FinDOM-XSS – Find potential DOM based XSS vulnerability



$ git clone
$ cd findom-xss/
$ git submodule update

Dependencies: LinkFinder


To run the tool on a target, just use the following command.

$ ./ https://domain.tld/about-us.html

This will run the tool against domain.tld.

URLs can also be piped to findom-xss and scan on them. For example:

$ cat urls.txt | ./

The second argument can be used to specify an output file.

$ ./ https://domain.tld/about-us.html /path/to/output.txt

By default, output will be stored in the results/ directory in the repository with domain.tld.txt name.


FinDOM-XSS is licensed under the Apache. Take a look at the LICENSE for more information.


Please follow and like us: