evilcos/xssor2

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

2224 stars · 381 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

XSS'OR is a self-hostable web application for penetration testers that provides XSS/CSRF payload generation, encoding/decoding utilities, and a JavaScript-based browser probe. It is built with Python/Django and JavaScript, and can be deployed via Docker or uWSGI/Nginx.

Use cases

• generate xss payloads for penetration testing
• encode and decode javascript payloads
• probe a victim browser after an xss injection
• craft csrf attack payloads
• self-host a pentest toolkit for web vulnerabilities
• unpack and beautify obfuscated javascript

When to choose

• you are a pentester or security researcher testing xss/csrf vulnerabilities
• you need a self-hosted toolkit for payload encoding and browser probing
• you want a dockerized security testing tool you control

When to avoid

• you need a general-purpose web vulnerability scanner
• you want an actively developed tool with recent updates
• you are looking for a defensive security or WAF solution

Facets

application · maturity maintenance

security penetration-testing web-framework http-server serialization security penetration-testing web-development developer-tools self-hosted python browser xss csrf pentest hacking-tool payload-generation encoding-decoding browser-probe javascript web-server docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="evilcos/xssor2")