dwisiswant0 / findom-xss

A fast DOM based XSS vulnerability scanner with simplicity.

FinDOM-XSS

FinDOM-XSS is a tool that allows you to finding for possible and/ potential DOM based XSS vulnerability in a fast manner.

---

Installation

$ git clone https://github.com/dwisiswant0/findom-xss.git --recurse-submodules

Dependencies: LinkFinder

Usage

To run the tool on a target, just use the following command.

$ ./findom-xss.sh https://domain.tld/about-us.html

This will run the tool against domain.tld.

URLs can also be piped to findom-xss and scan on them. For example:

$ cat urls.txt | ./findom-xss.sh

The second argument can be used to specify an output file.

$ ./findom-xss.sh https://domain.tld/about-us.html /path/to/output.txt

By default, output will be stored in the results/ directory in the repository with domain.tld.txt name.

License

FinDOM-XSS is licensed under the Apache. Take a look at the LICENSE for more information.

Thanks

• @dark_warlord14 - Inspired by the JSScanner tool, that's why this tool was made.
• @aslanewre - With possible patterns.
• All Contributors

findom-xss's Issues

Can't open file '/home/dw1/Tools/LinkFinder/linkfinder.py

---

| () _ | \ / _ | / |\ / / / |
| || | ' | |) | () | |/| |> <_ __
|| |||||/ _/|| || //__/_/

[email protected]

Find for Possible DOM Based XSS Vulnerability

[07/08/2020 20:33] Scanning against https://*********.com
/Library/Frameworks/Python.framework/Versions/3.6/Resources/Python.app/Contents/MacOS/Python: can't open file '/home/dw1/Tools/LinkFinder/linkfinder.py': [Errno 2] No such file or directory

Found nothing. ¯_(ツ)_/¯

MacBook-Pro-*********:findom-xss *$ ---
[!] https://.com
1:window.location.href

MacBook-Pro-*********:findom-xss **********$

WHAT ITS WRONG BRO PLEASE ?

syntax error in expression

gan maaf ganggu, mau nanya kalo begini itu kenapa ya?

sebelumnya bisa tp setelah beberapa kali lanjut, dia error begitu (jadi ga nongol di terminal dan ga ke save di xxx.txt nya)
di line 65.

https://ibb.co/XjxYYsT

Terims sebelumnya gan

what is this token

1: syntax error in expression (error token is "1")

SSL warning supress error message fix.

line 72
change
python3 ${LINKFINDER} -d -i ${1} -o cli | grep -Eoi "https?://[^\"\\'> ]+" | grep "${DOMAIN}" | grep ".js" | uniq |
to
python3 -W ignore ${LINKFINDER} -d -i ${1} -o cli | grep -Eoi "https?://[^\"\\'> ]+" | grep "${DOMAIN}" | grep ".js" | uniq |

Host Unreachable error

Running this tool against one of my pet websites returns an host unreachable error, even though i'm connected to the Wifi, and the website is up. The command in run is below:

$ ./findom-xss.sh https://alicescfernandes.github.io/random-who/index.html

Error cloning repository (LinkFinder dependency)

Error cloning repository (LinkFinder dependency)

[email protected]: Permission denied (publickey).
fatal: ... '[email protected]:GerbenJavado/LinkFinder' en la ruta de submódulo '/home/redacted/findom-xss/LinkFinder' falló
Falló al clonar 'LinkFinder' una segunda vez, abortando

Seems some problem with the public ssh-key.

1: syntax error in expression (error token is "1")

Bug - The example.com host is unreachable exists the script.

When I give a list to findom-xss.sh, it itetarates over all domains, but when hit an unreachable one, script stops immediately. Don't continue to other domains.

Thanks.

Ready to use docker executable

Hi. I have created a ready to use Docker wrap fork from this repo. Check it out! https://github.com/cesarochoa2006/findom-xss.

Ps: Thanks for your awesome work with this utility.