xss0r Diamond Plan

Advance your expertise with our DIAMOND PLAN for XSS detection, offering a comprehensive toolset for mastering advanced cross-site scripting techniques. This plan includes essential features like GET, POST with cookie support, and PATH request analysis, along with 3,000 payloads, full WAF bypass, and unlimited custom payload list loading. Additional tools include BlindXSS, Reflection Checker, Alert-Only Notifications, suffix and prefix customization, JSON and Multipart WebApp support, fuzzing, crawling, CSP Bypass, limit request controls, user-interaction payloads, and a speed limit of up to 13 threads. The DIAMOND PLAN provides technical support, an eBook with examples, and instructional videos, with unlimited xss0r Tool usage, enabling extensive scans on up to 4 devices across 2 IP addresses.
$89.99
every 3 months
BUY NOW
4.9
 (
5
)
Crypto payments soon...
xss0r heading logo

The DIAMOND PLAN is tailored for advanced users looking to master complex XSS security testing with an extensive toolset. It includes essential features like GET and POST requests with cookie support, PATH request handling, and access to 3,000 XSS payloads with full WAF bypass capabilities and unlimited custom payload loading. Advanced features such as BlindXSS, Reflection Checker, Alert-Only Notifications, and support for JSON and Multipart WebApps provide flexibility in vulnerability detection. Additional tools like fuzzing, crawling, resume scan functionality, limit requests, and CSP bypass elevate your testing capabilities. With a thread speed limit of up to 13, plus technical support, an eBook with examples, and instructional videos, the DIAMOND PLAN provides comprehensive support. This plan allows 1 license, usable on up to 4 devices across 2 IP addresses.

Complete Features Overview

GET Request with Cookie Support: Master the ability to craft and send GET requests with cookie support to retrieve data from web servers, an essential skill for web testing.

POST Request with Cookie Support: Learn to submit data to web applications via POST requests with cookie support, critical for testing input handling and form submissions.

PATH Request: Inject payloads at the end of URLs to explore Path-based XSS vulnerabilities and broaden your testing scope.

Access to 3,000 XSS Payloads + All WAF Bypass + Unlimited Custom Payload List Loading: Gain access to a vast library of 3,000 payloads, advanced WAF bypass capabilities, and the ability to load custom payload lists to target a wide range of vulnerabilities.

BlindXSS with All Features Included: Detect delayed-execution vulnerabilities with full BlindXSS capabilities for expanded XSS testing.

Reflection Checker: Identify reflection-based vulnerabilities with enhanced precision using the Reflection Checker.

Only Alerts: Focus on critical findings with alert-only notifications for streamlined testing.

Suffix & Prefix Customization: Customize payloads with suffixes and prefixes for increased flexibility in vulnerability testing.

Support for JSON WebApps: Test JSON-based web applications with dedicated support for JSON payloads and vulnerabilities.

Support for Multipart WebApps: Extend testing to web applications that utilize multipart forms.

One Result Option: Limit output to one match per vulnerability type for clearer, more concise reporting.

Resume Scan Functionality: Resume scans from where you left off, ensuring efficient completion of long testing sessions.

Fuzzing: Employ fuzzing techniques to discover unique vulnerabilities by injecting unexpected data into applications.

Crawling: Automatically navigate and analyze website pages to identify hidden vulnerabilities.

Resuming Scan: Pick up scanning exactly where it stopped to ensure thorough analysis without redundant processing.

Limit Requests: Control request limits to avoid overloading target applications, ensuring safe and efficient scanning.

User-Interaction Payloads Support: Test vulnerabilities that rely on user interaction, enhancing real-world testing capabilities.

CSP Bypass: Test for potential Content Security Policy bypasses to expose critical weaknesses in security controls.

Thread Speed Limit: Up to 13 Threads: Execute faster scans with the ability to run up to 13 threads simultaneously.

Stealth: low|medium|high] – Adjusts the stealth mode level to evade WAFs and security filters.

Save: Saves current scanning session.

Technical Support: Access dedicated technical support with a 24-hour response time for any questions or issues. Reach our team via Twitter or LinkedIn for prompt assistance.

eBook with Practical Examples: Reference an eBook filled with practical examples to strengthen your learning and contextualize the DIAMOND PLAN features.

Instructional Videos: Gain access to a series of instructional videos that guide you through using each feature effectively.

License: 1 User, supporting up to 4 devices across 2 different IP addresses.

GET Request with Cookie Support
POST Request with Cookie Support
PATH Request
Access to 3,000 XSS Payloads + All WAF Bypass + Unlimited Custom Payload List Loading
BlindXSS with All Features Included ( automatically crawls forms & links, injects BlindXSS payloads, and sends Telegram notifications )
Reflection Checker for Enhanced Detection
Stealth low|medium|high] – Adjusts the stealth mode level toevade WAFs and security filters.
Suffix & Prefix Customization
Only Alerts
Support for JSON WebApps
Support for Multipart WebApps
One Result Option
Resume Scan Functionality
Fuzzing
Crawling
Resuming Scan
Save  Saves current scanning session.
Limit Requests
User-Interaction Payloads Support
CSP Bypass
Thread Speed Limit: Up to 13 Threads
Technical Support
eBook with Practical Examples
Instructional Videos
License: 1 User, Supports Up to 4 Devices on 2 Different IP Addresses

😊❤️ Hear from Our Happy Customers! 😊❤️

🚀 Don't just take our word for it! Explore the authentic experiences of our amazing community who have worked with us. Their honest reviews and feedback speak volumes about the accuracy of the xss0r Tool, with zero false positives. We can't wait for you to see it—check out the images below! 📸✨

4.9/5 (264)

Frequently Asked Questions

What is an XSS tool, and why do penetration testers utilize it?

An XSS tool is designed to identify Cross-Site Scripting vulnerabilities in web applications. Penetration testers employ these tools to detect security weaknesses that may enable attackers to inject malicious code, thereby enhancing the overall security posture of web applications.

What types of XSS vulnerabilities does the tool detect?

Our tool detects a range of XSS vulnerabilities, including reflected, stored, DOM-based, path-based, blind XSS, as well as vulnerabilities in both GET and POST requests.

How do I customize the payloads?

Our user-friendly interface enables you to effortlessly modify existing payloads or create custom payloads tailored to specific testing scenarios.

Are there any new improvements for WAF bypass?

Yes! We’ve made significant improvements:
+300 new payloads have been added to every plan.
Golden and Business plans now include
500+ new payloads, covering a wide variety of WAFs.
New Fuzzing Feature: This feature performs static analysis based on page source reflection and allowed characters. It generates and automates payloads intelligently, using only the characters allowed by the target application.
Clickable Payloads: xss0r V3 introduces a feature for payloads requiring user interaction, such as <ClickME> buttons. The tool automatically performs POST requests with these payloads, clicks on them, and completes all actions on your behalf.

Is there a trial version available?

Yes, we offer a DEMO service that clients can request at any time, allowing for a 5-day testing period. Additionally, we provide a free access key for new users on the 10th to 15th of every month, enabling them to test the tool before making a purchase, specifically for the PRO plan.

Can xss0r analyze JSON web applications?

Yes, xss0r supports JSON web applications, allowing for detailed testing of JSON payloads and data structures.

What are the advanced search and filter options in xss0r?

xss0r offers advanced search and filter capabilities, allowing users to quickly locate specific vulnerabilities and tailor their testing approach.

What is Blind XSS, and how is it implemented in xss0r?

xss0r now includes Blind XSS functionality, allowing automated testing of reflected vulnerabilities over time. It sends payloads to trigger XSS even in delayed interactions.

Does xss0r V3 support macOS and other Linux distributions?

Yes! xss0r V3 fully supports macOS, Ubuntu (latest version), and is compatible with all Linux platforms.

How does the new crawler feature enhance testing?

The built-in crawler searches through HTML, XML, and JS tags to discover URLs. It also identifies input forms, such as usernames, feedback, and comment fields, and can automatically submit Blind XSS payloads using the new --spray feature.

Where is the API key sent, and how can I add my API key?

When purchasing any XSS Plan, please use a valid email address during registration. API access will be provided within 6 to 12 hours after purchase, though it often arrives sooner. The xss0r tool will be accessible after purchasing a plan, and the API key will be sent to the registered email. If you do not receive your API access within 12 hours, please reach out directly through Support Chat or X.

What new features are included in the V3 version of xss0r?

Introducing xss0r V3:
Session Control: Save (--save) and resume (--resume) your scanning sessions. Custom Headers: Use a custom User-Agent with --user-agent.
Stealth Modes: Bypass modern WAFs with low/medium/high --stealth settings.
Plan Status: Check your current plan features with --status.
ClickMe Automation: Trigger clickable payload techniques using the ClickMe Keyboard Press.
Enhanced BlindXSS: New and improved BlindXSS capabilities.
Updated Chrome: Better performance with the latest Chrome version.
Fresh Look: A new logo marks the updated design.
Experience a faster, smarter, andmore customizable scanning tool with xss0r V3!

What are the complete features of BlindXSS in xss0r?

Blind XSS in xss0r now offers automatic crawling of forms onwebsites, spraying Blind XSS payloads, and saving any triggeredpayloads directly to your account with Telegram notifications. Italso supports injection of Blind XSS payloads in the user-agentheader, capturing all discovered links for manual inspection.Email-specific payloads target only email fields, and Blind XSSdorking has been added for deeper exploration. Additionally, testpages are provided for learning and practicing Blind XSS techniques.Telegram and Email Notifications Event Payloads for Account Takeover New Features:
All Cookies (Non-HttpOnly): Collects all accessible cookies that are not flagged as HttpOnly for analysis and debugging. Referrer Information: Retrieves the referring URL to identify the source of traffic to the page.
IP Address of the Target Client: Captures the public IP address and provides approximate location details, including city, region, and country.
Browser Language Information: Detects the browser's language settings to support localization and customization.
Browser Name and Version: Identifies the browser name and version using the User-Agent string.
Screenshot of DOM Structure: Generates a visual screenshot of the current DOM structure for debugging and reporting purposes. Screen Resolution: Collects the screen resolution and window size of the client’s device.
Graphics Card Information: Retrieves detailed GPU information, including vendor and renderer.
Battery Status: Tracks the device’s battery level and charging status when supported by the browser.
Network Information: Captures the network type (e.g., Wi-Fi, 4G) and downlink speed. Local Storage and Session Storage: Extracts data stored in the client’s local and session storage.
Form Inputs: Collects values from all form inputs, including text fields, text areas, and dropdowns, on the page.
Page Metadata: Gathers essential page metadata, including the page title, URL, and full HTML structure.
Plugins and Mime Types: Retrieves a list of installed browser plugins and supported MIME types.
Admin Panel Accessibility Check: Attempts to access the /admin endpoint to verify if it is accessible and logs the response status.
API Key Discovery in Scripts: Scans all script files loaded on the page to identify potential API keys in their content.