brs-xss


Namebrs-xss JSON
Version 2.0.2 PyPI version JSON
download
home_pageNone
SummaryContext-aware async XSS scanner for CI/CD
upload_time2025-10-26 02:59:37
maintainerNone
docs_urlNone
authorNone
requires_python>=3.8
licenseDual License: GPL-3.0-or-later OR Commercial
keywords security xss dast sarif playwright bug-bounty ci-cd async context-aware
VCS
bugtrack_url
requirements aiohttp typer rich pyyaml jinja2 babel polib playwright beautifulsoup4
Travis-CI No Travis.
coveralls test coverage No coveralls.
            **Company: EasyProTech LLC (www.easypro.tech)**
**Dev: Brabus**
**Contact: https://t.me/EasyProTech**

# BRS-XSS


**Context-aware async XSS scanner for CI**

![Python](https://img.shields.io/badge/python-3.8+-blue)
![Tests](https://img.shields.io/github/actions/workflow/status/EPTLLC/brs-xss/test.yml?branch=main&label=tests&logo=github)
![Coverage](https://img.shields.io/codecov/c/github/EPTLLC/brs-xss?label=coverage&logo=codecov)
![Docker](https://img.shields.io/badge/docker-multi--arch-blue?logo=docker)
![PyPI](https://img.shields.io/pypi/v/brs-xss?label=pypi&logo=pypi)
![GHCR](https://img.shields.io/badge/GHCR-ghcr.io%2Feptllc%2Fbrs--xss-blue?logo=docker)
![SARIF](https://img.shields.io/badge/SARIF-2.1.0-green?logo=github)
![Security](https://img.shields.io/badge/security-hardened-brightgreen?logo=shield)
![Performance](https://img.shields.io/badge/benchmark-1k%20URLs%20%2F%2012min-brightgreen)
![License](https://img.shields.io/badge/license-Dual%3A%20GPLv3%2B%20%2F%20Commercial-red)

> XSS vulnerability scanner with context detection, async performance, and multi-format reporting.

---

## Why BRS-XSS?

**Context-Aware Detection** - Understands HTML, JavaScript, CSS, and attribute contexts for precise payload generation  
**Async Performance** - Scans 1000+ URLs in 12 minutes on 8 vCPU with intelligent rate limiting  
**CI/CD Ready** - SARIF output integrates directly with GitHub Security, GitLab, and other SAST platforms  
**WAF Evasion** - Advanced bypass techniques for Cloudflare, AWS WAF, ModSecurity, and 7+ popular WAFs  
**Enterprise Features** - Comprehensive reporting, payload deduplication, and production-safe defaults

### Comparison Matrix

| Feature | BRS-XSS | XSStrike | XSpear | dalfox |
|---------|---------|----------|--------|--------|
| **Context Detection** | ✅ 6 contexts | ⚠️ Basic | ⚠️ Basic | ✅ 4 contexts |
| **Async Performance** | ✅ 32 concurrent | ❌ Sequential | ❌ Sequential | ✅ 100 concurrent |
| **SARIF Output** | ✅ Full spec | ❌ No | ❌ No | ⚠️ Basic |
| **WAF Bypass** | ✅ 8 WAFs | ✅ 5 WAFs | ⚠️ 3 WAFs | ✅ 6 WAFs |
| **False Positive Rate** | ✅ <5% | ⚠️ ~15% | ⚠️ ~20% | ✅ <8% |
| **CI Integration** | ✅ Native | ❌ Manual | ❌ Manual | ⚠️ Scripts |

---

## Quickstart (60 seconds)

> **Note:** Version `2.0.1` includes a critical fix for a bug that prevented the scanner from correctly detecting vulnerabilities in HTML forms (POST requests). Please upgrade if you are using an older version.

