X9
Table of Contents
🧪 x9 — Passive XSS Discovery Tool
x9 is a powerful tool for discovering potential Cross-Site Scripting (XSS) vulnerabilities from passive URL sources.
Focused on automation, filtering, and alerting — built for bug bounty hunters and researchers who want to catch XSS with minimal false positives.
🔍 What It Does
- 🕸 Collects passive URLs from:
- Waybackurls
- GAU (GetAllURLs)
- Katana (optional)
- 🔎 Filters and extracts only relevant URLs
- 🧼 Removes noise like static assets and non-parameterized links
- 🧬 Optionally discovers hidden parameters with
fallparams - 🧨 Injects payloads into filtered URLs
- 📢 Sends alerts on detection (via Discord Webhook)
- 📄 Outputs can be saved, piped to Nuclei, or used in CI flows
🧰 Components
| File | Role |
|---|---|
x9_passive.py |
Gathers passive URLs and filters out noise |
x9_fuzz.py |
Splits and prepares URLs for fuzzing |
x9.py |
Main XSS payload injector |
x9_run.py |
Orchestrates passive + fuzz + detection + alerting |
⚙️ Installation
git clone https://github.com/electro0nes/x9.git
cd x9
pip install -r requirements.txt