[IA]_

Peer-reviewed research · IEEE SCSE 2026

XSSpecter.

An Automated Framework for End-to-End Blind XSS Detection and Reporting

View DOI Source code

Abstract

One workflow from discovery to evidence.

Blind cross-site scripting is difficult to observe because execution occurs out of band. XSSpecter brings the complete authorized-testing workflow into one system: intelligent crawling and injection, callback handling, forensic capture, notifications, and reporting.

In controlled, favorable execution conditions, the study detected every triggered payload and observed approximately 650 ms mean callback latency. These results describe the evaluated environment, not a universal detection guarantee.

Authors Isira Adithya RuwanpathiranaChamara DisanayakeShan Jayasinghe

Architecture

A traceable blind-XSS pipeline.

Each stage keeps the originating input connected to the later out-of-band execution evidence.

  1. 01

    Discover

    A Python command-line workflow crawls authorized targets and identifies input surfaces.

  2. 02

    Tag

    Uniquely identified test payloads connect an input location to a later callback.

  3. 03

    Capture

    A Node.js service records callbacks, DOM evidence, screenshots, and environment context.

  4. 04

    Triage

    A Vue dashboard organizes alerts and keeps evidence attached to the originating test.

  5. 05

    Report

    Email, Discord, Slack, and Telegram notifications support a structured disclosure workflow.

Cite

Publication metadata.

2026 IEEE International Research Conference on Smart Computing and Systems Engineering (SCSE)

IEEE

I. A. Ruwanpathirana, C. Disanayake, and S. Jayasinghe, “XSSpecter: An Automated Framework for End-to-End Blind XSS Detection and Reporting,” 2026 IEEE International Research Conference on Smart Computing and Systems Engineering (SCSE), 2026, doi: 10.1109/SCSE70081.2026.11499908.

BibTeX 
@inproceedings{ruwanpathirana2026xsspecter,
  title={XSSpecter: An Automated Framework for End-to-End Blind XSS Detection and Reporting},
  author={Ruwanpathirana, Isira Adithya and Disanayake, Chamara and Jayasinghe, Shan},
  booktitle={2026 IEEE International Research Conference on Smart Computing and Systems Engineering (SCSE)},
  year={2026},
  doi={10.1109/SCSE70081.2026.11499908}
}

Responsible use

Built for authorized testing.

XSSpecter should only be used on systems and applications for which the tester has explicit permission. The public archive intentionally excludes active targets, private payloads, and confidential report evidence.