.
Live Chat Support: The GOLDEN PLAN includes live chat support, providing real-time assistance for users who need immediate help. This feature is exclusive to the GOLDEN PLAN and not available in the DIAMOND PLAN, making it ideal for users who require quick resolutions and direct support.
Cost Savings with Semi-Annual Payments: Choosing the GOLDEN PLAN over the DIAMOND PLAN results in substantial savings. While the GOLDEN PLAN costs $119.99 every 6 months (totaling $239.98 per year), the DIAMOND PLAN is priced at $89.99 every 3 months (totaling $359.96 per year). This results in an annual savings of $119.98, making the GOLDEN PLAN a more cost-effective option for long-term users.
Comprehensive Feature Set at a Better Price: Both the GOLDEN PLAN and DIAMOND PLAN offer essential features such as GET and POST Requests with Cookie Support, PATH Request Analysis, Private xss0r Payloads with Full WAF Bypass, and Unlimited Custom Payload List Loading. Additionally, both plans include BlindXSS with All Features Included, Reflection Checker, Only Alerts, Suffix & Prefix Customization, and support for JSON and Multipart WebApps. Other shared functionalities include the One Result Option, Resume Scan, Fuzzing, Crawling, Resuming Scan, Limit Requests, User-Interaction Payloads Support, and CSP Bypass.
Device and IP Flexibility: Both plans allow 1 user across up to 4 devices on 2 different IP addresses, providing ample flexibility for users who need access across multiple environments.

The GOLDEN PLAN offers all the advanced features of the DIAMOND PLAN while delivering additional benefits, such as a higher thread limit, live chat support, and significant cost savings. This makes the GOLDEN PLAN ideal for users seeking top-tier XSS detection capabilities, enhanced support options, and better value for long-term use.

What the BUSINESS PLAN Offers Beyond the GOLDEN PLAN:

ClickMe Private Payloads for Enhanced BlindXSS: The BUSINESS PLAN includes ClickMe Private Payloads for BlindXSS, offering additional payload options to detect delayed-execution and hidden XSS vulnerabilities. This advanced feature enhances the detection capabilities beyond those provided in the GOLDEN PLAN.
Unlimited Speed on Threads: The BUSINESS PLAN offers unlimited speed on threads, allowing for unrestricted scanning performance, while the GOLDEN PLAN is limited to a maximum of 15 threads. This makes the BUSINESS PLAN ideal for users who need to conduct rapid scans on complex applications without any thread speed limitations.
24/7 Technical and Live Chat Support: With 24/7 access to both technical support and live chat, the BUSINESS PLAN ensures that users have round-the-clock assistance. In contrast, the GOLDEN PLAN does not guarantee 24/7 availability for these support channels, making the BUSINESS PLAN more suitable for users who need immediate support at any time.
Additional Licenses for Team Flexibility: The BUSINESS PLAN provides 2 free additional licenses, enabling usage for multiple team members or organizational flexibility. This feature is not available in the GOLDEN PLAN, making the BUSINESS PLAN a better choice for companies and larger teams.
Extended Device and IP Flexibility: Supporting up to 10 devices on any IP addresses, the BUSINESS PLAN offers significantly more flexibility than the GOLDEN PLAN, which supports only 4 devices on 2 different IP addresses. This additional device support is advantageous for teams needing broad access across multiple devices and locations.

‍

The BUSINESS PLAN offers all the features of the GOLDEN PLAN and adds substantial benefits, including ClickMe Private Payloads for BlindXSS, unlimited thread speed, 24/7 support, additional licenses, and enhanced device/IP flexibility. This plan is ideal for businesses, teams, and organizations seeking a high-performance, versatile, and scalable XSS detection solution with comprehensive support and flexibility.

‍

Frequently Asked Questions

What is an XSS tool, and why do penetration testers utilize it?

An XSS tool is designed to identify Cross-Site Scripting vulnerabilities in web applications. Penetration testers employ these tools to detect security weaknesses that may enable attackers to inject malicious code, thereby enhancing the overall security posture of web applications.

What types of XSS vulnerabilities does the tool detect?

Our tool detects a range of XSS vulnerabilities, including reflected, stored, DOM-based, path-based, blind XSS, as well as vulnerabilities in both GET and POST requests.

How do I customize the payloads?

Our user-friendly interface enables you to effortlessly modify existing payloads or create custom payloads tailored to specific testing scenarios.

Are there any new improvements for WAF bypass?

Yes! We’ve made significant improvements:
‍+300 new payloads have been added to every plan.
‍Golden and Business plans now include
‍500+ new payloads, covering a wide variety of WAFs.
‍New Fuzzing Feature: This feature performs static analysis based on page source reflection and allowed characters. It generates and automates payloads intelligently, using only the characters allowed by the target application.
‍Clickable Payloads: xss0r V2 introduces a feature for payloads requiring user interaction, such as <ClickME> buttons. The tool automatically performs POST requests with these payloads, clicks on them, and completes all actions on your behalf.

Is there a trial version available?

Yes, we offer a DEMO service that clients can request at any time, allowing for a 5-day testing period. Additionally, we provide a free access key for new users on the 10th to 15th of every month, enabling them to test the tool before making a purchase, specifically for the PRO plan.

Can xss0r analyze JSON web applications?

Yes, xss0r supports JSON web applications, allowing for detailed testing of JSON payloads and data structures.

What are the advanced search and filter options in xss0r?

xss0r offers advanced search and filter capabilities, allowing users to quickly locate specific vulnerabilities and tailor their testing approach.

What is Blind XSS, and how is it implemented in xss0r?

xss0r now includes Blind XSS functionality, allowing automated testing of reflected vulnerabilities over time. It sends payloads to trigger XSS even in delayed interactions.

Does xss0r V2 support macOS and other Linux distributions?

Yes! xss0r V2 fully supports macOS, Ubuntu (latest version), and is compatible with all Linux platforms.

How does the new crawler feature enhance testing?

The built-in crawler searches through HTML, XML, and JS tags to discover URLs. It also identifies input forms, such as usernames, feedback, and comment fields, and can automatically submit Blind XSS payloads using the new --spray feature.

Where is the API key sent, and how can I add my API key?

When purchasing any XSS Plan, please use a valid email address during registration. API access will be provided within 6 to 12 hours after purchase, though it often arrives sooner. The xss0r tool will be accessible after purchasing a plan, and the API key will be sent to the registered email. If you do not receive your API access within 12 hours, please reach out directly through Support Chat or X.

What new features are included in the V2 version of xss0r?

The V2 version of xss0r introduces several powerful features: unlimited custom payload list loading, Blind XSS with full form and link crawling, Telegram notifications, and private "ClickMe" payloads. The update also includes a reflection checker, a “Only Alerts” mode, options for limiting requests, support for CSP bypass, and unlimited threading speed. New functionalities like resumable scans, fuzzing, crawling, and 24/7 live chat support enhance flexibility and usability. The tool now supports up to 10 devices, based on your plan, and automated Blind XSS payload injection in headers.

What are the complete features of BlindXSS in xss0r?

Blind XSS in xss0r now offers automatic crawling of forms on websites, spraying Blind XSS payloads, and saving any triggered payloads directly to your account with Telegram notifications. It also supports injection of Blind XSS payloads in the user-agent header, capturing all discovered links for manual inspection. Email-specific payloads target only email fields, and Blind XSS dorking has been added for deeper exploration. Additionally, test pages are provided for learning and practicing Blind XSS techniques.