Usage

1. Record request(s) with Burp proxy
2. Select request(s) you want to generate, then right click and select “Save items”
3. Use xssless to generate your payload: ./xssless.py burp_export_file
4. Pwn!

Features

• Automated XSS payload generation from imported Burp proxy requests
• Payloads are 100% asynchronous and won’t freeze the user’s browser
• Payloads are optimized, but should be minimized by a third party tool
• CSRF tokens can be easily extracted and set via the -p option
• POST multipart is supported, along with XSS file uploading via the -f option
• Payloads are dynamic and portable (due to relative URLs)
• Self propagation is now supported – meaning you can set a POST value to the payload itself!
• Crazy JavaScript worms with no hassle!

Installation

Download the latest xssless:

git clone https://github.com/mandatoryprogrammer/xssless

Run the script:
./xssless.py -h

Download and read more at