KNOXSS

Skip to Automation and Browser Extension

KNOXSS is an automated XSS detection and proof-of-concept engine, available as an API at api.knoxss.pro and through its official browser extension. It finds source-based and DOM-based reflected and stored XSS in web pages, using the URL and POST body as its entry points. It's built and maintained by Brute Logic Research & Development in Offensive Security.

Confidence by Design

KNOXSS has an almost zero false positive rate, because it only reports a vulnerability after actually popping an alert box to prove it. Its false negative rate stays low across the XSS cases it covers, making it one of the strongest options available for this specific class of vulnerability.

Superior Technology

KNOXSS detects and proves XSS flaws automatically, with very little effort from the user. Give it a target URL (and, if needed, POST data or authentication headers), and it pops an alert box the moment it finds a working exploit.

Featuring

Types — Source-based XSS (HTML, JavaScript, XML contexts); DOM-based XSS (Document, Location, Execution sinks); Blind XSS (email reporting, custom payloads, automatic injection).

Injection — Input scope: POST body parameters, URL parameters, URL path (3 levels deep), URL fragment. Input techniques: Base64 and double encoding, multi-injection and multi-context, parameter guessing. Input authentication: user-provided headers.

Exclusive — Modes: XSS polyglots and PoC checking. ReferenceError fix: JS object hoisting and hoisting override. Filter bypass: validated URL/email formats, hardcoded obfuscation, I/O difference evasion, basic CSP bypass.

FAQ

What KNOXSS does — KNOXSS finds source-based and DOM-based reflected and stored XSS in vulnerable pages, using components of the URL (path and query parameters) and POST body as entry points.

How to use KNOXSS — KNOXSS runs through its API: send it a target URL and, if needed, POST data and authentication headers. Use it directly via the API below, or through the official browser extension, which handles the API key for you.

How KNOXSS works — Basically, KNOXSS takes the target URL plus any extra data provided and checks for a reflection on all URL or POST body parameter values (also on name), along with the URL path (3 levels deep) and fragment. If it finds a reflection somewhere, in the HTTP response, DOM, or associated JS calls, it decides what type of injection to use (HTML or JS). Finally, it tries several specific XSS vectors to pop an alert box and prove the vulnerability.

After a 10-year run, KNOXSS is retiring its public web interface. The detection engine hasn't gone anywhere — it's available directly through the API below, or through the official browser extension, for anyone with an active KNOXSS plan.

API Documentation

The API

KNOXSS API is another way to query the KNOXSS system to find and prove a XSS vulnerability in a given target page. Unlike other APIs that just retrieve data from a database, KNOXSS API returns the results like the web interface, actually performing a comprehensive vulnerability scan for XSS. Since scan results are not stored by our system, they need to be generated on the fly, taking several JavaScript-evaluated live tests to return them. So it's natural the data returned takes some time to be delivered, since there's a process running server side.

Available to brutelogic.net KNOXSS plan holders. The standard rate limit is 1,000 requests over a 24-hour period, rate-limited so it spreads across the full day instead of being used up all at once.

API Key

To use the KNOXSS API you need your API key: it must be sent to the API endpoint with the header X-API-KEY.

X-API-KEY: 93c864f5-af3a-4f6a-8b25-8662bc8b5ab6

Your key is generated automatically when you purchase a plan and shown in your My Account dashboard, where you can also regenerate it any time.

Skip to Automation and Browser Extension

All requests to the API must be done via POST method to:

https://api.knoxss.pro

API Request Data

Target (mandatory) — target
Target is the only mandatory field; without it KNOXSS API can't test anything. Provide a URL in the format http(s)://domain/path/page with a query string (?param1=value&param2=value&param3=value) or not.

target=https://domain/path/page?param1=value%26param2=value%26param3=value
target=https://domain/path/page

POST Body — post
Provide a POST body if your request is done via HTTP POST method (HTML forms), in the format param1=value&param2=value&param3=value, with the action URL (without query string).

post=param1=value%26param2=value%26param3=value

Extra Header(s) for Authentication — auth
Provide a header needed to pass the request to test authenticated pages, in the format header:value. Separate pairs with CRLF (%0D%0A) if more than one header is needed.

auth=header:value
auth=header1:value%0D%0Aheader2:value

Flash Mode Mark — [XSS]
Provide the [XSS] mark in any place of the target's data values to enable Flash Mode, which makes KNOXSS perform a single quick XSS Polyglot-based test.

target=https://domain/path/page?param1=value[XSS]
target=https://domain/path/page?param1=[XSS]
target=https://domain/path/[XSS]?param1=value
post=param1=value[XSS]
post=param1=[XSS]
auth=header:[XSS]

CheckPoC — checkpoc
Provide the value 1 to enable the CheckPoC feature, which validates a PoC (a URL with a working XSS payload) to confirm the engine can detect its popup. The best use case is using the same path, page, and parameter combination to find a similar XSS in another domain, by swapping in a list of other domains — especially useful for known public CVEs.

checkpoc=1

PoC Feedback — poc
Submit a PoC for a given target if KNOXSS couldn't detect it. GET requests only; the URL must contain a working XSS payload popping the number 1, a letter "K", or the string "KNOXSS" in a dialog box. After it's stored, KNOXSS revalidates it and delivers it in the results for any later request to that same target.

poc=https://domain/path/page?param1=XSS_PAYLOAD%26param2=value

Runtime Log — log
Provides a live runtime log of the scan.

log=1

ForceNew — new
Forces a new scan instead of getting cached results.

new=1

IMPORTANT: encode all "&" signs as %26 in URL parameters and POST bodies — curl uses the plain "&" to separate its own parameters, not the target's.

