EdgeIQ XSS Scanner

Version: 1.2.0
Skill Name: xss-scanner
Category: Security / Offensive / Auditing
Author: EdgeIQ Labs
License: Defensive Use Only
OpenClaw Compatible: Yes — Python 3, pure stdlib, WSL + Windows + macOS

---

What It Does

Professional-grade XSS vulnerability scanner for authorized security auditing. Scans web applications for reflected XSS, DOM-based XSS, stored/persistent XSS (via blind callback), and WAF-bypass variants. Designed for penetration testers, bug bounty researchers, and security teams with explicit written authorization.

⚠️ Legal Notice: Only scan targets you own or have explicit written permission to audit. Unauthorized scanning is illegal and strictly prohibited. This tool is for defensive security professionals.

---

Pricing

Feature	Lifetime ($39)	Optional Monthly ($7/mo)
All scanner features	✅	✅
Blind XSS detection	✅	✅
Screenshot evidence capture	✅	✅
HTML report export	✅	✅
Reflected params deep analysis	✅	✅
Scheduled recurring scans	✅	✅
Alert delivery (Discord/Telegram/Email)	✅	✅
Priority support	✅	✅
Core reflected XSS scan (40+ payloads)	✅	✅
Crawl mode + BFS depth	✅	✅
JSON report export	✅	✅
HTTP security header analysis	✅	✅
WAF detection + auto-bypass	✅	✅
Custom headers, cookies, auth	✅	✅
Proxy support	✅	✅
Rate limiting control	✅	✅
--quiet mode + exit codes	✅	✅

Lifetime License: $39 — your tool forever, all Pro features included permanently.

Optional Monthly: $7/mo — for those who prefer recurring billing (cancel anytime).

👉 Buy Lifetime — $39 👉 Subscribe Monthly — $7/mo 👉 Subscribe Monthly — $7/mo

---

Feature Tiers at a Glance

Feature	Free	Lifetime ($39)
Core reflected XSS scan (40+ payloads)	✅	✅
Crawl mode + BFS depth	✅	✅
JSON report export	✅	✅
HTTP security header analysis	✅	✅
WAF detection + auto-bypass	✅	✅
Custom headers, cookies, auth	✅	✅
Proxy support	✅	✅
Rate limiting control	✅	✅
--quiet mode + exit codes	✅	✅
Blind XSS detection (--blind-callback)	❌	✅
Screenshot evidence capture (--screenshot-dir)	❌	✅
HTML report export (--format html)	❌	✅
Reflected params deep analysis	❌	✅
Scheduled recurring scans	❌	✅
Alert delivery (Discord/Telegram/Email)	❌	✅
Priority support	❌	✅

All Pro features are now included in the Lifetime License. The Lifetime purchase gives you permanent access to everything previously locked behind Pro/Bundle tiers.

---

What's New in v2

Feature	Free	Lifetime ($39)
Core reflected XSS scan	✅	✅
40+ payloads (incl. WAF bypass)	✅	✅
7 injection context modes	✅	✅
Crawl mode with BFS depth	✅	✅
JSON + HTML report export	✅	✅
HTTP security header analysis (CSP, XFO, HSTS…)	✅	✅
WAF detection + auto-bypass payload switching	✅	✅
Custom headers, cookies, auth	✅	✅
Proxy support (stealth scanning)	✅	✅
Rate limiting control	✅	✅
Blind XSS detection (callback mode)	❌	✅
Reflected params analysis	❌	✅
Screenshot evidence capture	❌	✅
--quiet mode + exit codes (CI/CD)	✅	✅
Scheduled recurring scans	❌	✅
Alert delivery (Discord / Telegram / Email)	❌	✅
Priority support	❌	✅