### Install & Scan
```bash
pip install -U brs-xss
brs-xss scan https://target.tld -o out.sarif --fast
```

### Docker
```bash
docker run --rm -v $(pwd):/out ghcr.io/eptllc/brs-xss:latest scan https://target.tld -o /out/out.sarif
```

### GitHub Actions Integration
```yaml
- name: XSS Security Scan
  run: |
    pip install brs-xss
    brs-xss scan ${{ github.event.repository.html_url }} -o xss-results.sarif
    
- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v2
  with:
    sarif_file: xss-results.sarif
```

---

## Results & Reporting

### SARIF Integration
Perfect integration with GitHub Security tab, GitLab Security Dashboard, and SAST platforms:

Notes on SARIF 2.1.0 compliance:
- Includes driver.semanticVersion matching package version
- Each rule provides help text and helpUri
- run-level properties columnKind=utf16CodeUnits and defaultEncoding=utf-8 are set on save

```bash
# Scan and upload to GitHub Security
brs-xss scan https://app.example.com -o security.sarif
gh api repos/:owner/:repo/code-scanning/sarifs -f sarif=@security.sarif
```

### Interactive HTML Reports
Rich HTML reports with vulnerability details, payload explanations, and one-click replay:

```bash
brs-xss scan https://target.tld --output-html report.html
```

### JSON Schema Validation
Machine-readable results with full JSON Schema validation:

```json
{
  "scan_info": {
  "timestamp": "2025-09-08T09:03:08Z",
  "scanner": "BRS-XSS v2.0.1",
    "targets_scanned": 47,
    "vulnerabilities_found": 8,
    "false_positive_rate": "3.2%"
  },
  "vulnerabilities": [
    {
      "url": "https://app.example.com/search?q=test",
      "parameter": "q",
      "context": "html_attribute", 
      "payload": "\" onmouseover=\"alert(1)\"",
      "severity": "high",
      "confidence": 0.94,
      "cwe": "CWE-79",
      "sarif_rule_id": "XSS001"
    }
  ]
}
```

---

## Advanced Features

### Context Matrix
- **HTML Context** - Tag content, attributes, comments
- **JavaScript Context** - Script blocks, event handlers, JSON
- **CSS Context** - Style blocks, inline styles
- **URI Context** - URL parameters, fragments
- **SVG Context** - SVG elements and attributes  
- **XML Context** - CDATA, processing instructions

### Performance & Safety
- **Rate Limiting** - 8 RPS default, respects robots.txt
- **Concurrency Control** - 32 concurrent requests with backoff
- **Smart Caching** - URL+parameter reflection cache, Bloom filter deduplication
- **Safe Mode** - Production-safe defaults: depth 3, denylist enabled

### Payload Engineering
- **1200+ Payloads** - Context-specific, polyglot, and WAF bypass variants
- **Intelligent Selection** - ML-enhanced payload effectiveness scoring  
- **Aggr Mode** - Multi-encoding polyglots for maximum coverage
- **WAF Metrics** - Hit rates tested on 10+ demo targets

### Knowledge Base System
- **17 Context Modules** - 5,535 lines of expert vulnerability documentation
- **SIEM Integration** - CVSS scoring, severity levels, CWE/OWASP mapping
- **Reverse Mapping** - Payload → Context → Defense correlation
- **CLI Access** - `brs-xss kb` commands for vulnerability information
- **Schema Validation** - JSON Schema with pytest test suite
- **Versioning** - Semantic versioning (KB v1.0.0)
- **Metadata Export** - YAML files for quick revision without Python import

---

## License

Dual License: GPL-3.0-or-later OR Commercial License.

- Open Source (GPLv3+): for education, research, open-source, and non-commercial usage.
- Commercial License: for commercial use, proprietary integrations, or when GPL is not suitable.

See the LICENSE file for full terms and contact details.

