ezXSS

ezXSS is an easy way for penetration testers and bug bounty hunters to test (blind) Cross Site Scripting.

MIT License

Stars
1.9K

Bot releases are visible (Hide)

ezXSS - ezXSS v1.4

Published by ssl over 7 years ago

I'm happy to release ezXSS version 1.4. Added some great features and removed bad things.

  • Change DOM part setting and timezone on the Settings page
  • Removed https or http on Origin
  • Changed the max chars to show on All reports page to prevent long URI's.
  • Removed some unnecessary code
  • Option to filter reports that they do not save or alert if identical to a other report.
  • Added a new feature to share a report with a other ezXSS owner using domainname and a secretkey
  • All CSS and font's are now hosted on Github.
  • Some other small fixes

This is the first release that can be used in production. If you have any problems or ideas let me know.

Screenshot of sharing

ezXSS - ezXSS v1.3

Published by ssl over 7 years ago

Some bug fixes and lightweight callback file.

  • The JS callback file is minified from 301765 to 43944 total characters. Load time can be up to 5 times faster.
  • Some bug fixes and typo fixes.

Next version will have (and currently in build):

  • Remove all not-used CSS because CSS is currently bigger than everything else combined
  • Add feature to share a report with a other ezXSS user with domain+secretkey
  • Option to block a domain because you get too many reports or not interested in the domain
  • Option that if report is 100% the same as a other report, do not safe/re-alert.
  • Max chars on report page for url (responsive fix)
  • Cleanup code in Components
  • Cleanup code overal, there is some bad-practice code thats need to be fixed
ezXSS - ezXSS v1.2

Published by ssl over 7 years ago

Some bug fixes and a new feature.

  • Screenshots now upload on your host
  • Screenshot preview is send in the mail
  • On PHP7+ not all reports got saved because of a big image, this is now fixed with the new features.
  • /manage page is now HTTPS only, and cookies are HTTP only protected.
  • Last report stats on dashboard bugged if it was more then x seconds, this is fixed.

If you have any suggestions please let me know. Have fun with this new version :-)!