Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to find any recommended tools for XSS security testing using OSX. I tried using the latest OWASP Xenotix XSS Exploit Framework 4, although when used via CrossOver it crashes upon trying to use the Scanner :/

share|improve this question

closed as off-topic by Xander, Scott Pack, TildalWave, Terry Chia, this.josh Sep 9 at 17:59

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

1  
Why not try to use the right tool for the job instead of trying to fit the problem to your tools ? –  Stephane Aug 21 '13 at 6:53
1  
what about Burp Suite..or Owasp ZAP? both works on OSX –  Marius Aug 21 '13 at 7:27
    
@Marius, thanks - i'll check them both out. –  dufus Aug 21 '13 at 11:30
    
A tool is not the solution. If XSS is problem for your app, then you have a software development problem and its likely you have other more serious security issues affecting your application. –  Rook Aug 21 '13 at 21:54

1 Answer 1

up vote 2 down vote accepted

In order to test only for Cross-Site Scripting, your best bet is to find a good intercepting proxy that will allow both manual and automatic tests. Burp Suite is a perfect example and can be executed on OS X, but keep in mind that the free version is pretty slow when using the Intruder for automated attacks.

The reason to perform also manual tests is that you'll need to check exactly how and where the payloads are placed inside the response, something an automatic scanner can't do.

To complete your toolbox for XSS testing, get a good cheat sheet and you should be able to succesfully assess your application. Keep in mind that XSS research is ever-expanding and you'll probably want to keep up to date with the latest discoveries (eg. sla.ckers.org has a section specific for XSS).

share|improve this answer
    
cool, that's very good information i didn't have before — i'll report back in a day - thanks! :) –  dufus Aug 21 '13 at 11:27
    
the burp suite is very limited as you say, it's too bad xenotix doesn't run under osx. oh, well - thanks for the suggestions :) –  dufus Aug 24 '13 at 12:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.