---

## Configuration

Default config in `~/.config/brs-xss/config.toml`:

```toml
[scanner]
concurrency = 32
rate_limit = 8.0  # requests per second
timeout = 15
max_depth = 3
safe_mode = true

[generator]
max_payloads = 500
effectiveness_threshold = 0.65
include_evasions = true
include_waf_specific = true
seed = 1337
max_manager_payloads = 2000
max_evasion_bases = 10
evasion_variants_per_tech = 2
waf_bases = 3
enable_aggressive = false
pool_cap = 10000
norm_hash = false

[payloads]
contexts = ["html", "attribute", "script", "css", "uri", "svg"]
aggr_mode = false  # Enable polyglot + multi-encoding
waf_bypass = true

[output]
formats = ["sarif", "json", "html"]
include_screenshots = true
replay_urls = true
```

---

## Commands

```bash
# Quick scan
brs-xss scan https://target.tld

# Comprehensive scan with all contexts
brs-xss scan https://target.tld --aggr --deep

# Knowledge Base commands
brs-xss kb info                              # Show KB information
brs-xss kb list                              # List all contexts
brs-xss kb show html_content                 # View context details
brs-xss kb show html_attribute --section remediation
brs-xss kb search "dom xss"                  # Search contexts
brs-xss kb export html_content output.json   # Export to file

# List available payloads by context
brs-xss payloads list --context html

# Replay specific vulnerability
brs-xss replay https://target.tld/vuln?param=payload

# Merge multiple scan reports  
brs-xss report merge scan1.json scan2.json -o combined.sarif
```

---

## Knowledge Base

The scanner uses **[BRS-KB](https://github.com/EPTLLC/BRS-KB)** - a standalone open-source XSS knowledge base.

### BRS-KB Integration

BRS-KB provides expert vulnerability information for 17 XSS contexts:
- HTML contexts (content, attributes, comments)
- JavaScript contexts (direct injection, strings, objects)
- CSS contexts (styles, selectors, keyloggers)
- Data formats (JSON, XML, SVG, Markdown)
- Advanced vectors (DOM XSS, template injection, PostMessage, WebAssembly)

Each vulnerability includes CVSS scores, CWE/OWASP mappings, attack vectors, and remediation guidance.

### Usage in BRS-XSS

```python
from brsxss.report.knowledge_base import get_vulnerability_details

details = get_vulnerability_details('html_content')
cvss = details['cvss_score']      # 8.8
severity = details['severity']    # 'critical'
cwe = details['cwe']              # ['CWE-79']
```

### Standalone Usage

BRS-KB can be used independently in other security tools:

```bash
pip install brs-kb
```

```python
from brs_kb import get_vulnerability_details, list_contexts

# Get all available contexts
contexts = list_contexts()

# Get details for specific context
info = get_vulnerability_details('dom_xss')
```

**Documentation**: https://github.com/EPTLLC/BRS-KB  
**License**: MIT (separate from BRS-XSS dual license)

---

## CI/CD & Docker

- Dockerfile included for local builds
- Multi-arch Docker builds via GitHub Actions (linux/amd64, linux/arm64). To push images, set repository secrets DOCKERHUB_USERNAME and DOCKERHUB_TOKEN.

---

## Installation Options

### PyPI (Recommended)
```bash
pip install brs-xss
```

### Docker
```bash
docker pull ghcr.io/eptllc/brs-xss:latest
```

### From Source
```bash
git clone https://github.com/EPTLLC/brs-xss.git
cd brs-xss
pip install -e .
```

---

## How-To Guides

1. **[Quick Scan](docs/quickstart.md)** - Get started in 2 minutes
2. **[CI Integration](docs/ci-integration.md)** - GitHub Actions, GitLab CI, Jenkins
3. **[SARIF in GitHub](docs/github-sarif.md)** - Security tab integration
4. **[Docker Usage](docs/docker.md)** - Container deployment
5. **[Safe Mode](docs/safe-mode.md)** - Production scanning guidelines
6. **[Configuration](docs/configuration.md)** - Complete parameter reference

---

## Benchmarks

**Performance**: 1000 URLs scanned in 12 minutes on 8 vCPU VPS  
**Accuracy**: <5% false positive rate on DVWA, WebGoat, XSS-Game  
**Coverage**: 98% payload success rate against unprotected targets  
**Reliability**: 100% reproducible results with pinned dependencies

![Benchmark](https://img.shields.io/badge/benchmark-1k%20URLs%20%2F%2012min-brightgreen)

