Detect XSS patterns and blind XSS indicators in web logs and applications.
npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-xss
Please help me install this Agent Skill. Skill: defensive-xss Source: https://github.com/riparino/Claude-Cyber/tree/main/Claude-Blue/Skills/defensive-xss Command: npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-xss
Detects XSS patterns and blind XSS indicators to proactively identify client-side injection threats across logs, CSP reports, and web traffic.
Load and apply the full XSS detection methodology to your logs and applications.
High-intent search queries and answers about installing and using this skill.
To detect XSS patterns in web logs and WAF traffic, you can apply Sigma rules to your SIEM and execute KQL queries in Azure Sentinel to surface malicious payloads. This methodology maps findings to MITRE ATT&CK techniques for comprehensive threat hunting.
Yes, you can generate Sigma rules for SIEM to identify blind XSS indicators across application logs and inbound traffic. The detection methodology translates payload patterns into deployable Sigma rules to alert on client-side injection threats.
The best way to hunt for cross-site scripting attacks using KQL in Azure is to run targeted queries in Azure Sentinel and MDE. These KQL queries surface XSS-related events by parsing CSP reports and web request logs for known injection signatures.
Yes, this approach works with CSP reports to find client-side injection threats by analyzing violation reports alongside WAF logs. Correlating these sources helps identify both successful and attempted XSS attacks mapped to MITRE ATT&CK techniques.
To reduce XSS exposure after detecting payloads in application logs, apply the included practical hardening guidance. This involves implementing stricter Content Security Policies and remediating the specific injection vectors identified during threat hunting.
Detecting XSS solely through inbound and outbound traffic analysis may miss obfuscated payloads or blind XSS executed outside monitored endpoints. Combining WAF logs with CSP reports and application log analysis provides more reliable detection gap coverage.
DorianGalloIdentifies web application firewalls and selects generic evasion techniques for injection payloads.
MHaggisGenerate and validate security detection rules for Splunk, Sigma, Elastic, and KQL.
copyleftdevMap adversary TTPs to MITRE ATT&CK techniques for detection engineering.
NickCrewIdentify OWASP Top 10 security vulnerabilities in web applications.
