How tx-c0re/xss-grenade works
XSS Grenade is a modular XSS scanner with a desktop interface. The principal workflow is target and scan configuration → endpoint discovery → context-aware probing and specialized analyses → real-browser verification → ranked findings and exported reports. The graph preserves documented detection branches, including static and runtime DOM XSS, stored XSS, and modern vulnerability audits. The README identifies the main engine and several modules; other subsystem links reflect documented capabilities, since their implementation was not sampled.
Main entry points: xss_grenade.py Scan engine · xss_grenade_gui.py Desktop GUI · _headless_crawler.py Endpoint crawler · _dom_v6.py Runtime DOM XSS
Components 22
User interface
- Desktop GUI
xss_grenade_gui.py
Scan workflow
- Scan engine
xss_grenade.py - Authentication
_auth.py - Endpoint crawler
_headless_crawler.py
Detection analysis
- Reflection context
context_engine.py - Payload synthesis
_breakout_synth.py - Reflected XSS
_html_analyzer.py - Runtime DOM XSS
_dom_v6.py - DOM exploit engine
_dom_exploit_engine.py - Static JS taint
_static_js_analyzer.py - Stored XSS
_stored_xss_tracker.py - Prototype pollution
_proto_pollution_analyzer.py - Mutation XSS
_mutation_xss.py - DOM clobbering
_dom_clobbering.py - Trusted Types audit
_trusted_types_analyzer.py - Library CVE audit
_library_cve_feed.py
Verification and results
- Browser verifier
_headless_verifier.py - Finding ranking
_finding_scorer.py - Finding store
_finding_store.py - Report exporters
_html_report.py
Other components
- Security tester
- Target application
Connections 24
- Security tester → Desktop GUI: configures scan
- Desktop GUI → Scan engine: starts scan
- Scan engine → Authentication: uses cookies
- Scan engine → Endpoint crawler: discovers endpoints
- Endpoint crawler → Target application: crawls pages
- Scan engine → Target application: sends probes
- Scan engine → Reflection context: classifies reflections
- Scan engine → Payload synthesis: synthesizes payloads
- Scan engine → Reflected XSS: checks reflections
- Scan engine → Runtime DOM XSS: checks runtime DOM
- Runtime DOM XSS → DOM exploit engine: tests source-sink paths
- Scan engine → Static JS taint: analyzes scripts
- Scan engine → Stored XSS: checks round trips
- Scan engine → Prototype pollution: audits gadget chains
- Scan engine → Mutation XSS: checks mutation XSS
- Scan engine → DOM clobbering: checks clobbering
- Scan engine → Trusted Types audit: audits policy
- Scan engine → Library CVE audit: checks library versions
- Scan engine → Browser verifier: verifies candidates
- Browser verifier → Target application: loads test pages
- Scan engine → Finding ranking: ranks findings
- Scan engine → Finding store: records findings
- Scan engine → Report exporters: exports reports
- Report exporters → Security tester: delivers results