---

Installation

# Standalone usage
python3 /home/guy/.openclaw/workspace/apps/xss-scanner/scanner.py <target>

# As OpenClaw command (in any channel):
!xss https://example.com
!xss https://example.com --depth 3 --workers 20

---

Quick Start

Basic Scan

python3 scanner.py https://example.com

Verbose / Full Crawl

python3 scanner.py https://example.com --depth 2 --max-urls 30

With Proxy (Burp Suite / OWASP ZAP)

python3 scanner.py https://example.com --proxy http://127.0.0.1:8080 --quiet

Authenticated Scan

python3 scanner.py https://example.com --auth admin:secret --cookies "session=abc123"

Blind XSS (stored/persistent XSS detection)

python3 scanner.py https://example.com --blind-callback https://your-callback.com/log

Security Headers Audit

python3 scanner.py https://example.com --analyze-headers --format json --out report.json

Export HTML Report

python3 scanner.py https://example.com --format html --out xss-report.html

Automation / CI-CD (exit codes + quiet mode)

python3 scanner.py https://example.com --quiet --format json -o result.json
echo "Exit code: $?"   # 0=safe, 1=vulns found, 2=error, 3=interrupted

---

Command Reference

Positional Arguments

Argument	Description
url	Target URL (auto-adds https:// if missing)

Core Options

Flag	Type	Default	Description
--depth	int	2	Crawl depth (BFS link discovery)
--max-urls	int	20	Maximum URLs to scan before stopping
--workers	int	15	Concurrent threads for payload testing
--format	choice	discord	Output format: discord, json, html, simple
--follow-external	flag	False	Follow links to external domains
--quiet, -q	flag	False	Suppress progress output
--out, -o	path	—	Write output to file

Network Options

Flag	Type	Description
--proxy	URL	HTTP/S proxy (e.g. http://127.0.0.1:8080 for Burp/ZAP)
--user-agent	string	Custom User-Agent string
--auth	user:pass	Basic HTTP authentication
--cookies	string	Cookie string (name=value; name2=value2)
--custom-header	HDR	Add custom header (Name: value) — repeatable
--timeout	float	Request timeout in seconds (default: 15)
--rate-limit	float	Minimum seconds between requests (anti-rate-limit)

Advanced Options

Flag	Type	Description
--blind-callback	URL	Blind XSS callback URL for stored XSS detection
--analyze-headers	flag	Analyze HTTP security headers (CSP, X-Frame-Options, HSTS…)
--reflected-only	flag	Map reflected params without sending payloads
--screenshot-dir	path	Directory for evidence HTML files (default: /tmp/xss-screenshots)

Exit Codes

Code	Meaning
0	Scan complete — no vulnerabilities found
1	Scan complete — vulnerabilities detected
2	Scan error — target unreachable or connection failed
3	Interrupted — SIGINT/SIGTERM received

---

Payload Context Detection

The scanner automatically detects the injection context of each reflection and assigns severity accordingly:

Context	Triggered When	Severity	Example
js_string	Payload inside <script> or JS string	Critical	<script>alert(1)</script>
event_handler	Payload inside on* attribute	Critical	onerror=alert(1)
html_attr	Payload inside HTML attribute	High	" onmouseover=alert(1) x="
dom	DOM mutation / innerHTML injection	High	DOM clobbering vectors
html_body	Plain text reflection in HTML	Medium	<script>alert(1)</script>
comment	Inside HTML comment <!-- -->	Medium	--><script>alert(1)</script>
css	Inside <style> tag	Medium	Style-based injection
url_param	URL-encoded param in URL	Low	?q=<script>alert(1)</script>

---

WAF Detection & Bypass

Automatically detects these WAFs and switches to bypass payloads:

• Cloudflare, AWS CloudFront, Akamai, Imperva
• Fortinet, Sucuri, F5 BIG-IP ASM, Barracuda
• DenyAll, Cisco ACE, dotDefender, Google Armr

Bypass payloads activated automatically when WAF block patterns are detected:

• Case mutation: <ScRipT>, <IMG SRC=x ONERROR=...>
• Unicode escape: <script>\u0061lert(1)</script>
• Protocol-less: //evil.com/x.js

---

Security Header Analysis

When --analyze-headers is used, reports on:

Header	What It Checks
Content-Security-Policy	unsafe-inline / unsafe-eval present?
X-Frame-Options	Clickjacking protection (DENY / SAMEORIGIN)
X-Content-Type-Options	MIME-sniffing disabled (nosniff)
Strict-Transport-Security	HTTPS enforcement
Referrer-Policy	Referrer leakage
X-XSS-Protection	Legacy XSS filter (often disabled intentionally)
Permissions-Policy	Browser feature restrictions

---

Output Formats

Discord (default)

Rich embed with severity breakdown, grouped by critical/high/medium/low. Clean formatting for Discord channels.

JSON (machine-readable)

Full structured report for CI/CD pipelines, includes:

• Scan stats + metadata
• All vulnerabilities with severity, evidence, timestamp
• Security header findings
• WAF detection results
• Reflected parameter map

HTML (shareable report)

Self-contained styled HTML file — dark theme, sortable vulnerability table, header findings, WAF info. Ready to share with clients or include in pentest deliverables.

Simple (console)

One-line-per-finding format. Good for grep/parsing.

---

Discord Command Usage

In any OpenClaw Discord channel:

!xss https://example.com
!xss https://example.com --depth 3 --max-urls 50 --workers 20
!xss https://example.com --follow-external --format json -o report.json
!xss https://example.com --proxy http://127.0.0.1:8080 --quiet
!xss https://example.com --blind-callback https://your-domain.com/log
!xss https://example.com --analyze-headers --format html -o report.html

---

Free vs Pro

Free (v1) — Included

Full-featured scanner for manual authorized auditing. Everything in this SKILL.md except the Pro-only items.

Pro ($19/mo)

• Blind XSS detection with persistent callback monitoring
• Scheduled recurring scans (cron-based)
• Alert delivery to Discord, Telegram, or Email
• Screenshot evidence capture
• Reflected params deep analysis
• Priority onboarding and support

Network Pro ($29/mo) (deprecated)

All features included in Lifetime purchase above.

Bundle ($39/mo) (deprecated)

All features now included in Lifetime purchase above.

Upgrade Links

Tier	Link
$39	$39
Monthly ($7/mo)	$7/mo
$7/mo	$7/mo

Contact: gpalmieri21@gmail.com

---

Architecture

Component	Detail
Language	Python 3 (pure stdlib — no external dependencies)
Concurrency	concurrent.futures.ThreadPoolExecutor for parallel payload testing
Crawl Strategy	BFS with configurable depth, URL dedup, external-link filtering
HTTP Client	Custom HTTPClient class with proxy, auth, cookie, custom-header support
WAF Detection	Pattern-matching on response body + headers against 15+ WAF signatures
Context Detection	Regex + HTML parser across 8 injection contexts
Payload Library	40+ payloads across script injection, event handlers, attribute injection, URL injection, context breakers, mution/mull-byte bypass, Unicode, DOM clobbering
Supported OS	Linux/WSL, Windows, macOS
Exit Codes	Full automation support (0/1/2/3)

---

Legal & Ethical Use

This tool is for:

• Security researchers auditing authorized bug bounty targets
• Penetration testers assessing client applications under contract
• Developers testing their own applications
• Defensive security teams auditing internal infrastructure
• Capture The Flag (CTF) participants in authorized labs

This tool must NOT be used:

• Against targets without explicit written permission
• On production systems without authorization
• For any unauthorized access, enumeration, or exploitation
• In any jurisdiction where automated vulnerability scanning is restricted

---

Support

• Email: gpalmieri21@gmail.com
• Discord: https://discord.gg/aPhSnrU9
• Site: https://edgeiqlabs.com

---

🔗 More from EdgeIQ Labs

edgeiqlabs.com — Security tools, OSINT utilities, and micro-SaaS products for developers and security professionals.

• 🛠️ Subdomain Hunter — Passive subdomain enumeration via Certificate Transparency
• 📸 Screenshot API — URL-to-screenshot API for developers
• 🔔 uptime.check — URL uptime monitoring with alerts
• 🛡️ headers.check — HTTP security headers analyzer

👉 Visit edgeiqlabs.com →