Published 17 years 1 month ago • Last updated March 22, 2025 • ⏱️ 4 min read
I've developed a new XSS scanner tool that's written in Javascript called XSS Rays for Microsoft. They have given me permission to release the tool as open source which is awesome because it can be used for other open source applications. I recommend you use it as part of the web development process to make sure you've filtered XSS correctly on your application.
It works as a bookmarklet and scans any links, paths or forms on the target scanning page (even cross domain). You can add vectors to it quite easily and it includes some of the most common injections I've found on sites over the years. I've tested it on IE7/IE8 and Firefox but it could work in other browsers.
The advantage of the bookmarklet is that vectors can be customised for each browser and they are executed in the context of the browser, in IE8 standards mode were css expressions are disabled in IE8 the vector won't be executed for example.
Hopefully there should be no false positives either because each vector is actually executed and it reported back as successful, in fact if there is a false positive it will be a bug in my code (lets hope not).
The code works by creating connections to the target links/paths using iframes, each iframe is assign a name which is the url to return to on successful execution (the originating url). This allows cross domain links to be checked.
The vectors are stored in a simple object, each vector has the following properties:- input, name, browser, form, url, path (there's a optional second input). Input is the XSS vector, the string "XSS" is used to replace with a logger or a poc url and is required by all vectors.
Name is just a meaningful name applied to the vector, browser supports ALL|FF|IE and helps to save time when testing specific browser vectors as XSS Rays will only target those versions for the vector.
Form, url, path allows you to disable the vector for scanning forms etc, supports TRUE|FALSE.
There are a few configuration properties supported:-
There's a interesting little hack for IE to enable the onload event of a dynamic iframe, I use the following code to create a specific IE loader:-
<pre lang="javascript"> var ieLoader = "document.getElementById('"+'ray'+self.uniqueID+"').ieonload()"; if(self.isIE()) { try { var iframe = document.createElement('<iframe name="'+location + '#xss'+'" onload="'+ieLoader+'">'); } catch (e) { var iframe = document.createElement('iframe'); } } else { var iframe = document.createElement('iframe'); } </pre>Big thanks to David Ross, Manuel Caballero and you (you know who you are) for testing and feedback. Thanks to Microsoft for supporting the development of XSS Rays.
The latest version of XSS Rays is now online (0.5.0), it contains some speed improvements and bug fixes.