Airixss is for checking reflection in recon process to find xss vulnerable.

– Installation & Requirements:

> go install[email protected]


> git clone

> cd airixss

> go build airixss.go

> chmod +x airixss

> ./airixss -h

– Usage & Explanation:

  • In Your recon process, you may find endpoints that can be vulnerable to xss,

  • By replacing the “SameValue” to a xss payload, In order to see if there is reflection/vulnerable, it is when you use airixss

  • Lets say you have a url and you want to test reflection:

    Airixss reads from stdin:

    echo '"><img src=x onerror=confirm(1)>' | airixss -payload 'confirm(1)'

    In -payload flag, you need to specify a part of the payload used in url, -payload “value_will_be_checked_reflection”

    You can use a file containing a list of targets as well:

    cat targets | airixss -payload "alert(1)"

  • You can make use of Airixss with other tools such gau, gauplus, waybackurls, qsreplace and bhedak

    • Another examples of usage:

    echo "" | qsreplace '"><img src=x onerror=prompt(1)>' | airixss -payload '<img src=x onerror=prompt(1)>' echo "" | bhedak '"><svg onload=confirm(1)>' | airixss -payload "confirm(1)"

This project is for educational and bug bounty porposes only! I do not support any illegal activities!.

If any error in the program, talk to me immediatly.


View Github