API Response Data

  • XSS — "true" / "false" / "none". "true" if KNOXSS proved the vulnerability, "false" if the scan completed with none found, "none" on error.
  • PoC — "[STRING]" / "none". The proof-of-concept when XSS is "true", otherwise "none". In JSON, some characters are escaped (" and \) — adapt them before pasting into a browser.
  • Target — "[STRING]". Echoes the target provided.
  • POST Data — "[STRING]" / "none". Echoes the POST body provided, or "none".
  • Error — "[STRING]" / "none". An error description, or "none" if the scan ran cleanly.
  • API Call — "n/1000" / "0". Calls made so far in the current 24-hour period, or "0" on error.
  • Time Elapsed — "[STRING]". Scan duration, "[x].[y]s" format.
  • Timestamp — "[STRING]". Date and time the scan finished.
  • Version — "[STRING]". The API version.

API Request/Response Example

curl https://api.knoxss.pro -d "target=https://xss.brutelogic.net/brutelogic/xss.php?a=any" -H "X-API-KEY: your-api-key"

{
  "XSS": "true",
  "PoC": "https://xss.brutelogic.net/brutelogic/xss.php?a=<!--><Svg/OnLoad=(confirm)(1)-->",
  "Target": "https://xss.brutelogic.net/brutelogic/xss.php?a=any",
  "POST Data": "none",
  "Error": "none",
  "API Call": "1/1000",
  "Time Elapsed": "1.24s",
  "Timestamp": "Tue, 03 Nov 2026 15:00:00 +0000",
  "Version": "4.3.1"
}

Usage Examples

Command-line curl uses the "&" character to separate its own HTTP parameters, so encode "&" as %26 in target URLs and POST bodies. It's usually not needed when using 3rd party wrappers. For Windows systems use double quotes instead of single ones.

GET Method — URL with 1 parameter

curl https://api.knoxss.pro -d 'target=https://xss.brutelogic.net/brutelogic/xss.php?a=any' -H 'X-API-KEY: your-api-key'

GET Method — URL with 2+ parameters

curl https://api.knoxss.pro -d 'target=https://xss.brutelogic.net/brutelogic/xss.php?a=any%26b=any' -H 'X-API-KEY: your-api-key'

Notice the %26 between the "a=any" and "b=any" pairs.

POST Method — URL + POST data

curl https://api.knoxss.pro -d 'target=https://xss.brutelogic.net/brutelogic/xss.php&post=a=any' -H 'X-API-KEY: your-api-key'

Notice the &post= right at the end of the -d value — it's posted as another parameter to the API, not a parameter of the target.

POST Method — TestPHP VulnWeb

curl https://api.knoxss.pro -d 'target=http://testphp.vulnweb.com/search.php?test=query&post=searchFor=any%26goButton=go' -H 'X-API-KEY: your-api-key'

Authenticated GET Method — Cookies

curl https://api.knoxss.pro -d 'target=https://xss.brutelogic.net/brutelogic/session/index.php?name=guest&auth=Cookie:PHPSESSID=9p77u90dssmkmn3kgmmgq3b5d3' -H 'X-API-KEY: your-api-key'

Flash Mode — XSS Mark

curl https://api.knoxss.pro -d 'target=https://xss.brutelogic.net/brutelogic/xss.php?a=[XSS]' -H 'X-API-KEY: your-api-key'

CheckPoC Feature

curl https://api.knoxss.pro -d 'target=https://xss.brutelogic.net/brutelogic/xss.php?a=any<Svg+OnLoad=alert(1)>&checkpoc=1' -H 'X-API-KEY: your-api-key'

PoC Feedback

curl https://api.knoxss.pro -d 'target=https://xss.brutelogic.net/brutelogic/xss.php?a=any&poc=https://xss.brutelogic.net/brutelogic/xss.php?a=any<Svg+OnLoad=alert(1)>' -H 'X-API-KEY: your-api-key'

Mass Testing

A simple Bash script to automate submitting a file of URLs to the API:

#!/bin/bash
file=$1
key="API_KEY"
while read line
do curl https://api.knoxss.pro -d target=$line -H "X-API-KEY: $key" -s | grep PoC
done < $file

Save it as api.sh, run chmod +x api.sh, replace API_KEY with your key, create a text file urls.txt with one target per line (including POST data or other directives, separated by "&" for features and "%26" for parameters), then run ./api.sh urls.txt.

There are also some non-official wrappers publicly available to help with automation, most notably knoxnl and knoxsser.

Using the Browser Extension

The official KNOXSS browser extension uses your API key to scan the page you're on, right from the toolbar — no copying and pasting URLs.

  1. Download the extension (link below; only available to active plan holders).
  2. Unzip it, open chrome://extensions, turn on Developer mode, click "Load unpacked," and pick the unzipped folder.
  3. Click the KNOXSS icon — the first time, with no key set, it'll prompt you straight to Options; after that, right-click the icon and choose "Open options" any time. Paste in your API key and save.
  4. Click the icon on any page to scan it — a confirm popup lets you include cookies or force a fresh scan first.
  5. Any XSS or open redirect found pops its PoC automatically.
  6. Right-click the icon for more: view the last scan's full details and runtime log, or toggle quick scan (skip the confirm popup).

Download the browser extension