Package: meissner
AboutMeissner Lop is a dictionary-based mutation-based exploit fuzzer for XSS.InstallationAutomaticpip3installmeissnerManualgit clone https://github.com/arinerron/meissner.git
cd meissner
sudo ./setup.py installUsageusage: meissner [-h] [--no-ansi] [--log-level LOG_LEVEL] [--url URL] [--dictionary DICTIONARY] [--threads THREADS] [--filter FILTER] [--engine ENGINE] [cmd [cmd ...]]

Meissner Lop - XSS Filter Bypass Exploit Fuzzer

positional arguments:
  cmd                   the command to execute, where {xss} is the injection point

optional arguments:
  -h, --help            show this help message and exit
  --no-ansi, -c         disable ANSI coloring on all output
  --log-level LOG_LEVEL, -v LOG_LEVEL
                        set logging level
  --url URL, --uri URL, -u URL
                        use a URL harness, where {xss} is the injection point
  --dictionary DICTIONARY, --dict DICTIONARY, -d DICTIONARY
                        the Meissner mutation dictionary to use
  --threads THREADS, --threads-count THREADS, -t THREADS
                        the number of threads allocated to use for engines
  --filter FILTER, -f FILTER
                        pass the input through a filter before the program
  --engine ENGINE, --browser ENGINE, -e ENGINE
                        the browser rendering engine to useGeneralWhen entering a URL, simply put the string{xss}where you would like to insert XSS payloads. For example:meissner--url'https://example.com/vulnerable.php?query={xss}'Additionally, if you have a script that outputs the generated HTML, Meissner Lop can work with you. For example, if a mutation XSS CTF challenge provides source and you setup a local instance athttps://localhost:8080/xss.php, you may use that as the URL. It is more efficient to run instances locally as HTTP requests will not have to travel across the internet.Meissner can also provide XSS payloads throughargvif you have an executable that generates HTML output. This option is by far the most efficient as it removes need for HTTP servers/clients and networking.For example, if your executable is called./give-me-flag, you may use the tool like:meissner--./give-me-flag'{xss}'If the{xss}argument is not found in the arguments, Meissner will assume that you would like payloads to be passed through stdin/stdout.LimitationsThe tool does not attempt to abide by any character or length restrictions. This does not mean that it will not work for your specific XSS vulnerability, however; just that it may take longer to find something as the tool is not specifically trying to abide by restrictions.Meissner does not attempt to parse HTML and bypass filters in that way; rather, it is a "dumb" fuzzer and prioritizes based on cases it considers interesting. However, it can brute-force XSS challenges MUCH faster than you can. I'd recommend running this tool in the background while you manually solve challenges.The fuzzer may take the fun of the challenge away from you. If you are playing a CTF for fun, then solve the challenge by hand! ... unless you get some sort of odd satisfaction from using tools to solve all your problems like I do--in which case, by all means, use this tool.TODOdouble URL encodingNew featuresmore intelligent fuzzingdetect "interesting" cases and prioritize themmore mutationsrandomly pick bytes to encode with HTML entitiesmake HTTP requests more flexiblerandom user agent generationPOST,PUT, etc requestscookiesproxiesrequests from a filesupport custom filters through Python files (use stdin/stdout)if{xss}not found in stdin/stdout, write through stdinsaving and restoring progressFix bugs / race conditions (search forXXX:in the code!)expose some of the hardcoded timeouts to the CLIWrite documentationCreate more / better dictionariesOptimizations!