🗡️ XSSion - Fastest Reflected XSS Finder

XSSion is a fast, transparent Reflected XSS scanning tool designed for bug bounty hunters and penetration testers.
It shows every payload being tested in real time and clearly highlights reflections in the response.

🧠 Description

• ⚡ Quickly finds reflected XSS vectors
• 🎯 Shows live testing in terminal
• 🔍 Automatically detects parameters (even blank ones like ?param=)
• 📌 Saves results to XSSion.txt
• 🐍 Written in Python 3
• 💥 Beginner friendly and bug bounty ready

🛠️ Installation

Clone the repository:

git clone https://github.com/alhamrizvi-cloud/XSSion.git
cd XSSion

Install dependencies:

pip3 install -r requirements.txt

📦 Make XSSion a Global Command

To run xssion from anywhere:

1. Add the shebang at the top if not present:

   #!/usr/bin/env python3

2. Give execute permissions:

   chmod +x xssion.py

3. Move to a directory in your PATH:

   sudo mv xssion.py /usr/local/bin/xssion

Now you can run:

xssion <URL> <xss_all_payloads.txt>
or
xssion <URL> xss_all_payloads.txt

🚀 Usage

Basic

python3 xssion.py "<URL>?param=" xss_all_payloads.txt

Example:

xssion \
"https://www.bmw.de/de/shop/ls/cp/physical-goods/de-BF_ACCESSORY?tl=" \
xss_payloads.txt

📂 Example Payloads File

xss_payloads.txt:

"><svg/onload=alert(1)>
<script>alert(1)</script>
"><img src=x onerror=alert(1)>

📥 Output

Reflected payloads are saved to:

XSSion.txt

Example:

[XSS] https://target.com/search?q=<script>alert(1)</script> | <script>alert(1)</script>

📋 Features

• 🧪 Automatic parameter detection
• 🟡 Shows each payload tested
• 🔴 Highlights reflected ones
• 📊 Results logged to file

📈 Recommended Bug Bounty Workflow

gau / katana
   ↓
paramspider / arjun
   ↓
filter URLs with params
   ↓
XSSion
   ↓
If Reflected = manual verification

⚠️ Notes

• XSSion finds reflections, try manual testing too if the parameter is vulnerable
• Some sites sanitize input or use client-side encoding
• Works best during early recon

🧪 Tested With

• Python 3.6+
• Linux & macOS

👨‍💻 Author

Alham Rizvii — Bug Bounty Hunter & Cybersecurity Enthusiast Contributors are allowed

📜 License

This project is licensed under the MIT License. See the LICENSE file for details.

....