---

## Legal & Ethics

**Authorized Testing Only**: This tool is designed for legitimate security testing with proper authorization.

- **[LEGAL.md](LEGAL.md)** - Complete legal terms and compliance
- **[ETHICS.md](ETHICS.md)** - Responsible disclosure guidelines  
- **[DISCLAIMER.md](DISCLAIMER.md)** - Liability and warranty disclaimers

**Commercial License**: Enterprise support available at https://t.me/EasyProTech

---

## Contributing

1. Fork the repository
2. Create feature branch: `git checkout -b feature/amazing-feature`
3. Follow code standards: `ruff check .`
4. Add tests: `pytest tests/`
5. Submit pull request

**Good First Issues**: Look for `good-first-issue` and `help-wanted` labels.

---

## Related Projects

- **[BRS-KB](https://github.com/EPTLLC/BRS-KB)** - Open XSS Knowledge Base (MIT License)
- BRS-ATTACK - Network security testing suite (planned)

---

**BRS-XSS v2.0.1** | **EasyProTech LLC** | **https://t.me/EasyProTech**

*Context-aware async XSS scanner for CI*

            

Raw data

            {
    "_id": null,
    "home_page": null,
    "name": "brs-xss",
    "maintainer": null,
    "docs_url": null,
    "requires_python": ">=3.8",
    "maintainer_email": null,
    "keywords": "security, xss, dast, sarif, playwright, bug-bounty, ci-cd, async, context-aware",
    "author": null,
    "author_email": "Brabus <mail.easypro.tech@gmail.com>",
    "download_url": "https://files.pythonhosted.org/packages/fc/62/62c17707d48337afedca692e86d3aa252274e25e8abdadb46b1a91d9042d/brs_xss-2.0.2.tar.gz",
    "platform": null,
    "description": "**Company: EasyProTech LLC (www.easypro.tech)**\n**Dev: Brabus**\n**Contact: https://t.me/EasyProTech**\n\n# BRS-XSS\n\n\n**Context-aware async XSS scanner for CI**\n\n![Python](https://img.shields.io/badge/python-3.8+-blue)\n![Tests](https://img.shields.io/github/actions/workflow/status/EPTLLC/brs-xss/test.yml?branch=main&label=tests&logo=github)\n![Coverage](https://img.shields.io/codecov/c/github/EPTLLC/brs-xss?label=coverage&logo=codecov)\n![Docker](https://img.shields.io/badge/docker-multi--arch-blue?logo=docker)\n![PyPI](https://img.shields.io/pypi/v/brs-xss?label=pypi&logo=pypi)\n![GHCR](https://img.shields.io/badge/GHCR-ghcr.io%2Feptllc%2Fbrs--xss-blue?logo=docker)\n![SARIF](https://img.shields.io/badge/SARIF-2.1.0-green?logo=github)\n![Security](https://img.shields.io/badge/security-hardened-brightgreen?logo=shield)\n![Performance](https://img.shields.io/badge/benchmark-1k%20URLs%20%2F%2012min-brightgreen)\n![License](https://img.shields.io/badge/license-Dual%3A%20GPLv3%2B%20%2F%20Commercial-red)\n\n> XSS vulnerability scanner with context detection, async performance, and multi-format reporting.\n\n---\n\n## Why BRS-XSS?\n\n**Context-Aware Detection** - Understands HTML, JavaScript, CSS, and attribute contexts for precise payload generation  \n**Async Performance** - Scans 1000+ URLs in 12 minutes on 8 vCPU with intelligent rate limiting  \n**CI/CD Ready** - SARIF output integrates directly with GitHub Security, GitLab, and other SAST platforms  \n**WAF Evasion** - Advanced bypass techniques for Cloudflare, AWS WAF, ModSecurity, and 7+ popular WAFs  \n**Enterprise Features** - Comprehensive reporting, payload deduplication, and production-safe defaults\n\n### Comparison Matrix\n\n| Feature | BRS-XSS | XSStrike | XSpear | dalfox |\n|---------|---------|----------|--------|--------|\n| **Context Detection** | \u2705 6 contexts | \u26a0\ufe0f Basic | \u26a0\ufe0f Basic | \u2705 4 contexts |\n| **Async Performance** | \u2705 32 concurrent | \u274c Sequential | \u274c Sequential | \u2705 100 concurrent |\n| **SARIF Output** | \u2705 Full spec | \u274c No | \u274c No | \u26a0\ufe0f Basic |\n| **WAF Bypass** | \u2705 8 WAFs | \u2705 5 WAFs | \u26a0\ufe0f 3 WAFs | \u2705 6 WAFs |\n| **False Positive Rate** | \u2705 <5% | \u26a0\ufe0f ~15% | \u26a0\ufe0f ~20% | \u2705 <8% |\n| **CI Integration** | \u2705 Native | \u274c Manual | \u274c Manual | \u26a0\ufe0f Scripts |\n\n---\n\n## Quickstart (60 seconds)\n\n> **Note:** Version `2.0.1` includes a critical fix for a bug that prevented the scanner from correctly detecting vulnerabilities in HTML forms (POST requests). Please upgrade if you are using an older version.\n\n### Install & Scan\n```bash\npip install -U brs-xss\nbrs-xss scan https://target.tld -o out.sarif --fast\n```\n\n### Docker\n```bash\ndocker run --rm -v $(pwd):/out ghcr.io/eptllc/brs-xss:latest scan https://target.tld -o /out/out.sarif\n```\n\n### GitHub Actions Integration\n```yaml\n- name: XSS Security Scan\n  run: |\n    pip install brs-xss\n    brs-xss scan ${{ github.event.repository.html_url }} -o xss-results.sarif\n    \n- name: Upload SARIF\n  uses: github/codeql-action/upload-sarif@v2\n  with:\n    sarif_file: xss-results.sarif\n```\n\n---\n\n## Results & Reporting\n\n### SARIF Integration\nPerfect integration with GitHub Security tab, GitLab Security Dashboard, and SAST platforms:\n\nNotes on SARIF 2.1.0 compliance:\n- Includes driver.semanticVersion matching package version\n- Each rule provides help text and helpUri\n- run-level properties columnKind=utf16CodeUnits and defaultEncoding=utf-8 are set on save\n\n```bash\n# Scan and upload to GitHub Security\nbrs-xss scan https://app.example.com -o security.sarif\ngh api repos/:owner/:repo/code-scanning/sarifs -f sarif=@security.sarif\n```\n\n### Interactive HTML Reports\nRich HTML reports with vulnerability details, payload explanations, and one-click replay:\n\n```bash\nbrs-xss scan https://target.tld --output-html report.html\n```\n\n### JSON Schema Validation\nMachine-readable results with full JSON Schema validation:\n\n```json\n{\n  \"scan_info\": {\n  \"timestamp\": \"2025-09-08T09:03:08Z\",\n  \"scanner\": \"BRS-XSS v2.0.1\",\n    \"targets_scanned\": 47,\n    \"vulnerabilities_found\": 8,\n    \"false_positive_rate\": \"3.2%\"\n  },\n  \"vulnerabilities\": [\n    {\n      \"url\": \"https://app.example.com/search?q=test\",\n      \"parameter\": \"q\",\n      \"context\": \"html_attribute\", \n      \"payload\": \"\\\" onmouseover=\\\"alert(1)\\\"\",\n      \"severity\": \"high\",\n      \"confidence\": 0.94,\n      \"cwe\": \"CWE-79\",\n      \"sarif_rule_id\": \"XSS001\"\n    }\n  ]\n}\n```\n\n---\n\n## Advanced Features\n\n### Context Matrix\n- **HTML Context** - Tag content, attributes, comments\n- **JavaScript Context** - Script blocks, event handlers, JSON\n- **CSS Context** - Style blocks, inline styles\n- **URI Context** - URL parameters, fragments\n- **SVG Context** - SVG elements and attributes  \n- **XML Context** - CDATA, processing instructions\n\n### Performance & Safety\n- **Rate Limiting** - 8 RPS default, respects robots.txt\n- **Concurrency Control** - 32 concurrent requests with backoff\n- **Smart Caching** - URL+parameter reflection cache, Bloom filter deduplication\n- **Safe Mode** - Production-safe defaults: depth 3, denylist enabled\n\n### Payload Engineering\n- **1200+ Payloads** - Context-specific, polyglot, and WAF bypass variants\n- **Intelligent Selection** - ML-enhanced payload effectiveness scoring  \n- **Aggr Mode** - Multi-encoding polyglots for maximum coverage\n- **WAF Metrics** - Hit rates tested on 10+ demo targets\n\n### Knowledge Base System\n- **17 