skills.rest
gerald-ica
gerald-icaCOMMUNITY
Explore all skills by this author →
GitHub

Cross-Site Scripting and HTML Injection Testing

Detect and exploit stored, reflected, and DOM-based XSS vulnerabilities in web applications.

Updated Apr 6, 2026
Search Tags:#vulnerability assessment#security testing#XSS#web application#HTML injection
One-click install
npx skills add https://github.com/gerald-ica/dev-tool-configs --skill cross-site-scripting-and-html-injection-testing-gerald-ica
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Cross-Site Scripting and HTML Injection Testing
Source: https://github.com/gerald-ica/dev-tool-configs/tree/main/gemini/skills/xss-html-injection
Command: npx skills add https://github.com/gerald-ica/dev-tool-configs --skill cross-site-scripting-and-html-injection-testing-gerald-ica

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications, helping to identify vulnerabilities and protect against client-side injection vulnerabilities.

Core Features & Use Cases

  • XSS/HTMLi Vulnerability Detection: Execute comprehensive client-side injection vulnerability assessments on web applications.
  • Stored XSS Exploitation: Target areas with persistent user content and craft persistent payloads.
  • Reflected XSS Exploitation: Construct malicious URLs and deliver reflected XSS to victims.
  • DOM-Based XSS Exploitation: Identify vulnerable sinks and sources for DOM XSS payloads.
  • HTML Injection Techniques: Modify page appearance and content manipulation.
  • Filter Bypass Techniques: Overcome tag, attribute, encoding, and whitespace/comment bypass techniques.
  • Use Case: Use this Skill to perform security testing on a web application to detect and exploit XSS and HTML injection flaws.

Quick Start

Use the xss-html-injection skill to perform a vulnerability assessment on the web application at 'https://target.com'.

Frequently Asked Questions about Cross-Site Scripting and HTML Injection Testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for stored and reflected XSS vulnerabilities in a web application?▼

To test for Cross-Site Scripting (XSS) vulnerabilities, you inject malicious JavaScript payloads into input fields and URL parameters. This Skill automates detecting stored, reflected, and DOM-based XSS by analyzing HTTP request and response headers and HTML DOM structure.

Can I use HTML injection techniques to manipulate page content during security testing?▼

Yes, HTML injection allows you to modify page appearance and manipulate content during security assessments. This Skill provides techniques for executing client-side injection attacks to alter the visible content and structure of vulnerable web pages.

Do I need to understand JavaScript and HTML DOM structure to perform DOM-based XSS testing?▼

Yes, identifying DOM-based XSS requires a solid understanding of JavaScript, HTML DOM structure, and HTTP request/response headers. This prerequisite knowledge is necessary to accurately identify vulnerable sinks and sources for payload execution.

What is the best way to bypass XSS filters and web application firewall rules?▼

The best way to bypass XSS filters is using tag, attribute, encoding, and whitespace manipulation techniques. This Skill includes specialized filter bypass methods to overcome client-side and server-side security restrictions during vulnerability assessments.

How do I craft XSS payloads for session hijacking and cookie theft?▼

Crafting XSS payloads for session hijacking involves injecting scripts that extract session tokens and transmit them to an attacker-controlled endpoint. This Skill includes specific payload configurations designed for cookie theft and session hijacking validation.

Does this XSS testing approach work for all types of client-side injection flaws?▼

This approach specifically handles stored, reflected, and DOM-based XSS attack vectors alongside general HTML injection flaws. It targets client-side injection vulnerabilities, making it suitable for comprehensive web application security assessments.

Related Skills

Explore More Software Engineering Skills→
rahmatullahbossrahmatullahboss

Cross-Site Scripting and HTML Injection Testing

Identify XSS vulnerabilities and craft payloads for stored, reflected, and DOM-based vectors.

Community
Advanced
zebbernzebbern
34

Cross-Site Scripting and HTML Injection Testing

Detect, exploit, and bypass filters for Cross-Site Scripting and HTML injection vulnerabilities in web applications.

Community
Advanced
zebbernzebbern
4.5k

Red Team Tools and Methodology

Automate red-team reconnaissance and vulnerability discovery workflows.

Community
Advanced
VSF-QC-TTSVSF-QC-TTS

common-dast-tooling

Standardize dynamic application security testing across web applications and APIs.

Official
Advanced