OWASP Xenotix XSS Exploit Framework 6

Wednesday, October 8, 2014

OWASP Xenotix XSS Exploit Framework is an advanced Cross Site Scripting (XSS) vulnerability detection and exploitation framework. Xenotix provides Zero False Positive XSS Detection by performing the Scan within the browser engines where in real world, payloads get reflected. Xenotix Scanner Module is incorporated with 3 intelligent fuzzers to reduce the scan time and produce better results. If you really don't like the tool logic, then leverage the power of Xenotix API to make the tool work like you wanted it to be. It is claimed to have the world’s 2nd largest XSS Payloads of about 4800+ distinctive XSS Payloads. It is incorporated with a feature rich Information Gathering module for target Reconnaissance. The Exploit Framework includes real world offensive XSS exploitation modules for Penetration Testing and Proof of Concept creation.


  • GET Request Manual Mode
  • GET Request Auto Mode
  • Multiple Parameter Scanner
  • GET Request Fuzzer
  • POST Request Fuzzer
  • Advanced Request Fuzzer
  • OAuth 1.0a Request Scanner
  • DOM Scanner
  • Hidden Parameter Detector
  • WAF Fingerprinting
  • Victim Fingerprinting
    • IP to Location
    • IP to GeoLocation
  • Network
    • Network IP (WebRTC)
    • Ping Scan
    • Port Scan
    • Internal Network Scan
  • Browser
    • Fingerprinting
    • Features Detector
  • Send Message
  • Cookie Thief
  • Keylogger
  • HTML5 DDoSer
  • Load File
  • Grab Page Screenshot
  • JavaScript Shell
  • Reverse HTTP WebShell
  • Metasploit Browser Exploit
  • Social Engineering
    • Phisher
    • Tabnabbing
    • Live WebCam Screenshot
    • Download Spoofer
    • Geolocation HTML5 API
    • Java Applet Drive-By (Windows)
    • Java Applet Drive-By Reverse Shell (Windows)
    • HTA Network Configuration (Windows, IE)
    • HTA Drive-By (Windows, IE)
    • HTA Drive-By Reverse Shell (Windows, IE)
  • Firefox Addons
    • Reverse TCP Shell Addon (Windows, Persistent)
    • Reverse TCP Shell Addon (Linux, Persistent)
    • Session Stealer Addon (Persistent)
    • Keylogger Addon (Persistent)
    • DDoSer Addon (Persistent)
    • Linux Credential File Stealer Addon (Persistent)
    • Drop and Execute Addon (Persistent)
  • WebKit Developer Tools
  • Encoder/Decoder
  • JavaScript Encoders
    • JSFuck 6 Char Encoder
    • jjencode Encoder
    • aaencode Encoder
  • JavaScript Beautifier
  • Hash Calculator
  • Hash Detector
  • View Injected JavaScript
  • View XSS Payloads
  • Xenotix API
  • IronPython Scripting Support
  • Trident and Gecko Web Engine Support 

Subscribe via e-mail for updates!