XSS in eXceSS: A "learn-XSS tool"

kishord today presents a tool, called XSS in eXceSS and hosted by .mario that will allow you test attack vectors against a page in different contexts. On top of that it also incorporates PHP IDS, allowing you to skip whichever rules you choose.

From kishord's post:

It takes the input via various get parameters and leads to different areas in the HTML page. E.g. parameter freehtml=ATTACK_VECTOR will place the injection in to the HTML body. There are more than 25 such parameters which lead to different XSS areas.

Please read the usage notes on the page.
In order to make it a learning tool, it is coupled with PHP IDS with some modifications. It lets the user choose which IDS rules to skip. Thus each XSS area now can be XSSed by challenging different filters. E.g. If you are able to attack in an area where only the <script> can cause an injection, (E.g. html body, ummm, well ignore other cases for now) then you have to ask the page to skip the filter that detects script tag.

Good stuff!

XSS in eXceSS: A "learn-XSS tool" was originally published by Martin Paul Eve at eve.gd: Martin Paul Eve on May 16, 2007.