# Rexsser

Rexsser is a Dynamic Application Security Testing product. It runs on-premises. Pricing is free.

A Burp Suite plugin that extracts keywords from HTTP responses using regex patterns and tests for reflected XSS vulnerabilities within the target scope.

Checked October 2026.

## What is Rexsser?

Rexsser is a Burp Suite plugin that automates the detection of reflected Cross-Site Scripting (XSS) vulnerabilities in web applications.

The plugin operates by extracting keywords from HTTP responses using regular expressions and then testing these keywords for reflected XSS within the defined target scope.

It integrates directly with Burp Suite's workflow, allowing security researchers and developers to identify potential XSS vulnerabilities during web application testing.

The tool focuses on reflected XSS detection by analyzing response content and testing for reflection patterns that could indicate security weaknesses.

Rexsser is distributed as an open-source project available through GitHub, making it accessible for security testing and vulnerability assessment activities.

Tags: Open Source, XSS, XSS Scanner, Regex

## Where it fits in your security program (NIST CSF 2.0)

- [Protect](https://cybersectools.com/guides/building-protect-program-small-team): helps you prevent attacks and keep data safe.

## Quick facts

- Category: [Application Security](https://cybersectools.com/categories/application-security) · [Dynamic Application Security Testing](https://cybersectools.com/categories/dast)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 75
- Website: github.com

## Where it ranks

Rexsser is not a pick on the current [Best DAST Solutions for Business](https://cybersectools.com/shortlists/best-dast-solutions).

## Rexsser FAQ

### What is Rexsser?

Rexsser is a product in the Dynamic Application Security Testing category. It covers Open Source, XSS and XSS Scanner.

### What is the pricing for Rexsser?

Rexsser is free. Download and setup instructions are at https://github.com/profmoriarity/rexsser/.

### What are alternatives to Rexsser?

Alternatives to Rexsser listed on CybersecTools:

1. [Fortra BeSTORM](https://cybersectools.com/tools/fortra-bestorm) - Black box fuzzer and DAST product for application security testing (Commercial)
2. [VulnSign Dynamic Application Security Testing](https://cybersectools.com/tools/vulnsign-dynamic-application-security-testing) - DAST tool for scanning web apps, microservices, and APIs for vulnerabilities (Commercial)
3. [EnProbe Cybersecurity](https://cybersectools.com/tools/enprobe-cybersecurity) - Cloud-based vulnerability assessment tool for web application security (Commercial)
4. [AppCheck SPA Scanner](https://cybersectools.com/tools/appcheck-spa-scanner) - DAST scanner for Single Page Applications using headless browser technology (Commercial)
5. [Halo Security Application Scanning](https://cybersectools.com/tools/halo-security-application-scanning) - DAST tool for detecting web app vulnerabilities like SQL injection and XSS (Commercial)

Compare all Rexsser alternatives at [https://cybersectools.com/alternatives/rexsser](https://cybersectools.com/alternatives/rexsser)

### What deployment and organization size does Rexsser fit?

Rexsser is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.

## Compare Rexsser with similar solutions

- [Rexsser vs Fortra BeSTORM](https://cybersectools.com/compare/fortra-bestorm-vs-rexsser)
- [Rexsser vs VulnSign Dynamic Application Security Testing](https://cybersectools.com/compare/rexsser-vs-vulnsign-dynamic-application-security-testing)
- [Rexsser vs EnProbe Cybersecurity](https://cybersectools.com/compare/enprobe-cybersecurity-vs-rexsser)

All alternatives to Rexsser: [/alternatives/rexsser](https://cybersectools.com/alternatives/rexsser)

---

Source: https://cybersectools.com/tools/rexsser

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on Rexsser: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md