# hahwul/XSpear

🔱 Powerfull XSS Scanning and Parameter analysis tool&gem

Repository: https://github.com/hahwul/XSpear
Canonical: https://ross.abutalabs.com/products/xspear
Language: Ruby
License: MIT
License Family: permissive
Topics: xss, hacking, bugbounty, pentest, scanner, tool, gem, ruby, library, scanning-xss, selenium, bugbountytips, webhacking
Archived: true
Last push: 2026-03-03T08:54:02+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 70, release rhythm 8, longevity 100
- inputs: {"age_days": 2609, "days_push": 183, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: archived
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1364, forks 239 (observed 2026-08-28T04:04:30.529171+00:00)

## What it is
XSpear is a Ruby-based XSS (cross-site scripting) scanner and parameter analysis tool distributed as a gem, usable both as a CLI and as a Ruby library. It performs pattern-matching and headless-browser (Selenium) detection of XSS payloads, filter bypass tests, blind XSS checks, and security header analysis. The repository has been archived and is no longer maintained; the author recommends Dalfox instead.

## Use cases
- scan a website for reflected XSS vulnerabilities
- find injectable parameters in web app URLs
- test for XSS filter bypass with event handlers and special chars
- detect alert/confirm/prompt execution via headless browser
- run blind XSS tests with XSS Hunter or ezXSS endpoints
- analyze security headers like CSP and HSTS
- scan requests exported from Burp Suite or ZAP raw files
- integrate XSS scanning into Ruby code or CI pipelines

## When to choose
- you need a Ruby-native XSS scanner usable as a gem library
- you want parameter analysis plus XSS testing in one CLI tool
- you need JSON or HTML scan reports for bug bounty triage
- you want to test blind XSS with callback URLs

## When to avoid
- you need an actively maintained tool - the repo is archived and read-only
- you want the fastest or most feature-rich XSS scanner - use Dalfox instead
- you are not comfortable installing Ruby gems and Selenium dependencies
- you need non-web vulnerability scanning

## Facets
- artifact type: cli-tool
- maturity: abandoned
- function: vulnerability-scanning, security, cli, penetration-testing
- domain: security, penetration-testing, web-development, developer-tools
- platform: cli, ruby, cross-platform
- tags: xss-scanner, bugbounty, pentest, selenium, headless-browser, blind-xss, ruby-gem, archived

## Member repositories
- hahwul/XSpear (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:30.529171+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:41:20.989265+00:00, confidence not recorded.
  - readme: https://github.com/hahwul/XSpear (fetched 2026-08-28T04:04:30.529171+00:00, sha 2e1f32f81411)
- Data as of 2026-08-30T08:39:29.467469+00:00.