Per-site toggle
Off by default. When enabled for an origin, the content script runs on that site,
including iframes via all_frames.
[ CAPABILITIES · EXTENSION SURFACE ]
Everything you need to inject with intent.
XSSassin stays quiet until you enable an origin. Then hover inject, the panel, and popup actions share one ruleset for defaults and random selection.
Hover inject
A small control appears near focused text fields. Click to inject using your default or random rules; it hides shortly after the pointer leaves.
Payload panel
Choose a built-in or custom payload by category from the in-page panel when the site is enabled—no round-trip through the toolbar.
Smart-Injection
Optional global toggle. Infers a likely category from field metadata and page path when confidence is high; otherwise falls back to your stored scope.
Auto fill all
Fills matching inputs on the page. With Smart-Injection on, each field can receive a separately inferred category.
Copy payload
Copies a payload per your rules. With Smart-Injection enabled, prefers the currently focused field when possible.
Category map
Presets cover common control types. Category names only—payload bodies stay inside the extension, not on this site.
✓ NAMED ONLY
categories = [
"XSS", "SQL injection", "HTML injection",
"NoSQL", "LDAP", "command/OS",
"XPath", "template (SSTI)", "CRLF",
"path/filename", "XXE"
]