Context Modules** - 5,535 lines of expert vulnerability documentation\n- **SIEM Integration** - CVSS scoring, severity levels, CWE/OWASP mapping\n- **Reverse Mapping** - Payload \u2192 Context \u2192 Defense correlation\n- **CLI Access** - `brs-xss kb` commands for vulnerability information\n- **Schema Validation** - JSON Schema with pytest test suite\n- **Versioning** - Semantic versioning (KB v1.0.0)\n- **Metadata Export** - YAML files for quick revision without Python import\n\n---\n\n## License\n\nDual License: GPL-3.0-or-later OR Commercial License.\n\n- Open Source (GPLv3+): for education, research, open-source, and non-commercial usage.\n- Commercial License: for commercial use, proprietary integrations, or when GPL is not suitable.\n\nSee the LICENSE file for full terms and contact details.\n\n---\n\n## Configuration\n\nDefault config in `~/.config/brs-xss/config.toml`:\n\n```toml\n[scanner]\nconcurrency = 32\nrate_limit = 8.0  # requests per second\ntimeout = 15\nmax_depth = 3\nsafe_mode = true\n\n[generator]\nmax_payloads = 500\neffectiveness_threshold = 0.65\ninclude_evasions = true\ninclude_waf_specific = true\nseed = 1337\nmax_manager_payloads = 2000\nmax_evasion_bases = 10\nevasion_variants_per_tech = 2\nwaf_bases = 3\nenable_aggressive = false\npool_cap = 10000\nnorm_hash = false\n\n[payloads]\ncontexts = [\"html\", \"attribute\", \"script\", \"css\", \"uri\", \"svg\"]\naggr_mode = false  # Enable polyglot + multi-encoding\nwaf_bypass = true\n\n[output]\nformats = [\"sarif\", \"json\", \"html\"]\ninclude_screenshots = true\nreplay_urls = true\n```\n\n---\n\n## Commands\n\n```bash\n# Quick scan\nbrs-xss scan https://target.tld\n\n# Comprehensive scan with all contexts\nbrs-xss scan https://target.tld --aggr --deep\n\n# Knowledge Base commands\nbrs-xss kb info                              # Show KB information\nbrs-xss kb list                              # List all contexts\nbrs-xss kb show html_content                 # View context details\nbrs-xss kb show html_attribute --section remediation\nbrs-xss kb search \"dom xss\"                  # Search contexts\nbrs-xss kb export html_content output.json   # Export to file\n\n# List available payloads by context\nbrs-xss payloads list --context html\n\n# Replay specific vulnerability\nbrs-xss replay https://target.tld/vuln?param=payload\n\n# Merge multiple scan reports  \nbrs-xss report merge scan1.json scan2.json -o combined.sarif\n```\n\n---\n\n## Knowledge Base\n\nThe scanner uses **[BRS-KB](https://github.com/EPTLLC/BRS-KB)** - a standalone open-source XSS knowledge base.\n\n### BRS-KB Integration\n\nBRS-KB provides expert vulnerability information for 17 XSS contexts:\n- HTML contexts (content, attributes, comments)\n- JavaScript contexts (direct injection, strings, objects)\n- CSS contexts (styles, selectors, keyloggers)\n- Data formats (JSON, XML, SVG, Markdown)\n- Advanced vectors (DOM XSS, template injection, PostMessage, WebAssembly)\n\nEach vulnerability includes CVSS scores, CWE/OWASP mappings, attack vectors, and remediation guidance.\n\n### Usage in BRS-XSS\n\n```python\nfrom brsxss.report.knowledge_base import get_vulnerability_details\n\ndetails = get_vulnerability_details('html_content')\ncvss = details['cvss_score']      # 8.8\nseverity = details['severity']    # 'critical'\ncwe = details['cwe']              # ['CWE-79']\n```\n\n### Standalone Usage\n\nBRS-KB can be used independently in other security tools:\n\n```bash\npip install brs-kb\n```\n\n```python\nfrom brs_kb import get_vulnerability_details, list_contexts\n\n# Get all available contexts\ncontexts = list_contexts()\n\n# Get details for specific context\ninfo = get_vulnerability_details('dom_xss')\n```\n\n**Documentation**: https://github.com/EPTLLC/BRS-KB  \n**License**: MIT (separate from BRS-XSS dual license)\n\n---\n\n## CI/CD & Docker\n\n- Dockerfile included for local builds\n- Multi-arch Docker builds via GitHub Actions (linux/amd64, linux/arm64). To push images, set repository secrets DOCKERHUB_USERNAME and DOCKERHUB_TOKEN.