BUG BOUNTY: XSS AUTOMATION WITH A NEW TOOL! | 2023

APOLOGIES FOR THE POOR AUDIO QUALITY AS THERE'S CONSTRUCTION GOING ON AT MY HOME!
Note: This video is only for educational purpose.
Hi everyone! This video demonstrates the process of xss automation using xss_vibes
Tool Link: github.com/fai...
Website: bepractical.tech
Telegram: telegram.me/be...
Previous Video: • BUG BOUNTY: ANDROID AP...
Hacking Windows with Python from Scratch: www.udemy.com/...
The Ultimate Guide to Hunt Account Takeover:
www.udemy.com/...

[@gj9585]

please make a video on how to install katana in windows

[@jaman_pentester]

Nice tools. 🎉

[@amoh96]

i see your videos alot about automation can u make methdology video about how to manuel testing & tips , tbh i found 4 xss in vdp 2 dublecate with automation & 2 valid with manuel testing

[@ptyspawnbinbash]

Is Manuel ok with him being tested?

[@lekos1337]

@@ptyspawnbinbashbro 💀💀💀

[@letsgo...7842]

Great 😊 working 😍

[@rony8094]

fantastic

[@letsgo...7842]

Amezing ♨️

[@shivakumarmv4249]

Hi this is very nice tool. My request is if any special characters are identified by the tool that reflecting in response, will this tool able to generate the XSS payloads based on the identified special character? If not, try to bring this tool. this will be a great help.

[@dzzaza24]

goooog job

[@suryaroja03]

awesome bro

[@doshamitv5020]

What about a SQL one ? will you soon release it ? ( BLIND SQL ) test for all parametres

[@danielvergese9800]

This tool looks to be great for most of the wp websites however do you have something for the website post logins?

[@danielvergese9800]

@BePracticalTech does the current payloads includes WAF bypass?

[@SOBHITSHARMA]

Great Video man! thanks alot, but I have a question, this too checks the url only which is accessible, without login that means we have pages or modules which are hidden until we login, how to use this tool after succesfull login and then real modules test takes place. Please suggest. I have been looking for different automation for xss but all of them only works for open pages but not after login or may be I dont know how to use them after login. Once again thanks for your efforts.

[@SOBHITSHARMA]

Any suggestions here ?

[@omaralsayyed4146]

Hy
can help me for this issue please!
-uThe system cannot find the file specified.
Command 'cat res.txt | grep '=' | sort -u' returned non-zero exit status 1.

[@omaralsayyed4146]

It's problem because this tool just run in linux ,
i use windows 11 and cmd not support cat command ,
I installed ubuntu subsystem and executed in bash and it work successfully : )
@@BePracticalTech

[@pzer0man]

great video but after found xss vuln. teach how to exploit them pls.

[@Gowtham_SS]

Katana command not found bro

[@pankajsaini8916]

Same

[@josevannel4819]

Same here ayy

[@krivadnaaiservices]

He is not replying to anyone but only liking ur comments... hahaha

[@mohamedhussain6602]

katana not found what i do

[@Aniket18101]

Respect bro

[@sgeetha472]

\"is reflecting but didnt produce payload instead it shows connection reset ..continuously...why?i injected a basic xss payload ..but tgere is no response in burpsuite repeater.why?

[@sgeetha472]

@@BePracticalTech email sent

[@Official.Motivation.Machine]

Katana isnot working
No command katana found, did you mean:
Command botan3 in package botan3
Command cantata in package cantata from the x11-repo repository

[@BePracticalTech]

You need to install katana from github

[@Official.Motivation.Machine]

@@BePracticalTech Now its working 🫶. Take Love🖤 from Bangladesh 🇧🇩

[@Fetrah2]

Can you help me bro? it says 'is reflecting in the response
but when I try to use a paylaod it says access denied what should I do could you please help me?

[@rahul.bhardwaj]

​@@BePracticalTechSame as My problem sir ...

[@panagiotismitkas5526]

Waf is blocking the payload

[@Fetrah2]

No It doesn't @@BePracticalTech

[@cryptikbyte]

Bro please help karr kam se kam bolde pakda to nahi jaunga na??

[@doshamitv5020]

king

[@SOBHITSHARMA]

Another thing, I tried the tool and it gave me list of urls which says
[+] > is reflecting in the response
[+] ' is reflecting in the response
[+] " is reflecting in the response
[+] < is reflecting in the response
[+] / is reflecting in the response
[+] Testing parameter name:
but when I tried it with the payload which it says, I could not able to see xss on the webshite? Any suggestions?

[@SOBHITSHARMA]

@@BePracticalTech

[@SOBHITSHARMA]

@@BePracticalTech yep! not reflecting, so basically portal is auto encoding it.

[@SOBHITSHARMA]

@@BePracticalTech thank you man!

[@danmcgirr4210]

Great lesson!

[@nikhiltiwari1477]

Is xss_vibes offline or online attack. Like does it create any traffic while ruuning?

[@HawkPubg48]

Can you add -proxy option please it will be beast thank you

[@Arfat-Khan]

Can you make a video on file upload in details

[@krivadnaaiservices]

So file gas to be bamed katana.txt always? And for scan single url, do we have to give parameters

[@BePracticalTech]

Yes, you do need to provide the url containing the parameter eg. testphp.vulnweb.com/index.php?name=batman

[@krivadnaaiservices]

He is not replying to anyone but only liking ur comments... hahaha

[@shuvonsec]

payloads are not show

[@eowaldemar8195]

Please, is it possible to provide the katana.txt file

[@sugamdangal9974]

Will it be able to bypass Waf?

[@ali_aqeel]

Why don't you run on Linux?

[@tbjehad106]

is it just for reflected xss

[@BePracticalTech]

Currently yes

[@TheCyberWarriorGuy]

:)

[@mnageh-bo1mm]

it's not a new tool man , this just xss strike 🙄🙄🙄🙄

[@sgeetha472]

how to generate payload?>,',",/, is reflecting is there any website to generate?

[@deepspecial1161]

brother can i get your telegram username i want talk something with thank you