Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to find any recommended tools for XSS security testing using OSX. I tried using the latest OWASP Xenotix XSS Exploit Framework 4, although when used via CrossOver it crashes upon trying to use the Scanner :/

share|improve this question
1  
Why not try to use the right tool for the job instead of trying to fit the problem to your tools ? –  Stephane Aug 21 '13 at 6:53
1  
what about Burp Suite..or Owasp ZAP? both works on OSX –  Marius Aug 21 '13 at 7:27
    
@Marius, thanks - i'll check them both out. –  dufus Aug 21 '13 at 11:30
    
A tool is not the solution. If XSS is problem for your app, then you have a software development problem and its likely you have other more serious security issues affecting your application. –  Rook Aug 21 '13 at 21:54
add comment

1 Answer

up vote 2 down vote accepted

In order to test only for Cross-Site Scripting, your best bet is to find a good intercepting proxy that will allow both manual and automatic tests. Burp Suite is a perfect example and can be executed on OS X, but keep in mind that the free version is pretty slow when using the Intruder for automated attacks.

The reason to perform also manual tests is that you'll need to check exactly how and where the payloads are placed inside the response, something an automatic scanner can't do.

To complete your toolbox for XSS testing, get a good cheat sheet and you should be able to succesfully assess your application. Keep in mind that XSS research is ever-expanding and you'll probably want to keep up to date with the latest discoveries (eg. sla.ckers.org has a section specific for XSS).

share|improve this answer
    
cool, that's very good information i didn't have before — i'll report back in a day - thanks! :) –  dufus Aug 21 '13 at 11:27
    
the burp suite is very limited as you say, it's too bad xenotix doesn't run under osx. oh, well - thanks for the suggestions :) –  dufus Aug 24 '13 at 12:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.