ETSSDetector: a tool to automatically detect Cross-Site Scripting vulnerabilities

The inappropriate use of features intended to improve usability and interactivity of web applications has resulted in the emergence of various threats, including Cross-Site Scripting (XSS) attacks. In this work, we developed ETSSDetector, a generic and modular web vulnerability scanner that automatically analyzes web applications to find XSS vulnerabilities. ETSSDetector is able to identify and analyze all data entry points of the application and generate specific code injection tests for each one. The results shows that the correct filling of the input fields with only valid information ensures a better effectiveness of the tests, increasing the detection rate of XSS attacks.