Search the Community

Features Easy to use dashboard with settings, statistics, payloads, view/share/search reports Unlimited users with permissions to personal payloads & their reports Instant alerts via mail, Telegram, Slack, Discord or custom callback URL Custom javascript payloads Custom payload links to distinguish insert points Extract additional pages, block, whitelist and other filters Secure your login with Two-factor (2FA) The following information can be collected on a vulnerable page: The URL of the page IP Address Any page referer (or share referer) The User-Agent All Non-HTTP-Only Cookies All Locale Storage All Session Storage Full HTML DOM source of the page Page origin Time of execution Payload URL Screenshot of the page Extract additional defined pages much much more, and, its just ez 🙂 Required Server or hosting with PHP 7.1 or up Domain name (consider a short one) SSL Certificate to test on https websites (consider Cloudflare or Let's Encrypt for a free SSL) ezXSS v4.0 Latest I am excited to announce the release of ezXSS v4.0, a major update to the XSS tool. This version includes at least the following new features and improvements: Completely re-coded, resulting in clean, readable code that is easy to understand and maintain Multi-user setup that allows for roles and payload separation Alerts via Slack and Discord in addition to existing support for email and Telegram Redesigned pages and fixed styling bugs More statistics on the dashboards Improved reports view and search Ability to render collected DOM pages Lots of smaller bug fixes and much much more amazing things! It is highly recommended to update to ezXSS v4.0, as version 3.x will no longer be supported due to its old codebase. If you are currently running an older version of ezXSS, please make sure to first update to version >3.10 before upgrading to v4.0. Also, after updating, the default username will be "admin". Thank you for your continued support and I hope you enjoy using the new and improved ezXSS v4.0! [hide][Hidden Content]]

DNS Reaper is yet another subdomain takeover tool, but with an emphasis on accuracy, speed, and the number of signatures in our arsenal! We can scan around 50 subdomains per second, testing each one with over 50 takeover signatures. This means most organisations can scan their entire DNS estate in less than 10 seconds. [hide][Hidden Content]]

DNS Reaper is yet another subdomain takeover tool, but with an emphasis on accuracy, speed, and the number of signatures in our arsenal! We can scan around 50 subdomains per second, testing each one with over 50 takeover signatures. This means most organisations can scan their entire DNS estate in less than 10 seconds. You can use DNS Reaper as an attacker or bug hunter! You can run it by providing a list of domains in a file, or a single domain on the command line. DNS Reaper will then scan the domains with all of its signatures, producing a CSV file. You can use DNS Reaper as a defender! You can run it by letting it fetch your DNS records for you! Yes, that’s right, you can run it with credentials and test all your domain configs quickly and easily. DNS Reaper will connect to the DNS provider and fetch all your records, and then test them. We currently support AWS Route53, Cloudflare, and Azure. Documentation on adding your own provider can be found here You can use DNS Reaper as a DevSecOps Pro! Punk Security is a DevSecOps company, and DNS Reaper has its roots in modern security best practices. You can run DNS Reaper in a pipeline, feeding it a list of domains that you intend to provision, and it will exit Non-Zero if it detects a takeover is possible. You can prevent takeovers before they are even possible! Changelog v1.6.1 enhancement: Handle AWS provider API errors gracefully by @imnotbrandon in #119 fix: explicitly close pool #118 by @SimonGurney in #121 [hide][Hidden Content]]

DNS Reaper is yet another sub-domain takeover tool, but with an emphasis on accuracy, speed and the number of signatures in our arsenal! We can scan around 50 subdomains per second, testing each one with over 50 takeover signatures. This means most organisations can scan their entire DNS estate in less than 10 seconds. [hide][Hidden Content]]