C16-xsser工具安装和使用

# 环境准备
注意：xsser与新版的kali存在兼容性问题，需要使用kali 2022.04来安装

kali 2022.04下载链接:
https://old.kali.org/kali-images/kali-2022.4/kali-linux-2022.4-vmware-amd64.7z

# 安装步骤
1. 启动kali虚拟机，将下方链接的文件下载到虚拟机中并解压
https://github.com/epsylon/xsser/archive/refs/heads/master.zip

![](/media/202504/2025-04-23_101053_4097750.663012081575535.png)

2. 进入上一步解压后的目录，在此目录中打开终端

![](/media/202504/2025-04-23_101220_6372320.09386186245253458.png)

3. 执行以下命令，更新apt仓库缓存

```
sudo apt-get update -o Acquire::AllowInsecureRepositories=true  -o Acquire::AllowDowngradeToInsecureRepositories=true -o APT::Get::AllowUnauthenticated=true
```

![](/media/202504/2025-04-23_101345_7346150.5625980540592588.png)

4. 执行以下命令，安装工具的依赖
```
sudo pip3 install -i http://mirrors.aliyun.com/pypi/simple/ --trusted-host=mirrors.aliyun.com pycurl bs4 pygeoip gobject cairocffi selenium
```
![](/media/202504/2025-04-23_101601_9980690.36533227330786466.png)

5. 执行以下命令，运行工具
```
./xsser -u "http://192.168.55.1/dvwa/vulnerabilities/" -g "xss_r/?name=XSS" --cookie="security=low; PHPSESSID=1bb5f3949c82fd1a20254fed0215a675" -s -v --reverse-check
```

**将上述命令中的url等参数替换成你自己的靶场url**

![](/media/202504/2025-04-23_102242_8526310.3620079466872085.png)