XSS-HUNTER GitHub Details, Stars and Alternatives | OpenRepoFinder
EnCrYpTeD05 / repository
XSS-HUNTER
XSS Hunter is an automated reflected XSS scanner with subdomain discovery, parameter collection, Dalfox scanning, live web dashboard, stop/resume support, and clean report outputs.
A transparent discovery signal based on current public GitHub metadata.
Recent activity35% weight
72
Community adoption25% weight
9
Maintenance state20% weight
100
License clarity10% weight
100
Project information10% weight
100
This score does not audit code, security, maintainers, documentation quality, or suitability. Verify the repository and its current documentation before adoption.
README preview
🎯 XSS Hunter v2.0
Automated Reflected XSS Scanner for Bug Bounty Hunters
XSS Hunter v2.0 is an automated, end-to-end Reflected XSS vulnerability scanner built for fast bug bounty workflows.
It chains together trusted tools like Subfinder, ParamSpider, and Dalfox into one smooth pipeline: from subdomain discovery to vulnerable URL extraction.
Now it also includes a full local web dashboard:
Animated intro
Live scan logs
Stop scan
Resume stopped scan
Selective output file downloads
Fresh dashboard state on reopen
CLI users can still run everything from terminal:
xsshunter -d target.com
Web users can launch the dashboard:
xsshunter --web
⚙️ Workflow
Target Domain
|
v
+-------------------------+
| 1. Subfinder | -> Subdomain Enumeration
+-----------+-------------+
|
v
+-------------------------+
| 2. Active Check | -> Filter Live Subdomains
+-----------+-------------+
|
v
+-------------------------+
| 3. ParamSpider | -> Parameter Discovery
+-----------+-------------+
|
v
+-------------------------+
| 4. Smart Filter | -> Single Parameter URLs
+-----------+-------------+
|
v
+-------------------------+
| 5. FUZZ Cleanup | -> Replace FUZZ + Remove Duplicates
+-----------+-------------+
|
v
+-------------------------+
| 6. Dalfox Scan | -> Reflected XSS + WAF Evasion
+-----------+-------------+
|
v
+-------------------------+
| 7. Extract POCs | -> vulnerableurl.txt
+-------------------------+
🚀 Features
Core Features
Feature
Description
🔍 Subdomain Enumeration
Discovers subdomains using subfinder
✅ Active Subdomain Check
Filters live targets using threaded HTTP checks
🕷️ Parameter Discovery
Collects URLs and parameters using paramspider
🎯 Smart URL Filtering
Keeps single-parameter URLs and skips noisy login/account URLs
🔄 Duplicate Removal
Removes duplicate URLs before scanning
💉 Reflected XSS Scan
Runs Dalfox against prepared URL input
🛡️ WAF Evasion
Uses Dalfox WAF evasion flags
📋 Clean Output
Saves each scan stage into separate output files
🎯 POC Extraction
Extracts [POC] and [W] findings into vulnerableurl.txt
Web Dashboard Features
Feature
Description
🎬 Cinematic Intro
XSS HUNTER intro animation
🌈 Theme Variant
Alternates intro styles
📊 Live Status
Shows Running, Waiting, Stopped By User, and Scan Finish
🛑 Stop Scan
Stop the current scan from the web UI
🔁 Resume Scan
Resume a stopped scan from the dashboard
📥 Selective Downloads
Download only the output file you want
🧼 Fresh Reopen
Old scans do not auto-show when dashboard reopens
🖥️ Background Server
xsshunter --web starts the server and frees the terminal
Stability Features
Feature
Description
🌐 Internet Auto-Recovery
Waits when internet disconnects and continues after reconnect
⚡ Rate Limit Handling
Detects rate-limit signals and increases delay
📝 Error Logging
Saves timestamped error logs
🛑 Graceful Exit
Saves progress when stopped
🔄 Resume Logic
Skips already-scanned URLs during Dalfox resume flow
📋 Requirements
Tool
Type
Python 3
Runtime
Subfinder
Go tool
ParamSpider
Python tool
Dalfox
Go tool
Go
Required for Go-based tools
Git + Curl
Setup utilities
🛠️ Installation
Auto Install Recommended
git clone https://github.com/EnCrYpTeD05/XSS-HUNTER.git
cd XSS-HUNTER
chmod +x install.sh
./install.sh
The installer will:
Step
Action
1
Install required system packages
2
Install subfinder
3
Install dalfox
4
Install paramspider
5
Create global xsshunter command
6
Verify required tools
After install, run from anywhere:
xsshunter --help
Link Only
If tools are already installed and you only want the global command:
--web Launch local web dashboard
--host Web dashboard host (default: 127.0.0.1)
--port Web dashboard port (default: 8787)
-d, --domain Target domain
--threads Active subdomain check threads (default: 20)
--dalfox-mode default or custom
--workers Dalfox workers in custom mode (default: 5)
--delay Dalfox delay in ms (default: 500)
--timeout Dalfox timeout in seconds (default: 30)
