1

I'm aware that there are various tools for testing for XSS vulnerabilities. However, all the ones that I'm aware of (Vega, possibly BeEF, etc.) operate purely client-side. When testing for stored XSS vulnerabilities specifically, it seems that it would also be useful to directly modified the stored data on the server. For instance, even if input filtering normally protects against stored XSS, SQL injection might still be a way to introduce malicious HTML into the page output (albeit in a roundabout manner).

Are there any tools that are capable of directly modifying database records (or similar server content), in order to test for potential stored XSS vulnerabilities?

For instance, using a legitimate SQL connection (and/or SQL injection) to automatically insert malicious data in the DB, and then using a web crawler to see if that malicious data is properly escaped when/if it gets rendered to the webpage.

If not, is there a particular reason why it's not done, or is it just that nobody has gotten around to it yet?

I'm not necessarily looking for the "best" tool, I just want to know if any exist before I start writing my own.

closed as off-topic by TildalWave, Mark Buffalo, Xander, Neil Smithline, tim Mar 20 '16 at 13:53

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • Your list of tools indicates that you might need to expand your scope of vulnerability scanners. Try this list that ranks them by effectiveness to see if something there meets your specifications: sectoolmarket.com/… – schroeder Jul 23 '15 at 15:09
  • Yeah, I do need to expand my scope of vulnerability scanners. I've installed a Kali VM, but the list of tools is rather large; I'll likely hop on their IRC channel at some point, as another source of knowledge. – Ethan Kaminski Jul 23 '15 at 22:45
  • That's a useful list for overview purposes, thanks @schroeder. It looks like Vega doesn't support persistent XSS at all. Open source scanners that do (according to that list) include OWASP ZAP, SkipFish, and IronWASP. IronWASP's SessionPlugins seem particularly interesting - it's not quite what I'm after, but it might be something that I can use as a starting point. – Ethan Kaminski Jul 23 '15 at 22:51
  • I've not heard of such a tool. The idea sounds interesting; I'd be interested to hear how you get on. By the way, static analysis tools (like FindBugs) can find stored XSS effectively. – paj28 Aug 22 '15 at 15:07