>_ osk xss

Generate context-aware XSS payloads with WAF bypass variants and filter evasion from your terminal.

Part of OffSecKit | Browser version | Unified CLI

Install

This tool is part of the OffSecKit CLI toolkit:

pip install offseckit

Usage

# Generate XSS payloads for HTML body context
osk xss gen

# Generate payloads for double-quoted attribute injection
osk xss gen -c attr-double

# Cookie theft payloads with Cloudflare WAF bypass
osk xss gen -c html -a cookie --waf cloudflare

# URL-encoded payloads for JS string context
osk xss gen -c js-single -e url

# Filter out blocked characters
osk xss gen -c html --blocked "<>\"\'"

# Show polyglot payloads
osk xss polyglots

# List all injection contexts, encodings, and WAF profiles
osk xss contexts
osk xss encodings
osk xss wafs

Options

Flag	Description	Default
-c, --context	Injection context (html, attr-double, attr-single, attr-unquoted, js-single, js-double, js-template, url, event)	html
-a, --action	Payload action (alert, console, cookie, redirect, fetch)	alert
--custom-js	Custom JavaScript to execute	--
-e, --encoding	Encoding method (none, url, double-url, html-entities, hex, unicode, fromcharcode, base64)	none
--waf	WAF bypass profile (cloudflare, aws-waf, akamai, modsecurity)	--
--blocked	Characters to filter out of results	--

Injection Contexts

Context	Description
html	HTML body — direct tag injection
attr-double	Inside double-quoted attribute
attr-single	Inside single-quoted attribute
attr-unquoted	Inside unquoted attribute value
js-single	Inside JS single-quoted string
js-double	Inside JS double-quoted string
js-template	Inside JS template literal
url	Inside URL/href attribute
event	Inside inline event handler

Related

• OffSecKit CLI — full toolkit (pip install offseckit)
• Browser version — use in your browser
• XSS Cheat Sheet — full guide

License

MIT