\n\n---\n\n## Installation Options\n\n### PyPI (Recommended)\n```bash\npip install brs-xss\n```\n\n### Docker\n```bash\ndocker pull ghcr.io/eptllc/brs-xss:latest\n```\n\n### From Source\n```bash\ngit clone https://github.com/EPTLLC/brs-xss.git\ncd brs-xss\npip install -e .\n```\n\n---\n\n## How-To Guides\n\n1. **[Quick Scan](docs/quickstart.md)** - Get started in 2 minutes\n2. **[CI Integration](docs/ci-integration.md)** - GitHub Actions, GitLab CI, Jenkins\n3. **[SARIF in GitHub](docs/github-sarif.md)** - Security tab integration\n4. **[Docker Usage](docs/docker.md)** - Container deployment\n5. **[Safe Mode](docs/safe-mode.md)** - Production scanning guidelines\n6. **[Configuration](docs/configuration.md)** - Complete parameter reference\n\n---\n\n## Benchmarks\n\n**Performance**: 1000 URLs scanned in 12 minutes on 8 vCPU VPS  \n**Accuracy**: <5% false positive rate on DVWA, WebGoat, XSS-Game  \n**Coverage**: 98% payload success rate against unprotected targets  \n**Reliability**: 100% reproducible results with pinned dependencies\n\n![Benchmark](https://img.shields.io/badge/benchmark-1k%20URLs%20%2F%2012min-brightgreen)\n\n---\n\n## Legal & Ethics\n\n**Authorized Testing Only**: This tool is designed for legitimate security testing with proper authorization.\n\n- **[LEGAL.md](LEGAL.md)** - Complete legal terms and compliance\n- **[ETHICS.md](ETHICS.md)** - Responsible disclosure guidelines  \n- **[DISCLAIMER.md](DISCLAIMER.md)** - Liability and warranty disclaimers\n\n**Commercial License**: Enterprise support available at https://t.me/EasyProTech\n\n---\n\n## Contributing\n\n1. Fork the repository\n2. Create feature branch: `git checkout -b feature/amazing-feature`\n3. Follow code standards: `ruff check .`\n4. Add tests: `pytest tests/`\n5. Submit pull request\n\n**Good First Issues**: Look for `good-first-issue` and `help-wanted` labels.\n\n---\n\n## Related Projects\n\n- **[BRS-KB](https://github.com/EPTLLC/BRS-KB)** - Open XSS Knowledge Base (MIT License)\n- BRS-ATTACK - Network security testing suite (planned)\n\n---\n\n**BRS-XSS v2.0.1** | **EasyProTech LLC** | **https://t.me/EasyProTech**\n\n*Context-aware async XSS scanner for CI*\n",
    "bugtrack_url": null,
    "license": "Dual License: GPL-3.0-or-later OR Commercial",
    "summary": "Context-aware async XSS scanner for CI/CD",
    "version": "2.0.2",
    "project_urls": {
        "Changelog": "https://github.com/EPTLLC/brs-xss/releases",
        "Documentation": "https://github.com/EPTLLC/brs-xss/wiki",
        "Homepage": "https://github.com/EPTLLC/brs-xss",
        "Issues": "https://github.com/EPTLLC/brs-xss/issues"
    },
    "split_keywords": [
        "security",
        " xss",
        " dast",
        " sarif",
        " playwright",
        " bug-bounty",
        " ci-cd",
        " async",
        " context-aware"
    ],
    "urls": [
        {
            "comment_text": null,
            "digests": {
                "blake2b_256": "ba36a95fe869dce6715b5d1a0a50abec3e7e58544fca27e1006bead9dea5e72a",
                "md5": "adf6738332d7159c219b7fe350e0de15",
                "sha256": "c43be2e953aec8c9ea452c17588b39d6b540715118e4091a44b63f5f1174414b"
            },
