XSS & Param Fuzzing via Wayback + Nuclei

XSS & Param Fuzzing via Wayback + Nuclei - Printable Version

+- Dark C0d3rs (https://darkcoders.wiki)
+-- Forum: SecOps (https://darkcoders.wiki/Forum-SecOps)
+--- Forum: Web & Bug Bounty (https://darkcoders.wiki/Forum-Web-Bug-Bounty)
+--- Thread: XSS & Param Fuzzing via Wayback + Nuclei (/Thread-XSS-Param-Fuzzing-via-Wayback-Nuclei)

XSS & Param Fuzzing via Wayback + Nuclei - hashXploiter - 06-10-2025

Sharing a quick and effective one-liner to discover parameter-based vulnerabilities like XSS using archived URLs and fuzzing templates.

Single Subdomain One-Liner:

Code:
echo sub.target.com | waybackurls \

  | grep "=" \

  | gf xss \

  | uro \

  | httpx -silent -mc 200 -title \

  > live-params.txt && \

nuclei -l live-params.txt -t fuzzing-templates/ -severity low,medium,high -o findings.txt

Multiple Subdomains (List from subs.txt):

Code:
cat subs.txt | while read sub; do

  echo "[*] Processing $sub"

  echo $sub | waybackurls \

    | grep "=" \

    | gf xss \

    | uro \

    | httpx -silent -mc 200,302,403 -title \

    >> live-params.txt

done

nuclei -l live-params.txt -t fuzzing-templates/ -severity low,medium,high -o findings.txt

You can also use anew in place of >> to avoid duplicate URLs in live-params.txt.

Requirements:

You are not allowed to view links. Register or Login to view.
You are not allowed to view links. Register or Login to view.
You are not allowed to view links. Register or Login to view.
You are not allowed to view links. Register or Login to view.
You are not allowed to view links. Register or Login to view. with fuzzing-templates

Optional Speed Boost:

Code:
cat subs.txt | xargs -P 10 -I{} bash -c \

'echo {} | waybackurls | grep "=" | gf xss | uro | httpx -silent -mc 200,302,403 -title' >> live-params.txt