I am using xsser for XSS vulnerability testing and I have a doubt about the parameters when it's a POST method. I have tried against DVWA (which uses get) with success like this:

xsser -u "http://server.com/vulnerabilities/" -g "xss_r/?name=" --cookie="PHPSESSID=vjs31bec4gfvob6bcjmau2a644; security=low" -s

Now, against a web that uses post in the url and a form I have tried this without success, it seem malformer url, this is the url: http://server.com/post.php?id=1

xsser -u "http://server.com/post.php?id=1" -p "title=1234&author=12r&text=++++++++12r&submit=Enviar+consulta" -s

xsser -u "http://server.com/post.php?id=1" -p "?title=1234&author=12r&text=++++++++12r&submit=Enviar+consulta" -s

xsser -u "http://server.com/" -p "post.php?title=1234&author=12r&text=++++++++12r&submit=Enviar+consulta" -s

None of this have working, any idea¿? By the way, I got the values of the post with Live HTTP Headers in firefox. Thank you in advance

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.