Home

Home

ezXSS 5.0 is a self-hosted platform for finding and documenting (blind) Cross-Site Scripting during authorized security work. You host it on your own domain, build a small JavaScript payload in the dashboard, and place it wherever an app might store or reflect untrusted input. When it runs in a browser it collects data about the page, sends it back as a report, and alerts you.

Blind XSS, briefly

Reflected and stored XSS fire in a browser you can watch. Blind XSS fires later, somewhere you cannot see: you submit a payload into a field (a "company name", a support ticket, an HTTP header), and it only runs when some other browser renders that value without escaping it, such as an internal admin tool opened by staff. Since you are never there to see it, the payload has to call home. The moment it runs, ezXSS reports back the URL, the time, and the context of the page, so you can confirm the finding and measure its impact.

What you get

• Payload builder - pick an injection type (<script>, image onerror, SVG, and more), toggle the options you want, and copy the exact snippet. See Payloads.
• Reports - every fired payload stored with the page data in readable form, including the full DOM and an optional screenshot. See Reports.
• Live sessions and console - keep an XSS persistent while the tab is open, follow the affected user across pages, run a live JS console, and open a reverse proxy. See Sessions and persistent mode.
• Alerts - get notified the instant a payload fires over email, Telegram, Slack, Discord, or a custom callback. See Alerts.
• Users and permissions - multiple accounts scoped by role, with optional per-user overrides and two-factor login. See Users and permissions.
• Extensions - add or change payload functions without touching the core. See Extensions and the community ezXSS-extensions.
• CSP-bypass beacons - when a CSP blocks the callback, beacons across resource channels recover partial data and reveal which directives the target allows. See Payloads.
• JSON API - every dashboard action maps to an endpoint under /api, so ezXSS is easy to script. See API.

New here?

• First install? Start with Installation. You need PHP 7.1+ with PDO MySQL, a MySQL/MariaDB database, a domain, and an SSL certificate for https targets. No Composer, no build step.
• Coming from 4.x? See Upgrading from 4.x.
• Want to try it first? Create a free account at ezxss.com with no server of your own.

Ethical use

ezXSS is for authorized testing, research, and red-team work only. Only deploy payloads against applications you own or have explicit, written permission to test. Testing systems without authorization is illegal in most jurisdictions and can expose real people's data. A blind-XSS payload runs in the browser of whoever opens the affected page, so treat anything it collects as sensitive: store only what you need and delete it when testing is done. You are responsible for how you use this tool.