            "downloads": -1,
            "filename": "brs_xss-2.0.2-py3-none-any.whl",
            "has_sig": false,
            "md5_digest": "adf6738332d7159c219b7fe350e0de15",
            "packagetype": "bdist_wheel",
            "python_version": "py3",
            "requires_python": ">=3.8",
            "size": 341813,
            "upload_time": "2025-10-26T02:59:35",
            "upload_time_iso_8601": "2025-10-26T02:59:35.934370Z",
            "url": "https://files.pythonhosted.org/packages/ba/36/a95fe869dce6715b5d1a0a50abec3e7e58544fca27e1006bead9dea5e72a/brs_xss-2.0.2-py3-none-any.whl",
            "yanked": false,
            "yanked_reason": null
        },
        {
            "comment_text": null,
            "digests": {
                "blake2b_256": "fc6262c17707d48337afedca692e86d3aa252274e25e8abdadb46b1a91d9042d",
                "md5": "6fd68bc67fcf92e5cd22a9d241c7c5fc",
                "sha256": "9542282158113e713121f3935b4fce01d6e41368783a24348c97ae1eba64de16"
            },
            "downloads": -1,
            "filename": "brs_xss-2.0.2.tar.gz",
            "has_sig": false,
            "md5_digest": "6fd68bc67fcf92e5cd22a9d241c7c5fc",
            "packagetype": "sdist",
            "python_version": "source",
            "requires_python": ">=3.8",
            "size": 251860,
            "upload_time": "2025-10-26T02:59:37",
            "upload_time_iso_8601": "2025-10-26T02:59:37.417047Z",
            "url": "https://files.pythonhosted.org/packages/fc/62/62c17707d48337afedca692e86d3aa252274e25e8abdadb46b1a91d9042d/brs_xss-2.0.2.tar.gz",
            "yanked": false,
            "yanked_reason": null
        }
    ],
    "upload_time": "2025-10-26 02:59:37",
    "github": true,
    "gitlab": false,
    "bitbucket": false,
    "codeberg": false,
    "github_user": "EPTLLC",
    "github_project": "brs-xss",
    "travis_ci": false,
    "coveralls": false,
    "github_actions": true,
    "requirements": [
        {
            "name": "aiohttp",
            "specs": [
                [
                    ">=",
                    "3.8.0"
                ]
            ]
        },
        {
            "name": "typer",
            "specs": [
                [
                    ">=",
                    "0.9.0"
                ]
            ]
        },
        {
            "name": "rich",
            "specs": [
                [
                    ">=",
                    "13.0.0"
                ]
            ]
        },
        {
            "name": "pyyaml",
            "specs": [
                [
                    ">=",
                    "6.0"
                ]
            ]
        },
        {
            "name": "jinja2",
            "specs": [
                [
                    ">=",
                    "3.1.0"
                ]
            ]
        },
        {
            "name": "babel",
            "specs": [
                [
                    ">=",
                    "2.12.0"
                ]
            ]
        },
        {
            "name": "polib",
            "specs": [
                [
                    ">=",
                    "1.2.0"
                ]
            ]
        },
        {
            "name": "playwright",
            "specs": [
                [
                    ">=",
                    "1.40.0"
                ]
            ]
        },
        {
            "name": "beautifulsoup4",
            "specs": [
                [
                    ">=",
                    "4.12.3"
                ]
            ]
        }
    ],
    "lcname": "brs-xss"
}
        
Elapsed time: 8.99020s