CLI flags

CLI Flags Reference

Targeting

Flag	Description
-u URL	Target URL
-L FILE	File of target URLs to scan, one per line
-V	Print version and exit

Authentication

Flag	Description
--login-url URL	Login form URL — authenticates before scanning
--login-user USER	Username for form login
--login-pass PASS	Password for form login
--login-user-field NAME	Username input field name (default: username)
--login-pass-field NAME	Password input field name (default: password)
--auth-type TYPE	HTTP authentication type: basic, digest, or ntlm
--auth-cred USER:PASS	HTTP auth credentials

Request

Flag	Description
-d DATA	POST body — form-encoded or JSON
-H KEY:VALUE	Custom request header (repeatable)
-c COOKIE	Cookie string
--proxy URL	HTTP proxy
-t N	Worker threads 1–20 (default: 5)
--timeout N	Request timeout in seconds, 5–120 (default: 15)
--delay N	Seconds between requests (default: 0)

Scan options

Flag	Description
--level 1-3	Payload depth — 1=fast, 2=thorough, 3=deep (default: 1)
-f FILE	Custom payloads file, one per line; supports {marker} template (repeatable)
--payload-url URL	Load additional payloads from a remote URL (newline-delimited, supports {marker})
--inject-headers HEADER	Header names to test for XSS reflection, e.g. Referer, X-Forwarded-For (repeatable)
--test-stored	Inject payloads into surfaces, then revisit pages to detect stored XSS rendering
--no-probe-filter	Disable filter-probing — sends every payload without pre-mapping blocked characters
--poc	After scan, generate ready-to-use exploitation payloads for confirmed findings

Discovery & crawling

Flag	Description
--crawl	Enable BFS crawler (same-origin)
--max-pages N	Max pages to crawl (default: 50)
--max-depth N	Max crawl depth (default: 3)
--exclude PATTERN	Regex of URLs to skip (repeatable)
--openapi URL/FILE	OpenAPI / Swagger spec — imports all endpoints for scanning
--base-url URL	Base URL override for OpenAPI spec
--source-maps	Fetch .map files and analyse original source for DOM XSS (useful for minified apps)
--dork QUERY	Dork query — discovered URLs are prepended to the target list
--dork-max N	Max URLs to collect from dork results (default: 20)
--dork-engine ENGINE	Search engine: ddg (default), bing, yahoo, all

GraphQL & WebSocket

Flag	Description
--graphql	Probe and test GraphQL endpoints for XSS injection
--graphql-endpoint URL	Explicit GraphQL endpoint to test — skips auto-discovery (repeatable)
--websocket	Discover and test WebSocket endpoints (requires stingxss[websocket])
--ws-url URL	Explicit WebSocket URL to test — skips auto-discovery (repeatable)

Browser engine

Flag	Description
--browser	Headless Chromium scan — confirms JavaScript execution (requires stingxss[browser])
--browser-crawl	Headless Chromium endpoint discovery — finds JS-rendered routes before scanning
--no-browser-headless	Run browser in non-headless mode (visible window)
--browser-chromium PATH	Path to Chromium binary (default: auto-detect)
--browser-chromedriver PATH	Path to chromedriver binary (default: auto-detect)
--dom-include-minified	Include known app bundles (main.js, vendor.js, …) in DOM XSS analysis

WAF evasion

Flag	Description
--evasion TRANSFORMS	Comma-separated evasion chain — overrides WAF auto-detect. Names: case, html, unicode, double, chunked, null, newline, comment, backtick, css, fromcharcode, unescape
--randomize-payloads	Shuffle injection order to break sequential-pattern WAF rate limiting

Output

Flag	Description
-o FILE	Write JSON results to file
--json	Print raw JSON to stdout
--report-html FILE	Write a self-contained HTML report
--report-sarif FILE	Write a SARIF 2.1.0 report (for GitHub code scanning and SAST tools)
-q	Quiet — suppress all output except errors
-v	Verbose — show all checks including clean ones

---

Exit codes: 0 = no findings · 1 = findings · 2 = error