hunt-xss

What problem does it solve?

Hunting cross-site scripting (XSS) vulnerabilities wastes time on false positives and weak validation, especially for reflected, stored, and DOM-based cases where impact depends on where the payload executes.

Core Features & Use Cases

• Crown-jewel targeting guidance: Prioritizes high-payout XSS surfaces like admin panels, sign-in/SSO flows, stored-rendering contexts, and payout/financial pages.
• OOB confirmation methodology: Provides strict rules for when blind/stored XSS claims are valid, including collaborator-based proof requirements and what to treat as non-confirmation.
• Attack-surface driven workflow: Maps common XSS signals (URL patterns, response headers, DOM sinks, sanitizer/root-cause patterns) into a step-by-step hunting process that ends with browser validation.
• Context-appropriate payload strategy: Includes reflection markers, sanitizer probing, sanitizer-bypass techniques (including SVG and math/style mXSS), redirect/UTM testing, and cache-poisoning considerations.
• Chain references to adjacent skills: Links XSS to cache poisoning, CSRF exploitation via stored XSS, and HTTP request smuggling scenarios to help plan higher-impact reports.

Quick Start

Run the hunt on a new target by using a browser-safe XSS canary first, map reflection points, then validate the highest-value sinks with collaborator-based confirmation where needed.