Wingman

Your personal XSS Wingman

[Wingman @xsswingman]

Introducing: Wingman

Wingman is an XSS scanner designed for bug bounty hunters, infosec professionals, and hobbyists.

Read more:
https://t.co/Prf9CpHjQj

[Volerion @VolerionSec]

Launching today!

Volerion transforms raw CVEs into structured and instant insights

#CVE #CyberSecurity #infosec

[Wingman @xsswingman]

@mayank98108 The errors are generated by the Google Chrome driver, but don't cause any functional issues. Unfortunately, for now, the only way to get rid of them is to manually redirect them to /dev/null (or "nul" on windows it looks like):

https://t.co/ozXTdPPNRx

[Wingman @xsswingman]

@KN0X55 @rub003 @IamRenganathan Yes, a single request works 99% of the time. There are indeed some applications that will reject them. (Un)fortunately, those endpoints will be unexploitable since any characters you might need to create a valid payload are blocked anyway.

[Wingman @xsswingman]

@KN0X55 @rub003 @IamRenganathan I meant to say uncommon lol, autocorrect can be a pain sometimes 😆

[Wingman @xsswingman]

@KN0X55 @rub003 @IamRenganathan Using a browser to verify is fair, but not actually necessary if the underlying logic is solid. Wingman can determine whether something is vulnerable or not in a single request. In my case, false positives are very common and can usually be traced back to some kind of bug.🙂

[Wingman @xsswingman]

@KN0X55 @rub003 @IamRenganathan Dalfox is the only other scanner I can think of that relies on context awareness, I wouldn't call it common.

[Wingman @xsswingman]

@KN0X55 @rub003 @IamRenganathan You can find an example here of what it means to be context-aware: https://t.co/hz23wFWCxS

[Wingman @xsswingman]

@shadow00hunter1 @ofjaaah You're welcome! Mainly because HTTP or HTTPS might not serve the same webpage, happens more often than you'd think. I'd say it's better this way since what you give is always what you get.

[Wingman @xsswingman]

@shadow00hunter1 @ofjaaah Hi, it actually means it finished crawling. You can try running with verbose mode enabled (-v) to unsilence HTTP errors if you think something is wrong.

[Wingman @xsswingman]

@Blue_CanaryBE Hey, sorry for the delayed response. Not yet! I hope to get to it this week.

[Wingman @xsswingman]

@Blue_CanaryBE Noted, thanks! There should definitely be a flag to mute the sink logger, since there isn't one right now. However, even though it's not ideal, you can still filter the output with jq

[Wingman @xsswingman]

@theXSSrat @knoxss_me @sam25889936 Unless I misunderstood and you were referring to the automatic popup, which it doesn't do.

[Wingman @xsswingman]

@theXSSrat @knoxss_me @sam25889936 To be fair Wingman can do exactly that (and more). If you watch the video completely you'll see that it hooks into your Chrome browser rather than relying on an extension:

https://t.co/htiagfpaUb

[Wingman @xsswingman]

@scocco_s Hi, you can activate each license twice. It's possible to remove them if necessary but only by contacting us directly.

[Wingman @xsswingman]

@pxng0lin No worries! The confusion is understandable. Unfortunately, there are no notifications for upcoming payments as of now :(

[Wingman @xsswingman]

@Offxec Appreciate the kind words! Sure, tag as much as you like. Love seeing these extra projects! 😄

[Wingman @xsswingman]

@Alibay21546799 @MR_iambatman @ofjaaah Yes it is. There's a header (-h) flag that allows you to send headers (including cookies).

[Wingman @xsswingman]

@Offxec Nice! Cool script 🙂