ezXSS is a self-hostable PHP tool for penetration testers and bug bounty hunters who need to find and prove (blind) Cross Site Scripting vulnerabilities.

What it is

ezXSS is an easy way to test and exploit cross-site scripting, with a particular focus on blind XSS, where a payload is planted somewhere and the tester has to wait for it to fire on a victim. Once a payload is triggered, the tool stores everything it can read off the vulnerable page and alerts the user, turning an anonymous hit into a structured report that can be reviewed, searched and shared from a dashboard. It lives in the PHP web-application ecosystem and replaces the ad-hoc combination of a raw callback endpoint, hand-written payload scripts and a spreadsheet of hits that testers otherwise assemble by hand.

The concrete problem it solves is that blind XSS is hard to find with traditional scanning: there is no immediate response, and when the payload does execute you need to capture the context around it. ezXSS handles the waiting, then collects the page URL, IP address, referer, User-Agent, all non-HTTP-Only cookies, local storage, session storage, the full HTML DOM source, page origin, time of execution, payload URL, a screenshot of the page, and any extra custom fields defined through extensions or custom JavaScript. Payloads can be updated after insertion to make the XSS persistent, which lets you track the infected user across all visited pages and open a reverse proxy while the browser stays active.

Key capabilities

• Collects the full report context of a triggered payload, including the full HTML DOM source, a screenshot of the page, non-HTTP-Only cookies, local storage, session storage, page origin and time of execution.
• Keeps a persistent XSS session with a reverse proxy for as long as the browser remains active, so a single trigger continues to yield data.
• Sends instant alerts by mail, Telegram, Slack, Discord or a custom callback URL.
• Offers an easy dashboard with settings, statistics, payloads, and views for viewing, sharing and searching reports.
• Supports custom extra JavaScript payloads and custom payload links used to distinguish insert points.
• Extracts additional paths via an automatic recursive spider, and applies block, whitelist and other filters.
• Ships an extension mechanism (ezXSS-extensions) that can add or edit payload functions, plus two-factor (2FA) login protection and unlimited users with permissions over their personal payloads and reports.

Who uses it and how

• Penetration testers who plant an ezXSS payload in an application and wait for it to be triggered, then review the resulting report for tracking and further identification of sensitive data.
• Bug bounty hunters working blind XSS vectors where traditional methods give no immediate feedback.
• Red teams that turn a single trigger into persistent XSS sessions to track an infected user across visited pages and proxy their traffic.
• Multi-user teams, since the tool manages unlimited users with permissions scoped to their own payloads and reports.
• Users who prefer not to run their own instance: a free account on ezxss.com works without a domain name or web server.

Getting started

ezXSS installs on Apache, NGINX or Docker with step-by-step instructions in the project wiki, and requires a server or shared web hosting running PHP 7.1 or up, a domain name, and an SSL certificate for testing against HTTPS websites.

How it compares

The tool has no paid products listed that it replaces, and the facts name no comparable tools directly; it stands alone in this registry.

When to use it — and when not to

You must operate the web application yourself on PHP hosting, together with a domain name and an SSL certificate, and you are responsible for securing the login (2FA is available but optional). It is aimed at offensive security work, so it is the wrong choice for anyone who just needs a defensive scanner or does not have somewhere to host payloads that victims will reach. The maintained facts are otherwise favourable: the licence is MIT, the last push is recent, and only five issues are open.