# t3l3machus/toxssin

An XSS exploitation command-line interface and payload generator.

Repository: https://github.com/t3l3machus/toxssin
Canonical: https://ross.abutalabs.com/products/toxssin
Language: Python
License: MIT
License Family: permissive
Topics: cross-site-scripting, exploitation, javascript, penetration-testing, pentesting-tools, python, web-penetration-testing, xss-exploitation, xss-vulnerability, hacking, xss
Last push: 2025-01-19T16:24:50+00:00

## Health v2 (maintenance only)
Score: 33/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 2, release rhythm 35, longevity 100
- inputs: {"age_days": 1578, "days_push": 591, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1440, forks 197 (observed 2026-08-28T04:04:44.217631+00:00)

## What it is
toxssin is an open-source penetration testing CLI tool that automates exploitation of Cross-Site Scripting (XSS) vulnerabilities. It pairs a Python HTTPS server with a vanilla JavaScript payload (toxin.js) that hooks browsers, intercepting cookies, keystrokes, form data, and server responses while maintaining XSS persistence across page navigation.

## Use cases
- exploit xss vulnerabilities during authorized pentests
- generate xss payloads that hook victim browsers
- capture cookies and keystrokes via cross-site scripting
- maintain xss persistence while a user browses a site
- run an xss-based phishing campaign against multiple targets
- execute custom javascript against hooked browser sessions
- intercept form submissions and server responses through xss

## When to choose
- you have authorization to test a web app for XSS flaws
- you need to demonstrate the full impact of an XSS vulnerability beyond an alert popup
- you want automated session management for stored XSS or phishing simulations
- you need a payload that survives navigation by rewriting documents client-side

## When to avoid
- you are looking for an XSS scanner or vulnerability detector rather than an exploitation tool
- testing systems without explicit permission - this is illegal
- you need a general-purpose web proxy like Burp Suite rather than XSS-specific exploitation
- you require a GUI-driven pentesting workflow

## Facets
- artifact type: cli-tool
- maturity: active
- function: penetration-testing, security, http-server, web-scraping
- domain: security, penetration-testing, web-development
- platform: windows, python, cli
- tags: xss, cross-site-scripting, exploitation, payload-generator, keylogger, session-hijacking, pentesting-tools, javascript-payload, linux, macos

## Member repositories
- t3l3machus/toxssin (main) score 33

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:44.217631+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:36:33.092940+00:00, confidence not recorded.
  - readme: https://github.com/t3l3machus/toxssin (fetched 2026-08-28T04:04:44.217631+00:00, sha e69b04c83e5e)
- Data as of 2026-08-30T08:39:29.467469+00:00.