What is XSS Hunter?
XSS Hunter allows you to find all kinds of cross-site scripting vulnerabilities, including the often-missed blind XSS. The service works by hosting specialized XSS probes that scan the page and send information about the vulnerable page to the XSS Hunter service upon firing.
XSS Hunter is FREE and very good at earning some bounties.
How to use XSS Hunter?
You can use XSS hunter by opening their website, click on the Sign Up page. Enter all the details such as
Full Name
Username (Unique)
Password
Email( Here you will get the reports emailed to you)
Custom Domain(Unique)
Now. Click on the Sign Up button and you are now ready to go.
What to do NEXT?
Now click on the XSS Hunter page and here you will see 4 Tabs
XSS Fires
Collected Pages
Payloads(Contains all the payloads)
Settings
Now, copy the payload from the Payload Tab and paste it in any input field of Target such as Contact Forms, Feedback forms etc.
When the XSS will fire on the Target, you will get a mail report from XSS Hunter. Use that to file to report to Target. You can even see the XSS fired on the XSS fires tab on the XSS Hunter website.
The best use case of XSS Hunter is for BLIND XSS vulnerabilities.
What is BLIND XSS?
Blind XSS vulnerabilities are a type of persistent XSS vulnerabilities. It occurs when the attacker input is saved by the web server and executed in another part of the application or another application. For example, an attacker injects a malicious payload into a feedback page and when the administrator is reviewing the feedback entries, the attacker’s payload will be loaded.
How to check if XSS Hunter is properly Set Up?
It is very important to verify that XSS Hunter is working properly before starting on Target. For this, make an HTML File(.html) and copy the XSS payloads from the Payloads Tab. Open the file in the browser and immediately you will see an XSS fired e-mail and in the XSS tab of XSS Hunter. This means, it's working fine.
Other Researchers writeups
These writeups will give you a complete idea of XSS Hunter and motivate you. Check them out:
One last thing:
When you get a good bounty using XSS Hunter, try to donate some part to the creator of XSS Hunter.
Good Luck.
