edgeiq-xss-scanner（Edgeiq XSS 扫描仪）

EdgeIQ XSS Scanner

Version: 1.2.0 Skill Name: xss-scanner Category: Security / Offensive / Auditing Author: EdgeIQ Labs License: Defensive Use Only OpenClaw Compatible: Yes — Python 3, pure stdlib, WSL + Windows + macOS

What It Does

Professional-grade XSS vulnerability scanner for authorized security auditing. Scans web applications for reflected XSS, DOM-based XSS, stored/persistent XSS (via blind callback), and WAF-bypass variants. Designed for penetration testers, bug bounty researchers, and security teams with explicit written authorization.

⚠️ Legal Notice: Only scan targets you own or have explicit written permission to audit. Unauthorized scanning is illegal and strictly prohibited. This tool is for defensive security professionals.

Pricing

Lifetime License: $39 — your tool forever, all Pro features included permanently.

Optional Monthly: $7/mo — for those who prefer recurring billing (cancel anytime).

👉 Buy Lifetime — $39 👉 Subscribe Monthly — $7/mo 👉 Subscribe Monthly — $7/mo

Feature Tiers at a Glance

All Pro features are now included in the Lifetime License. The Lifetime purchase gives you permanent access to everything previously locked behind Pro/Bundle tiers.

What's New in v2

Installation

# Standalone usage
python3 /home/guy/.openclaw/workspace/apps/xss-scanner/scanner.py <target>

# As OpenClaw command (in any channel):
!xss https://example.com
!xss https://example.com --depth 3 --workers 20

Quick Start

Basic Scan

python3 scanner.py https://example.com

Verbose / Full Crawl

python3 scanner.py https://example.com --depth 2 --max-urls 30

With Proxy (Burp Suite / OWASP ZAP)

python3 scanner.py https://example.com --proxy http://127.0.0.1:8080 --quiet

Authenticated Scan

python3 scanner.py https://example.com --auth admin:secret --cookies "session=abc123"

Blind XSS (stored/persistent XSS detection)

python3 scanner.py https://example.com --blind-callback https://your-callback.com/log

Security Headers Audit

python3 scanner.py https://example.com --analyze-headers --format json --out report.json

Export HTML Report

python3 scanner.py https://example.com --format html --out xss-report.html

Automation / CI-CD (exit codes + quiet mode)

python3 scanner.py https://example.com --quiet --format json -o result.json
echo "Exit code: $?"   # 0=safe, 1=vulns found, 2=error, 3=interrupted

Command Reference

Positional Arguments

Core Options

Network Options

Advanced Options

Exit Codes

Payload Context Detection

The scanner automatically detects the injection context of each reflection and assigns severity accordingly:

WAF Detection & Bypass

Automatically detects these WAFs and switches to bypass payloads:

• Cloudflare, AWS CloudFront, Akamai, Imperva
• Fortinet, Sucuri, F5 BIG-IP ASM, Barracuda
• DenyAll, Cisco ACE, dotDefender, Google Armr

Bypass payloads activated automatically when WAF block patterns are detected:

• Case mutation: <ScRipT>, <IMG SRC=x ONERROR=...>
• Unicode escape: <script>\alert(1)</script>
• Protocol-less: //evil.com/x.js

Security Header Analysis

When --analyze-headers is used, reports on:

Output Formats

Discord (default)

Rich embed with severity breakdown, grouped by critical/high/medium/low. Clean formatting for Discord channels.

JSON (machine-readable)

Full structured report for CI/CD pipelines, includes:

• Scan stats + metadata
• All vulnerabilities with severity, evidence, timestamp
• Security header findings
• WAF detection results
• Reflected parameter map

HTML (shareable report)

Self-contained styled HTML file — dark theme, sortable vulnerability table, header findings, WAF info. Ready to share with clients or include in pentest deliverables.

Simple (console)

One-line-per-finding format. Good for grep/parsing.

Discord Command Usage

In any OpenClaw Discord channel:

!xss https://example.com
!xss https://example.com --depth 3 --max-urls 50 --workers 20
!xss https://example.com --follow-external --format json -o report.json
!xss https://example.com --proxy http://127.0.0.1:8080 --quiet
!xss https://example.com --blind-callback https://your-domain.com/log
!xss https://example.com --analyze-headers --format html -o report.html

Free vs Pro

Free (v1) — Included

Full-featured scanner for manual authorized auditing. Everything in this SKILL.md except the Pro-only items.

Pro ($19/mo)

• Blind XSS detection with persistent callback monitoring
• Scheduled recurring scans (cron-based)
• Alert delivery to Discord, Telegram, or Email
• Screenshot evidence capture
• Reflected params deep analysis
• Priority onboarding and support

Network Pro ($29/mo) *(deprecated)*

All features included in Lifetime purchase above.

Bundle ($39/mo) *(deprecated)*

All features now included in Lifetime purchase above.

Upgrade Links

Contact: gpalmieri21@gmail.com

Architecture

Legal & Ethical Use

This tool is for:

• Security researchers auditing authorized bug bounty targets
• Penetration testers assessing client applications under contract
• Developers testing their own applications
• Defensive security teams auditing internal infrastructure
• Capture The Flag (CTF) participants in authorized labs

This tool must NOT be used:

• Against targets without explicit written permission
• On production systems without authorization
• For any unauthorized access, enumeration, or exploitation
• In any jurisdiction where automated vulnerability scanning is restricted

Support

• Email: gpalmieri21@gmail.com
• Discord: https://discord.gg/aPhSnrU9
• Site: https://edgeiqlabs.com

🔗 More from EdgeIQ Labs

edgeiqlabs.com — Security tools, OSINT utilities, and micro-SaaS products for developers and security professionals.

• 🛠️ Subdomain Hunter — Passive subdomain enumeration via Certificate Transparency
• 📸 Screenshot API — URL-to-screenshot API for developers
• 🔔 uptime.check — URL uptime monitoring with alerts
• 🛡️ headers.check — HTTP security headers analyzer

👉 Visit edgeiqlabs.com →