t3l3machus/toxssin

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1440 stars · 197 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

toxssin is an open-source penetration testing CLI tool that automates exploitation of Cross-Site Scripting (XSS) vulnerabilities. It pairs a Python HTTPS server with a vanilla JavaScript payload (toxin.js) that hooks browsers, intercepting cookies, keystrokes, form data, and server responses while maintaining XSS persistence across page navigation.

Use cases

• exploit xss vulnerabilities during authorized pentests
• generate xss payloads that hook victim browsers
• capture cookies and keystrokes via cross-site scripting
• maintain xss persistence while a user browses a site
• run an xss-based phishing campaign against multiple targets
• execute custom javascript against hooked browser sessions
• intercept form submissions and server responses through xss

When to choose

• you have authorization to test a web app for XSS flaws
• you need to demonstrate the full impact of an XSS vulnerability beyond an alert popup
• you want automated session management for stored XSS or phishing simulations
• you need a payload that survives navigation by rewriting documents client-side

When to avoid

• you are looking for an XSS scanner or vulnerability detector rather than an exploitation tool
• testing systems without explicit permission - this is illegal
• you need a general-purpose web proxy like Burp Suite rather than XSS-specific exploitation
• you require a GUI-driven pentesting workflow

Facets

cli-tool · maturity active

penetration-testing security http-server web-scraping security penetration-testing web-development windows python cli xss cross-site-scripting exploitation payload-generator keylogger session-hijacking pentesting-tools javascript-payload linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="t3l3machus/toxssin")