Alerts

Alerts

Alerts tell you the moment a payload fires and a new report lands, so you don't have to watch the panel. ezXSS can notify you over mail, Telegram, Slack, Discord, or a raw JSON callback.

Only point payloads at applications you own or have explicit written permission to test.

How it works

Every channel needs two switches on to fire, which is the usual source of confusion:

1. The channel's master switch - platform-wide and admin-controlled. If mail (or Telegram, Slack, Discord) is off here, nobody gets that alert, whatever they configured.
2. A destination row for that channel, enabled and filled in. A mail row, for example, needs both its enable switch on and an email address entered.

There are two places destinations live:

• Global destinations are set by an admin under Settings - Alerts and fire for every report.
• Your own destinations live on the Account screen and fire only for reports from payloads you own.

When a report comes in, ezXSS notifies every enabled global destination plus the owning user's own destinations. A report with no clear owner (a catch-all fire) reaches only the global ones. To change who gets alerted for a payload, change its owner or share it (see Payloads).

Fields auto-save as you change them; there is no separate Save button.

Channels

Mail

Sends an HTML email per report, subject [ezXSS] XSS on <uri>, with any screenshot embedded inline.

1. (Admin) Turn on the Mail master switch.
2. Enter a destination email and enable its row, either globally or on your Account screen.

Mail goes through PHP mail() by default, but that is often unreliable (many hosts block it, and it gets filtered as spam). The Mail row has a transport selector - switch it to SMTP server to use a real server (see SMTP below), which is recommended.

Telegram

Sent through a bot you create; a screenshot arrives as a separate photo. You need a bot token and a chat id.

1. In Telegram, message @BotFather, create a bot, and copy the token (like 123456789:AAExampleTokenString).
2. Send your new bot any message (e.g. /start) so it has a chat to reply to.
3. (Admin) Turn on the Telegram master switch.
4. Paste the token into a Telegram destination row.
5. Click the Get chat ID arrow next to the token - ezXSS fills the chat id in for you. (A negative number is normal for groups.)
6. Enable the row.

Slack

Posts to an incoming webhook.

1. In Slack, create an incoming webhook for your channel. It looks like https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXX.
2. (Admin) Turn on the Slack master switch.
3. Paste the webhook URL into a Slack row and enable it.

Discord

Posts to a channel webhook as a rich embed, with a screenshot attached when present.

1. In Discord, open channel settings - Integrations - Webhooks - New Webhook and copy the URL.
2. (Admin) Turn on the Discord master switch.
3. Paste the webhook URL into a Discord row and enable it.

Report callback

Instead of a formatted message, ezXSS POSTs the entire report as JSON to a URL you pick - handy for piping reports into your own tooling, a SIEM, or a ticketing system.

• It is global only (admin-managed) and applies to every report.
• The screenshot blob is stripped to keep the request small; the report still references it the usual way.
• Redirects are not followed and it times out after 20 seconds. A URL with no scheme gets https://.

Enable it under Settings - Alerts - Global destinations. A minimal receiver:

<?php
$report = json_decode(file_get_contents('php://input'), true);
file_put_contents('reports.log', json_encode($report) . "\n", FILE_APPEND);
http_response_code(200);

The callback is not covered by the test button - trigger a real report to test it, for example by pointing a payload at a safe test page.

What an alert contains

Each message carries the key facts - report id, the URL it fired on, IP, referer, user-agent, cookies, origin, timestamp - plus a link back to the full report. Body values are truncated to keep notifications compact, so open the report for the complete capture, screenshot, and extra data.

Page DOM can be huge, so alerts include only a slice of it. Set how many characters under Settings - Alerts - Alert content (0 leaves DOM out entirely).

SMTP (for Mail)

Switching the Mail transport to SMTP server opens a settings modal:

• Host / Port - e.g. smtp.example.com, default port 587.
• Security - STARTTLS (587), SSL/TLS (465), or None.
• Username / Password - leave the username blank for an unauthenticated relay; leave the password blank to keep the current one.
• From address - the From on outgoing mail.

If an SMTP send fails, ezXSS falls back to mail() so the alert still has a chance to go out. With no host set, SMTP is treated as off.

Sending a test alert

The Send test alert button on the Account screen sends a sample report to your own enabled destinations, honouring the master switches. It does not touch global destinations or the Report callback. The response tells you which channels it tried; with nothing enabled you get "No enabled destinations to test."

Good to know

• Spidered sub-pages do not alert. A payload's extra-pages and spider collection submit each sub-page as its own report (see Reports), but only the original fire alerts - so a running spider never floods your channels.
• Duplicates may be suppressed. Depending on the instance duplicate-detection mode, a repeated hit from the same page can be saved without alerting you. See Reports and Configuration.